Gem in a box XSS vulenrability - CVE-2017-14506:

Malicious attacker create GEM file with crafted homepage value (gem.homepage in .gemspec file) includes XSS payload.

The attacker access geminabox system and uploads the gem file (or uses CSRF/SSRF attack to do so).

From now on, any user access Geminabox web server, executes the malicious XSS payload, that will delete any gems on the server, and won't let users use the geminabox anymore. (make victim's browser crash or redirect them to other hosts).

Mozilla Foundation reports:

CVE-2017-5433: Use-after-free in SMIL animation functions

CVE-2017-5435: Use-after-free during transaction processing in the editor

CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2

CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS

CVE-2017-5459: Buffer overflow in WebGL

CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL

CVE-2017-5434: Use-after-free during focus handling

CVE-2017-5432: Use-after-free in text input selection

CVE-2017-5460: Use-after-free in frame selection

CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing

CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing

CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing

CVE-2017-5441: Use-after-free with selection during scroll events

CVE-2017-5442: Use-after-free during style changes

CVE-2017-5464: Memory corruption with accessibility and DOM manipulation

CVE-2017-5443: Out-of-bounds write during BinHex decoding

CVE-2017-5444: Buffer overflow while parsing application/http-index-format content

CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data

CVE-2017-5447: Out-of-bounds read during glyph processing

CVE-2017-5465: Out-of-bounds read in ConvolvePixel

CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor

CVE-2017-5437: Vulnerabilities in Libevent library

CVE-2017-5454: Sandbox escape allowing file system read access through file picker

CVE-2017-5455: Sandbox escape through internal feed reader APIs

CVE-2017-5456: Sandbox escape allowing local file system access

CVE-2017-5469: Potential Buffer overflow in flex-generated code

CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content

CVE-2017-5449: Crash during bidirectional unicode manipulation with animation

CVE-2017-5450: Addressbar spoofing using javascript: URI on Firefox for Android

CVE-2017-5451: Addressbar spoofing with onblur event

CVE-2017-5462: DRBG flaw in NSS

CVE-2017-5463: Addressbar spoofing through reader view on Firefox for Android

CVE-2017-5467: Memory corruption when drawing Skia content

CVE-2017-5452: Addressbar spoofing during scrolling with editable content on Firefox for Android

CVE-2017-5453: HTML injection into RSS Reader feed preview page through TITLE element

CVE-2017-5458: Drag and drop of javascript: URLs can allow for self-XSS

CVE-2017-5468: Incorrect ownership model for Private Browsing information

CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1

CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1

Mozilla Foundation reports:

CVE-2017-5472: Use-after-free using destroyed node when regenerating trees

CVE-2017-7749: Use-after-free during docshell reloading

CVE-2017-7750: Use-after-free with track elements

CVE-2017-7751: Use-after-free with content viewer listeners

CVE-2017-7752: Use-after-free with IME input

CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object

CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files

CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors

CVE-2017-7757: Use-after-free in IndexedDB

CVE-2017-7778: Vulnerabilities in the Graphite 2 library

CVE-2017-7758: Out-of-bounds read in Opus encoder

CVE-2017-7759: Android intent URLs can cause navigation to local file system

CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service

CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application

CVE-2017-7762: Addressbar spoofing in Reader mode

CVE-2017-7763: Mac fonts render some unicode characters as spaces

CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks

CVE-2017-7765: Mark of the Web bypass when saving executable files

CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service

CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service

CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service

CVE-2017-5471: Memory safety bugs fixed in Firefox 54

CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2

The Fuzzing Project reports:

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Google reports:

A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.

Ruby blog:

CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf

If a malicious format string which contains a precious specifier (*) is passed and a huge minus value is also passed to the specifier, buffer underrun may be caused. In such situation, the result may contains heap, or the Ruby interpreter may crash.

CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick

When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject malicious escape sequences to the log and dangerous control characters may be executed on a victim?s terminal emulator.

This vulnerability is similar to a vulnerability already fixed, but it had not been fixed in the Basic authentication.

CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode

