OTRS reports:
An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user.
An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal article information of their customer tickets.
An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.
An attacker can send a specially prepared email to an OTRS system. If this system has cookie support disabled, and a logged in agent clicks a link in this email, the session information could be leaked to external systems, allowing the attacker to take over the agent’s session.
The Legion of the Bouncy Castle reports:
Release: 1.59
CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS when RSA key exchange is negotiated. This potentially affected BCJSSE servers and any other TLS servers configured to use JCE for the underlying crypto - note the two TLS implementations using the BC lightweight APIs are not affected by this.
Mozilla Foundation reports:
CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9
CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin
CVE-2017-7847: Local path string can be leaked from RSS feed
CVE-2017-7848: RSS Feed vulnerable to new line Injection
CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display
The phpMyAdmin team reports:
Description
By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
Severity
We consider this vulnerability to be critical.
The Asterisk project reports:
A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point.
The MariaDB project reports:
Fixes for the following security vulnerabilities: CVE-2017-15365
Jeriko One reports:
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.
Etienne Stalmans from the Heroku product security team reports:
There is a command injection vulnerability in Net::FTP bundled with Ruby.
Net::FTP#get,getbinaryfile,gettextfile,put,putbinaryfile, andputtextfileuseKernel#opento open a local file. If thelocalfileargument starts with the pipe character"|", the command following the pipe character is executed. The default value oflocalfileisFile.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
Phusion reports:
The cPanel Security Team discovered a vulnerability in Passenger that allows users to list the contents of arbitrary files on the system. CVE-2017-16355 has been assigned to this issue.
the freedesktop.org project reports:
A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog.
The freedesktop.org project reports:
If a pattern contains '?' character, any character in the string is skipped, even if it is '\0'. The rest of the matching then reads invalid memory.
Without the checks a malformed PCF file can cause the library to make atom from random heap memory that was behind the `strings` buffer. This may crash the process or leak information.
The freedesktop.org project reports:
It is possible to trigger heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for dimensions is too large for 32 bit systems, because each pixel takes 4 bytes. Properly chosen values allow an overflow which in turn will lead to less allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment as unsigned int, but casting it to int when calling the function XcursorCommentCreate. Turning length into a negative value allows the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following addition of sizeof (XcursorComment) + 1 makes it possible to allocate less memory than needed for subsequent reads.
MITRE reports:
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
The Jenkins project reports:
A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.
On Jenkins 2.81 and newer, including LTS 2.89.1, this could in rare cases (we estimate less than 20% of new instances) result in failure to initialize the setup wizard on the first startup.
There is a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
Node.js reports:
Data Confidentiality/Integrity Vulnerability - CVE-2017-15896
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
Uninitialized buffer vulnerability - CVE-2017-15897
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
Also included in OpenSSL update - CVE 2017-3738
Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.
GitLab reports:
User without access to private Wiki can see it on the project page
Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission.
E-mail address disclosure through member search fields
Hugo Geoffroy reported via HackerOne that it was possible to find out the full e-mail address of any user by brute-forcing the member search field.
Groups API leaks private projects
An internal code review discovered that users were able to list private projects they had no access to by using the Groups API.
Cross-Site Scripting (XSS) possible by editing a comment
Sylvain Heiniger reported via HackerOne that it was possible for arbitrary JavaScript code to be executed when editing a comment.
Issue API allows any user to create a new issue even when issues are restricted or disabled
Mohammad Hasbini reported that any user could create a new issues in a project even when issues were disabled or restricted to team members in the project settings.
The Torproject.org reports:
- TROVE-2017-009: Replay-cache ineffective for v2 onion services
- TROVE-2017-010: Remote DoS attack against directory authorities
- TROVE-2017-011: An attacker can make Tor ask for a password
- TROVE-2017-012: Relays can pick themselves in a circuit path
- TROVE-2017-013: Use-after-free in onion service v2
The Asterisk project reports:
If a compound RTCP packet is received containing more than one report (for example a Receiver Report and a Sender Report) the RTCP stack will incorrectly store report information outside of allocated memory potentially causing a crash.
libxml2 developers report:
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
Invoking SSL_read()/SSL_write() while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer.
In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. [CVE-2017-3737]
There is an overflow bug in the x86_64 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). [CVE-2017-3738] This bug only affects FreeBSD 11.x.
Applications with incorrect error handling may inappropriately pass unencrypted data. [CVE-2017-3737]
Mishandling of carry propagation will produce incorrect output, and make it easier for a remote attacker to obtain sensitive private-key information. No EC algorithms are affected and analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely.
Attacks against DH1024 are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. [CVE-2017-3738]
wireshark developers reports:
wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)
wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)
wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)
The OpenSSL project reports:
- Read/write after SSL object in error state (CVE-2017-3737)
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer.- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701.
If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. [CVE-2017-3735]
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. [CVE-2017-3736] This bug only affects FreeBSD 11.x.
Application using OpenSSL may display erroneous certificate in text format. [CVE-2017-3735]
Mishandling of carry propagation will produce incorrect output, and make it easier for a remote attacker to obtain sensitive private-key information. No EC algorithms are affected, analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely.
Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. [CVE-2017-3736]
The kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible.
Some bytes from the kernel stack can be observed in userspace.
Named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system.
A malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid.
This issue could lead to a Denial of Service or local privilege escalation.
Not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger.
Some bytes from the kernel stack of the thread using ptrace(PT_LWPINFO) call can be observed in userspace.
A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys.
Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used.
Mozilla Foundation reports:
CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data
CVE-2017-7844: Visited history information leak through SVG image
Varnish reports:
A wrong if statement in the varnishd source code means that synthetic objects in stevedores which over-allocate, may leak up to page size of data from a malloc(3) memory allocation.
mybb Team reports:
High risk: Language file headers RCE
Low risk: Language Pack Properties XSS
wordpress developers reports:
Use a properly generated hash for the newbloguser key instead of a determinate substring.
Add escaping to the language attributes used on html elements.
Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.
The Asterisk project reports:
If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.
Exim developers team reports:
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
xrdp reports:
The scp_v0s_accept function in the session manager uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
The cURL project reports:
- NTLM buffer overflow via integer overflow (CVE-2017-8816)
libcurl contains a buffer overrun flaw in the NTLM authentication code. The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up the lengths of the user name + password (= SUM) and multiplies the sum by two (= SIZE) to figure out how large storage to allocate from the heap.- FTP wildcard out of bounds read (CVE-2017-8817)
libcurl contains a read out of bounds flaw in the FTP wildcard function. libcurl's FTP wildcard matching feature, which is enabled with the CURLOPT_WILDCARDMATCH option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket ([) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard.- SSL out of buffer access (CVE-2017-8818)
libcurl contains an out boundary access flaw in SSL related code. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one.
BorgBackup reports:
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0.x are NOT affected.
Pale Moon reports:
CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers
CVE-2017-7835: Mixed content blocking incorrectly applies with redirects
CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags
Exim team reports:
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
myBB Team reports:
High risk: Installer RCE on configuration file write
High risk: Language file headers RCE
Medium risk: Installer XSS
Medium risk: Mod CP Edit Profile XSS
Low risk: Insufficient moderator permission check in delayed moderation tools
Low risk: Announcements HTML filter bypass
Low risk: Language Pack Properties XSS.
SaltStack reports:
Directory traversal vulnerability in minion id validation in SaltStack. Allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Credit for discovering the security flaw goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Remote Denial of Service with a specially crafted authentication request. Credit for discovering the security flaw goes to: Julian Brost (julian@0x4a42.net)
The CodeIgniter changelog reports:
Security: Fixed a potential object injection in Cache Library 'apc' driver when save() is used with $raw = TRUE.
MITRE reports:
A remote attacker could use a flaw to cause formail to crash, resulting in a denial of service or data loss.
FRR reports:
BGP Mishandled attribute length on Error
A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE packet can leak information from the BGP daemon and cause a denial of service by crashing the daemon.
cacti reports:
Changelog
issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions
issue#1066: CVE-2017-16660 in remote_agent.php logging function
issue#1066: CVE-2017-16661 in view log file
issue#1071: CVE-2017-16785 in global_session.php Reflection XSS
mediawiki reports:
security fixes:
T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.
T165846: BotPasswords doesn't throttle login attempts.
T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.
T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.
T176247: It's possible to mangle HTML via raw message parameter expansion.
T125163: id attribute on headlines allow raw.
T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.
T119158: Language converter: unsafe attribute injection via glossary rules.
T180488: api.log contains passwords in plaintext wasn't correctly fixed.
T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.
Adobe reports:
- These updates resolve out-of-bounds read vulnerabilities that could lead to remote code execution (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213).
- These updates resolve use after free vulnerabilities that could lead to remote code execution (CVE-2017-11215, CVE-2017-11225).
The Internet2 community reports:
The Shibboleth Service Provider software includes a MetadataProvider plugin with the plugin type "Dynamic" to obtain metadata on demand from a query server, in place of the more typical mode of downloading aggregates separately containing all of the metadata to load.
All the plugin types rely on MetadataFilter plugins to perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments.
Due to a coding error, the "Dynamic" plugin fails to configure itself with the filters provided to it and thus omits whatever checks they are intended to perform, which will typically leave deployments vulnerable to active attacks involving the substitution of metadata if the network path to the query service is compromised.
Mozilla Foundation reports:
CVE-2017-7828: Use-after-free of PressShell while restyling layout
CVE-2017-7830: Cross-origin URL information leak through Resource Timing API
CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects
CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers
CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters
CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections
CVE-2017-7835: Mixed content blocking incorrectly applies with redirects
CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X
CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies
CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN
CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism
CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags
CVE-2017-7842: Referrer Policy is not always respected for <link> elements
CVE-2017-7827: Memory safety bugs fixed in Firefox 57
CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5
NVD reports:
Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
KDE reports:
Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.
MITRE reports:
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session.
Google Chrome Releases reports:
2 security fixes in this release, including:
- [777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC. Reported by Ned Williamson on 2017-10-24
- [776677] High CVE-2017-15399: Use after free in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20
The PostgreSQL project reports:
- CVE-2017-15098: Memory disclosure in JSON functions
- CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges
Jenkins developers report:
Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.
Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
The Asterisk project reports:
A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. This then leads to file descriptors and RTP ports being leaked as well.
The Asterisk project reports:
No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. The earlier AST-2017-001 advisory for the CDR user field overflow was for the Party A buffer.
The Asterisk project reports:
By carefully crafting invalid values in the Cseq and the Via header port, pjprojects packet parsing code can create strings larger than the buffer allocated to hold them. This will usually cause Asterisk to crash immediately. The packets do not have to be authenticated.
The OpenSSL project reports:
bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline.Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Severity: Low
This issue was previously announced in security advisory https://www.openssl.org/news/secadv/20170828.txt, but the fix has not previously been included in a release due to its low severity.
wordpress developers reports:
WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we've added hardening to prevent plugins and themes from accidentally causing a vulnerability.
wireshark developers reports:
In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.
In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.
The PHP project reports:
The PHP development team announces the immediate availability of PHP 5.6.32. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 7.0.25. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 7.1.11. This is a bugfix release, with several bug fixes included. All PHP 7.1 users are encouraged to upgrade to this version.
Google Chrome Releases reports:
2 security fixes in this release, including:
- [770452] High CVE-2017-15396: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
- [770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
Antti Levomäki, Christian Jalio, Joonas Pihlaja:
Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.
Antti Levomäki, Christian Jalio, Joonas Pihlaja:
Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.
Node.js reports:
Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)
GitLab reports:
Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization filter
Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS) vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL schemes and was therefore vulnerable to persistent XSS attacks anywhere Markdown was supported.
Cross-Site Scripting (XSS) vulnerability in search bar
Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the issue search bar. Usernames were not being properly HTML escaped inside the author filter would could allow arbitrary script execution.
Open redirect in repository git redirects
Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an open redirect vulnerability when redirecting requests for repository names that include the git extension. GitLab was not properly removing dangerous parameters from the params field before redirecting which could allow an attacker to redirect users to arbitrary hosts.
Username changes could leave repositories behind
An internal code review discovered that a bug in the code that moves repositories during a username change could potentially leave behind projects, allowing an attacker who knows the previous username to potentially steal the contents of repositories on instances that are not configured with hashed namespaces.
The Apache Openofffice project reports:
CVE-2017-3157: Arbitrary file disclosure in Calc and Writer
By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.
The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor
A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter
A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles
A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
The cURL project reports:
libcurl contains a buffer overrun flaw in the IMAP handler.
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function.
libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Frederik Deweerdt reports:
Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details.
CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.
CVE-2017-10869: The stack may overflow when proxying huge requests.
Irssi reports:
When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string.
While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on.
Certain incorrectly formatted DCC CTCP messages could cause NULL pointer dereference.
Overlong nicks or targets may result in a NULL pointer dereference while splitting the message.
In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string.
Google Chrome Releases reports:
35 security fixes in this release, including:
- [762930] High CVE-2017-5124: UXSS with MHTML. Reported by Anonymous on 2017-09-07
- [749147] High CVE-2017-5125: Heap overflow in Skia. Reported by Anonymous on 2017-07-26
- [760455] High CVE-2017-5126: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-08-30
- [765384] High CVE-2017-5127: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-09-14
- [765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by Omair on 2017-09-14
- [765495] High CVE-2017-5129: Use after free in WebAudio. Reported by Omair on 2017-09-15
- [718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05
- [722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by Pranjal Jumde on 2017-05-14
- [744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by Anonymous on 2017-07-16
- [762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by Aleksandar Nikolic of Cisco Talos on 2017-09-05
- [752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03
- [756040] Medium CVE-2017-15387: Content security bypass. Reported by Jun Kokatsu on 2017-08-16
- [756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17
- [739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-07-06
- [750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by Haosheng Wang on 2017-07-28
- [598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by Joao Lucas Melo Brasio on 2016-03-28
- [714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration. Reported by Xiaoyin Liu on 2017-04-22
- [732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by Svyat Mitin on 2017-06-13
- [745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by Sam on 2017-07-18
- [759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by Johannes Bergman on 2017-08-28
- [775550] Various fixes from internal audits, fuzzing and other initiatives
cacti developers report:
The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
Several vulnerabilities: symlink directory traversal, absolute path directory traversal and buffer overflow were discovered in the arj archiver.
MIT reports:
CVE-2017-11368:
In MIT krb5 1.7 and later, an authenticated attacker can cause an assertion failure in krb5kdc by sending an invalid S4U2Self or S4U2Proxy request.
CVE-2017-11462:
RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context() if the call results in an error. This API behavior has been found to be dangerous, leading to the possibility of memory errors in some callers. For safety, GSS-API implementations should instead preserve existing security contexts on error until the caller deletes them.
All versions of MIT krb5 prior to this change may delete acceptor contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through 1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts on error.
Oracle reports:
Please reference CVE/URL list for details
xorg-server developers reports:
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.
Adobe reports:
- This update resolves a type confusion vulnerability that could lead to remote code execution (CVE-2017-11292).
wpa_supplicant developers report:
A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys.
mercurial developers reports:
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Cisco TALOS reports:
An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
FFmpeg security reports:
Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.
Adam Jackson reports:
One regression fix since 1.19.4 (mea culpa), and fixes for CVEs 2017-12176 through 2017-12187.
Solr developers report:
Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.
Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.
jenkins developers report:
A total of 11 issues are reported, please see reference URL for details.
The Xen project reports multiple vulnerabilities.
Mozilla reports:
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash.
osip developers reports:
In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.
ncurses developers reports:
There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.
Python reports:
Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.
node developers report:
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
zookeeper developers report:
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
libtiff developers report:
There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
oss-security mailing list:
There is a possible unsafe object desrialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Alan Coopersmith reports:
X.Org thanks Michal Srb of SuSE for finding these issues and bringing them to our attention, Julien Cristau of Debian for getting the fixes integrated, and Adam Jackson of Red Hat for publishing the release.
tomcat developers reports:
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
The cURL project reports:
FTP PWD response parser out of bounds read
libcurl may read outside of a heap allocated buffer when doing FTP.
When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses.
Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path.
A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault.
There is no limit on the password length.
A remote attacker may be able to cause an affected SSH server to use excessive amount of CPU by sending very long passwords, when PasswordAuthentication is enabled by the system administrator.
There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket.
An attacker who has control of the network between a client and the service it talks to will be able to impersonate the service, allowing a successful man-in-the-middle (MITM) attack that circumvents the mutual authentication.
Google Project Zero reports:
- CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this commit overflow was unrestricted.
- CVE-2017-14492: Heap based overflow.
- CVE-2017-14493: Stack Based overflow.
- CVE-2017-14494: Information Leak
- CVE-2017-14495: Lack of free()
- CVE-2017-14496: Invalid boundary checks. Integer underflow leading to a huge memcpy.
- CVE-2017-13704: Crash on large DNS query
phpmyfaq developers report:
Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
wordpress developers report:
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
Mozilla Foundation reports:
CVE-2017-7793: Use-after-free with Fetch API
CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode
CVE-2017-7818: Use-after-free during ARIA array manipulation
CVE-2017-7819: Use-after-free while resizing images in design mode
CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files
CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings
CVE-2017-7813: Integer truncation in the JavaScript parser
CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations
CVE-2017-7816: WebExtensions can load about: URLs in extension UI
CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction
CVE-2017-7823: CSP sandbox directive did not create a unique origin
CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV
CVE-2017-7820: Xray wrapper bypass with new tab and web console
CVE-2017-7811: Memory safety bugs fixed in Firefox 56
CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
sam2p developers report:
In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.
In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.
In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.
In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.
Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.
In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.
libraw developers report:
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
Steffan Karger reports:
The bounds check in read_key() was performed after using the value, instead of before. If 'key-method 1' is used, this allowed an attacker to send a malformed packet to trigger a stack buffer overflow. [...]
Note that 'key-method 1' has been replaced by 'key method 2' as the default in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4 and marked for removal in 2.5. This should limit the amount of users impacted by this issue.
MITRE reports:
The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.
Talos developers report:
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.
sugarcrm developers report:
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
libzip developers report:
The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.
mongodb developers report:
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
tcpdump developers report:
Too many issues to detail, see CVE references for details.
libraw developers report:
LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.
libraw developers report:
A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.
libgd developers report:
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
PHP developers report:
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
Talos reports:
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
Gentoo developers report:
DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.
ansible developers report:
Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.
WeeChat reports:
security problem: a crash can happen in logger plugin when converting date/time specifiers in file mask.
SO-AND-SO reports:
CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows
A possible stack buffer overflow in the %ENV code on Windows has been fixed by removing the buffer completely since it was superfluous anyway.
CVE-2017-12837: Heap buffer overflow in regular expression compiler
Compiling certain regular expression patterns with the case-insensitive modifier could cause a heap buffer overflow and crash perl. This has now been fixed.
CVE-2017-12883: Buffer over-read in regular expression parser
For certain types of syntax error in a regular expression pattern, the error message could either contain the contents of a random, possibly large, chunk of memory, or could crash perl. This has now been fixed.
Google Chrome releases reports:
3 security fixes in this release, including:
- [765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by Jordan Rabet, Microsoft Offensive Security Research and Microsoft ChakraCore team on 2017-09-14
- [752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by Choongwoo Han of Naver Corporation on 2017-08-04
- [767508] Various fixes from internal audits, fuzzing and other initiatives
The Asterisk project reports:
This is a follow up advisory to AST-2017-005.
Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.
The RTP stream qualification to learn the source address of media always accepted the first RTP packet as the new source and allowed what AST-2017-005 was mitigating. The intent was to qualify a series of packets before accepting the new source address.
The RTP/RTCP stack will now validate RTCP packets before processing them.
Ruby blog:
CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
If a malicious format string which contains a precious specifier (*) is passed and a huge minus value is also passed to the specifier, buffer underrun may be caused. In such situation, the result may contains heap, or the Ruby interpreter may crash.
CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick
When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject malicious escape sequences to the log and dangerous control characters may be executed on a victim’s terminal emulator.
This vulnerability is similar to a vulnerability already fixed, but it had not been fixed in the Basic authentication.
CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode
If a malicious string is passed to the decode method of OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.
CVE-2017-14064: Heap exposure vulnerability in generating JSON
The generate method of JSON module optionally accepts an instance of JSON::Ext::Generator::State class. If a malicious instance is passed, the result may include contents of heap.
Gem in a box XSS vulenrability - CVE-2017-14506:
Malicious attacker create GEM file with crafted homepage value (gem.homepage in .gemspec file) includes XSS payload.
The attacker access geminabox system and uploads the gem file (or uses CSRF/SSRF attack to do so).
From now on, any user access Geminabox web server, executes the malicious XSS payload, that will delete any gems on the server, and won't let users use the geminabox anymore. (make victim's browser crash or redirect them to other hosts).
The Fuzzing Project reports:
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
GitLab reports:
Please reference CVE/URL list for details
Adobe reports:
- These updates resolve memory corruption vulnerabilities that could lead to remote code execution (CVE-2017-11281, CVE-2017-11282).
Paul Eggert reports:
Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.
When Emacs renders MIME text/enriched data (Internet RFC 1896), it is vulnerable to arbitrary code execution. Since Emacs-based mail clients decode "Content-Type: text/enriched", this code is exploitable remotely. This bug affects GNU Emacs versions 19.29 through 25.2.
Cyrus IMAP 3.0.4 Release Notes states:
Fixed Issue #2132: Broken "Other Users" behaviour
Django blog:
In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.
Google Chrome releases reports:
22 security fixes in this release, including:
- [737023] High CVE-2017-5111: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-06-27
- [740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by Tobias Klein on 2017-07-10
- [747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by Anonymous on 2017-07-20
- [752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-08-07
- [744584] High CVE-2017-5115: Type confusion in V8. Reported by Marco Giovannini on 2017-07-17
- [759624] High CVE-2017-5116: Type confusion in V8. Reported by Anonymous on 2017-08-28
- [739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by Tobias Klein on 2017-07-04
- [747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24
- [725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by Anonymous on 2017-05-22
- [718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by Xiaoyin Liu on 2017-05-05
- [762099] Various fixes from internal audits, fuzzing and other initiatives
TALOS reports:
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality.
An exploitable heap-overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality.
The Asterisk project reports:
A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.
The Asterisk project reports:
AST-2017-005 - A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected the new code allowed a new source address to be learned at all times.
AST-2017-006 - The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.
GnuPG reports:
Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".
Official blog of RubyGems reports:
The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files.
chbi reports:
an authenticated standard user could reset the password of another user (including admin) by altering form data.
Poppler developers report:
Poppler is prone to a stack-based buffer-overflow vulnerability.
Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.
PHPMailer reports:
Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.
SaltStack reports:
Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com
PowerDNS Security Advisory reports:
The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website.
GNOME reports:
The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.
The same vulnerability affects atril, the Evince fork.
SquirrelMail developers report:
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server.
CVE Details reports:
- There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).
- There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).
- There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).
- There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).
- There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).
- There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).
Drupal Security Team:
CVE-2017-6923: Views - Access Bypass - Moderately Critical
CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica
CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical
Tobias Mueller reports:
libsoup is susceptible to a stack based buffer overflow attack when using chunked encoding. Regardless of libsoup being used as a server or client.
mitre reports:
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.
mnaberez reports:
supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.
This vulnerability can only be exploited by an authenticated client or if supervisord has been configured to run an HTTP server without authentication. If authentication has not been enabled, supervisord will log a message at the critical level every time it starts.
Guido Vranken reports:
Multiple vulnerabilities found via fuzzing: FR-GV-201 (v2,v3) Read / write overflow in make_secret() FR-GV-202 (v2) Write overflow in rad_coalesce() FR-GV-203 (v2) DHCP - Memory leak in decode_tlv() FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode() FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options() FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 FR-GV-207 (v2) Zero-length malloc in data2vp() FR-GV-301 (v3) Write overflow in data2vp_wimax() FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() FR-GV-305 (v3) Decode 'signed' attributes correctly FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data FR-AD-002 (v3) String lifetime issues in rlm_python FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare
Mercurial Release Notes:
CVE-2017-1000115
Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository.
CVE-2017-1000116
Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with -oProxyCommand. This is also present in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800), so please patch those tools as well if you have them installed.
subversion team reports:
A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument.
A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.
The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
An exploit has been tested.
GitLab reports:
Remote Command Execution in git client
An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command line arguments in URLs using the SSH protocol before invoking the SSH client. A specially crafted URL could be used to execute arbitrary shell commands on the GitLab server.
To fully patch this vulnerability two fixes were needed. The Omnibus versions of GitLab contain a patched git client. For source users who may still be running an older version of git, GitLab now also blocks import URLs containing invalid host and usernames.
This issue has been assigned CVE-2017-12426.Improper sanitization of GitLab export files on import
GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a patch for a critical directory traversal vulnerability in the GitLab export feature that could be exploited by including symlinks in the export file and then re-importing it to a GitLab instance. This vulnerability was patched by checking for and removing symlinks in these files on import.
Recurity-Labs also determined that this fix did not properly remove symlinks for hidden files. Though not as dangerous as the original vulnerability hidden file symlinks could still be used to steal copies of git repositories belonging to other users if the path to the git repository was known by the attacker. An updated fix has been included in these releases that properly removes all symlinks.
This import option was not made available to non-admin users until GitLab 8.13.0.
The PostgreSQL project reports:
- CVE-2017-7546: Empty password accepted in some authentication methods
- CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
- CVE-2017-7548: lo_put() function ignores ACLs
Adobe reports:
- These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3085).
- These updates resolve type confusion vulnerability that could lead to remote code execution (CVE-2017-3106).
The cURL project reports:
- FILE buffer read out of bounds
- TFTP sends more than buffer size
- URL globbing out of bounds read
Apache Axis2 reports:
The commons-fileupload dependency has been updated to a version that fixes CVE-2016-1000031 (AXIS2-5853).
Mozilla Foundation reports:
Please reference CVE/URL list for details
Google reports:
A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.
phk reports:
A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert.
Google Chrome releases reports:
40 security fixes in this release
Please reference CVE/URL list for details
kimiizhang reports:
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
NVD reports:
ProFTPD ... controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link.
SecurityFocus reports:
JabberD is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.
The Webkit gtk team reports:
Please reference CVE/URL list for details
Senrio reports:
Genivia gSOAP is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.
A remote attacker may exploit this issue to execute arbitrary code in the context of the affected device. Failed attempts will likely cause a denial-of-service condition.
GitLab reports:
Please reference CVE/URL list for details
Oracle reports:
Please reference CVE/URL list for details
marcinguy reports:
After sending this payload, collectd seems to be entering endless while() loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.
strongSwan security team reports:
- RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception. [CVE-2017-9022]
- ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate.
kimiizhang reports:
Cross-site scripting (XSS) vulnerability in link.php in Cacti
1.1.12 allows remote anonymous users to inject arbitrary web
script or HTML via the id parameter.
The Apache httpd project reports:
important: Read after free in mod_http2 (CVE-2017-9789)
When under stress, closing many connections, the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.important: Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788)
The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by mod_auth_digest.
Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault.
Adobe reports:
- These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3080).
- These updates resolve memory corruption vulnerability that could lead to remote code execution (CVE-2017-3099).
- These updates resolve memory corruption vulnerability that could lead to memory address disclosure (CVE-2017-3100).
The samba project reports:
A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by returning malicious replication or authorization data.
Updates are now available for all active Node.js release lines as well as the 7.x line. These include the fix for the high severity vulnerability identified in the initial announcement, one additional lower priority Node.js vulnerability in the 4.x release line, as well as some lower priority fixes for Node.js dependencies across the current release lines.
Constant Hashtable Seeds (CVE pending)
Node.js was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. Thanks to Jann Horn of Google Project Zero for reporting this vulnerability.
This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.
http.get with numeric authorization options creates uninitialized buffers
Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string.
This is a low severity defect and only applies to the 4.x release line.
Maxim Dounin reports:
A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).
The CodeIgniter changelog reports:
Form Validation Library rule valid_email could be bypassed if idn_to_ascii() is available.
irssi reports:
When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.
While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table.
the PHP project reports:
- A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer (CVE-2017-9224).
- A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption (CVE-2017-9226).
- A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer (CVE-2017-9227).
- A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption (CVE-2017-9228).
- A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition (CVE-2017-9228).
Drupal Security Team Reports:
CVE-2017-6920: PECL YAML parser unsafe object handling.
CVE-2017-6921: File REST resource does not properly validate
CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users.
Matt Johnston reports:
Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user.
Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys.
The smarty project reports:
bugfix {math} shell injection vulnerability
GnuPG reports:
Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".
GitLab reports:
Please reference CVE/URL list for details
The Tor Project reports:
Tor 0.3.0.9 fixes a path selection bug that would allow a client to use a guard that was in the same network family as a chosen exit relay. This is a security regression; all clients running earlier versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or 0.3.1.4-alpha.
Qualsys reports:
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
Michael J Rubinsky reports:
The second vulnerability (CVE-2017-9773) is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the "Null" image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL.
Michael J Rubinsky reports:
The fist vulnerability (CVE-2017-9774) is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server.
Samuli Seppänen reports:
In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.
This is a list of fixed important vulnerabilities:
- Remotely-triggerable ASSERT() on malformed IPv6 packet
- Pre-authentication remote crash/information disclosure for clients
- Potential double-free in --x509-alt-username
- Remote-triggerable memory leaks
- Post-authentication remote DoS when using the --x509-track option
- Null-pointer dereference in establish_http_proxy_passthru()
The Apache httpd project reports:
- ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):
Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.- mod_ssl Null Pointer Dereference (CVE-2017-3169):
mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.- mod_http2 Null Pointer Dereference (CVE-2017-7659):
A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process.- ap_find_token() Buffer Overread (CVE-2017-7668):
The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.- mod_mime Buffer Overread (CVE-2017-7679):
mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
Google Chrome releases reports:
5 security fixes in this release, including:
- [725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by Ned Williamson on 2017-05-22
- [729991] High CVE-2017-5088: Out of bounds read in V8. Reported by Xiling Gong of Tencent Security Platform Department on 2017-06-06
- [714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by Michal Bentkowski on 2017-04-21
- [732498] Various fixes from internal audits, fuzzing and other initiatives
cURL security advisory:
When libcurl is given either
1. a file: URL that doesn't use two slashes following the colon, or
2. is told that file is the default scheme to use for URLs without scheme
... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.
We are not aware of any exploit of this flaw.
BestPractical reports:
Please reference CVE/URL list for details
Adobe reports:
- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084).
- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).
Mozilla Foundation reports:
Please reference CVE/URL list for details
Roundcube reports:
Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
The GnuTLS project reports:
It was found using the TLS fuzzer tools that decoding a status response TLS extension with valid contents could lead to a crash due to a null pointer dereference. The issue affects GnuTLS server applications.
Joseph Bisch reports:
When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer.
When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory.
Google Chrome releases reports:
30 security fixes in this release
Please reference CVE/URL list for details
RedHat security team reports:
An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.
The duo security team reports:
An untrusted user may be able to set the http_proxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success.
Stefan Winter reports:
The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
Viktor Dukhovni reports:
Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. (CVE-2017-6594)
ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed).
Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.
A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6464]
A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. [CVE-2017-6462]
A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6463]
A vulnerability was found in NTP, affecting the origin timestamp check function. [CVE-2016-9042]
A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. [CVE-2017-6463, CVE-2017-6464]
A malicious device could send crafted messages, causing ntpd to crash. [CVE-2017-6462]
An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service. [CVE-2016-9042]
Check Point research team reports:
Remote code execution via crafted subtitles
Brandon Perry reports:
[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).
- CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
- CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
- CVE-2017-9112 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
- CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
- CVE-2017-9114 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
- CVE-2017-9116 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
Please reference CVE/URL list for details
The samba project reports:
Remote code execution from a writable share.
All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
NVIDIA Unix security team reports:
NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges.
Tintinweb reports:
An integer signedness error was found in miniupnp's miniwget allowing an unauthenticated remote entity typically located on the local network segment to trigger a heap corruption or an access violation in miniupnp's http response parser when processing a specially crafted chunked-encoded response to a request for the xml root description url.
WordPress versions 4.7.4 and earlier are affected by six security issues
- Insufficient redirect validation in the HTTP class.
- Improper handling of post meta data values in the XML-RPC API.
- Lack of capability checks for post meta data in the XML-RPC API.
- A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.
- A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.
The Asterisk project reports:
A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.
The Asterisk project reports:
A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By overrunning the buffer, the memory allocation table becomes corrupted, leading to an eventual crash.
The multi-part body parser in PJSIP contains a logical error that can make certain multi-part body parts attempt to read memory from outside the allowed boundaries. A specially-crafted packet can trigger these invalid reads and potentially induce a crash.
This issues is in PJSIP, and so the issue can be fixed without performing an upgrade of Asterisk at all. However, we are releasing a new version of Asterisk with the bundled PJProject updated to include the fix.
If you are running Asterisk with chan_sip, this issue does not affect you.
JSST reports:
Inadequate filtering of request data leads to a SQL Injection vulnerability.
GitLab reports:
Please reference CVE/URL list for details
GitLab reports:
Information Disclosure in Issue and Merge Request Trackers
During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to disclose that user's private token, email token, email address, and encrypted OTP secret. Reporter-level access to a GitLab project is required to exploit this flaw.
SSRF when importing a project from a Repo by URL
GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services that are bound to the local interface of the server. These services often do not require authentication. Depending on the service an attacker might be able craft an attack using the project import request URL.
Links in Environments tab vulnerable to tabnabbing
edio via HackerOne reported that user-configured Environment links include target=_blank but do not also include rel: noopener noreferrer. Anyone clicking on these links may therefore be subjected to tabnabbing attacks where a link back to the requesting page is maintained and can be manipulated by the target server.
Accounts with email set to "Do not show on profile" have addresses exposed in public atom feed
Several GitLab users reported that even with "Do not show on profile" configured for their email addresses those addresses were still being leaked in Atom feeds if they commented on a public project.
Werner Lemberg reports:
CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 fonts.
Samuli Seppänen reports:
OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities. Fixes to them have been backported to v2.3.15.
An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)
An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).
The PostgreSQL project reports:
Security Fixes nested CASE expressions + database and role names with embedded special characters
- CVE-2017-7484: selectivity estimators bypass SELECT privilege checks.
- CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
- CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.
Albert Astals Cid reports:
KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account.
rwhitworth reports:
I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here: https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse id_filename to cause seg faults.
Google Chrome Releases reports:
1 security fix in this release:
Timo Sirainen reports:
passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS.
Jakub Jirutka reports:
LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.
Jenkins Security Advisory:
Description
SECURITY-412 through SECURITY-420 / CVE-2017-1000356
CSRF: Multiple vulnerabilities
SECURITY-429 / CVE-2017-1000353
CLI: Unauthenticated remote code execution
SECURITY-466 / CVE-2017-1000354
CLI: Login command allowed impersonating any Jenkins user
SECURITY-503 / CVE-2017-1000355
XStream: Java crash when trying to instantiate void/Void
The CodeIgniter changelog reports:
Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).
Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.
Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.
Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.
Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.
Common Vulnerabilities and Exposures:
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.
Drupal Security Team Reports:
CVE-2017-6919: Access bypass
Google Chrome Releases reports:
29 security fixes in this release, including:
- [695826] High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360
- [694382] High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani
- [684684] High CVE-2017-5059: Type confusion in Blink. Credit to SkyLined working with Trend Micro's Zero Day Initiative
- [683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to Xudong Zheng
- [672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)
- [702896] Medium CVE-2017-5062: Use after free in Chrome Apps. Credit to anonymous
- [700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to Sweetchip
- [693974] Medium CVE-2017-5064: Use after free in Blink. Credit to Wadih Matar
- [704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to Khalil Zhani
- [690821] Medium CVE-2017-5066: Incorrect signature handing in Networking. Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen (ICTT, Xidian University)
- [648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to Khalil Zhani
- [691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to Michael Reizelman
- [713205] Various fixes from internal audits, fuzzing and other initiatives
NVD reports:
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
NVD reports:
Please reference CVE/URL list for details
NVD reports:
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
NVD reports:
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
cURL security advisory:
libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).
libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.
This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Mozilla Foundation reports:
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products.
Debian Security reports:
CVE-2016-10195: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.
CVE-2016-10196: Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
CVE-2016-10197: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
Mozilla Foundation reports:
An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.
Mozilla Foundation reports:
Please reference CVE/URL list for details
Oracle reports:
This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
ISC reports:
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.
An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.
A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.
The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks.
The Xen Project reports:
The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.
The cURL project reports:
There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..
This flaw only exists in the command line tool.
We are not aware of any exploit of this flaw.
Django team reports:
These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
- Open redirect and possible XSS attack via user-supplied numeric redirect URLs
- Open redirect vulnerability in django.views.static.serve()
The Asterisk project reports:
No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection.
NVIDIA Unix security team reports:
NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where multiple integer overflows, improper access control, and improper validation of a user input may cause a denial of service or potential escalation of privileges.
Google Chrome Releases reports:
5 security fixes in this release, including:
- [698622] Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar
- [699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs
- [662767] High CVE-2017-5052: Bad cast in Blink. Credit to JeongHoon Shin
- [705445] High CVE-2017-5056: Use after free in Blink. Credit to anonymous
- [702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)
The Xen Project reports:
Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host.
The phpMyAdmin team reports:
Summary
Bypass $cfg['Servers'][$i]['AllowNoPassword']
Description
A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).
This behavior depends on the PHP version used (it seems PHP 5 is affected, while PHP 7.0 is not).
Severity
We consider this vulnerability to be of moderate severity.
Mitigation factor
Set a password for all users.
Samba team reports:
A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks.
The Xen Project reports:
A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process.
The irssi project reports:
Use after free while producing list of netjoins (CWE-416). This issue was found and reported to us by APic. This issue usually leads to segmentation faults. Targeted code execution should be difficult.
Openwall reports:
C client library for MySQL (libmysqlclient.so) has use-after-free defect which can cause crash of applications using that MySQL client.
The Mozilla Foundation reports:
An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer.
Marina Glancy reports:
In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. We highly recommend that you upgrade your sites as soon as possible. Upgrading should be very straightforward. As per our usual policy, admins of all registered Moodle sites will be notified of security issue details directly via email and we'll publish details more widely in a week.
Marina Glancy reports:
MSA-17-0001: System file inclusion when adding own preset file in Boost theme
MSA-17-0002: Incorrect sanitation of attributes in forums
MSA-17-0003: PHPMailer vulnerability in no-reply address
MSA-17-0004: XSS in assignment submission page
Drupal Security Team reports:
CVE-2017-6377: Editor module incorrectly checks access to inline private files
CVE-2017-6379: Some admin paths were not protected with a CSRF token
CVE-2017-6381: Remote code execution
Simon G. Tatham reports:
Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]
This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.
Adobe reports:
- These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).
- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).
- These updates resolve a random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).
- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003).
Janos Follath reports:
- If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
- If the client and the server both support MD5 and the client can be tricked to authenticate to a malicious server, then the malicious server can impersonate the client. To launch this man in the middle attack, the adversary has to compute a chosen-prefix MD5 collision in real time. This is very expensive computationally, but can be practical. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
- A bug in the logic of the parsing of a PEM encoded Certificate Revocation List in mbedtls_x509_crl_parse() can result in an infinite loop. In versions before 1.3.10 the same bug results in an infinite recursion stack overflow that usually crashes the application. Methods and means of acquiring the CRLs is not part of the TLS handshake and in the strict TLS setting this vulnerability cannot be triggered remotely. The vulnerability cannot be triggered unless the application explicitly calls mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM formatted CRL of untrusted origin. In which case the vulnerability can be exploited to launch a denial of service attack against the application.
Google Chrome Releases reports:
36 security fixes in this release
Please reference CVE/URL list for details
The Legion of the Bouncy Castle reports:
Release: 1.56
2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)
Albert Aastals Cid reports:
A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.
Albert Aastals Cid reports:
A directory traversal issue was found in KTNEF which can be exploited by tricking a user into opening a malicious winmail.dat file. The issue allows to write files with the permission of the user opening the winmail.dat file during extraction.
Albert Astals Cid reports:
Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs.
This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens).
This attack can be carried out remotely (over the LAN) since proxy settings allow "Detect Proxy Configuration Automatically". This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one.
WordPress versions 4.7.2 and earlier are affected by six security issues.
- Cross-site scripting (XSS) via media file metadata.
- Control characters can trick redirect URL validation.
- Unintended files can be deleted by administrators using the plugin deletion functionality.
- Cross-site scripting (XSS) via video URL in YouTube embeds.
- Cross-site scripting (XSS) via taxonomy term names.
- Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources.
Mozilla Foundation reports:
Please reference CVE/URL list for details
The CodeIgniter changelog reports:
Fixed an XSS vulnerability in Security Library method xss_clean().
Fixed a possible file inclusion vulnerability in Loader Library method vars().
Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane from NamePros).
Added protection against timing side-channel attacks in Security Library method csrf_verify().
Added protection against BREACH attacks targeting the CSRF token field generated by Form Helper function form_open().
ikiwiki reports:
The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact:
An attacker who can log in to a site with a password can log in as a different and potentially more privileged user.
An attacker who can create a new account can set arbitrary fields in the user database for that account
Mitre reports:
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
When CGI::FormBuilder->field("foo") is called in list context (and in particular in the arguments to a subroutine that takes named arguments), it can return zero or more values for foo from the CGI request, rather than the expected single value. This breaks the usual Perl parsing convention for named arguments, similar to CVE-2014-1572 in Bugzilla (which was caused by a similar API design issue in CGI.pm).
potrace reports:
CVE-2016-8685: invalid memory access in findnext
CVE-2016-8686: memory allocation failure
The MPD project reports:
httpd: fix two buffer overflows in IcyMetaData length calculation
The cURL project reports:
SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error.
Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work.
This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.
The Xen Project reports:
In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check whether the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.
Alan Somers reports:
The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.
David Bryant reports:
global buffer overread in read_code / read_words.c
heap out of bounds read in WriteCaffHeader / caff.c
heap out of bounds read in unreorder_channels / wvunpack.c
heap oob read in read_new_config_info / open_utils.c
ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.
Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.
The OpenSSL project reports:
Severity: High
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.
This issue does not affect OpenSSL version 1.0.2.
Ximin Luo reports:
[v67] introduced a security hole where diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive.
FFmpeg security reports:
FFmpeg 3.2.4 fixes the following vulnerabilities: CVE-2017-5024, CVE-2017-5025
Daniel P. Berrange reports:
CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings
CVE-2017-5885 - fix color map index bounds checking.
The Xen Project reports:
When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory.
A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation.
libtiff project reports:
Multiple flaws have been discovered in libtiff library and utilities.
wdollman reports:
The value of the view_type parameter on the view_all_bug_page.php page is not encoded before being displayed on the page.
Ludovic Courtès reports:
The REPL server is vulnerable to the HTTP inter-protocol attack
The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.
Peter Bex reports:
A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn.
Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing.
Irregex versions before 0.9.6 contain a resource exhaustion vulnerability: when compiling deeply nested regexes containing the "+" operator due to exponential expansion behaviour.
Mortiz Bunkus reports:
Multiple invalid memory accesses vulnerabilities.
TALOS reports:
An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library.
Jens Georg reports:
I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins.
Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade.
Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade.
Jenkins Security Advisory:
Please reference CVE/URL list for details
Aaron D. Campbell reports:
WordPress versions 4.7.1 and earlier are affected by three security issues:
- The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.
- WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.
- A cross-site scripting (XSS) vulnerability was discovered in the posts list table.
- An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.
Peter Haag reports:
A remote attacker with access to the web interface to execute arbitrary commands on the host operating system.
Google Chrome Releases reports:
51 security fixes in this release
Please reference CVE/URL list for details
The OpenSSL project reports:
- Truncated packet could crash via OOB read (CVE-2017-3731)
- Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
- BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
- Montgomery multiplication may produce incorrect results (CVE-2016-7055)
Mozilla Foundation reports:
Please reference CVE/URL list for details
The phpMyAdmin development team reports:
Open redirect
php-gettext code execution
DOS vulnerability in table editing
CSS injection in themes
Cookie attribute injection attack
SSRF in replication
DOS in replication status
Intel Corporation reports:
A security vulnerability in the Intel(R) Ethernet Controller X710 and Intel(R) Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.
The PHP project reports:
The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release.
The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several security bugs were fixed in this release.
Choongwoo Han reports:
An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int.
Oracle reports:
No further details have been provided in the Critical Patch Update
PowerDNS reports:
2016-02: Crafted queries can cause abnormal CPU usage
2016-03: Denial of service via the web server
2016-04: Insufficient validation of TSIG signatures
2016-05: Crafted zone record can cause a denial of service
The Apache Groovy project reports:
When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. This is similar to CVE-2015-3253 but this exploit involves extra wrapping of objects and catching of exceptions which are now safe guarded against.
Pivotal.io reports:
MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Aaron D. Campbell reports:
WordPress versions 4.7 and earlier are affected by eight security issues...
Oracle reports:
Local security vulnerability in 'Server: Packaging' sub component.
The MySQL project reports:
- CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component.
- CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
- CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
- CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub component.
- CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub component.
- CVE-2016-5629: Remote security vulnerability in 'Server: Federated' sub component.
- CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub component.
Computest reports:
Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.
SecurityFocus reports:
PHPMailer is prone to an local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.
ISC reports:
A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.
Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers. DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.
An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.
An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.
The ssh-agent(1) agent supports loading a PKCS#11 module from outside a trusted whitelist. An attacker can request loading of a PKCS#11 module across forwarded agent-socket. [CVE-2016-10009]
When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. [CVE-2016-10010]
A remote attacker who have control of a forwarded agent-socket on a remote system and have the ability to write files on the system running ssh-agent(1) agent can run arbitrary code under the same user credential. Because the attacker must already have some control on both systems, it is relatively hard to exploit this vulnerability in a practical attack. [CVE-2016-10009]
When privilege separation is disabled (on FreeBSD, privilege separation is enabled by default and has to be explicitly disabled), an authenticated attacker can potentially gain root privileges on systems running OpenSSH server. [CVE-2016-10010]
Cesar Pereida Garcia reports:
The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect omits setting the BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in the BN_mod_inverse method and therefore resulting in a cache-timing attack vulnerability.
A malicious user with local access can recover ECDSA P-256 private keys.
Adobe reports:
These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).
These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931).
Thomas Waldmann reports:
fix XSS in AttachFile view (multifile related) CVE-2016-7148
fix XSS in GUI editor's attachment dialogue CVE-2016-7146
fix XSS in GUI editor's link dialogue CVE-2016-9119
libvnc server reports:
Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).
Christian Rebischke reports:
libdwarf is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.
Oracle reports:
Lynx is vulnerable to POODLE by still supporting vulnerable version of SSL. Lynx is also vulnerable to URL attacks by incorrectly parsing hostnames ending with an '?'.
Talos Security reports:
CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability
CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability
CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability
CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability
These packages have reached End of Life status and/or have been removed from the Ports Tree. They may contain undocumented security issues. Please take caution and find alternative software as soon as possible.
Peter Wu on Openwall mailing-list reports:
The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root. while any local user can connect to the Unix socket. Fixed by patch which is released with hpcsc-lite 1.8.20.
The GnuTLS project reports:
- It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. (GNUTLS-SA-2017-2)
- It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificate with Proxy Certificate Information extension present could lead to a double free. (GNUTLS-SA-2017-1)
The Apache Software Foundation reports:
Important: Information Disclosure CVE-2016-8745
The Apache Software Foundation reports:
Important: Remote Code Execution CVE-2016-8735
Important: Information Disclosure CVE-2016-6816
The Apache Software Foundation reports:
Low: Unrestricted Access to Global Resources CVE-2016-6797
Low: Security Manager Bypass CVE-2016-6796
Low: System Property Disclosure CVE-2016-6794
Low: Security Manager Bypass CVE-2016-5018
Low: Timing Attack CVE-2016-0762
Irssi reports:
Five vulnerabilities have been located in Irssi
- A NULL pointer dereference in the nickcmp function found by Joseph Bisch. (CWE-690)
- Use after free when receiving invalid nick message (Issue #466, CWE-146)
- Out of bounds read in certain incomplete control codes found by Joseph Bisch. (CWE-126)
- Out of bounds read in certain incomplete character sequences found by Hanno Böck and independently by J. Bisch. (CWE-126)
- Out of bounds read when Printing the value '%['. Found by Hanno Böck. (CWE-126)
These issues may result in denial of service (remote crash).
The CodeIgniter changelog reports:
Fixed a number of new vulnerabilities in Security Library method xss_clean().
The CodeIgniter changelog reports:
Fixed an SQL injection in the ‘odbc’ database driver.
Updated set_realpath() Path Helper function to filter-out php:// wrapper inputs.
Multiple remote code execution and denial of service conditions present.
The Gitea project reports:
Security
- Sanitize uploaded file names
- HTMLEncode user added text
rpm4 reports:
Regression in -setperms, -setugids and -restore
Note that this update can not automatically fix possible damage done by using -setperms, -setugids or -restore with rpm 4.14.2, it merely fixes the functionlity itself. Any damage needs to be investigated and fixed manually, such as using -verify and -restore or reinstalling packages.
Gitlab reports:
Arbitrary File read in Gitlab project import
The Shibboleth Consortium reports:
SAML messages, assertions, and metadata all commonly contain date/time information in a standard XML format.
Invalid formatted data in such fields cause an exception of a type that was not handled properly in the V3 software and causes a crash (usually to the shibd daemon process, but possibly to Apache in rare cases). Note that the crash occurs prior to evaluation of a message's authenticity, so can be exploited by an untrusted attacker.
The problem is believed to be specific to the V3 software and would not cause a crash in the older, now unsupported, V2 software.
Apache CouchDB PMC reports:
Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases.
Bro Network security Monitor reports:
Bro 2.6.1 updates the embedded SQLite to version 3.26.0 to address the "Magellan" remote code execution vulnerability. The stock Bro configuration/scripts don't use SQLite by default, but custom user scripts/packages may.
Due to insufficient validation of network-provided data it may be possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow.
It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.
wordpress developers reports:
WordPress versions 5.0 and earlier are affected by the following bugs, which are fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are also available, for users who have not yet updated to 5.0.
Karim El Ouerghemmi discovered that authors could alter meta data to delete files that they weren’t authorized to.
Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input.
Sam Thomas discovered that contributors could craft meta data in a way that resulted in PHP object injection.
Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability.
Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. WordPress itself was not affected, but plugins could be in some situations.
Team Yoast discovered that the user activation screen could be indexed by search engines in some uncommon configurations, leading to exposure of email addresses, and in some rare cases, default generated passwords.
Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload specifically crafted files that bypass MIME verification, leading to a cross-site scripting vulnerability.
Janos Follath reports:
An attacker who can run code on the same machine that is performing an RSA decryption can potentially recover the plaintext through a Bleichenbacher-like oracle.
Typo3 core team reports:
CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.
Failing to properly encode user input, online media asset rendering (*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.
Template patterns that are affected are:
- ###FEUSER_[fieldName]### using system extension felogin
- <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
The Install Tool exposes the current TYPO3 version number to non-authenticated users.
Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.
Gitlab reports:
Arbitrary File read in GitLab project import with Git LFS
The phpMyAdmin development team reports:
Summary
Local file inclusion through transformation feature
Description
A flaw has been found where an attacker can exploit phpMyAdmin to leak the contents of a local file. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Severity
We consider this vulnerability to be severe.
Summary
XSRF/CSRF vulnerability in phpMyAdmin
Description
By deceiving a user to click on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
Severity
We consider this vulnerability to be of moderate severity.
Summary
XSS vulnerability in navigation tree
Description
A Cross-Site Scripting vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a specially-crafted database/table name.
Severity
We consider this attack to be of moderate severity.
Mitigation factor
The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms.
Mozilla Foundation reports:
CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module
CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
CVE-2018-18492: Use-after-free with select element
CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
CVE-2018-18495: WebExtension content scripts can be loaded in about: pages
CVE-2018-18496: Embedded feed preview page can be abused for clickjacking
CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators
CVE-2018-18498: Integer overflow when calculating buffer sizes for images
CVE-2018-12406: Memory safety bugs fixed in Firefox 64
CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
Insufficient bounds checking in one of the device models provided by bhyve(8) can permit a guest operating system to overwrite memory in the bhyve(8) processing possibly permitting arbitary code execution.
A guest OS using a firmware image can cause the bhyve process to crash, or possibly execute arbitrary code on the host as root.
Insufficient and improper checking in the NFS server code could cause a denial of service or possibly remote code execution via a specially crafted network packet.
A remote attacker could cause the NFS server to crash, resulting in a denial of service, or possibly execute arbitrary code on the server.
Node.js reports:
Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.
We recommend that all Node.js users upgrade to a version listed below as soon as possible.
Debugger port 5858 listens on any interface by default (CVE-2018-12120)
All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with
node --debugornode debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such asnode --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.Denial of Service with large HTTP headers (CVE-2018-12121)
All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.
"Slowloris" HTTP Denial of Service (CVE-2018-12122)
All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.
A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with
server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction withserver.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service.Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using
url.parse()to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.HTTP request splitting (CVE-2018-12116)
Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the
pathoption of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.
OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.
OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.
powerdns Team reports:
CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.
mitre.org Reports:
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests A customized SSH client can simply skip the authentication step.
Gitlab reports:
Directory Traversal in Templates API
Adobe reports:
- This update resolves a use-after-free vulnerability that could lead to arbitrary code execution (CVE-2018-15982).
- This update resolves an insecure library loading vulnerability that could lead to privilege escalation (CVE-2018-15983).
Jenkins Security Advisory:
Description
(Critical) SECURITY-595
Code execution through crafted URLs
(Medium) SECURITY-904
Forced migration of user records
(Medium) SECURITY-1072
Workspace browser allowed accessing files outside the workspace
(Medium) SECURITY-1193
Potential denial of service through cron expression form validation
moodle reports:
The login form is not protected by a token to prevent login cross-site request forgery.
Ruby on Rails blog:
Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These contain the following important security fixes, and it is recommended that users upgrade as soon as possible
CVE-2018-16476 Broken Access Control vulnerability in Active Job: Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.
The upstream project reports:
* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx* Commit 864f5d4c127def386dd5cc926ad96934b297f04e Thanks to Google Autofuzz team for the report!
* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx* Commit f76275d4a91b28d687250525d3a0c5509bbd666f Thanks to Google Autofuzz team for the report!
* Fixed: Protect uriResetUri* against acting on NULL input Commit f58c25069cf4a986fe17a80c5b38687e31feb539
Albert Astals Cid reports:
messagelib is the library used by KMail to display emails.
messagelib by default displays emails as plain text, but gives the user an option to "Prefer HTML to plain text" in the settings and if that option is not enabled there is way to enable HTML display when an email contains HTML.
Some HTML emails can trick messagelib into opening a new browser window when displaying said email as HTML.
This happens even if the option to allow the HTML emails to access remote servers is disabled in KMail settings.
This means that the owners of the servers referred in the email can see in their access logs your IP address.
FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution.
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 4.3 (Integrity impacts).
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. While the vulnerability is in Oracle GlassFish Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).
Gitlab reports:
View Names of Private Groups
Persistent XSS in Environments
SSRF in Prometheus integration
Unauthorized Promotion of Milestones
Exposure of Confidential Issue Title
Persisent XSS in Markdown Fields via Mermaid Script
Persistent XSS in Markdown Fields via Unrecognized HTML Tags
Symlink Race Condition in Pages
Unauthorized Changes by Guest User in Issues
Unauthorized Comments on Locked Issues
Improper Enforcement of Token Scope
CRLF Injection in Project Mirroring
XSS in OAuth Authorization
SSRF in Webhooks
Send Email on Email Address Change
Workhorse Logs Contained Tokens
Unauthorized Publishing of Draft Comments
Guest Can Set Weight of a New Issue
Disclosure of Private Group's Members and Milestones
Persisent XSS in Operations
Reporter Can View Operations Page
The samba project reports:
All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue.
When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ.
During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process.
During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate
A user in a Samba AD domain can crash the KDC when Samba is built in the non-default MIT Kerberos configuration.
AD DC Configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all.
The PHP team reports:
imap_open allows to run arbitrary shell commands via mailbox parameter.
SO-AND-SO reports:
CVE-2018-19296:Fix potential object injection vulnerability.
Adobe reports:
- This update resolves a type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-15981).
Gitlab reports:
Persistent XSS Autocompletion
Unauthorized service template creation
PowerDNS Team reports:
CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause a memory leak by inserting a specially crafted record in a zone under their control, then sending a DNS query for that record. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed. When the PowerDNS Authoritative Server is run inside the guardian (--guardian), or inside a supervisor like supervisord or systemd, an out-of-memory crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.
CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.
powerdns Team reports:
CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing a malicious authoritative server to cause a memory leak by sending specially crafted records. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, an out-of-memory crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.
CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC validation by themselves might consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.
CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail.
The Asterisk project reports:
There is a buffer overflow vulnerability in dns_srv and dns_naptr functions of Asterisk that allows an attacker to crash Asterisk via a specially crafted DNS SRV or NAPTR response. The attackers request causes Asterisk to segfault and crash.
Adobe reports:
- This update resolves a out-of-bounds vulnerability that could lead to information disclosure (CVE-2018-15978).
The OpenSSL project reports:
Microarchitecture timing vulnerability in ECC scalar multiplication. Severity: Low
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.
Albert Astals Cid reports:
Various KDE applications share a plugin system to create thumbnails of various file types for displaying in file managers, file dialogs, etc. kio-extras contains a thumbnailer plugin for HTML files.
The HTML thumbnailer was incorrectly accessing some content of remote URLs listed in HTML files. This meant that the owners of the servers referred in HTML files in your system could have seen in their access logs your IP address every time the thumbnailer tried to create the thumbnail.
The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0 because it was actually not creating thumbnails for files at all.
NVD reports:
An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
Lighttpd Project reports:
Security fixes for Lighttpd:
security: process headers after combining folded headers
The PostgreSQL project reports:
CVE-2018-16850: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.
Using a purpose-crafted trigger definition, an attacker can run arbitrary SQL statements with superuser privileges when a superuser runs pg_upgrade on the database or during a pg_dump dump/restore cycle. This attack requires a CREATE privilege on some non-temporary schema or a TRIGGER privilege on a table. This is exploitable in the default PostgreSQL configuration, where all users have CREATE privilege on public schema.
NGINX Team reports:
Two security issues were identified in nginx HTTP/2 implementation, which might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844).
The issues affect nginx compiled with the ngx_http_v2_module (not compiled by default) if the "http2" option of the "listen" directive is used in a configuration file.
A security issue was identified in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory isclosure by using a specially crafted mp4 file (CVE-2018-16845).
The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the "mp4" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
The Gitea project reports:
[This release] contains crit[i]cal security fix for vulnerability that could potentially allow for authorized users to do remote code ex[e]cution.
curl security problems:
CVE-2018-16839: SASL password overflow via integer overflow
libcurl contains a buffer overrun in the SASL authentication code.
The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate.
On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow.
This bug is very similar to CVE-2017-14618.
It affects curl 7.33.0 to 7.61.1.
CVE-2018-16840: use-after-free in handle close
libcurl contains a heap use-after-free flaw in code related to closing an easy handle.
When closing and cleaning up an "easy" handle in the Curl_close() function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.
It affects curl 7.59.0 to 7.61.1.
CVE-2018-16842: warning message out-of-buffer read
curl contains a heap out of buffer read vulnerability.
The command line tool has a generic function for displaying warning and informational messages to stderr for various situations. For example if an unknown command line argument is used, or passed to it in a "config" file.
This display function formats the output to wrap at 80 columns. The wrap logic is however flawed, so if a single word in the message is itself longer than 80 bytes the buffer arithmetic calculates the remainder wrong and will end up reading behind the end of the buffer. This could lead to information disclosure or crash.
This vulnerability could lead to a security issue if used in this or similar situations:
1. a server somewhere uses the curl command line to run something
2. if it fails, it shows stderr to the user
3. the server takes user input for parts of its command line input
4. user provides something overly long that triggers this crash
5. the stderr output may now contain user memory contents that wasn't meant to be available
It affects curl 7.14.1 to 7.61.1.
SO-AND-SO reports:
SSRF in Kubernetes integration
GitHub issue:
This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported (independently) by Shubham Pathak and @yasinS (Yasin Soliman).
In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Gitlab reports:
RCE in Gitlab Wiki API
SSRF in Hipchat integration
Cleartext storage of personal access tokens
Information exposure through stack trace error message
Persistent XSS autocomplete
Information exposure in stored browser history
Information exposure when replying to issues through email
Persistent XSS in License Management and Security Reports
Metrics information disclosure in Prometheus integration
Unauthorized changes to a protected branch's access levels
The OpenSSL project reports:
Timing vulnerability in ECDSA signature generation (CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key (Low).
Timing vulnerability in DSA signature generation (CVE-2018-0734): Avoid a timing attack that leaks information via a side channel that triggers when a BN is resized. Increasing the size of the BNs prior to doing anything with them suppresses the attack (Low).
Talos reports:
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Jef Poskanzer reports:
Prior versions allowed remote users to read arbitrary files in some circumstances.
SaltStack reports:
Remote command execution and incorrect access control when using salt-api.
Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events.
Mozilla Foundation reports:
CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin
CVE-2018-12392: Crash with nested event loops
CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript
CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting
CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts
CVE-2018-12397:
CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs
CVE-2018-12399: Spoofing of protocol registration notification bar
CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android
CVE-2018-12401: DOS attack through special resource URI parsing
CVE-2018-12402: SameSite cookies leak when pages are explicitly saved
CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP
CVE-2018-12388: Memory safety bugs fixed in Firefox 63
CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
Drupal Security Team reports:
he path module allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.The issue is mitigated by the fact that the user needs the administer paths permission to exploit.
When sending email some variables were not being sanitized for shell arguments, which could lead to remote code execution.
Ruby news:
CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly
An instance of OpenSSL::X509::Name contains entities such as CN, C and so on. Some two instances of OpenSSL::X509::Name are equal only when all entities are exactly equal. However, there is a bug that the equality check is not correct if the value of an entity of the argument (right-hand side) starts with the value of the receiver (left-hand side). So, if a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal.
CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives
Array#pack method converts the receiver's contents into a string with specified format. If the receiver contains some tainted objects, the returned string also should be tainted. String#unpack method which converts the receiver into an array also should propagate its tainted flag to the objects contained in the returned array. But, with B, b, H and h directives, the tainted flags are not propagated. So, if a script processes unreliable inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags, the check might be wrong.
Oracle reports:
Please reference CVE/URL list for details
Matomo reports:
Several XSS issues have been fixed thanks to the great work of security researchers who responsible disclosed issues to us.
gladiac reports:
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.
The Git community reports:
Multiple vulnerabilities.
The Tox project blog reports:
A memory leak bug was discovered in Toxcore that can be triggered remotely to exhaust one’s system memory, resulting in a denial of service attack. The bug is present in the TCP Server module of Toxcore and therefore it affects mostly bootstrap nodes. Regular Tox clients generally have the TCP Server functionality disabled by default, leaving them unaffected.
Gitea project reports:
CSRF Vulnerability on API.
Enforce token on api routes.
Jenkins Security Advisory:
Description
(Low) SECURITY-867
Path traversal vulnerability in Stapler allowed accessing internal data
(Medium) SECURITY-1074
Arbitrary file write vulnerability using file parameter definitions
(Medium) SECURITY-1129
Reflected XSS vulnerability
(Medium) SECURITY-1162
Ephemeral user record was created on some invalid authentication attempts
(Medium) SECURITY-1128
Ephemeral user record creation
(Medium) SECURITY-1158
Session fixation vulnerability on user signup
(Medium) SECURITY-765
Failures to process form submission data could result in secrets being displayed or written to logs
tinc-vpn.org reports:
The authentication protocol allows an oracle attack that could potentially be exploited.
If a man-in-the-middle has intercepted the TCP connection it might be able to force plaintext UDP packets between two nodes for up to a PingInterval period.
Gitlab reports:
Merge request information disclosure
Private project namespace information disclosure
Gitlab Flavored Markdown API information disclosure
Joel Esler reports:
- CVE-2018-15378:
- Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
- Reported by Secunia Research at Flexera.
- Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.
- Reported by Alex Gaynor.
- CVE-2018-14680:
- An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
- CVE-2018-14681:
- An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
- CVE-2018-14682:
- An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.
Django release notes:
CVE-2018-16984: Password hash disclosure to "view only" admin users
If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem.
Mozilla Foundation reports:
CVE-2018-12386: Type confusion in JavaScript
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered.
CVE-2018-12387:
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.
Gitlab reports:
SSRF GCP access token disclosure
Persistent XSS on issue details
Diff formatter DoS in Sidekiq jobs
Confidential information disclosure in events API endpoint
validate_localhost function in url_blocker.rb could be bypassed
Slack integration CSRF Oauth2
GRPC::Unknown logging token disclosure
IDOR merge request approvals
Persistent XSS package.json
Persistent XSS merge request project import
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
Serendipity reports:
Security: Fix XSS for pagination, when multi-category selection is used.
Bitcoin Core reports:
CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.
the Apache Spamassassin project reports:
In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed.
Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.
Fix a reliance on "." in @INC in one configuration script. Whether this can be exploited in any way is uncertain.
Fix a potential Remote Code Execution bug with the PDFInfo plugin. Thanks to cPanel Security Team for their report of this issue.
Fourth, this release fixes a local user code injection in the meta rule syntax. Thanks again to cPanel Security Team for their report of this issue.
shadowm reports:
A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0. Users of all previous version should upgrade immediately.
The Apache httpd project reports:
low: DoS for HTTP/2 connections by continuous SETTINGS
By sending continous SETTINGS frames of maximum size an ongoing HTTP/2 connection could be kept busy and would never time out. This can be abused for a DoS on the server. This only affect a server that has enabled the h2 protocol.
Brian Carpenter reports:
Reflected XSS in view_filters_page.php via core/filter_form_api.php
MITRE reports:
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Mediawiki reports:
Security fixes:
T169545: $wgRateLimits entry for 'user' overrides 'newbie'.
T194605: BotPasswords can bypass CentralAuth's account lock.
T187638: When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden
T193237: Special:BotPasswords should require reauthenticate.
The Mozilla Foundation reports:
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.
The Asterisk project reports:
There is a stack overflow vulnerability in the res_http_websocket.so module of Asterisk that allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket. The attackers request causes Asterisk to run out of stack space and crash.
As a workaround disable HTTP websocket access by not loading the res_http_websocket.so module.
moodle reports:
Moodle XML import of ddwtos could lead to intentional remote code execution
QuickForm library remote code vulnerability (upstream)
Boost theme - blog search GET parameter insufficiently filtered
JSST reports: Multiple low-priority Vulnerabilities
Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.
Inadequate output filtering on the user profile page could lead to a stored XSS attack.
Inadequate checks regarding disabled fields can lead to an ACL violation.
mybb Team reports:
High risk: Email field SQL Injection.
Medium risk: Video MyCode Persistent XSS in Visual Editor.
Low risk: Insufficient permission check in User CP’s attachment management.
Low risk: Insufficient email address verification.
Insufficient validation was performed in the ELF header parser, and malformed or otherwise invalid ELF binaries were not rejected as they should be.
Execution of a malicious ELF binary may result in a kernel crash or may disclose kernel memory.
MITRE reports:
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Adobe reports:
- This update resolves a privilege escalation vulnerability that could lead to information disclosure (CVE-2018-15967).
Chris reports:
The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Unauthenticated attackers on the same LAN can use this vulnerability to:
- Access arbitrary files from the filesystem with the same permission as the user account running Plex.
- Initiate SMB connections to capture NetNTLM challenge/response and crack to clear-text password.
- Initiate SMB connections to relay NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
MITRE reports:
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.
The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.
mybb Team reports:
High risk: Image MyCode “alt” attribute persistent XSS.
Medium risk: RSS Atom 1.0 item title persistent XSS.
The Gitea project reports:
[Privacy] Gitea leaks hidden email addresses #4417
A fix has been implemented in Gitea 1.5.1.
NIST reports:
The put_chars function in html_r.c in Twibright Links 2.14 allows remote attackers to cause a denial of service (buffer over-read) via a crafted HTML file.
curl security problems:
CVE-2018-14618: NTLM password overflow via integer overflow
The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap.
The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow.
This bug is almost identical to CVE-2017-8816.
Mozilla Foundation reports:
CVE-2018-12377: Use-after-free in refresh driver timers
CVE-2018-12378: Use-after-free in IndexedDB
CVE-2018-12379: Out-of-bounds write with malicious MAR file
CVE-2017-16541: Proxy bypass using automount and autofs
CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation
CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android
CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords
CVE-2018-12375: Memory safety bugs fixed in Firefox 62
CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2
CERT reports:
Ghostscript contains an optional -dSAFER option, which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER, which can allow an attacker to execute arbitrary commands with arbitrary arguments. This vulnerability can also be exploited in applications that leverage Ghostscript, such as ImageMagick, GraphicsMagick, evince, Okular, Nautilus, and others.
Exploit code for this vulnerability is publicly available.
Grafana Labs reports:
On the 20th of August at 1800 CEST we were contacted about a potential security issue with the “remember me” cookie Grafana sets upon login. The issue targeted users without a local Grafana password (LDAP & OAuth users) and enabled a potential attacker to generate a valid cookie knowing only a username.
All installations which use the Grafana LDAP or OAuth authentication features must be upgraded as soon as possible. If you cannot upgrade, you should switch authentication mechanisms or put additional protections in front of Grafana such as a reverse proxy.
Gitlab reports:
Persistent XSS in Pipeline Tooltip
GitLab.com GCP Endpoints Exposure
Persistent XSS in Merge Request Changes View
Sensitive Data Disclosure in Sidekiq Logs
Missing CSRF in System Hooks
Orphaned Upload Files Exposure
Missing Authorization Control API Repository Storage
Corelight reports:
Bro 2.5.5 primarily addresses security issues:
- Fix array bounds checking in BinPAC: for arrays that are fields within a record, the bounds check was based on a pointer to the start of the record rather than the start of the array field, potentially resulting in a buffer over-read.
- Fix SMTP command string comparisons: the number of bytes compared was based on the user-supplied string length and can lead to incorrect matches. e.g. giving a command of "X" incorrectly matched "X-ANONYMOUSTLS" (and an empty commands match anything).
Address potential vectors for Denial of Service:
- "Weird" events are now generally suppressed/sampled by default according to some tunable parameters.
- Improved handling of empty lines in several text protocol analyzers that can cause performance issues when seen in long sequences.
- Add `smtp_excessive_pending_cmds' weird which serves as a notification for when the "pending command" queue has reached an upper limit and been cleared to prevent one from attempting to slowly exhaust memory.
Node.js reports:
OpenSSL: Client DoS due to large DH parameter
This fixes a potential denial of service (DoS) attack against client connections by a malicious server. During a TLS communication handshake, where both client and server agree to use a cipher-suite using DH or DHE (Diffie-Hellman, in both ephemeral and non-ephemeral modes), a malicious server can send a very large prime value to the client. Because this has been unbounded in OpenSSL, the client can be forced to spend an unreasonably long period of time to generate a key, potentially causing a denial of service.
OpenSSL: ECDSA key extraction via local side-channel
Attackers with access to observe cache-timing may be able to extract DSA or ECDSA private keys by causing the victim to create several signatures and watching responses. This flaw does not have a CVE due to OpenSSL policy to not assign itself CVEs for local-only vulnerabilities that are more academic than practical. This vulnerability was discovered by Keegan Ryan at NCC Group and impacts many cryptographic libraries including OpenSSL.
Unintentional exposure of uninitialized memory
Only Node.js 10 is impacted by this flaw.
Node.js TSC member Nikita Skovoroda discovered an argument processing flaw that causes Buffer.alloc() to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is misinterpreted by Buffer's internal "fill" method as the start to a fill operation. This flaw may be abused where Buffer.alloc() arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
Out of bounds (OOB) write
Node.js TSC member Nikita Skovoroda discovered an OOB write in Buffer that can be used to write to memory outside of a Buffer's memory space. This can corrupt unrelated Buffer objects or cause the Node.js process to crash.
When used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
When using WPA2, EAPOL-Key frames with the Encrypted flag and without the MIC flag set, the data field was decrypted first without verifying the MIC. When the dta field was encrypted using RC4, for example, when negotiating TKIP as a pairwise cipher, the unauthenticated but decrypted data was subsequently processed. This opened wpa_supplicant(8) to abuse by decryption and recovery of sensitive information contained in EAPOL-Key messages.
See https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt for a detailed description of the bug.
All users of the WPA2 TKIP pairwise cipher are vulnerable to information, for example, the group key.
A researcher has notified us of a DoS attack applicable to another operating system. While FreeBSD may not be vulnerable to that exact attack, we have identified several places where inadequate DoS protection could allow an attacker to consume system resources.
It is not necessary that the attacker be able to establish two-way communication to carry out these attacks. These attacks impact both IPv4 and IPv6 fragment reassembly.
In the worst case, an attacker could send a stream of crafted fragments with a low packet rate which would consume a substantial amount of CPU.
Other attack vectors allow an attacker to send a stream of crafted fragments which could consume a large amount of CPU or all available mbuf clusters on the system.
These attacks could temporarily render a system unreachable through network interfaces or temporarily render a system unresponsive. The effects of the attack should clear within 60 seconds after the attack stops.
On certain Intel 64-bit x86 systems there is a period of time during terminal fault handling where the CPU may use speculative execution to try to load data. The CPU may speculatively access the level 1 data cache (L1D). Data which would otherwise be protected may then be determined by using side channel methods.
This issue affects bhyve on FreeBSD/amd64 systems.
An attacker executing user code, or kernel code inside of a virtual machine, may be able to read secret data from the kernel or from another virtual machine.
bluecatli (Tencent's Xuanwu Lab) reports:
The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.
If the Location header startswith /\, it will be transformed to // by browsers.
The phpMyAdmin development team reports:
Description
A Cross-Site Scripting vulnerability was found in the file import feature, where an attacker can deliver a payload to a user through importing a specially-crafted file.
Severity
We consider this attack to be of moderate severity.
The freedesktop.org project reports:
The functions XGetFontPath, XListExtensions, and XListFonts are vulnerable to an off-by-one override on malicious server responses. The server replies consist of chunks consisting of a length byte followed by actual string, which is not NUL-terminated. While parsing the response, the length byte is overridden with '\0', thus the memory area can be used as storage of C strings later on. To be able to NUL-terminate the last string, the buffer is reserved with an additional byte of space. For a boundary check, the variable chend (end of ch) was introduced, pointing at the end of the buffer which ch initially points to. Unfortunately there is a difference in handling "the end of ch". While chend points at the first byte that must not be written to, the for-loop uses chend as the last byte that can be written to. Therefore, an off-by-one can occur.
The length value is interpreted as signed char on many systems (depending on default signedness of char), which can lead to an out of boundary write up to 128 bytes in front of the allocated storage, but limited to NUL byte(s).
If the server sends a reply in which even the first string would overflow the transmitted bytes, list[0] (or flist[0]) will be set to NULL and a count of 0 is returned. If the resulting list is freed with XFreeExtensionList or XFreeFontPath later on, the first Xfree call is turned into Xfree (NULL-1) which will most likely trigger a segmentation fault. Casting the length value to unsigned char fixes the problem and allows string values with up to 255 characters.
Apache CouchDB PMC reports:
Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases.
botan2 developers report:
A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.
Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.
Jenkins Security Advisory:
Description
(Low) SECURITY-637
Jenkins allowed deserialization of URL objects with host components
(Medium) SECURITY-672
Ephemeral user record was created on some invalid authentication attempts
(Medium) SECURITY-790
Cron expression form validation could enter infinite loop, potentially resulting in denial of service
(Low) SECURITY-996
"Remember me" cookie was evaluated even if that feature is disabled
(Medium) SECURITY-1071
Unauthorized users could access agent logs
(Low) SECURITY-1076
Unauthorized users could cancel scheduled restarts initiated from the update center
Adobe reports:
- This update resolves out-of-bounds read vulnerabilities that could lead to information disclosure (CVE-2018-12824, CVE-2018-12826, CVE-2018-12827).
- This update resolves a security bypass vulnerability that could lead to security mitigation bypass (CVE-2018-12825).
- This update resolves a component vulnerability that could lead to privilege escalation (CVE-2018-12828).
The samba project reports:
Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server.
Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer.
Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing.
Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer.
All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.
GraphicsMagick News:
Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is another manefestation of CVE-2016-2317, which should finally be fixed correctly due to active detection/correction of pending overflow rather than using estimation.
CHICKEN reports:
- CVE-2017-6949: Unchecked malloc() call in SRFI-4 constructors when allocating in non-GC memory, resulting in potential 1-word buffer overrun and/or segfault
- CVE-2017-9334: "length" crashes on improper lists
- CVE-2017-11343: The randomization factor of the symbol table was set before the random seed was set, causing it to have a fixed value on many platforms
The Gitea project reports:
TOTP passcodes can be reused.
Simon Butcher reports:
- When using a CBC based ciphersuite, a remote attacker can partially recover the plaintext.
- When using a CBC based ciphersuite, an attacker with the ability to execute arbitrary code on the machine under attack can partially recover the plaintext by use of cache based side-channels.
The PostgreSQL project reports:
CVE-2018-10915: Certain host connection parameters defeat client-side security defenses
libpq, the client connection API for PostgreSQL that is also used by other connection libraries, had an internal issue where it did not reset all of its connection state variables when attempting to reconnect. In particular, the state variable that determined whether or not a password is needed for a connection would not be reset, which could allow users of features requiring libpq, such as the "dblink" or "postgres_fdw" extensions, to login to servers they should not be able to access.
CVE-2018-10925: Memory disclosure and missing authorization in `INSERT ... ON CONFLICT DO UPDATE`
An attacker able to issue CREATE TABLE can read arbitrary bytes of server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`) query. By default, any user can exploit that. A user that has specific INSERT privileges and an UPDATE privilege on at least one column in a given table can also update other columns using a view and an upsert query.
Oracle reports:
Multiple vulnerabilities have been disclosed by Oracle without further detail. CVSS scores 7.1 - 2.7
The shibboleth project reports:
SAML messages, assertions, and metadata all commonly make use of the XML Signature KeyInfo construct, which expresses information about keys and certificates used in signing or encrypting XML.
The Apache Santuario XML Security for C++ library contained code paths at risk of dereferencing null pointers when processing various kinds of malformed KeyInfo hints typically found in signed or encrypted XML. The usual effect is a crash, and in the case of the Shibboleth SP software, a crash in the shibd daemon, which prevents access to protected resources until the daemon is restarted.
One of the data structures that holds TCP segments uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue.
An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.
The Python Cryptographic Authority (PyCA) project reports:
finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor
Jann Horn reports:
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
NVD reports:
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
Sinatra blog:
Sinatra had a critical vulnerability since v2.0.0. The purpose of this release is to fix CVE-2018-11627.
The vulnerability is that XSS can be executed by using illegal parameters.
Mark Sapiro reports:
A URL with a very long text listname such as
http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_textwill echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.
This issue was discovered by Hammad Qureshi.
mantis reports:
Teun Beijers reported a cross-site scripting (XSS) vulnerability in the Edit Filter page which allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name. Prevent the attack by sanitizing the filter name before display.
Ömer Cıtak, Security Researcher at Netsparker, reported this vulnerability, allowing remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO on view_filters_page.php. Prevent the attack by sanitizing the output of $_SERVER['PHP_SELF'] before display.
bleach developer reports:
Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
This security issue was introduced in Bleach 2.1. Anyone using Bleach 2.1 is highly encouraged to upgrade.
lshell reports:
The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).
lshell reports:
It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).
Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).
OpenJPEG reports:
Multiple vulnerabilities have been found in OpenJPEG, the opensource JPEG 2000 codec. Please consult the CVE list for further details.
CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.
CVE-2018-5785 was fixed in r480624.
CVE-2018-6616 was fixed in r489415.
MITRE reports:
Multiple vulnerabilities have been found in FFmpeg. Please refer to CVE list for details.
Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed in 3.4.1. They're listed here for completeness of the record.
GNOME reports:
CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1
Google Chrome Releases reports:
42 security fixes in this release, including:
- [850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07
- [848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01
- [842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11
- [841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10
- [840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07
- [812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15
- [805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25
- [805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24
- [841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09
- [837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26
- [839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04
- [826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27
- [804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21
- [849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04
- [848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01
- [847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30
- [835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21
- [833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15
- [828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03
- [394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16
- [862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10
- [851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12
- [847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28
- [836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25
- [835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20
- [826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26
- [666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18
- [826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27
- [823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19
- [816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26
- [797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23
- [791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03
- [866821] Various fixes from internal audits, fuzzing and other initiatives
Peter Wu reports:
curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.
Gitlab reports:
Markdown DoS
Information Disclosure Prometheus Metrics
CSRF in System Hooks
Persistent XSS Pipeline Tooltip
Persistent XSS in Branch Name via Web IDE
Persistent XSS in Branch Name via Web IDE
libvips reports:
A buffer overflow was found and fixed in the libvips code
MITRE reports:
bsixel 1.8.1 has a memory leak in sixel_decoder_decode in decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in fromsixel.c and sixel_allocator_new in allocator.c
Mitre reports:
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
Kevin J. McCarthy reports:
Fixes a remote code injection vulnerability when "subscribing" to an IMAP mailbox, either via $imap_check_subscribed, or via the <subscribe> function in the browser menu. Mutt was generating a "mailboxes" command and sending that along to the muttrc parser. However, it was not escaping "`", which executes code and inserts the result. This would allow a malicious IMAP server to execute arbitrary code (for $imap_check_subscribed).
Fixes POP body caching path traversal vulnerability.
Fixes IMAP header caching path traversal vulnerability.
CVE-2018-14349 - NO Response Heap Overflow
CVE-2018-14350 - INTERNALDATE Stack Overflow
CVE-2018-14351 - STATUS Literal Length relative write
CVE-2018-14352 - imap_quote_string off-by-one stack overflow
CVE-2018-14353 - imap_quote_string int underflow
CVE-2018-14354 - imap_subscribe Remote Code Execution
CVE-2018-14355 - STATUS mailbox header cache directory traversal
CVE-2018-14356 - POP empty UID NULL deref
CVE-2018-14357 - LSUB Remote Code Execution
CVE-2018-14358 - RFC822.SIZE Stack Overflow
CVE-2018-14359 - base64 decode Stack Overflow
CVE-2018-14362 - POP Message Cache Directory Traversal
NeoMutt report:
Description
CVE-2018-14349
NO Response Heap Overflow
CVE-2018-14350
INTERNALDATE Stack Overflow
CVE-2018-14351
STATUS Literal Length relative write
CVE-2018-14352
imap_quote_string off-by-one stack overflow
CVE-2018-14353
imap_quote_string int underflow
CVE-2018-14354
imap_subscribe Remote Code Execution
CVE-2018-14355
STATUS mailbox header cache directory traversal
CVE-2018-14356
POP empty UID NULL deref
CVE-2018-14357
LSUB Remote Code Execution
CVE-2018-14358
RFC822.SIZE Stack Overflow
CVE-2018-14359
base64 decode Stack Overflow
CVE-2018-14360
NNTP Group Stack Overflow
CVE-2018-14361
NNTP Write 1 where via GROUP response
CVE-2018-14362
POP Message Cache Directory Traversal
CVE-2018-14363
NNTP Header Cache Directory Traversal
Jenkins Security Advisory:
Description
(High) SECURITY-897 / CVE-2018-1999001
Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart
(High) SECURITY-914 / CVE-2018-1999002
Arbitrary file read vulnerability
(Medium) SECURITY-891 / CVE-2018-1999003
Unauthorized users could cancel queued builds
(Medium) SECURITY-892 / CVE-2018-1999004
Unauthorized users could initiate and abort agent launches
(Medium) SECURITY-944 / CVE-2018-1999005
Stored XSS vulnerability
(Medium) SECURITY-925 / CVE-2018-1999006
Unauthorized users are able to determine when a plugin was extracted from its JPI package
(Medium) SECURITY-390 / CVE-2018-1999007
XSS vulnerability in Stapler debug mode
Mitre reports:
ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
The Apache project reports:
- DoS for HTTP/2 connections by crafted requests (CVE-2018-1333). By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. (low)
- mod_md, DoS via Coredumps on specially crafted requests (CVE-2018-8011). By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. (moderate)
Gitlab reports:
Remote Code Execution Vulnerability in GitLab Projects Import
Typo3 core team reports:
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.
Failing to properly dissociate system related configuration from user generated configuration, the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. Basically instructions can be persisted to a form definition file that were not configured to be modified - this applies to definitions managed using the form editor module as well as direct file upload using the regular file list module. A valid backend user account as well as having system extension form activated are needed in order to exploit this vulnerability.
It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed to exploit this vulnerability.
The Legion of the Bouncy Castle reports:
Release 1.60 is now available for download.
CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API.
CVE-2018-1000613: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS state information.
qutebrowser team reports:
Due to a CSRF vulnerability affecting the qute://settings page, it was possible for websites to modify qutebrowser settings. Via settings like editor.command, this possibly allowed websites to execute arbitrary code.
Adobe reports:
- This update resolves an out-of-bounds read vulnerability that could lead to information disclosure (CVE-2018-5008).
- This update resolves a type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-5007).
Apache CouchDB PMC reports:
Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases.
The Git community reports:
Out-of-bounds reads when reading objects from a packfile
Joel Esler reports:
3 security fixes in this release:
- CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).
- CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.
- CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report ed by aCaB.
NIST reports (by search in the range 2017/01/01 - 2018/07/06):
17 security fixes in this release:
- Heap-based buffer overflow in the __zzip_get32 function in fetch.c.
- Heap-based buffer overflow in the __zzip_get64 function in fetch.c.
- Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c.
- The zzip_mem_entry_new function in memdisk.c allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.
- The prescan_entry function in fseeko.c allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted ZIP file.
- The zzip_mem_entry_new function in memdisk.c cause a NULL pointer dereference and crash via a crafted ZIP file.
- seeko.c cause a denial of service (assertion failure and crash) via a crafted ZIP file.
- A segmentation fault caused by invalid memory access in the zzip_disk_fread function because the size variable is not validated against the amount of file->stored data.
- A memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c.
- A bus error caused by loading of a misaligned address in the zzip_disk_findfirst function.
- An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function.
- An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c.
- A memory leak triggered in the function zzip_mem_disk_new in memdisk.c.
wordpressdevelopers reports:
Taxonomy: Improve cache handling for term queries.
Posts, Post Types: Clear post password cookie when logging out.
Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.
Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.
Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.
mybb Team reports:
High risk: Image and URL MyCode Persistent XSS
Medium risk: Multipage Reflected XSS
Low risk: ACP logs XSS
Low risk: Arbitrary file deletion via ACP’s Settings
Low risk: Login CSRF
Low risk: Non-video content embedding via Video MyCode
Mitre reports:
An integer overflow during the parsing of XML using the Expat library.
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
Marlies Ruck reports:
Fix heap buffer overflow while trying to emit access log - see references for full details.
CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
MITRE reports:
SQLite databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
Mozilla Foundation reports:
CVE-2018-12359: Buffer overflow using computed size of canvas element
CVE-2018-12360: Use-after-free when using focus()
CVE-2018-12361: Integer overflow in SwizzleData
CVE-2018-12358: Same-origin bypass using service worker and redirection
CVE-2018-12362: Integer overflow in SSSE3 scaler
CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
CVE-2018-12363: Use-after-free when appending DOM nodes
CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
CVE-2018-12365: Compromised IPC child process can list local filenames
CVE-2018-12371: Integer overflow in Skia library during edge builder allocation
CVE-2018-12366: Invalid data handling during QCMS transformations
CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming
CVE-2018-12368: No warning when opening executable SettingContent-ms files
CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments
CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View
CVE-2018-5186: Memory safety bugs fixed in Firefox 61
CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1
CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9
Mark Sapiro reports:
Existing protections against malicious listowners injecting evil scripts into listinfo pages have had a few more checks added.
A few more error messages have had their values HTML escaped.
The hash generated when SUBSCRIBE_FORM_SECRET is set could have been the same as one generated at the same time for a different list and IP address.
Gitlab reports:
Wiki XSS
Sanitize gem updates
XSS in url_for(params)
Content injection via username
Activity feed publicly displaying internal project names
Persistent XSS in charts
The phpMyAdmin development team reports:
Summary
XSS in Designer feature
Description
A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name.
Severity
We consider this attack to be of moderate severity.
Summary
File inclusion and remote code execution attack
Description
A flaw has been discovered where an attacker can include (view and potentially execute) files on the server.
The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages.
An attacker must be authenticated, except in these situations:
- $cfg['AllowArbitraryServer'] = true: attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin
- $cfg['ServerDefault'] = 0: this bypasses the login and runs the vulnerable code without any authentication
Severity
We consider this to be severe.
Mitigation factor
Configuring PHP with a restrictive `open_basedir` can greatly restrict an attacker's ability to view files on the server. Vulnerable systems should not be run with the phpMyAdmin directives $cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault'] = 0
A subset of Intel processors can allow a local thread to infer data from another thread through a speculative execution side channel when Lazy FPU state restore is used.
Any local thread can potentially read FPU state information from other threads running on the host. This could include cryptographic keys when the AES-NI CPU feature is present.
GraphicsMagick reports:
Multiple vulnerabilities have been found in GraphicsMagick 1.3.26 or earlier. Please refer to the CVE list for details.
SchedMD reports:
Insecure handling of user_name and gid fields (CVE-2018-10995)
While fixes are only available for the supported 17.02 and 17.11 releases, it is believed that similar vulnerabilities do affect past versions as well. The only resolution is to upgrade Slurm to a fixed release.
Node.js reports:
Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)
All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue.
Denial of Service, nghttp2 dependency (CVE-2018-1000168)
All versions of 9.x and later are vulnerable and the severity is HIGH. Under certain conditions, a malicious client can trigger an uninitialized read (and a subsequent segfault) by sending a malformed ALTSVC frame. This has been addressed through an by updating nghttp2.
Denial of Service Vulnerability in TLS (CVE-2018-7162)
All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team.
Memory exhaustion DoS on v9.x (CVE-2018-7164)
Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.
Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases.
Jason A. Donenfeld reports:
Markus Brinkmann discovered that [the] parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username.
This has a number of nasty consequences:
- an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your .gpg-id key and have your passwords encrypted under additional keys;
- if you have extensions enabled (disabled by default), an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your extensions and hence execute code.
GnuPG reports:
Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".
The OpenSSL project reports:
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.
The Asterisk project reports:
When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.
The Asterisk project reports:
When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable.
Google Chrome Releases reports:
1 security fix contributed by external researchers:
- [845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23
GnuPG reports:
GnuPG did not sanitize input file names, which may then be output to the terminal. This could allow terminal control sequences or fake status messages to be injected into the output.
The Mozilla Foundation reports:
A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash.
Adobe reports:
- This update resolves a type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-4945).
- This update resolves an integer overflow vulnerability that could lead to information disclosure (CVE-2018-5000).
- This update resolves an out-of-bounds read vulnerability that could lead to information disclosure (CVE-2018-5001).
- This update resolves a stack-based buffer overflow vulnerability that could lead to arbitrary code execution (CVE-2018-5002).
Corelight reports:
Bro 2.5.4 primarily fixes security issues
Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.
The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.
The Git community reports:
Insufficient validation of submodule names
The Git community reports:
- In affected versions of Git, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
- In affected versions of Git, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
GitLab reports:
Removing public deploy keys regression
Users can update their password without entering current password
Persistent XSS - Selecting users as allowed merge request approvers
Persistent XSS - Multiple locations of user selection drop downs
include directive in .gitlab-ci.yml allows SSRF requests
Permissions issue in Merge Requests Create Service
Arbitrary assignment of project fields using "Import project"
strongSwan security team reports:
- A denial-of-service vulnerability in the IKEv2 key derivation was fixed if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (which is not FIPS-compliant). So this should only affect very specific setups, but in such configurations all strongSwan versions since 5.0.1 may be affected.
- A denial-of-service vulnerability in the stroke plugin was fixed. When reading a message from the socket the plugin did not check the received length. Unless a group is configured, root privileges are required to access that socket, so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
Google Chrome Releases reports:
34 security fixes in this release, including:
- [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22
- [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07
- [818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05
- [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18
- [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15
- [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09
- [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01
- [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30
- [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27
- [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04
- [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28
- [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23
- [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19
- [831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12
- [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21
- [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08
- [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24
- [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01
- [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19
- [837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28
- [843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15
- [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02
- [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25
- [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02
- [847542] Various fixes from internal audits, fuzzing and other initiatives
ISC reports:
An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession.
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging.
cURL security problems:
CVE-2018-1000300: FTP shutdown response buffer overflow
curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.
When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed.
FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server.
This situation was detected by an assert() in the code, but that was of course only preventing bad stuff in debug builds. This bug is very unlikely to trigger with non-malicious servers.
We are not aware of any exploit of this flaw.
CVE-2018-1000301: RTSP bad headers buffer over-read
curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.
When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part.
The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use.
This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw.
We are not aware of any exploit of this flaw.
Sebastian Ramacher reports:
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
Thuan Pham reports:
An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
Google Chrome Releases reports:
4 security fixes in this release:
- [835887] Critical: Chain leading to sandbox escape. Reported by Anonymous on 2018-04-23
- [836858] High CVE-2018-6121: Privilege Escalation in extensions
- [836141] High CVE-2018-6122: Type confusion in V8
- [833721] High CVE-2018-6120: Heap buffer overflow in PDFium. Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17
- [841841] Various fixes from internal audits, fuzzing and other initiatives
Jenkins developers report:
The agent to master security subsystem ensures that the Jenkins master is protected from maliciously configured agents. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access.
Black Duck Hub Plugin's API endpoint was affected by an XML External Entity (XXE) processing vulnerability. This allowed an attacker with Overall/Read access to have Jenkins parse a maliciously crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
Several other lower severity issues were reported, see reference url for details.
Mozilla Foundation reports:
CVE-2018-5183: Backport critical security fixes in Skia
CVE-2018-5154: Use-after-free with SVG animations and clip paths
CVE-2018-5155: Use-after-free with SVG animations and text paths
CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
CVE-2018-5160: Uninitialized memory use by WebRTC encoder
CVE-2018-5152: WebExtensions information leak through webRequest API
CVE-2018-5153: Out-of-bounds read in mixed content websocket messages
CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache
CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace
CVE-2018-5166: WebExtension host permission bypass through filterReponseData
CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger
CVE-2018-5168: Lightweight themes can be installed without user interaction
CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages
CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer
CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters
CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies
CVE-2018-5176: JSON Viewer script injection
CVE-2018-5177: Buffer overflow in XSLT during number formatting
CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox
CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension
CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink
CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar
CVE-2018-5151: Memory safety bugs fixed in Firefox 60
CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c
Harry Sintonen of F-Secure Corporation reports:
GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.
Adobe reports:
- This update resolves a type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-4944).
The MOV SS and POP SS instructions inhibit debug exceptions until the instruction boundary following the next instruction. If that instruction is a system call or similar instruction that transfers control to the operating system, the debug exception will be handled in the kernel context instead of the user context.
An authenticated local attacker may be able to read sensitive data in kernel memory, control low-level operating system functions, or may panic the system.
python release notes:
Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.
The KDE Community reports:
kwallet-pam was doing file writing and permission changing as root that with correct timing and use of carefully crafted symbolic links could allow a non privileged user to become the owner of any file on the system.
Drupal Security Team reports:
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
GitLab reports:
Persistent XSS in Move Issue using project namespace
Download Archive allowing unauthorized private repo access
Mattermost Updates
Google Chrome Releases reports:
3 security fixes in this release:
- [831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12
- [837635] Various fixes from internal audits, fuzzing and other initiatives
Gentoo reports:
quasselcore: corruption of heap metadata caused by qdatastream leading to preauth remote code execution.
- Severity: high, by default the server port is publicly open and the address can be requested using the /WHOIS command of IRC protocol.
- Description: In Qdatastream protocol each object is prepended with 4 bytes for the object size, this can be used to trigger allocation errors.
quasselcore DDOS
- Severity: low, only impacts unconfigured quasselcore instances.
- Description: A login attempt causes a NULL pointer dereference when the database is not initialized.
Google Chrome Releases reports:
62 security fixes in this release:
- [826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28
- [827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30
- [813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20
- [822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15
- [808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04
- [820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12
- [771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05
- [819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08
- [780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01
- [633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01
- [637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11
- [776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19
- [806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26
- [798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03
- [808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03
- [811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11
- [813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19
- [813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20
- [816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24
- [820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08
- [803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18
- [805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25
- [808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02
- [816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27
- [710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10
- [777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24
- [780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02
- [798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29
- [805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25
- [811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13
- [819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07
- [822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15
- [822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15
- [822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15
Simon Butcher reports:
- Defend against Bellcore glitch attacks by verifying the results of RSA private key operations.
- Fix implementation of the truncated HMAC extension. The previous implementation allowed an offline 2^80 brute force attack on the HMAC key of a single, uninterrupted connection (with no resumption of the session).
- Reject CRLs containing unsupported critical extensions. Found by Falko Strenzke and Evangelos Karatsiolis.
- Fix a buffer overread in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
- Fix a buffer overread in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
Oracle reports:
MySQL Multiple Flaws Let Remote Authenticated Users Access and Modify Data, Remote and Local Users Deny Service, and Local Users Access Data and Gain Elevated Privileges
- A local user can exploit a flaw in the Replication component to gain elevated privileges [CVE-2018-2755].
- A remote authenticated user can exploit a flaw in the GIS Extension component to cause denial of service conditions [CVE-2018-2805].
- A remote authenticated user can exploit a flaw in the InnoDB component to cause denial of service conditions [CVE-2018-2782, CVE-2018-2784, CVE-2018-2819].
- A remote authenticated user can exploit a flaw in the Security Privileges component to cause denial of service conditions [CVE-2018-2758, CVE-2018-2818].
- A remote authenticated user can exploit a flaw in the DDL component to cause denial of service conditions [CVE-2018-2817].
- A remote authenticated user can exploit a flaw in the Optimizer component to cause denial of service conditions [CVE-2018-2775, CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781, CVE-2018-2816].
- A remote user can exploit a flaw in the Client programs component to cause denial of service conditions [CVE-2018-2761, CVE-2018-2773].
- A remote authenticated user can exploit a flaw in the InnoDB component to partially modify data and cause denial of service conditions [CVE-2018-2786, CVE-2018-2787].
- A remote authenticated user can exploit a flaw in the Optimizer component to partially modify data and cause denial of service conditions [CVE-2018-2812].
- A local user can exploit a flaw in the Cluster ndbcluster/plugin component to cause denial of service conditions [CVE-2018-2877].
- A remote authenticated user can exploit a flaw in the InnoDB component to cause denial of service conditions [CVE-2018-2759, CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].
- A remote authenticated user can exploit a flaw in the DML component to cause denial of service conditions [CVE-2018-2839].
- A remote authenticated user can exploit a flaw in the Performance Schema component to cause denial of service conditions [CVE-2018-2846].
- A remote authenticated user can exploit a flaw in the Pluggable Auth component to cause denial of service conditions [CVE-2018-2769].
- A remote authenticated user can exploit a flaw in the Group Replication GCS component to cause denial of service conditions [CVE-2018-2776].
- A local user can exploit a flaw in the Connection component to cause denial of service conditions [CVE-2018-2762].
- A remote authenticated user can exploit a flaw in the Locking component to cause denial of service conditions [CVE-2018-2771].
- A remote authenticated user can exploit a flaw in the DDL component to partially access data [CVE-2018-2813].
wordpress developers reports:
Don't treat localhost as same host by default.
Use safe redirects when redirecting the login page if SSL is forced.
Make sure the version string is correctly escaped for use in generator tags.
The phpMyAdmin development team reports:
Summary
CSRF vulnerability allowing arbitrary SQL execution
Description
By deceiving a user to click on a crafted URL, it is possible for an attacker to execute arbitrary SQL commands.
Severity
We consider this vulnerability to be critical.
The Drupal security team reports:
CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting (XSS) vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin (which Drupal 8 core also uses).
The OpenSSL project reports:
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.
Drupal Security Team reports:
CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
perldelta:
CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom (regcomp.c)
A crafted regular expression could cause a heap buffer write overflow, with control over the bytes written. [perl #132227]
CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)
Matching a crafted locale dependent regular expression could cause a heap buffer read overflow and potentially information disclosure. [perl #132063]
CVE-2018-6913: heap-buffer-overflow in S_pack_rec
pack() could cause a heap buffer write overflow with a large item count. [perl #131844]
Robert Foggia via NetBSD GNATS reports:
The ipsec-tools racoon daemon contains a remotely exploitable computational complexity attack when parsing and storing isakmp fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending isakmp fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place.
nghttp2 blog:
If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault.
ALTSVC frame is defined by RFC 7838.
The largest frame size libnghttp2 accept is by default 16384 bytes.
Receiving ALTSVC frame is disabled by default. Application has to enable it explicitly by calling nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).
Transmission of ALTSVC is always enabled, and it does not cause this vulnerability.
ALTSVC frame is expected to be sent by server, and received by client as defined in RFC 7838.
Client and server are both affected by this vulnerability if the reception of ALTSVC frame is enabled. As written earlier, it is useless to enable reception of ALTSVC frame on server side. So, server is generally safe unless application accidentally enabled the reception of ALTSVC frame.
Upstream reports:
This update primarily fixes a recently discovered IMAP-cmd-injection vulnerability caused by insufficient input validation within the archive plugin. Details about the vulnerability are published under CVE-2018-9846.
Jenkins developers report:
The Jenkins CLI sent different error responses for commands with view and agent arguments depending on the existence of the specified views or agents to unauthorized users. This allowed attackers to determine whether views or agents with specified names exist.
The Jenkins CLI now returns the same error messages to unauthorized users independent of the existence of specified view or agent names
Some JavaScript confirmation dialogs included the item name in an unsafe manner, resulting in a possible cross-site scripting vulnerability exploitable by users with permission to create or configure items.
JavaScript confirmation dialogs that include the item name now properly escape it, so it can be safely displayed.
Adobe reports:
- This update resolves a use-after-free vulnerability that could lead to remote code execution (CVE-2018-4932).
- This update resolves out-of-bounds read vulnerabilities that could lead to information disclosure (CVE-2018-4933, CVE-2018-4934).
- This update resolves out-of-bounds write vulnerabilities that could lead to remote code execution (CVE-2018-4935, CVE-2018-4937).
- This update resolves a heap overflow vulnerability that could lead to information disclosure (CVE-2018-4936).
GitLab reports:
Confidential issue comments in Slack, Mattermost, and webhook integrations.
Persistent XSS in milestones data-milestone-id.
Persistent XSS in filename of merge request.
The length field of the option header does not count the size of the option header itself. This causes a problem when the length is zero, the count is then incremented by zero, which causes an infinite loop.
In addition there are pointer/offset mistakes in the handling of IPv4 options.
A remote attacker who is able to send an arbitrary packet, could cause the remote target machine to crash.
Insufficient validation of user-provided font parameters can result in an integer overflow, leading to the use of arbitrary kernel memory as glyph data. Characters that reference this data can be displayed on the screen, effectively disclosing kernel memory.
Unprivileged users may be able to access privileged kernel data.
Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way; for example, a terminal buffer might include a user-entered password.
moodle reports:
Unauthenticated users can trigger custom messages to admin via paypal enrol script.
Suspended users with OAuth 2 authentication method can still log in to the site.
Ruby news:
CVE-2017-17742: HTTP response splitting in WEBrick
If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.
CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir
Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers "../", so this method can be used to target any directory. So, if a script accepts an external input as the prefix, and the targeted directory has inappropriate permissions or the ruby process has inappropriate privileges, the attacker can create a directory or a file at any directory.
CVE-2018-8777: DoS by large request in WEBrick
If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack.
CVE-2018-8778: Buffer under-read in String#unpack
String#unpack receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier @. If a big number is passed with @, the number is treated as the negative value, and out-of-buffer read is occurred. So, if a script accepts an external input as the argument of String#unpack, the attacker can read data on heaps.
CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket
UNIXServer.open accepts the path of the socket to be created at the first parameter. If the path contains NUL (\0) bytes, this method recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of this method, the attacker can make the socket file in the unintentional path. And, UNIXSocket.open also accepts the path of the socket to be created at the first parameter without checking NUL bytes like UNIXServer.open. So, if a script accepts an external input as the argument of this method, the attacker can accepts the socket file in the unintentional path.
CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir
Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.
Node.js reports:
Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)
Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.
'path' module regular expression denial of service (CVE-2018-7158)
The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.
Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)
The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.
The WebKit team reports many vulnerabilities.
Please reference the CVE/URL list for details.
Google Chrome Releases reports:
1 security fix in this release, including:
- [823553] Various fixes from internal audits, fuzzing and other initiatives
The OpenSSL project reports:
- Constructed ASN.1 types with a recursive definition could exceed the stack (CVE-2018-0739)
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe.- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation).
GitLab reports:
SSRF in services and web hooks
There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potentially code execution. This issue has been assigned CVE-2018-8801.
Gitlab Auth0 integration issue
There was an issue with the GitLab
omniauth-auth0configuration which resulted in the Auth0 integration signing in the wrong users.
The Mozilla Foundation reports:
CVE-2018-5148: Use-after-free in compositor
A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.
OSS-Security list:
There is a possible XSS vulnerability in rails-html-sanitizer. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications.
This issue is similar to CVE-2018-8048 in Loofah.
The Apache httpd reports:
Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig enabled (CVE-2017-15710)
mod_session: CGI-like applications that intend to read from mod_session's 'SessionEnv ON' could be fooled into reading user-supplied data instead. (CVE-2018-1283)
mod_cache_socache: Fix request headers parsing to avoid a possible crash with specially crafted input data. (CVE-2018-1303)
core: Possible crash with excessively long HTTP request headers. Impractical to exploit with a production build and production LogLevel. (CVE-2018-1301)
core: Configure the regular expression engine to match '$' to the end of the input string only, excluding matching the end of any embedded newline characters. Behavior can be changed with new directive 'RegexDefaultOptions'. (CVE-2017-15715)
mod_auth_digest: Fix generation of nonce values to prevent replay attacks across servers using a common Digest domain. This change may cause problems if used with round robin load balancers. (CVE-2018-1312)
mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)
mybb Team reports:
Medium risk: Tasks Local File Inclusion
Medium risk: Forum Password Check Bypass
Low risk: Admin Permissions Group Title XSS
Low risk: Attachment types file extension XSS
Low risk: Moderator Tools XSS
Low risk: Security Questions XSS
Low risk: Settings Management XSS
Low risk: Templates Set Name XSS
Low risk: Usergroup Promotions XSS
Low risk: Warning Types XSS
MITRE reports:
SQLite databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
Sanitize release:
Fixed an HTML injection vulnerability that could allow XSS.
When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.
Sanitize now performs additional escaping on affected attributes to prevent this.
GitHub issue:
This issue has been created for public disclosure of an XSS / code injection vulnerability that was responsibly reported by the Shopify Application Security Team.
Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.
MITRE reports:
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Florian Grunow reports:
An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That means an attacker would need valid credentials for the application to log in or needs to exploit an additional vulnerability of which we are not aware of at this point of time.
An attacker would also be able to delete files on the system, if the user running the application has the rights to do so.
Does this issue affect me?
Likely yes, if you are using Squirrelmail. We checked the latest development version, which is 1.5.2-svn and the latest version available for download at this point of time, 1.4.22. Both contain the vulnerable code.
SchedMD reports:
Several issues were discovered with incomplete sanitization of user-provided text strings, which could potentially lead to SQL injection attacks against SlurmDBD itself. Such exploits could lead to a loss of accounting data, or escalation of user privileges on the cluster.
NVD reports:
Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().
The Mozilla Foundation reports:
CVE-2018-5146: Out of bounds memory write in libvorbis
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.
CVE-2018-5147: Out of bounds memory write in libtremor
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.
Theodore Y. Ts'o reports:
Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.
A number of issues relating to speculative execution were found last year and publicly announced January 3rd. Two of these, known as Meltdown and Spectre V2, are addressed here.
CVE-2017-5754 (Meltdown) - ------------------------
This issue relies on an affected CPU speculatively executing instructions beyond a faulting instruction. When this happens, changes to architectural state are not committed, but observable changes may be left in micro- architectural state (for example, cache). This may be used to infer privileged data.
CVE-2017-5715 (Spectre V2) - --------------------------
Spectre V2 uses branch target injection to speculatively execute kernel code at an address under the control of an attacker.
An attacker may be able to read secret data from the kernel or from a process when executing untrusted code (for example, in a web browser).
Due to a lack of strict checking, an attacker from a trusted host can send a specially constructed IP packet that may lead to a system crash.
Additionally, a use-after-free vulnerability in the AH handling code could cause unpredictable results.
Access to out of bounds or freed mbuf data can lead to a kernel panic or other unpredictable results.
Adobe reports:
- This update resolves a use-after-free vulnerability that could lead to remote code execution (CVE-2018-4919).
- This update resolves a type confusion vulnerability that could lead to remote code execution (CVE-2018-4920).
Mozilla Foundation reports:
CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
CVE-2018-5128: Use-after-free manipulating editor selection ranges
CVE-2018-5129: Out-of-bounds write with malformed IPC messages
CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
CVE-2018-5132: WebExtension Find API can search privileged pages
CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized
CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions
CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts
CVE-2018-5136: Same-origin policy violation with data: URL shared workers
CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources
CVE-2018-5138: Android Custom Tab address spoofing through long domain names
CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol
CVE-2018-5141: DOS attack through notifications Push API
CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs
CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar
CVE-2018-5126: Memory safety bugs fixed in Firefox 59
CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
The samba project reports:
Missing null pointer checks may crash the external print server process.
On a Samba 4 AD DC any authenticated user can change other user's passwords over LDAP, including the passwords of administrative users and service accounts.
Simon Butcher reports:
- When the truncated HMAC extension is enabled and CBC is used, sending a malicious application packet can be used to selectively corrupt 6 bytes on the peer's heap, potentially leading to a crash or remote code execution. This can be triggered remotely from either side in both TLS and DTLS.
- When RSASSA-PSS signature verification is enabled, sending a maliciously constructed certificate chain can be used to cause a buffer overflow on the peer's stack, potentially leading to crash or remote code execution. This can be triggered remotely from either side in both TLS and DTLS.
Google Chrome Releases reports:
45 security fixes in this release:
- [758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25
- [758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25
- [780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02
- [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12
- [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31
- [789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30
- [792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07
- [798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03
- [808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01
- [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05
- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30
- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30
- [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08
- [668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25
- [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23
- [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01
- [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20
- [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06
- [608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03
- [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24
- [778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26
- [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10
- [788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24
- [792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05
- [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24
- [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21
- [771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04
wireshark developers reports:
wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)
wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)
wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)
wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)
wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)
wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)
wnpa-sec-2018-11. Pcapng file parser crash.
wnpa-sec-2018-12. IPMI dissector crash.
wnpa-sec-2018-13. SIGCOMP dissector crash.
wnpa-sec-2018-14. NBAP dissector crash.
ISC reports:
Failure to properly bounds check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section.
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash.
Xin-Jiang on Github reports:
CVE-2017-14245 (Medium): An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2017-14246 (Medium): An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
my123px on Github reports:
CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.
CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.
Agostino Sarubbo, Gentoo reports:
CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.
CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.
manxorist on Github reports:
CVE-2017-12562 (High): Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Xin-Jiang on Github reports:
CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
The PostgreSQL project reports:
- CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications
Strongswan Release Notes reports:
Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused by insufficient input validation. One of the configurable parameters in algorithm identifier structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is currently specified for this purpose. However, this in turn takes itself a parameter that specifies the underlying hash function. strongSwan's parser did not correctly handle the case of this parameter being absent, causing an undefined data read. his vulnerability has been registered as CVE-2018-6459.
Laurent Delosieres, Secunia Research at Flexera Software reports:
Secunia Research has discovered a vulnerability in libsndfile, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an error in the "aiff_read_chanmap()" function (src/aiff.c), which can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28. Other versions may also be affected.
Network Time Foundation reports:
The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.
This release addresses five security issues in ntpd:
- LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack
- INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak
- LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations
- LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state
- LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset authenticated interleaved association
one security issue in ntpq:
- MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its buffer limit
and provides over 33 bugfixes and 32 other improvements.
Google Chrome Releases reports:
1 security fix in this release:
- [806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26
Google Chrome Releases reports:
Several security fixes in this release, including:
- [780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01
- [787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20
- [793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09
- [784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12
- [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
- [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
- [753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on 2017-08-09
- [774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12
- [775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17
- [778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26
- [760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29
- [773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12
- [785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16
- [797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
- [798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31
- [799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08
- [763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08
- [771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05
- [774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13
- [774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15
- [441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11
- [615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28
- [758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23
- [797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24
The Apache Software Foundation reports:
Security constraints defined by annotations of Servlets were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Shibboleth consortium reports:
Shibboleth SP software vulnerable to additional data forgery flaws
The XML processing performed by the Service Provider software has been found to be vulnerable to new flaws similar in nature to the one addressed in an advisory last month.
These bugs involve the use of other XML constructs rather than entity references, and therefore required additional mitigation once discovered. As with the previous issue, this flaw allows for changes to an XML document that do not break a digital signature but can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.
As before, the use of XML Encryption is a significant mitigation, but we have not dismissed the possibility that attacks on the Response "envelope" may be possible, in both the original and this new case. No actual attacks of this nature are known, so deployers should prioritize patching systems that expect to handle unencrypted SAML assertions.
An updated version of XMLTooling-C (V1.6.4) is available that protects against these new attacks, and should help prevent similar vulnerabilities in the future.
Unlike the previous case, these bugs are NOT prevented by any existing Xerces-C parser version on any platform and cannot be addressed by any means other than the updated XMLTooling-C library.
The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing.
Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.
While newer versions of the xerces-c3 parser are configured by the SP into disallowing the use of a DTD via an environment variable, this feature is not present in the xerces-c3 parser before version 3.1.4, so an additional fix is being provided now that an actual DTD exploit has been identified. Xerces-c3-3.1.4 was committed to the ports tree already on 2016-07-26.
Drupal Security Team reports:
CVE-2017-6926: Comment reply form allows access to restricted content
CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete
CVE-2017-6928: Private file access bypass - Moderately Critical
CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical
CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions
CVE-2017-6931: Settings Tray access bypass
CVE-2017-6932: External link injection on 404 pages when linking to the current page
Hank Leininger reports:
Bugs in Git, Subversion, and Mercurial were just announced and patched which allowed arbitrary local command execution if a malicious name was used for the remote server, such as starting with - to pass options to the ssh client: git clone ssh://-oProxyCommand=some-command... CVS has a similar problem with the -d option:
Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.
LibreOffice reports:
LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file URL (e.g file://) which can be used to inject local files into the spreadsheet without warning the user. Subsequent formulas can operate on that inserted data and construct a remote URL whose path leaks the local data to a remote attacker.
In later versions of LibreOffice without this flaw, WEBSERVICE has now been limited to accessing http and https URLs along with bringing WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.
Note: This vulnerability has been identified upstream as CVE-2018-1055, but NVD/Mitre are advising it's a reservation duplicate of CVE-2018-6871 which should be used instead.
Louis Dion-Marcil reports:
Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses.
This problem allows a remote server delivering certain ESI response syntax to trigger a denial of service for all clients accessing the Squid service.
Due to unrelated changes Squid-3.5 has become vulnerable to some regular ESI server responses also triggering this issue.
This problem is limited to the Squid custom ESI parser. Squid built to use libxml2 or libexpat XML parsers do not have this problem.
Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses or downloading intermediate CA certificates.
This problem allows a remote client delivering certain HTTP requests in conjunction with certain trusted server responses to trigger a denial of service for all clients accessing the Squid service.
The Asterisk project reports:
AST-2018-004 - When processing a SUBSCRIBE request the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed despite having a fixed limit of 32. If more than 32 Accept headers were present the code would write outside of its memory and cause a crash.
AST-2018-005 - A crash occurs when a number of authenticated INVITE messages are sent over TCP or TLS and then the connection is suddenly closed. This issue leads to a segmentation fault.
The Asterisk project reports:
AST-2018-002 - By crafting an SDP message with an invalid media format description Asterisk crashes when using the pjsip channel driver because pjproject's sdp parsing algorithm fails to catch the invalid media format description.
AST-2018-003 - By crafting an SDP message body with an invalid fmtp attribute Asterisk crashes when using the pjsip channel driver because pjproject's fmtp retrieval function fails to check if fmtp value is empty (set empty if previously parsed as invalid).
The phpMyAdmin team reports:
Summary
Self XSS in central columns feature
Description
A self-cross site scripting (XSS) vulnerability has been reported relating to the central columns feature.
Severity
We consider this vulnerability to be of moderate severity.
Mitigation factor
A valid token must be used in the attack
GitLab reports:
SnippetFinder information disclosure
The GitLab SnippetFinder component contained an information disclosure which allowed access to snippets restricted to Only team members or configured as disabled. The issue is now resolved in the latest version.
LDAP API authorization issue
An LDAP API endpoint contained an authorization vulnerability which unintentionally disclosed bulk LDAP groups data. This issue is now fixed in the latest release.
Persistent XSS mermaid markdown
The mermaid markdown feature contained a persistent XSS issue that is now resolved in the latest release.
Insecure direct object reference Todo API
The Todo API was vulnerable to an insecure direct object reference issue which resulted in an information disclosure of confidential data.
GitHub import access control issue
An improper access control weakness issue was discovered in the GitHub import feature. The issue allowed an attacker to create projects under other accounts which they shouldn't have access to. The issue is now resolved in the latest version.
Protected variables information disclosure
The CI jobs protected tag feature contained a vulnerability which resulted in an information disclosure of protected variables. The issue is now resolved in the latest release.
Irssi reports:
Use after free when server is disconnected during netsplits. Found by Joseph Bisch.
Use after free when SASL messages are received in unexpected order. Found by Joseph Bisch.
Null pointer dereference when an “empty” nick has been observed by Irssi. Found by Joseph Bisch.
When the number of windows exceed the available space, Irssi would crash due to Null pointer dereference. Found by Joseph Bisch.
Certain nick names could result in out of bounds access when printing theme strings. Found by Oss-Fuzz.
Upstream commit:
Vulnerabilities existed in cookie handling.
Bugzilla Security Advisory
A CSRF vulnerability in report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to.
Philippe Antoine of Catena cyber:
This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)
Consul developers report:
A flaw was found in the embedded DNS library used in consul which may allow a denial of service attack. Consul was updated to include the fixed version.
Frank Meier:
Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
Quagga reports:
The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash.
The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.
The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.
The Quagga BGP daemon, bgpd, can enter an infinite loop if sent an invalid OPEN message by a configured peer.
Secunia Research reports:
CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
CVE-2017-5801: An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.
CVE-2017-5802: An error within the "kodak_radc_load_raw()" function (internal/dcraw_common.cpp) related to the "buf" variable can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.
Secunia Research reports:
CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.
CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) can be exploited to cause an invalid read memory access.
Bitmessage developers report:
A remote code execution vulnerability has been spotted in use against some users running PyBitmessage v0.6.2. The cause was identified and a fix has been added and released as 0.6.3.2. (Will be updated if/when CVE will be available.)
Jenkins developers report:
Jenkins did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to.
Mitre reports:
bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.
Mitre reports:
bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.
Mitre reports:
bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.
Uwsgi developers report:
It was discovered that the uwsgi_expand_path function in utils.c in Unbit uWSGI, an application container server, has a stack-based buffer overflow via a large directory length that can cause a denial-of-service (application crash) or stack corruption.
Python issue:
There is a possible integer overflow in PyString_DecodeEscape function of the file stringobject.c, which can be abused to gain a heap overflow, possibly leading to arbitrary code execution.
MITRE reports:
JSONRPC vulnerability
X-cela reports:
Calls into build_benocde that use %zu could crash on 64 bit machines due to the size change of size_t. Someone can force READ_ENC_IA to fail allowing an internal_error to be thrown and bring down the client.
Exim developers report:
There is a buffer overflow in base64d(), if some pre-conditions are met. Using a handcrafted message, remote code execution seems to be possible.
MITRE reports:
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, alows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
MITRE reports:
Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
mpv developers report:
mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.
Mark Sapiro reports:
An XSS vulnerability in the user options CGI could allow a crafted URL to execute arbitrary javascript in a user's browser. A related issue could expose information on a user's options page without requiring login.
The PostgreSQL project reports:
- CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)
- CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable
Debian Security Advisory reports:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.
Adobe reports:
- This update resolves use-after-free vulnerabilities that could lead to remote code execution (CVE-2018-4877, CVE-2018-4878).
Alessio Santoru reports:
Buffer overflow in htpasswd.
MITRE reports:
Improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic.
Pale Moon reports:
CVE-2018-5102: Use-after-free in HTML media elements
CVE-2018-5122: Potential integer overflow in DoCrypt
Django release notes:
CVE-2018-6188: Information leakage in AuthenticationForm
A regression in Django 1.11.8 made AuthenticationForm run its confirm_login_allowed() method even if an incorrect password is entered. This can leak information about a user, depending on what messages confirm_login_allowed() raises. If confirm_login_allowed() isn't overridden, an attacker enter an arbitrary username and see if that user has been set to is_active=False. If confirm_login_allowed() is overridden, more sensitive details could be leaked.
This issue is fixed with the caveat that AuthenticationForm can no longer raise the "This account is inactive." error if the authentication backend rejects inactive users (the default authentication backend, ModelBackend, has done that since Django 1.10). This issue will be revisited for Django 2.1 as a fix to address the caveat will likely be too invasive for inclusion in older versions.
Tatsuya Kinoshita reports:
CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().
CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().
CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.
The Mozilla Foundation reports:
Mozilla developer Johann Hofmann reported that unsanitized output in the browser UI can lead to arbitrary code execution.
Upstream reports:
A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.
Pedro Sampaio reports:
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of SASL authentication results in a memory leak in Dovecot auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
The cURL project reports:
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
ClamAV project reports:
Join us as we welcome ClamAV 0.99.3 to the family!.
This release is a security release and is recommended for all ClamAV users.
CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities
CVE-2017-12375 ClamAV Buffer Overflow Vulnerability
CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname Vulnerability
CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability
CVE-2017-12378 ClamAV Buffer Over Read Vulnerability
CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument Vulnerability
CVE-2017-12380 ClamAV Null Dereference Vulnerability
Mozilla Foundation reports:
CVE-2018-5091: Use-after-free with DTMF timers
CVE-2018-5092: Use-after-free in Web Workers
CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing
CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory
CVE-2018-5095: Integer overflow in Skia library during edge builder allocation
CVE-2018-5097: Use-after-free when source document is manipulated during XSLT
CVE-2018-5098: Use-after-free while manipulating form input elements
CVE-2018-5099: Use-after-free with widget listener
CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory
CVE-2018-5101: Use-after-free with floating first-letter style elements
CVE-2018-5102: Use-after-free in HTML media elements
CVE-2018-5103: Use-after-free during mouse event handling
CVE-2018-5104: Use-after-free during font face manipulation
CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts
CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker
CVE-2018-5107: Printing process will follow symlinks for local file access
CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs
CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution
CVE-2018-5110: Cursor can be made invisible on OS X
CVE-2018-5111: URL spoofing in addressbar through drag and drop
CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel
CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow
CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts
CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs
CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access
CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right
CVE-2018-5118: Activity Stream images can attempt to load local content through file:
CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers
CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar
CVE-2018-5122: Potential integer overflow in DoCrypt
CVE-2018-5090: Memory safety bugs fixed in Firefox 58
CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6
PowerDNS Security Advisory reports:
An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist.
Google Chrome Releases reports:
2 security fixes in this release, including:
- [788453] High CVE-2017-15429: UXSS in V8. Reported by Anonymous on 2017-11-24
- [794792] Various fixes from internal audits, fuzzing and other initiatives
Google Chrome Releases reports:
37 security fixes in this release, including:
- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by Ned Williamson on 2017-10-26
- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06
- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11
- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-16
- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-29
- [727039] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27
- [766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19
- [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15
- [779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by Ned Williamson on 2017-10-28
- [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. Reported by Max May on 2017-03-07
- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15
- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu on 2017-10-31
- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23
- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13
- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. Reported by jinmo123 on 2017-01-11
- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25
- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16
- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17
- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18
- [768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox. Reported by Junaid Farhan on 2017-09-26
- [792099] Various fixes from internal audits, fuzzing and other initiatives
Google Chrome Releases reports:
1 security fix in this release, including:
- [782145] High CVE-2017-15428: Out of bounds read in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07
Unbound reports:
We discovered a vulnerability in the processing of wildcard synthesized NSEC records. While synthesis of NSEC records is allowed by RFC4592, these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions.
phpbb developers reports:
Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.
Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.
Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.
Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.
Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.
Oracle reports:
Not all vulnerabilities are relevant for all flavors/versions of the servers and clients
- Vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640, CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703, Partition: CVE-2018-2562.
- Vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576, CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema: CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600, CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication: CVE-2018-2647.
- Vulnerability allows a low or high privileged attacker with network access via multiple protocols to compromise MySQL Server with unauthorized creation, deletion, modification or access to data/ critical data. InnoDB: CVE-2018-2612, Performance Schema: CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
wordpress developers reports:
JavaScript errors that prevented saving posts in Firefox have been fixed.
The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.
Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.
GitLab developers report:
Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain a number of important security fixes, including two that prevent remote code execution, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.
Google Project Zero reports:
The transmission bittorrent client uses a client/server architecture, the user interface is the client which communicates to the worker daemon using JSON RPC requests.
As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on localhost with XMLHttpRequest(), but the theory is they will be ignored because clients must prove they can read and set a specific header, X-Transmission-Session-Id. Unfortunately, this design doesn't work because of an attack called "DNS rebinding". Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost.
Exploitation is simple, you could set script-torrent-done-enabled and run any command, or set download-dir to /home/user/ and then upload a torrent for .bashrc.
Shibboleth consortium reports:
Shibboleth SP software vulnerable to forged user attribute data
The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing.
Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.
While newer versions of the xerces-c3 parser are configured by the SP into disallowing the use of a DTD via an environment variable, this feature is not present in the xerces-c3 parser before version 3.1.4, so an additional fix is being provided now that an actual DTD exploit has been identified. Xerces-c3-3.1.4 was committed to the ports tree already on 2016-07-26.
Adobe reports:
- This update resolves an out-of-bounds read vulnerability that could lead to information disclosure (CVE-2018-4871).
Mitre reports:
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
Irssi reports:
When the channel topic is set without specifying a sender, Irssi may dereference NULL pointer. Found by Joseph Bisch.
When using incomplete escape codes, Irssi may access data beyond the end of the string. Found by Joseph Bisch.
A calculation error in the completion code could cause a heap buffer overflow when completing certain strings. Found by Joseph Bisch.
When using an incomplete variable argument, Irssi may access data beyond the end of the string. Found by Joseph Bisch.
Mozilla Foundation reports:
Jann Horn of Google Project Zero Security reported that speculative execution performed by modern CPUs could leak information through a timing side-channel attack. Microsoft Vulnerability Research extended this attack to browser JavaScript engines and demonstrated that code on a malicious web page could read data from other web sites (violating the same-origin policy) or private data from the browser itself.
Since this new class of attacks involves measuring precise time intervals, as a parti al, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The precision of
performance.now()has been reduced from 5μs to 20μs, and theSharedArrayBufferfeature has been disabled because it can be used to construct a high-resolution timer.
ooooooo_q reports:
The old versions of
CGI::Cookie.parseapplied URL decoding to cookie names. An attacker could exploit this vulnerability to spoof security prefixes in cookie names, which may be able to trick a vulnerable application.By this fix,
CGI::Cookie.parseno longer decodes cookie names. Note that this is an incompatibility if cookie names that you are using include non-alphanumeric characters that are URL-encoded.
chamal reports:
A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to
CGI.escape_htmlon a platform wherelongtype takes 4 bytes, typically, Windows.
Matrix developers report:
This release patches one high severity issue affecting Synapse installations 1.47.0 and earlier using the media repository. An attacker could cause these Synapses to download a remote file and store it in a directory outside the media repository.
Note that:
- This only affects homeservers using Synapse's built-in media repository, as opposed to synapse-s3-storage-provider or matrix-media-repo.
- Attackers cannot control the exact name or destination of the stored file.
Joonun Jang reports:
heap buffer overflow running advzip with "-l poc" option
Running 'advzip -l poc' with the attached file raises heap buffer overflow which may allow a remote attacker to cause unspecified impact including denial-of-service attack. I expected the program to terminate without segfault, but the program crashes as follow. [...]
and other vulnerabilities.
Chrome Releases reports:
This release contains 25 security fixes, including:
- [1263620] High CVE-2021-38008: Use after free in media. Reported by Marcin Towalski of Cisco Talos on 2021-10-26
- [1260649] High CVE-2021-38009: Inappropriate implementation in cache. Reported by Luan Herrera (@lbherrera_) on 2021-10-16
- [1240593] High CVE-2021-38006: Use after free in storage foundation. Reported by Sergei Glazunov of Google Project Zero on 2021-08-17
- [1254189] High CVE-2021-38007: Type Confusion in V8. Reported by Polaris Feng and SGFvamll at Singular Security Lab on 2021-09-29
- [1241091] High CVE-2021-38005: Use after free in loader. Reported by Sergei Glazunov of Google Project Zero on 2021-08-18
- [1264477] High CVE-2021-38010: Inappropriate implementation in service workers. Reported by Sergei Glazunov of Google Project Zero on 2021-10-28
- [1268274] High CVE-2021-38011: Use after free in storage foundation. Reported by Sergei Glazunov of Google Project Zero on 2021-11-09
- [1262791] Medium CVE-2021-38012: Type Confusion in V8. Reported by Yonghwi Jin (@jinmo123) on 2021-10-24
- [1242392] Medium CVE-2021-38013: Heap buffer overflow in fingerprint recognition. Reported by raven (@raid_akame) on 2021-08-23
- [1248567] Medium CVE-2021-38014: Out of bounds write in Swiftshader. Reported by Atte Kettunen of OUSPG on 2021-09-10
- [957553] Medium CVE-2021-38015: Inappropriate implementation in input. Reported by David Erceg on 2019-04-29
- [1244289] Medium CVE-2021-38016: Insufficient policy enforcement in background fetch. Reported by Maurice Dauer on 2021-08-28
- [1256822] Medium CVE-2021-38017: Insufficient policy enforcement in iframe sandbox. Reported by NDevTK on 2021-10-05
- [1197889] Medium CVE-2021-38018: Inappropriate implementation in navigation. Reported by Alesandro Ortiz on 2021-04-11
- [1251179] Medium CVE-2021-38019: Insufficient policy enforcement in CORS. Reported by Maurice Dauer on 2021-09-20
- [1259694] Medium CVE-2021-38020: Insufficient policy enforcement in contacts picker. Reported by Luan Herrera (@lbherrera_) on 2021-10-13
- [1233375] Medium CVE-2021-38021: Inappropriate implementation in referrer. Reported by Prakash (@1lastBr3ath) and Jun Kokatsu on 2021-07-27
- [1248862] Low CVE-2021-38022: Inappropriate implementation in WebAuthentication. Reported by Michal Kepkowski on 2021-09-13
Stanislav Valkanov reports:
Date's parsing methods including
Date.parseare using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.
The Roundcube project reports:
XSS issue in handling attachment filename extension in mimetype mismatch warning
possible SQL injection via some session variables
Mark Sapiro reports:
A potential XSS attack via the user options page has been reported by Harsh Jaiswal. This is fixed. CVE-2021-43331 (LP: #1949401).
A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-43332 (LP: #1949403)
The PostgreSQL Project reports:
CVE-2021-23214: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could be abused to send faked SQL commands to the server, although that would only work if the server did not demand any authentication data. (However, a server relying on SSL certificate authentication might well not do so.)
CVE-2021-23222: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214.
Puppet reports:
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync.
Puppet reports:
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007.
The Samba Team reports:
- CVE-2020-25717: A user in an AD Domain could become root on domain members.
- CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC.
- CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets.
- CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid).
- CVE-2020-25722: Samba AD DC did not do sufficient access and conformance checking of data stored.
- CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication.
- CVE-2021-3738: Use after free in Samba AD DC RPC server.
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability.
Nathaniel McCallum reports:
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
The Go project reports:
debug/macho fails out when loading a file that contains a dynamic symbol table command that indicates a larger number of symbols than exist in the loaded symbol table.
Previously, opening a zip with (*Reader).Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements. Open could also panic if passed the empty string directly as an argument.
Jenkins Security Advisory:
Description
(Critical) SECURITY-2455 / CVE-2021-21685, CVE-2021-21686, CVE-2021-21687, CVE-2021-21688, CVE-2021-21689, CVE-2021-21690, CVE-2021-21691, CVE-2021-21692, CVE-2021-21693, CVE-2021-21694, CVE-2021-21695
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control
(High) SECURITY-2423 / CVE-2021-21696
Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin
(High) SECURITY-2428 / CVE-2021-21697
Agent-to-controller access control allows reading/writing most content of build directories
(Medium) SECURITY-2506 / CVE-2021-21698
Path traversal vulnerability in Subversion Plugin allows reading arbitrary files
The Gitea Team reports for release 1.15.5:
- Upgrade Bluemonday to v1.0.16 (#17372) (#17374)
- Ensure correct SSH permissions check for private and restricted users (#17370) (#17373)
Gitlab reports:
Stored XSS via ipynb files
Pipeline schedules on imported projects can be set to automatically active after import
Potential Denial of service via Workhorse
Improper Access Control allows Merge Request creator to bypass locked status
Projects API discloses ID and name of private groups
Severity of an incident can be changed by a guest user
System root password accidentally written to log file
Potential DoS via a malformed TIFF image
Bypass of CODEOWNERS Merge Request approval requirement
Change project visibility to a restricted option
Project exports leak external webhook token value
SCIM token is visible after creation
Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered
Regular expression denial of service issue when cleaning namespace path
Prevent creation of scopeless apps using applications API
Webhook data exposes assignee's private email address
Chrome Releases reports:
This release contains 8 security fixes, including:
- [1259864] High CVE-2021-37997 : Use after free in Sign-In. Reported by Wei Yuan of MoyunSec VLab on 2021-10-14
- [1259587] High CVE-2021-37998 : Use after free in Garbage Collection. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-10-13
- [1251541] High CVE-2021-37999 : Insufficient data validation in New Tab Page. Reported by Ashish Arun Dhone on 2021-09-21
- [1249962] High CVE-2021-38000 : Insufficient validation of untrusted input in Intents. Reported by Clement Lecigne, Neel Mehta, and Maddie Stone of Google Threat Analysis Group on 2021-09-15
- [1260577] High CVE-2021-38001 : Type Confusion in V8. Reported by @s0rrymybad of Kunlun Lab via Tianfu Cup on 2021-10-16
- [1260940] High CVE-2021-38002 : Use after free in Web Transport. Reported by @__R0ng of 360 Alpha Lab, ? via Tianfu Cup on 2021-10-16
- [1263462] High CVE-2021-38003 : Inappropriate implementation in V8. Reported by Clément Lecigne from Google TAG and Samuel Gross from Google Project Zero on 2021-10-26
Google is aware that exploits for CVE-2021-38000 and CVE-2021-38003 exist in the wild.
Jakub Żoczek reports:
Command
mail-whoiscan execute command if unescaped sequences (\n~) are available in "foreign" input (for instance in whois output).
Grafana Labs reports:
Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:
/dashboard/snapshot/:key, or/api/snapshots/:keyIf the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:
/api/snapshots-delete/:deleteKeyRegardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:
/api/snapshots/:key, or/api/snapshots-delete/:deleteKeyThe combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.
minio developers report:
Looks like policy restriction was not working properly for normal users when they are not svc or STS accounts.
- svc accounts are now properly fixed to get right permissions when its inherited, so we do not have to set 'owner = true'
- sts accounts have always been using right permissions, do not need an explicit lookup
- regular users always have proper policy mapping
Mark Sapiro reports:
A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
A CSRF attack via the user options page could allow takeover of a users account. This is fixed.
Chrome Releases reports:
This release contains 19 security fixes, including:
- [1246631] High CVE-2021-37981: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-09-04
- [1248661] High CVE-2021-37982: Use after free in Incognito. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-09-11
- [1249810] High CVE-2021-37983: Use after free in Dev Tools. Reported by Zhihua Yao of KunLun Lab on 2021-09-15
- [1253399] High CVE-2021-37984: Heap buffer overflow in PDFium. Reported by Antti Levomäki, Joonas Pihlaja andChristian Jali from Forcepoint on 2021-09-27
- [1241860] High CVE-2021-37985: Use after free in V8. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-08-20
- [1242404] Medium CVE-2021-37986: Heap buffer overflow in Settings. Reported by raven (@raid_akame) on 2021-08-23
- [1206928] Medium CVE-2021-37987: Use after free in Network APIs. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-08
- [1228248] Medium CVE-2021-37988: Use after free in Profiles. Reported by raven (@raid_akame) on 2021-07-12
- [1233067] Medium CVE-2021-37989: Inappropriate implementation in Blink. Reported by Matt Dyas, Ankur Sundara on 2021-07-26
- [1247395] Medium CVE-2021-37990: Inappropriate implementation in WebView. Reported by Kareem Selim of CyShield on 2021-09-07
- [1250660] Medium CVE-2021-37991: Race in V8. Reported by Samuel Gross of Google Project Zero on 2021-09-17
- [1253746] Medium CVE-2021-37992: Out of bounds read in WebAudio. Reported by sunburst@Ant Security Light-Year Lab on 2021-09-28
- [1255332] Medium CVE-2021-37993: Use after free in PDF Accessibility. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-10-02
- [1243020] Medium CVE-2021-37996: Insufficient validation of untrusted input in Downloads. Reported by Anonymous on 2021-08-24
- [1100761] Low CVE-2021-37994: Inappropriate implementation in iFrame Sandbox. Reported by David Erceg on 2020-06-30
- [1242315] Low CVE-2021-37995: Inappropriate implementation in WebApp Installer. Reported by Terence Eden on 2021-08-23
Oracle reports:
This Critical Patch Update contains 66 new security patches for Oracle MySQL. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.8.Note: MariaDB only vulnerable against CVE-2021-35604
Node.js reports:
HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)
The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).
HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)
The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
OpenBSD Project reports:
sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user. Instead these commands would inherit the groups that sshd(8) was started with.
Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privilege.
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are enabled by default in sshd_config(5).
Cory Sabol reports:
A malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality.
Red Hat reports:
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
The Apache Openoffice project reports:
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory
It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.
It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory.
The Go project reports:
When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments.
If using wasm_exec.js to execute WASM modules, users will need to replace their copy after rebuilding any modules.
Chrome Releases reports:
This release contains 4 security fixes, including:
- [1252878] High CVE-2021-37977: Use after free in Garbage Collection. Reported by Anonymous on 2021-09-24
- [1236318] High CVE-2021-37978: Heap buffer overflow in Blink. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-08-04
- [1247260] High CVE-2021-37979: Heap buffer overflow in WebRTC. Reported by Marcin Towalski of Cisco Talos on 2021-09-07
- [1254631] High CVE-2021-37980: Inappropriate implementation in Sandbox. Reported by Yonghwi Jin (@jinmo123) on 2021-09-30
The Apache http server project reports:
critical: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013).
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives.
If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution.
This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Acknowledgements: Reported by Juan Escobar from Dreamlab Technologies, Fernando Munoz from NULL Life CTF Team, and Shungo Kumasaka
Jenkins Security Advisory:
Description
(Medium) SECURITY-2475 / CVE-2014-3577
Jenkins core bundles vulnerable version of the commons-httpclient library
The Apache http server project reports:
- moderate: null pointer dereference in h2 fuzzing (CVE-2021-41524)
- important: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773)
Bacula-Web reports:
Address Smarty CVE
The Redis Team reports:
- CVE-2021-41099
- Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured.
- CVE-2021-32762
- Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms.
- CVE-2021-32687
- Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value.
- CVE-2021-32675
- Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
- CVE-2021-32672
- Random heap reading issue with Lua Debugger.
- CVE-2021-32628
- Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value.
- CVE-2021-32627
- Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit.
- CVE-2021-32626
- Specially crafted Lua scripts may result with Heap buffer overflow.
Mediawiki reports:
(T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
(T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full table scan.
(T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of Special:Contributions.
(T279090, CVE-2021-41801) SECURITY: ReplaceText continues performing actions if the user no longer has the correct permission (such as by being blocked).
Chrome Releases/Stable updates reports:
This release contains 4 security fixes, including:
- [1245578] High CVE-2021-37974: Use after free in Safe Browsing. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-09-01
- [1252918] High CVE-2021-37975: Use after free in V8. Reported by Anonymous on 2021-09-24
- [1251787] Medium CVE-2021-37976: Information leak in core. Reported by Clement Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero on 2021-09-21
Google is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild.
Gitlab reports:
Stored XSS in merge request creation page
Denial-of-service attack in Markdown parser
Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown
DNS Rebinding vulnerability in Gitea importer
Exposure of trigger tokens on project exports
Improper access control for users with expired password
Access tokens are not cleared after impersonation
Reflected Cross-Site Scripting in Jira Integration
DNS Rebinding vulnerability in Fogbugz importer
Access tokens persist after project deletion
User enumeration vulnerability
Potential DOS via API requests
Pending invitations of public groups and public projects are visible to any user
Bypass Disabled Repo by URL Project Creation
Low privileged users can see names of the private groups shared in projects
API discloses sensitive info to low privileged users
Epic listing do not honour group memberships
Insecure Direct Object Reference vulnerability may lead to protected branch names getting disclosed
Low privileged users can import users from projects that they they are not a maintainer on
Potential DOS via dependencies API
Create a project with unlimited repository size through malicious Project Import
Bypass disabled Bitbucket Server import source project creation
Requirement to enforce 2FA is not honored when using git commands
Content spoofing vulnerability
Improper session management in impersonation feature
Create OAuth application with arbitrary scopes through content spoofing
Lack of account lockout on change password functionality
Epic reference was not updated while moved between groups
Missing authentication allows disabling of two-factor authentication
Information disclosure in SendEntry
Alexander Cherepanov reports:
Version 0.999b and older of ha archiver is susceptible to directory traversal vulnerabilities via absolute and relative paths.
Sonatype reports:
- CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack
Sonatype reports:
- CVE-2020-15012: NXRM2 Directory Traversal vulnerability
The WebKitGTK project reports vulnerabilities:
- CVE-2021-30858: Processing maliciously crafted web content may lead to arbitrary code execution.
Chrome Releases reports:
][1251727] High CVE-2021-37973 : Use after free in Portals. Reported by Clement Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero on 2021-09-21
Google is aware that an exploit for CVE-2021-37973 exists in the wild.
Tim Wojtulewicz of Corelight reports:
Paths from log stream make it into system() unchecked, potentially leading to commands being run on the system unintentionally. This requires either bad scripting or a malicious package to be installed, and is considered low severity.
Fix potential unbounded state growth in the PIA analyzer when receiving a connection with either a large number of zero-length packets, or one which continues ack-ing unseen segments. It is possible to run Zeek out of memory in these instances and cause it to crash. Due to the possibility of this happening with packets received from the network, this is a potential DoS vulnerability.
Jakub Hrozek reports:
Version 0.17.0 and older of mod_auth_mellon allows the redirect URL validation to be bypassed by specifying an URL formatted as ///fishing-site.example.com/logout.html
Node.js reports:
npm 6 update - node-tar, arborist, npm cli modules
These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist.
Node.js reports:
cares upgrade - Improper handling of untypical characters in domain names (High) (CVE-2021-22931)
Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Use after free on close http2 on stream canceling (High) (CVE-2021-22940)
Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930.
Incomplete validation of rejectUnauthorized parameter (Low) (CVE-2021-22939)
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Node.js reports:
Use after free on close http2 on stream canceling (High) (CVE-2021-22930)
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Node.js reports:
libuv upgrade - Out of bounds read (Medium) (CVE-2021-22918)
Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
Windows installer - Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)
This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks.
npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)
This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks.
Chrome Releases reports:
This update contains 19 security fixes, including:
- [1243117] High CVE-2021-37956: Use after free in Offline use. Reported by Huyna at Viettel Cyber Security on 2021-08-24
- [1242269] High CVE-2021-37957: Use after free in WebGPU. Reported by Looben Yang on 2021-08-23
- [1223290] High CVE-2021-37958: Inappropriate implementation in Navigation. Reported by James Lee (@Windowsrcer) on 2021-06-24
- [1229625] High CVE-2021-37959: Use after free in Task Manager. Reported by raven (@raid_akame) on 2021-07-15
- [1247196] High CVE-2021-37960: Inappropriate implementation in Blink graphics. Reported by Atte Kettunen of OUSPG on 2021-09-07
- [1228557] Medium CVE-2021-37961: Use after free in Tab Strip. Reported by Khalil Zhani on 2021-07-13
- [1231933] Medium CVE-2021-37962: Use after free in Performance Manager. Reported by Sri on 2021-07-22
- [1199865] Medium CVE-2021-37963: Side-channel information leakage in DevTools. Reported by Daniel Genkin and Ayush Agarwal, University of Michigan, Eyal Ronen and Shaked Yehezkel, Tel Aviv University, Sioli O'Connell, University of Adelaide, and Jason Kim, Georgia Institute of Technology on 2021-04-16
- [1203612] Medium CVE-2021-37964: Inappropriate implementation in ChromeOS Networking. Reported by Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong on 2021-04-28
- [1239709] Medium CVE-2021-37965: Inappropriate implementation in Background Fetch API. Reported by Maurice Dauer on 2021-08-13
- [1238944] Medium CVE-2021-37966: Inappropriate implementation in Compositing. Reported by Mohit Raj (shadow2639) on 2021-08-11
- [1243622] Medium CVE-2021-37967: Inappropriate implementation in Background Fetch API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-26
- [1245053] Medium CVE-2021-37968: Inappropriate implementation in Background Fetch API. Reported by Maurice Dauer on 2021-08-30
- [1245879] Medium CVE-2021-37969: Inappropriate implementation in Google Updater. Reported by Abdelhamid Naceri (halov) on 2021-09-02
- [1248030] Medium CVE-2021-37970: Use after free in File System API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-09-09
- [1219354] Low CVE-2021-37971: Incorrect security UI in Web Browser UI. Reported by Rayyan Bijoora on 2021-06-13
- [1234259] Low CVE-2021-37972: Out of bounds read in libjpeg-turbo. Reported by Xu Hanyu and Lu Yutao from Panguite-Forensics-Lab of Qianxin on 2021-07-29
libssh security advisories:
The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called `secret_hash` and and the other `session_id`. Initially, both of them are the same, but after key re-exchange, previous `session_id` is kept and used as an input to new `secret_hash`.
Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating `secret_hash` of different size than the `session_id` has.
This becomes an issue when the `session_id` memory is zeroized or when it is used again during second key re-exchange.
The Apache project reports:
- moderate: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)
- moderate: NULL pointer dereference in httpd core (CVE-2021-34798)
- moderate: mod_proxy_uwsgi out of bound read (CVE-2021-36160)
- low: ap_escape_quotes buffer overflow (CVE-2021-39275)
- high: mod_proxy SSRF (CVE-2021-40438)
The cURL project reports:
- UAF and double-free in MQTT sending (CVE-2021-22945)
- Protocol downgrade required TLS bypassed (CVE-2021-22946)
- STARTTLS protocol injection via MITM (CVE-2021-22945)
libpano13 developers reports:
Fix crash and security issue caused by malformed filename prefix
Kenny Levinsen reports:
seatd-launch used execlp, which reads the PATH environment variable to search for the requested executable, to execute seatd. This meant that the caller could freely control what executable was loaded by adding a user-writable directory to PATH.
If seatd-launch had the SUID bit set, this could be used by a malicious user with the ability to execute seatd-launch to mount a privilege escalation attack to the owner of seatd-launch, which is likely root.
Chrome Releases reports:
This release includes 11 security fixes, including:
- [1237533] High CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06
- [1241036] High CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18
- [1245786] High CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01
- [1241123] High CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18
- [1243646] High CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-08-26
- [1244568] High CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30
- [1246932] High CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06
- [1247763] High CVE-2021-30632: Out of bounds write in V8. Reported by Anonymous on 2021-09-08
- [1247766] High CVE-2021-30633: Use after free in Indexed DB API. Reported by Anonymous on 2021-09-08
Google is aware that exploits for CVE-2021-30632 and CVE-2021-30633 exist in the wild.
Matrix developers report:
Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element (Web/Desktop/Android), FluffyChat, Nheko, Cinny, and SchildiChat.
Specifically, in certain circumstances it may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.
Exploiting this vulnerability to read encrypted messages requires gaining control over the recipient’s account. This requires either compromising their credentials directly or compromising their homeserver.
Hashicorp reports:
HashiCorp Consul Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation.
The Go project reports:
An oversight in the previous fix still allows for an OOM panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable.
Python reports:
bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid a potential race condition.
bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used on Windows and macOS.
bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n characters to avoid (unlikely) command injection.
bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address strings. Leading zeros are ambiguous and interpreted as octal notation by some libraries. For example the legacy function socket.inet_aton() treats leading zeros as octal notation. glibc implementation of modern inet_pton() does not accept any leading zeros. For a while the ipaddress module used to accept ambiguous leading zeros.
Version 5.9_2 contains security fix for PPPoE servers. Insufficient validation of incoming PPPoE Discovery request specially crafted by unauthenticated user might lead to unexpected termination of the process. The problem affects mpd versions since 5.0. Installations not using PPPoE server configuration were not affected.
Python reports:
bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used on Windows and macOS.
bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n characters to avoid (unlikely) command injection.
The WeeChat project reports:
Crash when decoding a malformed websocket frame in relay plugin.
Matrix developers report:
This release patches two moderate severity issues which could reveal metadata about private rooms:
- CVE-2021-39164: Enumerating a private room's list of members and their display names.
- CVE-2021-39163: Disclosing a private room's name, avatar, topic, and number of members.
Python reports:
bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid a potential race condition.
bpo-41180: Add auditing events to the marshal module, and stop raising code.__init__ events for every unmarshalled code object. Directly instantiated code objects will continue to raise an event, and audit event handlers should inspect or collect the raw marshal data. This reduces a significant performance overhead when loading from .pyc files.
bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used on Windows and macOS.
bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n characters to avoid (unlikely) command injection.
Chrome Releases reports:
This release contains 27 security fixes, including:
- [1233975] High CVE-2021-30606: Use after free in Blink. Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of 360 Alpha Lab on 2021-07-28
- [1235949] High CVE-2021-30607: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-08-03
- [1219870] High CVE-2021-30608: Use after free in Web Share. Reported by Huyna at Viettel Cyber Security on 2021-06-15
- [1239595] High CVE-2021-30609: Use after free in Sign-In. Reported by raven (@raid_akame) on 2021-08-13
- [1200440] High CVE-2021-30610: Use after free in Extensions API. Reported by Igor Bukanov from Vivaldi on 2021-04-19
- [1233942] Medium CVE-2021-30611: Use after free in WebRTC. Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of 360 Alpha Lab on 2021-07-28
- [1234284] Medium CVE-2021-30612: Use after free in WebRTC. Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of 360 Alpha Lab on 2021-07-29
- [1209622] Medium CVE-2021-30613: Use after free in Base internals. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-16
- [1207315] Medium CVE-2021-30614: Heap buffer overflow in TabStrip. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-05-10
- [1208614] Medium CVE-2021-30615: Cross-origin data leak in Navigation. Reported by NDevTK on 2021-05-12
- [1231432] Medium CVE-2021-30616: Use after free in Media. Reported by Anonymous on 2021-07-21
- [1226909] Medium CVE-2021-30617: Policy bypass in Blink. Reported by NDevTK on 2021-07-07
- [1232279] Medium CVE-2021-30618: Inappropriate implementation in DevTools. Reported by @DanAmodio and @mattaustin from Contrast Security on 2021-07-23
- [1235222] Medium CVE-2021-30619: UI Spoofing in Autofill. Reported by Alesandro Ortiz on 2021-08-02
- [1063518] Medium CVE-2021-30620: Insufficient policy enforcement in Blink. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2020-03-20
- [1204722] Medium CVE-2021-30621: UI Spoofing in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-04-30
- [1224419] Medium CVE-2021-30622: Use after free in WebApp Installs. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2021-06-28
- [1223667] Low CVE-2021-30623: Use after free in Bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-06-25
- [1230513] Low CVE-2021-30624: Use after free in Autofill. Reported by Wei Yuan of MoyunSec VLab on 2021-07-19
Cyrus IMAP 3.4.2 Release Notes states:
Fixed CVE-2021-33582: Certain user inputs are used as hash table keys during processing. A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a single bucket. Each subsequent insertion to the same bucket requires a strcmp of every other entry in it. At tens of thousands of entries, each new insertion could keep the CPU busy in a strcmp loop for minutes. The string hashing algorithm has been replaced with a better one, and now also uses a random seed per hash table, so malicious inputs cannot be precomputed.
Gitlab reports:
Stored XSS in DataDog Integration
Invited group members continue to have project access even after invited group is deleted
Specially crafted requests to apollo_upload_server middleware leads to denial of service
Privilege escalation of an external user through project token
Missing access control allows non-admin users to add/remove Jira Connect Namespaces
User enumeration on private instances
Member e-mails can be revealed via project import/export feature
Stored XSS in Jira integration
Stored XSS in markdown via the Design reference
Problem:
In certain circumstances, fetchmail 6.4.21 and older would not encrypt the session using STARTTLS/STLS, and might not have cleared session state across the TLS negotiation.
The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for *p == '\0' one byte too late because p++ was already performed.
The connection buffer size can be controlled by a malicious FTP server because the size is increased until a newline is encountered (or no more characters are read). This also allows to move the buffer into more interesting areas within the address space, potentially parsing relevant numbers for the attacker. Since these bytes become available to the server in form of a new TCP connection to a constructed port number or even part of the IPv6 address this is a potential information leak.
The ggatec(8) daemon does not validate the size of a response before writing it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).
A malicious ggated(8) or an attacker in a priviledged network position can overwrite the stack with crafted content and potentially execute arbitrary code.
Certain VirtIO-based device models failed to handle errors when fetching I/O descriptors. Such errors could be triggered by a malicious guest. As a result, the device model code could be tricked into operating on uninitialized I/O vectors, leading to memory corruption.
A malicious guest may be able to crash the bhyve process. It may be possible to exploit the memory corruption bugs to achieve arbitrary code execution in the bhyve process.
The OpenSSL project reports:
SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
Read buffer overruns processing ASN.1 strings (CVE-2021-3712: Moderate)
The Gitea Team reports for release 1.15.0:
- Encrypt LDAP bind password in db with SECRET_KEY (#15547)
- Remove random password in Dockerfiles (#15362)
- Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 (#16590) (#16606)
- Correctly create of git-daemon-export-ok files (#16508) (#16514)
- Don't show private user's repo in explore view (#16550) (#16554)
- Update node tar dependency to 6.1.6 (#16622) (#16623)
The Gitea Team reports for release 1.14.6:
- Bump github.com/markbates/goth from v1.67.1 to v1.68.0 (#16538) (#16540)
- Switch to maintained JWT lib (#16532) (#16535)
- Upgrade to latest version of golang-jwt (as forked for 1.14) (#16590) (#16607)
The Bouncy Castle team reports:
The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
The Bouncy Castle team reports::
Bouncy Castle BC Java before 1.66 has a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Hao Wang reports:
There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption.
Chrome Releases reports:
This release contains 9 security fixes, including:
- [1234764] High CVE-2021-30598: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30
- [1234770] High CVE-2021-30599: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30
- [1231134] High CVE-2021-30600: Use after free in Printing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-07-20
- [1234009] High CVE-2021-30601: Use after free in Extensions API. Reported by koocola(@alo_cook) and Nan Wang(@eternalsakura13) of 360 Alpha Lab on 2021-07-28
- [1230767] High CVE-2021-30602: Use after free in WebRTC. Reported by Marcin Towalski of Cisco Talos on 2021-07-19
- [1233564] High CVE-2021-30603: Race in WebAudio. Reported by Sergei Glazunov of Google Project Zero on 2021-07-27
- [1234829] High CVE-2021-30604: Use after free in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-07-30
Axel Beckert reports:
[...] I was able to capture the password given on the commandline in traffic of an TLS handshake using tcpdump and analysing it with Wireshark: [...]
The PostgreSQL Project reports:
A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
Debian reports:
xtrlock did not block multitouch events so an attacker could still input and thus control various programs such as Chromium, etc. via so-called "multitouch" events including pan scrolling, "pinch and zoom" or even being able to provide regular mouse clicks by depressing the touchpad once and then clicking with a secondary finger.
Marco Ivaldi (marco.ivaldi () mediaservice net) reports:
A buffer overflow in the CheckMonitor() function in the Common Desktop Environment 2.3.1 and earlier and 1.6 and earlier, as distributed with Oracle Solaris 10 1/13 (Update 11) and earlier, allows local users to gain root privileges via a long palette name passed to dtsession in a malicious .Xdefaults file.
The Go project reports:
A net/http/httputil ReverseProxy can panic due to a race condition if its Handler aborts with ErrAbortHandler, for example due to an error in copying the response body. An attacker might be able to force the conditions leading to the race condition.
Gitlab reports:
Stored XSS in Mermaid when viewing Markdown files
Stored XSS in default branch name
Perform Git actions with an impersonation token even if impersonation is disabled
Tag and branch name confusion allows Developer to access protected CI variables
New subscriptions generate OAuth tokens on an incorrect OAuth client application
Ability to list and delete impersonation tokens for your own user
Pipelines page is partially visible for users that have no right to see CI/CD
Improper email validation on an invite URL
Unauthorised user was able to add meta data upon issue creation
Unauthorized user can trigger deployment to a protected environment
Guest in private project can see CI/CD Analytics
Guest users can create issues for Sentry errors and track their status
Private user email disclosure via group invitation
Projects are allowed to add members with email address domain that should be blocked by group settings
Misleading username could lead to impersonation in using SSH Certificates
Unauthorized user is able to access and view project vulnerability reports
Denial of service in repository caused by malformed commit author
A Prosody XMPP server advisory reports:
It was discovered that Prosody allows any entity to access the list of admins, members, owners and banned entities of any federated XMPP group chat of which they know the address.
Chrome Releases reports:
This release contains 10 security fixes, including:
- [1227777] High CVE-2021-30590: Heap buffer overflow in Bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-07-09
- [1229298] High CVE-2021-30591: Use after free in File System API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-07-14
- [1209469] High CVE-2021-30592: Out of bounds write in Tab Groups. Reported by David Erceg on 2021-05-15
- [1209616] High CVE-2021-30593: Out of bounds read in Tab Strip. Reported by David Erceg on 2021-05-16
- [1218468] High CVE-2021-30594: Use after free in Page Info UI. Reported by raven (@raid_akame) on 2021-06-10
- [1214481] Medium CVE-2021-30596: Incorrect security UI in Navigation. Reported by Mohit Raj (shadow2639) on 2021-05-29
- [1232617] Medium CVE-2021-30597: Use after free in Browser UI. Reported by raven (@raid_akame) on 2021-07-24
Pivotal.io reports:
All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint.
Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab reports:
Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignored the transfer-encoding header if the client declared it would only accept an HTTP/1.0 response; Tomcat honoured the identify encoding; and Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
ilja.farber reports:
Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.
rbeaudry reports:
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS.
Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Matthias Andree reports:
When a log message exceeds c. 2 kByte in size, for instance, with very long header contents, and depending on verbosity option, fetchmail can crash or misreport each first log message that requires a buffer reallocation.
Huang Zhw reports:
On 32-bit versions, Redis BITFIELD command is vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves constructing specially crafted bit commands which overflow the bit offset.
This problem only affects 32-bit versions of Redis.
powerdns reports:
PowerDNS Security Advisory 2021-01: Specific query crashes Authoritative Server
Roger Light reports:
If an authenticated client connected with MQTT v5 sent a malformed CONNACK message to the broker a NULL pointer dereference occurred, most likely resulting in a segfault.
(Note: a CVE is referenced in the github commit but it appears to be for a python-bleach vulnerability so it is not included here.)
pjsip reports:
There are a couple of issues found in the SSL socket:
- A race condition between callback and destroy, due to the accepted socket having no group lock.
- SSL socket parent/listener may get destroyed during handshake.
The Asterisk project reports:
Depending on the timing, it's possible for Asterisk to crash when using a TLS connection if the underlying socket parent/listener gets destroyed during the handshake.
The Asterisk project reports:
If the IAX2 channel driver receives a packet that contains an unsupported media format it can cause a crash to occur in Asterisk.
The Asterisk project reports:
When Asterisk receives a re-INVITE without SDP after having sent a BYE request a crash will occur. This occurs due to the Asterisk channel no longer being present while code assumes it is.
Chrome Releases reports:
This release contains 35 security fixes, including:
- ][1210985] High CVE-2021-30565: Out of bounds write in Tab Groups. Reported by David Erceg on 2021-05-19
- [1202661] High CVE-2021-30566: Stack buffer overflow in Printing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-04-26
- [1211326] High CVE-2021-30567: Use after free in DevTools. Reported by DDV_UA on 2021-05-20
- [1219886] High CVE-2021-30568: Heap buffer overflow in WebGL. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-06-15
- [1218707] High CVE-2021-30569: Use after free in sqlite. Reported by Chris Salls (@salls) of Makai Security on 2021-06-11
- [1101897] High CVE-2021-30571: Insufficient policy enforcement in DevTools. Reported by David Erceg on 2020-07-03
- [1214234] High CVE-2021-30572: Use after free in Autofill. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-05-28
- [1216822] High CVE-2021-30573: Use after free in GPU. Reported by Security For Everyone Team - https://securityforeveryone.com on 2021-06-06
- [1227315] High CVE-2021-30574: Use after free in protocol handling. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-07-08
- [1213313] Medium CVE-2021-30575: Out of bounds read in Autofill. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-05-26
- [1194896] Medium CVE-2021-30576: Use after free in DevTools. Reported by David Erceg on 2021-04-01
- [1204811] Medium CVE-2021-30577: Insufficient policy enforcement in Installer. Reported by Jan van der Put (REQON B.V) on 2021-05-01
- [1201074] Medium CVE-2021-30578: Uninitialized Use in Media. Reported by Chaoyuan Peng on 2021-04-21
- [1207277] Medium CVE-2021-30579: Use after free in UI framework. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-05-10
- [1189092] Medium CVE-2021-30580: Insufficient policy enforcement in Android intents. Reported by @retsew0x01 on 2021-03-17
- [1194431] Medium CVE-2021-30581: Use after free in DevTools. Reported by David Erceg on 2021-03-31
- [1205981] Medium CVE-2021-30582: Inappropriate implementation in Animation. Reported by George Liu on 2021-05-05
- [1179290] Medium CVE-2021-30583: Insufficient policy enforcement in image handling on Windows. Reported by Muneaki Nishimura (nishimunea) on 2021-02-17
- [1213350] Medium CVE-2021-30584: Incorrect security UI in Downloads. Reported by @retsew0x01 on 2021-05-26
- [1023503] Medium CVE-2021-30585: Use after free in sensor handling. Reported by niarci on 2019-11-11
- [1201032] Medium CVE-2021-30586: Use after free in dialog box handling on Windows. Reported by kkomdal with kkwon and neodal on 2021-04-21
- [1204347] Medium CVE-2021-30587: Inappropriate implementation in Compositing on Windows. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-04-30
- [1195650] Low CVE-2021-30588: Type Confusion in V8. Reported by Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-04
- [1180510] Low CVE-2021-30589: Insufficient validation of untrusted input in Sharing. Reported by Kirtikumar Anandrao Ramchandani (@Kirtikumar_A_R) and Patrick Walker (@homesen) on 2021-02-20
The cURL project reports:
CURLOPT_SSLCERT mixup with Secure Transport (CVE-2021-22926)
TELNET stack contents disclosure again (CVE-2021-22925)
Bad connection reuse due to flawed path name checks (CVE-2021-92254)
Metalink download sends credentials (CVE-2021-92253)
Wrong content via metalink not discarded (CVE-2021-92252)
Oracle reports:
This Critical Patch Update contains 41 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 8.8.MariaDB is affected by CVE-2021-2372 and CVE-2021-2389 only.
The Gitea Team reports for release 1.14.5:
- Hide mirror passwords on repo settings page (#16022) (#16355)
- Update bluemonday to v1.0.15 (#16379) (#16380)
Chrome Releases reports:
This release contains 8 security fixes, including:
- [1219082] High CVE-2021-30559: Out of bounds write in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-06-11
- [1214842] High CVE-2021-30541: Use after free in V8. Reported by Richard Wheeldon on 2021-05-31
- [1219209] High CVE-2021-30560: Use after free in Blink XSLT. Reported by Nick Wellnhofer on 2021-06-12
- [1219630] High CVE-2021-30561: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-06-14
- [1220078] High CVE-2021-30562: Use after free in WebSerial. Reported by Anonymous on 2021-06-15
- [1228407] High CVE-2021-30563: Type Confusion in V8. Reported by Anonymous on 2021-07-12
- [1221309] Medium CVE-2021-30564: Heap buffer overflow in WebXR. Reported by Ali Merchant, iQ3Connect VR Platform on 2021-06-17
Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild.
Ruby news:
This release includes security fixes. Please check the topics below for details.
CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP
CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP
CVE-2021-31799: A command injection vulnerability in RDoc
The Go project reports:
crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.
Mantis 2.25.1 and 2.25.2 releases report:
Security and maintenance release, PHPMailer update to 6.5.0
- 0028552: XSS in manage_custom_field_edit_page.php (CVE-2021-33557)
- 0028821: Update PHPMailer to 6.5.0 (CVE-2021-3603, CVE-2020-36326)
Gitlab reports:
Arbitrary file read via design feature
Exiv2 teams reports:
Multiple vulnerabilities covering buffer overflows, out-of-bounds, read of uninitialized memory and denial of serivce. The heap overflow is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file.
Cary Phillips reports:
- 1038 fix/extend part number validation in MultiPart methods
- 1037 verify data size in deepscanlines with NO_COMPRESSION
- 1036 detect buffer overflows in RleUncompress
Gitlab reports:
DoS using Webhook connections
CSRF on GraphQL API allows executing mutations through GET requests
Private projects information disclosure
Denial of service of user profile page
Single sign-on users not getting blocked
Some users can push to Protected Branch with Deploy keys
A deactivated user can access data through GraphQL
Reflected XSS in release edit page
Clipboard DOM-based XSS
Stored XSS on Audit Log
Forks of public projects by project members could leak codebase
Improper text rendering
HTML Injection in full name field
Jenkins Security Advisory:
Description
(Medium) SECURITY-2278 / CVE-2021-21670
Improper permission checks allow canceling queue items and aborting builds
(High) SECURITY-2371 / CVE-2021-21671
Session fixation vulnerability
Jonathon Knudsen of Synopsys Cybersecurity Research Center reports:
All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious client can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.
alanxz reports:
When parsing a frame header, validate that the frame_size is less than or equal to INT32_MAX. Given frame_max is limited between 0 and INT32_MAX in amqp_login and friends, this does not change the API. This prevents a potential buffer overflow when a malicious client sends a frame_size that is close to UINT32_MAX, in which causes an overflow when computing state->target_size resulting in a small value there. A buffer is then allocated with the small amount, then memcopy copies the frame_size writing to memory beyond the end of the buffer.
Puppet reports:
Fixed an issue where someone with the ability to query PuppetDB could arbitrarily write, update, or delete data CVE-2021-27021 PDB-5138.
Ansible developers report:
Templating engine fix for not preserving usnafe status when trying to preserve newlines.
Dovecot team reports reports:
Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out.
Dovecot team reports:
CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk.
CVE-2021-33515: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected.
The Gitea Team reports for release 1.14.3:
- Encrypt migration credentials at rest (#15895) (#16187)
- Only check access tokens if they are likely to be tokens (#16164) (#16171)
- Add missing SameSite settings for the i_like_gitea cookie (#16037) (#16039)
- Fix setting of SameSite on cookies (#15989) (#15991)
Chrome Releases reports:
This release includes 4 security fixes, including:
- [1219857] High CVE-2021-30554: Use after free in WebGL. Reported by anonymous on 2021-06-15
- [1215029] High CVE-2021-30555: Use after free in Sharing. Reported by David Erceg on 2021-06-01
- [1212599] High CVE-2021-30556: Use after free in WebAudio. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-24
- [1202102] High CVE-2021-30557: Use after free in TabGroups. Reported by David Erceg on 2021-04-23
Michael Ortmann reports:
ircii has a bug in parsing CTCP UTC messages.
Its unknown if this could also be used for arbitrary code execution.
The Apache httpd reports:
- moderate: mod_proxy_wstunnel tunneling of non Upgraded connections (CVE-2019-17567)
- moderate: Improper Handling of Insufficient Privileges (CVE-2020-13938)
- low: mod_proxy_http NULL pointer dereference (CVE-2020-13950)
- low: mod_auth_digest possible stack overflow by one nul byte (CVE-2020-35452)
- low: mod_session NULL pointer dereference (CVE-2021-26690)
- low: mod_session response handling heap overflow (CVE-2021-26691)
- moderate: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)
- important: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618)
NVD reports:
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Cati team reports:
Due to a lack of validation, data_debug.php can be the source of a SQL injection.
Chrome Releases reports:
This release contains 14 security fixes, including:
- [1212618] Critical CVE-2021-30544: Use after free in BFCache. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-05-24
- [1201031] High CVE-2021-30545: Use after free in Extensions. Reported by kkwon with everpall and kkomdal on 2021-04-21
- [1206911] High CVE-2021-30546: Use after free in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-05-08
- [1210414] High CVE-2021-30547: Out of bounds write in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-05-18
- [1210487] High CVE-2021-30548: Use after free in Loader. Reported by Yangkang(@dnpushme) & Wanglu of Qihoo360 Qex Team on 2021-05-18
- [1212498] High CVE-2021-30549: Use after free in Spell check. Reported by David Erceg on 2021-05-23
- [1212500] High CVE-2021-30550: Use after free in Accessibility. Reported by David Erceg on 2021-05-23
- [1216437] High CVE-2021-30551: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-06-04
- [1200679] Medium CVE-2021-30552: Use after free in Extensions. Reported by David Erceg on 2021-04-20
- [1209769] Medium CVE-2021-30553: Use after free in Network service. Reported by Anonymous on 2021-05-17
Google is aware that an exploit for CVE-2021-30551 exists in the wild.
Dino team reports:
It was discovered that when a user receives and downloads a file in Dino, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user.
2ndQuadrant reports:
- Fix pg_dump/pg_restore execution (CVE-2021-3515)
Correctly escape the connection string for both pg_dump and pg_restore so that exotic database and user names are handled correctly.
Reported by Pedro Gallegos
Drupal Security team reports:
Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.
Cedric Buissart reports:
The function
polkit_system_bus_name_get_creds_syncis used to get the uid and pid of the process requesting the action. It does this by sending the unique bus name of the requesting process, which is typically something like ":1.96", todbus-daemon. These unique names are assigned and managed bydbus-daemonand cannot be forged, so this is a good way to check the privileges of the requesting process.The vulnerability happens when the requesting process disconnects from
dbus-daemonjust before the call topolkit_system_bus_name_get_creds_syncstarts. In this scenario, the unique bus name is no longer valid, sodbus-daemonsends back an error reply. This error case is handled inpolkit_system_bus_name_get_creds_syncby setting the value of theerrorparameter, but it still returnsTRUE, rather thanFALSE. This behavior means that all callers ofpolkit_system_bus_name_get_creds_syncneed to carefully check whether an error was set. If the calling function forgets to check for errors then it will think that the uid of the requesting process is 0 (because theAsyncGetBusNameCredsDatastruct is zero initialized). In other words, it will think that the action was requested by a root process, and will therefore allow it.
sogo.nu reports:
SOGo was not validating the signatures of any SAML assertions it received.
This means any actor with network access to the deployment could impersonate
users when SAML was the authentication method.
The :class:`~urllib.request.AbstractBasicAuthHandler` class of the :mod:`urllib.request` module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service
entrouvert reports:
When AuthnResponse messages are not signed (which is permitted by the specifiation), all assertion's signatures should be checked, but currently after the first signed assertion is checked all following assertions are accepted without checking their signature, and the last one is considered the main assertion.
The Go project reports:
The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents.
ReverseProxy in net/http/httputil could be made to forward certain hop-by-hop headers, including Connection. In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set by the ReverseProxy.Director.
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use.
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.
Sviatoslav Sydorenko reports:
Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
It is caused by a bug in the
aiohttp.web_middlewares.normalize_path_middlewaremiddleware.
Tim Wojtulewicz of Corelight reports:
Fix potential Undefined Behavior in decode_netbios_name() and decode_netbios_name_type() BIFs. The latter has a possibility of a remote heap-buffer-overread, making this a potential DoS vulnerability.
Add some extra length checking when parsing mobile ipv6 packets. Due to the possibility of reading invalid headers from remote sources, this is a potential DoS vulnerability.
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
Michael McNally reports:
Program code used by the ISC DHCP package to read and parse stored leases
has a defect that can be exploited by an attacker to cause one of several undesirable outcomes
Gitlab reports:
Stealing GitLab OAuth access tokens using XSLeaks in Safari
Denial of service through recursive triggered pipelines
Unauthenticated CI lint API may lead to information disclosure and SSRF
Server-side DoS through rendering crafted Markdown documents
Issue and merge request length limit is not being enforced
Insufficient Expired Password Validation
XSS in blob viewer of notebooks
Logging of Sensitive Information
On-call rotation information exposed when removing a member
Spoofing commit author for signed commits
Enable qsh verification for Atlassian Connect
Redis development team reports:
An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477.
The X.org project reports:
XLookupColor() and other X libraries function lack proper validation of the length of their string parameters. If those parameters can be controlled by an external application (for instance a color name that can be emitted via a terminal control sequence) it can lead to the emission of extra X protocol requests to the X server.
Prometheus reports:
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Tobias Stoeckmann reports:
The libXcursor fix for CVE-2013-2003 has never been imported into wayland, leaving it vulnerable to it.
libradius did not perform sufficient validation of received messages.
rad_get_attr(3) did not verify that the attribute length is valid before subtracting the length of the Type and Length fields. As a result, it could return success while also providing a bogus length of SIZE_T_MAX - 2 for the Value field.
When processing attributes to find an optional authenticator, is_valid_response() failed to verify that each attribute length is non-zero and could thus enter an infinite loop.
A server may use libradius(3) to process messages from RADIUS clients. In this case, a malicious client could trigger a denial-of-service in the server. A client using libradius(3) to process messages from a server is susceptible to the same problem.
The impact of the rad_get_attr(3) bug depends on how the returned length is validated and used by the consumer. It is possible that libradius(3) applications will crash or enter an infinite loop when calling rad_get_attr(3) on untrusted RADIUS messages.
The FreeBSD kernel enables SMAP during boot when the CPU reports that the SMAP capability is present. Subroutines such as copyin() and copyout() are responsible for disabling SMAP around the sections of code that perform user memory accesses.
Such subroutines must handle page faults triggered when user memory is not mapped. The kernel's page fault handler checks the validity of the fault, and if it is indeed valid it will map a page and resume copying. If the fault is invalid, the fault handler returns control to a trampoline which aborts the operation and causes an error to be returned. In this second scenario, a bug in the implementation of SMAP support meant that SMAP would remain disabled until the thread returns to user mode.
This bug may be used to bypass the protections provided by SMAP for the duration of a system call. It could thus be combined with other kernel bugs to craft an exploit.
Chrome Releases reports:
This release contains 32 security fixes, including:
- [1208721] High CVE-2021-30521: Heap buffer overflow in Autofill. Reported by ZhanJia Song on 2021-05-13
- [1176218] High CVE-2021-30522: Use after free in WebAudio. Reported by Piotr Bania of Cisco Talos on 2021-02-09
- [1187797] High CVE-2021-30523: Use after free in WebRTC. Reported by Tolyan Korniltsev on 2021-03-13
- [1197146] High CVE-2021-30524: Use after free in TabStrip. Reported by David Erceg on 2021-04-08
- [1197888] High CVE-2021-30525: Use after free in TabGroups. Reported by David Erceg on 2021-04-11
- [1198717] High CVE-2021-30526: Out of bounds write in TabStrip. Reported by David Erceg on 2021-04-13
- [1199198] High CVE-2021-30527: Use after free in WebUI. Reported by David Erceg on 2021-04-15
- [1206329] High CVE-2021-30528: Use after free in WebAuthentication. Reported by Man Yue Mo of GitHub Security Lab on 2021-05-06
- [1195278] Medium CVE-2021-30529: Use after free in Bookmarks. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2021-04-02
- [1201033] Medium CVE-2021-30530: Out of bounds memory access in WebAudio. Reported by kkwon on 2021-04-21
- [1115628] Medium CVE-2021-30531: Insufficient policy enforcement in Content Security Policy. Reported by Philip Papurt on 2020-08-12
- [1117687] Medium CVE-2021-30532: Insufficient policy enforcement in Content Security Policy. Reported by Philip Papurt on 2020-08-18
- [1145553] Medium CVE-2021-30533: Insufficient policy enforcement in PopupBlocker. Reported by Eliya Stein on 2020-11-04
- [1151507] Medium CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox. Reported by Alesandro Ortiz on 2020-11-20
- [1194899] Medium CVE-2021-30535: Double free in ICU. Reported by nocma, leogan, cheneyxu of WeChat Open Platform Security Team on 2021-04-01
- [1145024] Medium CVE-2021-21212: Insufficient data validation in networking. Reported by Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong on 2020-11-03
- [1194358] Low CVE-2021-30536: Out of bounds read in V8. Reported by Chris Salls (@salls) on 2021-03-31
- [830101] Low CVE-2021-30537: Insufficient policy enforcement in cookies. Reported by Jun Kokatsu (@shhnjk) on 2018-04-06
- [1115045] Low CVE-2021-30538: Insufficient policy enforcement in content security policy. Reported by Tianze Ding (@D1iv3) of Tencent Security Xuanwu Lab on 2020-08-11
- [971231] Low CVE-2021-30539: Insufficient policy enforcement in content security policy. Reported by unnamed researcher on 2019-06-05
- [1184147] Low CVE-2021-30540: Incorrect security UI in payments. Reported by @retsew0x01 on 2021-03-03
Google's oss-fuzz project reports:
Denial-of-Service on CURVE/ZAP-protected servers by unauthenticated clients. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them.
Fang-Pen Lin reports:
A remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
NGINX team reports:
1-byte memory overwrite might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process crash or, potentially, arbitrary code execution.
PG Partition Manager reports:
In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.
Kurt Seifried reports:
So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.).
A billion laughs attack is a type of denial-of-service attack which is aimed at parsers of XML documents.
Daniel Veillard reports:
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
The PostgreSQL project reports:
Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will..
Buffer overrun from integer overflow in array subscripting calculations
While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory.
The PostgreSQL project reports:
Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will.
The Prosody security advisory 2021-05-12 reports:
This advisory details 5 new security vulnerabilities discovered in the Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release default configuration.
- CVE-2021-32918: DoS via insufficient memory consumption controls
- CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU consumption
- CVE-2021-32921: Use of timing-dependent string comparison with sensitive values
- CVE-2021-32917: Use of mod_proxy65 is unrestricted in default configuration
- CVE-2021-32919: Undocumented dialback-without-dialback option insecure
CVE reports:
Several vulnerabilities have been discovered in ImageMagick:
- CVE-2021-20309: A flaw was found in ImageMagick in versions before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick.
- CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero.
- CVE-2020-29599: ImageMagick before 6.9.11-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files.
- And maybe some others…
CVE reports:
Several vulnerabilities have been discovered in ImageMagick:
- CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible.
- CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick.
- CVE-2021-20311: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick.
- CVE-2021-20310: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick.
- CVE-2021-20309: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick.
- And several others…
python-pillow reports:
This release fixes several vulnerabilities found with `OSS-Fuzz`.
- `CVE-2021-25288`: Fix OOB read in Jpeg2KDecode. This dates to Pillow 2.4.0.
- `CVE-2021-28675`: Fix DOS in PsdImagePlugin. This dates to the PIL fork.
- `CVE-2021-28676`: Fix FLI DOS. This dates to the PIL fork.
- `CVE-2021-28677`: Fix EPS DOS on _open. This dates to the PIL fork.
- `CVE-2021-28678`: Fix BLP DOS. This dates to Pillow 5.1.0.
- Fix memory DOS in ImageFont. This dates to the PIL fork.
Chrome Releases reports:
This release contains 19 security fixes, including:
- [1180126] High CVE-2021-30506: Incorrect security UI in Web App Installs. Reported by @retsew0x01 on 2021-02-19
- [1178202] High CVE-2021-30507: Inappropriate implementation in Offline. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-14
- [1195340] High CVE-2021-30508: Heap buffer overflow in Media Feeds. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-04-02
- [1196309] High CVE-2021-30509: Out of bounds write in Tab Strip. Reported by David Erceg on 2021-04-06
- [1197436] High CVE-2021-30510: Race in Aura. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-04-09
- [1197875] High CVE-2021-30511: Out of bounds read in Tab Groups. Reported by David Erceg on 2021-04-10
- [1200019] High CVE-2021-30512: Use after free in Notifications. Reported by ZhanJia Song on 2021-04-17
- [1200490] High CVE-2021-30513: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2021-04-19
- [1200766] High CVE-2021-30514: Use after free in Autofill. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2021-04-20
- [1201073] High CVE-2021-30515: Use after free in File API. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-04-21
- [1201446] High CVE-2021-30516: Heap buffer overflow in History. Reported by ZhanJia Song on 2021-04-22
- [1203122] High CVE-2021-30517: Type Confusion in V8. Reported by laural on 2021-04-27
- [1203590] High CVE-2021-30518: Heap buffer overflow in Reader Mode. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2021-04-28
- [1194058] Medium CVE-2021-30519: Use after free in Payments. Reported by asnine on 2021-03-30
- [1193362] Medium CVE-2021-30520: Use after free in Tab Strip. Reported by Khalil Zhani on 2021-04-03
Matrix developers report:
"Push rules" can specify conditions under which they will match, including event_match, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.
Cyrus IMAP 3.4.1 Release Notes states:
Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.
Oss-Fuzz reports:
There is a possible out of bounds read due to a heap buffer overflow in FLAC__bitreader_read_rice_signed_block of bitreader.c.
Ruby on Rails blog:
Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These releases contain important security fixes. Here is a list of the issues fixed:
CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack
CVE-2021-22902: Possible Denial of Service vulnerability in Action Dispatch
CVE-2021-22903: Possible Open Redirect Vulnerability in Action Pack
CVE-2021-22904: Possible DoS Vulnerability in Action Controller Token Authentication
The Go project reports:
http.ReadRequest can stack overflow due to recursion when given a request with a very large header (~8-10MB depending on the architecture). A http.Server which overrides the default max header of 1MB by setting Server.MaxHeaderBytes to a much larger value could also be vulnerable in the same way.
NVD reports:
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems..
Django Release reports:
CVE-2021-31542:Potential directory-traversal via uploaded files.
MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names.
Python reports:
bpo-43434: Creating a sqlite3.Connection object now also produces a sqlite3.connect auditing event. Previously this event was only produced by sqlite3.connect() calls. Patch by Erlend E. Aasland.
bpo-43882: The presence of newline or tab characters in parts of a URL could allow some forms of attacks.Following the controlling specification for URLs defined by WHATWG urllib.parse() now removes A SCII newlines and tabs from URLs, preventing such attacks.
bpo-43472: Ensures interpreter-level audit hooks receive the cpython. PyInterpreterState_New event when called through the _xxsubinterpreters module.
bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address strings. Leading zeros are ambiguous and interpreted as octal notation by some libraries. For example the legacy function socket.inet_aton() treats leading zeros as octal notatation. glibc implementation of modern inet_pton() does not accept any leading zeros. For a while the ipaddress module used to accept ambiguous leading zeros.
bpo-43075: Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server.
bpo-42800: Audit hooks are now fired for frame.f_code, traceback.tb_frame, and generator code/frame attribute access.
Redis project reports:
- Vulnerability in the STRALGO LCS command
- An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution.
- Vulnerability in the COPY command for large intsets
- An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2).
Alexandr Savca reports:
RDoc used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run rdoc command.
Sympa community reports:
Unauthorised full access via SOAP API due to illegal cookie
The Samba Team reports:
- CVE-2021-20254: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token.
Gitlab reports:
Read API scoped tokens can execute mutations
Pull mirror credentials were exposed
Denial of Service when querying repository branches API
Non-owners can set system_note_timestamp when creating / updating issues
DeployToken will impersonate a User with the same ID when using Dependency Proxy
Community reports:
Fix Code Injection vulnerability in CarrierWave::RMagick
Fix SSRF vulnerability in the remote file download feature
Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file.
This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following:
- To be used as a salt to encrypt passwords stored in the database by the RC4 symmetric key algorithm.
Note that RC4 is no longer considered secure enough and is not supported in the current version of Sympa.
- To prevent attackers from sending crafted messages to achieve XSS and so on in message archives.
There were the following problems with the use of this parameter.
- This parameter, for its purpose, should be different for each installation, and once set, it cannot be changed. As a result, some sites have been operating without setting this parameter. This completely invalidates the security measures described above.
- Even if this parameter is properly set, it may be considered not being strong enough against brute force attacks.
Chrome Releases reports:
This release contains 9 security fixes, including:
- [1199345] High CVE-2021-21227: Insufficient data validation in V8. Reported by Gengming Liu of Singular Security Lab on 2021-04-15
- [1175058] High CVE-2021-21232: Use after free in Dev Tools. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-05
- [1182937] High CVE-2021-21233: Heap buffer overflow in ANGLE. Reported by Omair on 2021-02-26
- [1139156] Medium CVE-2021-21228: Insufficient policy enforcement in extensions. Reported by Rob Wu on 2020-10-16
- [$TBD][1198165] Medium CVE-2021-21229: Incorrect security UI in downloads. Reported by Mohit Raj (shadow2639) on 2021-04-12
- [1198705] Medium CVE-2021-21230: Type Confusion in V8. Reported by Manfred Paul on 2021-04-13
- [1198696] Low CVE-2021-21231: Insufficient data validation in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-04-13
Shibboleth project reports:
Session recovery feature contains a null pointer deference.
The cookie-based session recovery feature added in V3.0 contains a flaw that is exploitable on systems *not* using the feature if a specially crafted cookie is supplied.
This manifests as a crash in the shibd daemon/service process.
Because it is very simple to trigger this condition remotely, it results in a potential denial of service condition exploitable by a remote, unauthenticated attacker.
Jon Siwek of Corelight reports:
Fix null-pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a set[enum]. For those that have such an input feed whose contents may come from external/remote sources, this is a potential DoS vulnerability.
Gert Döring reports:
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
Chrome Reelases reports:
This release includes 7 security fixes, including:
- 1194046] High CVE-2021-21222: Heap buffer overflow in V8. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30
- [1195308] High CVE-2021-21223: Integer overflow in Mojo. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02
- [1195777] High CVE-2021-21224: Type Confusion in V8. Reported by Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-05
- [1195977] High CVE-2021-21225: Out of bounds memory access in V8. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-05
- [1197904] High CVE-2021-21226: Use after free in navigation. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-11
Jenkins Security Advisory:
Description
(High) JENKINS-65280 / CVE-2021-28165
Denial of service vulnerability in bundled Jetty
Oracle reports:
This Critical Patch Update contains 49 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.8.MariaDB is affected by CVE-2021-2166 and CVE-2021-2154 only
The Apache Openofffice project reports:
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
The Apache Maven project reports:
We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues:
- Possible Man-In-The-Middle-Attack due to custom repositories using HTTP. More and more repositories use HTTPS nowadays, but this hasn't always been the case. This means that Maven Central contains POMs with custom repositories that refer to a URL over HTTP. This makes downloads via such repository a target for a MITM attack. At the same time, developers are probably not aware that for some downloads an insecure URL is being used. Because uploaded POMs to Maven Central are immutable, a change for Maven was required. To solve this, we extended the mirror configuration with blocked parameter, and we added a new external:http:* mirror selector (like existing external:*), meaning "any external URL using HTTP". The decision was made to block such external HTTP repositories by default: this is done by providing a mirror in the conf/settings.xml blocking insecure HTTP external URLs.
- Possible Domain Hijacking due to custom repositories using abandoned domains Sonatype has analyzed which domains were abandoned and has claimed these domains.
- Possible hijacking of downloads by redirecting to custom repositories This one was the hardest to analyze and explain. The short story is: you're safe, dependencies are only downloaded from repositories within their context. So there are two main questions: what is the context and what is the order? The order is described on the Repository Order page. The first group of repositories are defined in the settings.xml (both user and global). The second group of repositories are based on inheritence, with ultimately the super POM containing the URL to Maven Central. The third group is the most complex one but is important to understand the term context: repositories from the effective POMs from the dependency path to the artifact. So if a dependency was defined by another dependency or by a Maven project, it will also include their repositories. In the end this is not a bug, but a design feature.
Hashicorp reports:
Add content-type headers to raw KV responses to prevent XSS attacks (CVE-2020-25864). audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log (CVE-2021-28156).
NVD reports:
Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
Rust Security Response Working Group reports:
The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.
SO-AND-SO reports:
Remote code execution when uploading specially crafted image files
Update Rexml
Chrome Releases reports:
This release contains 37 security fixes, including:
- [1025683] High CVE-2021-21201: Use after free in permissions. Reported by Gengming Liu, Jianyu Chen at Tencent Keen Security Lab on 2019-11-18
- [1188889] High CVE-2021-21202: Use after free in extensions. Reported by David Erceg on 2021-03-16
- [1192054] High CVE-2021-21203: Use after free in Blink. Reported by asnine on 2021-03-24
- [1189926] High CVE-2021-21204: Use after free in Blink. Reported by Chelse Tsai-Simek, Jeanette Ulloa, and Emily Voigtlander of Seesaw on 2021-03-19
- [1165654] High CVE-2021-21205: Insufficient policy enforcement in navigation. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-01-12
- [1195333] High CVE-2021-21221: Insufficient validation of untrusted input in Mojo. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02
- [1185732] Medium CVE-2021-21207: Use after free in IndexedDB. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2021-03-08
- [1039539] Medium CVE-2021-21208: Insufficient data validation in QR scanner. Reported by Ahmed Elsobky (@0xsobky) on 2020-01-07
- [1143526] Medium CVE-2021-21209: Inappropriate implementation in storage. Reported by Tom Van Goethem (@tomvangoethem) on 2020-10-29
- [1184562] Medium CVE-2021-21210: Inappropriate implementation in Network. Reported by @bananabr on 2021-03-04
- [1103119] Medium CVE-2021-21211: Inappropriate implementation in Navigation. Reported by Akash Labade (m0ns7er) on 2020-07-08
- [1145024] Medium CVE-2021-21212: Incorrect security UI in Network Config UI. Reported by Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong on 2020-11-03
- [1161806] Medium CVE-2021-21213: Use after free in WebMIDI. Reported by raven (@raid_akame) on 2020-12-25
- [1170148] Medium CVE-2021-21214: Use after free in Network API. Reported by Anonymous on 2021-01-24
- [1172533] Medium CVE-2021-21215: Inappropriate implementation in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-01-30
- [1173297] Medium CVE-2021-21216: Inappropriate implementation in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-02
- [1166462] Low CVE-2021-21217: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-14
- [1166478] Low CVE-2021-21218: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-14
- [1166972] Low CVE-2021-21219: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-15
Chrome Releases reports:
This release contains two security fixes:
- [1196781] High CVE-2021-21206: Use after free in Blink. Reported by Anonymous on 2021-04-07
- [1196683] High CVE-2021-21220: Insufficient validation of untrusted input in V8 for x86_64. Reported by Bruno Keith (@bkth_) and Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_it) via ZDI (ZDI-CAN-13569) on 2021-04-07>
X.Org server security reports for release 1.20.11:
- Fix XChangeFeedbackControl() request underflow
.
The Gitea Team reports for release 1.14.0:
- Validate email in external authenticator registration form
- Ensure validation occurs on clone addresses too
syncthing developers report:
syncthing can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field.
The relay server strelaysrv can be caused to crash and exit if sent a malformed relay protocol message with a negative length field.
David Schwörer reports:
Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords.
Daniel Stenberg reports:
Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes.
When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.
When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed.
This flaw can allow a malicious HTTPS proxy to MITM the traffic. Such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
Daniel Stenberg reports:
libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
libcurl automatically sets the Referer: HTTP request header field in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set. With the curl tool, it is enabled with --referer ";auto".
The Gitea Team reports for release 1.13.7:
- Update to bluemonday-1.0.6
- Clusterfuzz found another way
Micah Snyder reports:
- CVE-2021-1252
- Excel XLM parser infinite loop
- CVE-2021-1404
- PDF parser buffer over-read; possible crash.
- CVE-2021-1405
- Mail parser NULL-dereference crash.
Jenkins Security Advisory:
Description
(Low) SECURITY-1721 / CVE-2021-21639
Lack of type validation in agent related REST API
(Medium) SECURITY-1871 / CVE-2021-21640
View name validation bypass
Node.js reports:
OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
Due to a race condition between lookup of ".." and remounting a filesystem, a process running inside a jail might access filesystem hierarchy outside of jail.
A process with superuser privileges running inside a jail configured with the allow.mount permission (not enabled by default) could change the root directory outside of the jail, and thus gain full read and write access to all files and directories in the system.
An unprivileged process can configure an accept filter on a listening socket. This is done using the setsockopt(2) system call. The process supplies the name of the accept filter which is to be attached to the socket, as well as a string containing filter-specific information.
If the filter implements the accf_create callback, the socket option handler attempts to preserve the process-supplied argument string. A bug in the socket option handler caused this string to be freed prematurely, leaving a dangling pointer. Additional operations on the socket can turn this into a double free or a use-after-free.
The bug may be exploited to trigger local privilege escalation or kernel memory disclosure.
A particular case of memory sharing is mishandled in the virtual memory system. It is possible and legal to establish a relationship where multiple descendant processes share a mapping which shadows memory of an ancestor process. In this scenario, when one process modifies memory through such a mapping, the copy-on-write logic fails to invalidate other mappings of the source page. These stale mappings may remain even after the mapped pages have been reused for another purpose.
An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel.
Mitre reports:
A stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.
Juho Nurminen reports:
When parsing and serializing a crafted XML document, REXML gem (including the one bundled with Ruby) can create a wrong XML document whose structure is different from the original one. The impact of this issue highly depends on context, but it may lead to a vulnerability in some programs that are using REXML.
Chrome Releases reports:
This update contains 8 security fixes, including:
- [1181228] High CVE-2021-21194: Use after free in screen capture. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-02-23
- [1182647] High CVE-2021-21195: Use after free in V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent Security Xuanwu Lab on 2021-02-26
- [1175992] High CVE-2021-21196: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-02-08
- [1173903] High CVE-2021-21197: Heap buffer overflow in TabStrip. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-03
- [1184399] High CVE-2021-21198: Out of bounds read in IPC. Reported by Mark Brand of Google Project Zero on 2021-03-03
- [1179635] High CVE-2021-21199: Use Use after free in Aura. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group and Evangelos Foutras
Gitlab reports:
Arbitrary File Read During Project Import
Kroki Arbitrary File Read/Write
Stored Cross-Site-Scripting in merge requests
Access data of an internal project through a public project fork as an anonymous user
Incident metric images can be deleted by any user
Infinite Loop When a User Access a Merge Request
Stored XSS in scoped labels
Admin CSRF in System Hooks Execution Through API
Update OpenSSL dependency
Update PostgreSQL dependency
The Samba Team reports:
- CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
- CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
Niels Möller reports:
I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves.
Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. [...] It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis.
The OpenSSL project reports:
High: CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450)
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default.High: NULL pointer deref in signature_algorithms processing (CVE-2021-3449)
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack.
The Apache SpamAssassin project reports:
Apache SpamAssassin 3.4.5 was recently released [1], and fixes an issue of security note where malicious rule configuration (.cf) files can be configured to run system commands.
In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
The Gitea Team reports for release 1.13.6:
- Fix bug on avatar middleware
- Fix another clusterfuzz identified issue
The Gitea Team reports for release 1.13.5:
- Update to goldmark 1.3.3
OpenBSD Project reports:
ssh-agent(1): fixed a double-free memory corruption that was introduced in OpenSSH 8.2 . We treat all such memory faults as potentially exploitable. This bug could be reached by an attacker with access to the agent socket.
On modern operating systems where the OS can provide information about the user identity connected to a socket, OpenSSH ssh-agent and sshd limit agent socket access only to the originating user and root. Additional mitigation may be afforded by the system's malloc(3)/free(3) implementation, if it detects double-free conditions.
The most likely scenario for exploitation is a user forwarding an agent either to an account shared with a malicious user or to a host with an attacker holding root access.
Gigtlab reports:
Remote code execution via unsafe user-controlled markdown rendering options
Simon Kelley reports:
[In configurations where the forwarding server address contains an @ character for specifying a sending interface or source address, the] random source port behavior was disabled, making cache poisoning attacks possible.
This only affects configurations of the form server=1.1.1.1@em0 or server=1.1.1.1@192.0.2.1, i. e. those that specify an interface to send through, or an IP address to send from, or use together with NetworkManager.
minio developer report:
This is a security issue because it enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures.
In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature.
OpenBSD reports:
A TLS client using session resumption may cause a use-after-free.
Chrome Releases reports:
This release includes 5 security fixes, including:
- [1167357] High CVE-2021-21191: Use after free in WebRTC. Reported by raven (@raid_akame) on 2021-01-15
- [1181387] High CVE-2021-21192: Heap buffer overflow in tab groups. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-23
- [1186287] High CVE-2021-21193: Use after free in Blink. Reported by Anonymous on 2021-03-09
Phillip Lougher reports:
Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
The Go project reports:
The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element.
The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with "../".
The Gitea Team reports for release 1.13.3:
- Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one
The Gitea Team reports for release 1.13.4:
- Fix issue popups
Mantis 2.24.4 release reports:
Security and maintenance release, addressing 6 CVEs:
- 0027726: CVE-2020-29603: disclosure of private project name
- 0027727: CVE-2020-29605: disclosure of private issue summary
- 0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and attachments
- 0027361: Private category can be access/used by a non member of a private project (IDOR)
- 0027779: CVE-2020-35571: XSS in helper_ensure_confirmed() calls
- 0026794: User Account - Takeover
- 0027363: Fixed in version can be changed to a version that doesn't exist
- 0027350: When updating an issue, a Viewer user can be set as Reporter
- 0027370: CVE-2020-35849: Revisions allow viewing private bugnotes id and summary
- 0027495: CVE-2020-28413: SQL injection in the parameter "access" on the mc_project_get_users function throught the API SOAP.
- 0027444: Printing unsanitized user input in install.php
Node.js reports:
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)
Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
DNS rebinding in --inspect (CVE-2021-22884)
Affected Node.js versions are vulnerable to a DNS rebinding attack when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.
OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt
Gitlab reports:
JWT token leak via Workhorse
Stored XSS in wiki pages
Group Maintainers are able to use the Group CI/CD Variables API
Insecure storage of GitLab session keys
The Asterisk project reports:
When Asterisk sends a re-invite initiating T.38 faxing and the endpoint responds with a m=image line and zero port, a crash will occur in Asterisk. This is a reoccurrence of AST-2019-004.
Chrome Releases reports:
This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details.
JasPer Releases:
- Fix memory-related bugs in the JPEG-2000 codec resulting from attempting to decode invalid code streams. (#264, #265)
This fix is associated with CVE-2021-26926 and CVE-2021-26927.
- Fix wrong return value under some compilers (#260)
- Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)
SaltStack reports multiple security vulnerabilities in Salt
- CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
- CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.
- CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
- CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.
- CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion
- CVE-2021-3148: command injection in salt.utils.thin.gen_thin()
- CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.
- CVE-2021-3144: eauth Token can be used once after expiration.
- CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack
- CVE-2020-28243: Local Privilege Escalation in the Minion.
vault developers report:
Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.
Due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes.
A process running inside a jail can avoid being killed during jail termination. If a jail is subsequently started with the same root path, a lingering jailed process may be able to exploit the window during which a devfs filesystem is mounted but the jail's devfs ruleset has not been applied, to access device nodes which are ordinarily inaccessible. If the process is privileged, it may be able to escape the jail and gain full access to the system.
Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation.
Unfortunately, when running in HVM/PVH mode, the FreeBSD backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery.
A malicious or buggy frontend driver may be able to cause resource leaks in the domain running the corresponding backend driver.
When a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed.
A process with superuser privileges running inside a jail could change the root directory outside of the jail, thereby gaining full read and writing access to all files and directories in the system.
A regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.
The configuration in login.access(5) may not be applied, permitting login access to users even when the system is configured to deny it.
Redis Development team reports:
Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption.
Jon Siwek of Corelight reports:
Fix ASCII Input reader's treatment of input files containing null-bytes. An input file containing null-bytes could lead to a buffer-over-read, crash Zeek, and be exploited to cause Denial of Service.
Redland Issue Tracker reports:
due to an out of bounds array access in raptor_xml_writer_start_element_common.
Jenkins Security Advisory:
Description
(high) SECURITY-2195 / CVE-2021-22112
Privilege escalation vulnerability in bundled Spring Security library
The Asterisk project reports:
Given a scenario where an outgoing call is placed from Asterisk to a remote SIP server it is possible for a crash to occur.
The Asterisk project reports:
Due to a signedness comparison mismatch, an authenticated WebRTC client could cause a stack overflow and Asterisk crash by sending multiple hold/unhold requests in quick succession.
The Asterisk project reports:
An unauthenticated remote attacker could replay SRTP packets which could cause an Asterisk instance configured without strict RTP validation to tear down calls prematurely.
The Asterisk project reports:
When re-negotiating for T.38 if the initial remote response was delayed just enough Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream then Asterisk would crash.
The Asterisk project reports:
If a registered user is tricked into dialing a malicious number that sends lots of 181 responses to Asterisk, each one will cause a 181 to be sent back to the original caller with an increasing number of entries in the "Supported" header. Eventually the number of entries in the header exceeds the size of the entry array and causes a crash.
Ruby on Rails blog:
Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those version are security releases and addresses two issues:
CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.
CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.
Chrome Releases reports:
This release contains 10 security fixes, including:
- [1138143] High CVE-2021-21149: Stack overflow in Data Transfer. Reported by Ryoya Tsukasaki on 2020-10-14
- [1172192] High CVE-2021-21150: Use after free in Downloads. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29
- [1165624] High CVE-2021-21151: Use after free in Payments. Reported by Khalil Zhani on 2021-01-12
- [1166504] High CVE-2021-21152: Heap buffer overflow in Media. Reported by Anonymous on 2021-01-14
- [1155974] High CVE-2021-21153: Stack overflow in GPU Process. Reported by Jan Ruge of ERNW GmbH on 2020-12-06
- [1173269] High CVE-2021-21154: Heap buffer overflow in Tab Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-01
- [1175500] High CVE-2021-21155: Heap buffer overflow in Tab Strip. Reported by Khalil Zhani on 2021-02-07
- [1177341] High CVE-2021-21156: Heap buffer overflow in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-02-11
- [1170657] Medium CVE-2021-21157: Use after free in Web Sockets. Reported by Anonymous on 2021-01-26
The OpenSSL project reports:
Null pointer deref in X509_issuer_and_serial_hash() CVE-2021-23841
(Moderate) The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.Integer overflow in CipherUpdate CVE-2021-23840
(Low) Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.
Cary Phillips reports:
Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files[...].
Gitlab reports:
Improper Certificate Validation for Fortinet OTP
Denial of Service Attack on gitlab-shell
Resource exhaustion due to pending jobs
Confidential issue titles were exposed
Improper access control allowed demoted project members to access authored merge requests
Improper access control allowed unauthorized users to access analytic pages
Unauthenticated CI lint API may lead to information disclosure and SSRF
Prometheus integration in Gitlab may lead to SSRF
SO-AND-SO reports:
In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect.
Subversion project reports:
Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
The Gitea Team reports for release 1.13.2:
- Prevent panic on fuzzer provided string
- Add secure/httpOnly attributes to the lang cookie
Chrome Releases reports:
[1170176] High CVE-2021-21148: Heap buffer overflow in V8. Reported by Mattias Buelens on 2021-01-24. Google is aware of reports that an exploit for CVE-2021-21148 exists in the wild.
Chrome Releases reports:
This update include 6 security fixes:
- 1169317] Critical CVE-2021-21142: Use after free in Payments. Reported by Khalil Zhani on 2021-01-21
- [1163504] High CVE-2021-21143: Heap buffer overflow in Extensions. Reported by Allen Parker and Alex Morgan of MU on 2021-01-06
- [1163845] High CVE-2021-21144: Heap buffer overflow in Tab Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-01-07
- [1154965] High CVE-2021-21145: Use after free in Fonts. Reported by Anonymous on 2020-12-03
- [1161705] High CVE-2021-21146: Use after free in Navigation. Reported by Alison Huffman and Choongwoo Han of Microsoft Browser Vulnerability Research on 2020-12-24
- [1162942] Medium CVE-2021-21147: Inappropriate implementation in Skia. Reported by Roman Starkov on 2021-01-04
Gitlab reports:
Stored XSS in merge request
Stored XSS in epic's pages
Sensitive GraphQL variables exposed in structured log
Guest user can see tag names in private projects
Information disclosure via error message
DNS rebinding protection bypass
Validate existence of private project
Minio developers report:
Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.
All users are advised to upgrade ASAP.
The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).
In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.
Some OSes (including Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued.
As the queue is unbound, a guest may be able to trigger a OOM in the backend.
Several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. This problem is not present in FreeBSD 11.
Additionally, msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.
Kernel stack disclosures may leak sensitive information which could be used to compromise the security of the system.
The libpng project reports:
pngcheck versions 3.0.0 and earlier have a pair of buffer-overrun bugs related to the sPLT and PPLT chunks (the latter is a MNG-only chunk, but it gets noticed even in PNG files if the -s option is used). Both bugs are fixed in version 3.0.1, released on 24 January 2021. Again, while all known vulnerabilities are fixed in this version, the code is quite crufty, so it would be safest to assume there are still some problems hidden in there. As always, use at your own risk.
Todd C. Miller reports:
When invoked as sudoedit, the same set of command line options are now accepted as for sudo -e. The -H and -P options are now rejected for sudoedit and sudo -e which matches the sudo 1.7 behavior. This is part of the fix for CVE-2021-3156.
Fixed a potential buffer overflow when unescaping backslashes in the command's arguments. Normally, sudo escapes special characters when running a command via a shell (sudo -s or sudo -i). However, it was also possible to run sudoedit with the -s or -i flags in which case no escaping had actually been done, making a buffer overflow possible. This fixes CVE-2021-3156.
pysaml2 Releases:
Fix processing of invalid SAML XML documents - CVE-2021-21238
Fix unspecified xmlsec1 key-type preference - CVE-2021-21239
Jenkins Security Advisory:
Description
(Medium) SECURITY-2197 / CVE-2021-21615
Arbitrary file read vulnerability in workspace browsers
Tavis Ormandy reports:
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
Oracle reports:
This Critical Patch Update contains 34 new security patches for Oracle MySQL Server and 4 for MySQL Client.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 6.8.
Chrome Releases reports:
This release contains 36 security fixes, including:
- [1137179] Critical CVE-2021-21117: Insufficient policy enforcement in Cryptohome. Reported by Rory McNamara on 2020-10-10
- [1161357] High CVE-2021-21118: Insufficient data validation in V8. Reported by Tyler Nighswander (@tylerni7) of Theori on 2020-12-23
- [1160534] High CVE-2021-21119: Use after free in Media. Reported by Anonymous on 2020-12-20
- [1160602] High CVE-2021-21120: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2020-12-21
- [1161143] High CVE-2021-21121: Use after free in Omnibox. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22
- [1162131] High CVE-2021-21122: Use after free in Blink. Reported by Renata Hodovan on 2020-12-28
- [1137247] High CVE-2021-21123: Insufficient data validation in File System API. Reported by Maciej Pulikowski on 2020-10-11
- [1131346] High CVE-2021-21124: Potential user after free in Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23
- [1152327] High CVE-2021-21125: Insufficient policy enforcement in File System API. Reported by Ron Masas (Imperva) on 2020-11-24
- [1163228] High CVE-2020-16044: Use after free in WebRTC. Reported by Ned Williamson of Project Zero on 2021-01-05
- [1108126] Medium CVE-2021-21126: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-07-22
- [1115590] Medium CVE-2021-21127: Insufficient policy enforcement in extensions. Reported by Jasminder Pal Singh, Web Services Point WSP, Kotkapura on 2020-08-12
- [1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink. Reported by Liang Dong on 2020-10-15
- [1140403] Medium CVE-2021-21129: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20
- [1140410] Medium CVE-2021-21130: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20
- [1140417] Medium CVE-2021-21131: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20
- [1128206] Medium CVE-2021-21132: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-09-15
- [1157743] Medium CVE-2021-21133: Insufficient policy enforcement in Downloads. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11
- [1157800] Medium CVE-2021-21134: Incorrect security UI in Page Info. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11
- [1157818] Medium CVE-2021-21135: Inappropriate implementation in Performance API. Reported by ndevtk on 2020-12-11
- [1038002] Low CVE-2021-21136: Insufficient policy enforcement in WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad Mohammed on 2019-12-27
- [1093791] Low CVE-2021-21137: Inappropriate implementation in DevTools. Reported by bobblybear on 2020-06-11
- [1122487] Low CVE-2021-21138: Use after free in DevTools. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-08-27
- [1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported by David Manouchehri on 2020-10-08
- [1140435] Low CVE-2021-21141: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20
Michal Dardas from LogicalTrust reports:
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.
Nokogiri reports:
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.
Simon Kelley reports:
There are broadly two sets of problems. The first is subtle errors in dnsmasq's protections against the chronic weakness of the DNS protocol to cache-poisoning attacks; the Birthday attack, Kaminsky, etc.[...]
the second set of errors is a good old fashioned buffer overflow in dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an installation is at risk.
The Go project reports:
The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running "go get", or any other command that builds code. Only users who build untrusted code (and don't execute it) are affected. In addition to Windows users, this can also affect Unix users who have "." listed explicitly in their PATH and are running "go get" or build commands outside of a module or with module mode disabled.
The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve.
cloud-init reports:
cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4.
Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in sshd_config, cloud-init 20.4 started writing all of these keys to such a file, granting all such keys SSH access as root.
It's worth restating this implication: if you are using the default AuthorizedKeysFile setting in /etc/ssh/sshd_config, as most will be, then you are _not_ affected by this issue.
MoinMoin reports:
Security fix for CVE-2020-25074: fix remote code execution via cache action
Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability
SO-AND-SO reports:
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Node.js reports:
use-after-free in TLSWrap (High) (CVE-2020-8265)
Affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)
Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
iThis is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt.
SO-AND-SO reports:
Ability to steal a user's API access token through GitLab Pages
The wavpack project reports:
src/pack_utils.c - issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738) - sanitize configuration parameters better (improves clarity and aids debugging)
Jenkins Security Advisory:
Description
(Medium) SECURITY-1452 / CVE-2021-21602
Arbitrary file read vulnerability in workspace browsers
(High) SECURITY-1889 / CVE-2021-21603
XSS vulnerability in notification bar
(High) SECURITY-1923 / CVE-2021-21604
Improper handling of REST API XML deserialization errors
(High) SECURITY-2021 / CVE-2021-21605
Path traversal vulnerability in agent names
(Medium) SECURITY-2023 / CVE-2021-21606
Arbitrary file existence check in file fingerprints
(Medium) SECURITY-2025 / CVE-2021-21607
Excessive memory allocation in graph URLs leads to denial of service
(High) SECURITY-2035 / CVE-2021-21608
Stored XSS vulnerability in button labels
(Low) SECURITY-2047 / CVE-2021-21609
Missing permission check for paths with specific prefix
(High) SECURITY-2153 / CVE-2021-21610
Reflected XSS vulnerability in markup formatter preview
(High) SECURITY-2171 / CVE-2021-21611
Stored XSS vulnerability on new item page
phpmyfaq developers report:
phpMyFAQ does not implement sufficient checks to avoid XSS injection for displaying tags.
Todd C. Miller reports:
A potential information leak in sudoedit that could be used to test for the existence of directories not normally accessible to the user in certain circumstances. When creating a new file, sudoedit checks to make sure the parent directory of the new file exists before running the editor. However, a race condition exists if the invoking user can replace (or create) the parent directory. If a symbolic link is created in place of the parent directory, sudoedit will run the editor as long as the target of the link exists.If the target of the link does not exist, an error message will be displayed. The race condition can be used to test for the existence of an arbitrary directory. However, it _cannot_ be used to write to an arbitrary location.
CairoSVG security advisories:
When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).
If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.
Gitlab reports:
Ability to steal a user's API access token through GitLab Pages
Prometheus denial of service via HTTP request with custom method
Unauthorized user is able to access private repository information under specific conditions
Regular expression denial of service in NuGet API
Regular expression denial of service in package uploads
Update curl dependency
CVE-2019-3881 mitigation
Chrome Releases reports:
This release includes 16 security fixes, including:
- [1148749] High CVE-2021-21106: Use after free in autofill. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-11-13
- [1153595] High CVE-2021-21107: Use after free in drag and drop. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-11-30
- [1155426] High CVE-2021-21108: Use after free in media. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-04
- [1152334] High CVE-2021-21109: Use after free in payments. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2020-11-24
- [1152451] High CVE-2021-21110: Use after free in safe browsing. Reported by Anonymous on 2020-11-24
- [1149125] High CVE-2021-21111: Insufficient policy enforcement in WebUI. Reported by Alesandro Ortiz on 2020-11-15
- [1151298] High CVE-2021-21112: Use after free in Blink. Reported by YoungJoo Lee(@ashuu_lee) of Raon Whitehat on 2020-11-20
- [1155178] High CVE-2021-21113: Heap buffer overflow in Skia. Reported by tsubmunu on 2020-12-03
- [1148309] High CVE-2020-16043: Insufficient data validation in networking. Reported by Samy Kamkar, Ben Seri at Armis, Gregory Vishnepolsky at Armis on 2020-11-12
- [1150065] High CVE-2021-21114: Use after free in audio. Reported by Man Yue Mo of GitHub Security Lab on 2020-11-17
- [1157790] High CVE-2020-15995: Out of bounds write in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2020-12-11
- [1157814] High CVE-2021-21115: Use after free in safe browsing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-11
- [1151069] Medium CVE-2021-21116: Heap buffer overflow in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-11-19
Aki Tuomi reports:
When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server.
Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822 (or if parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100.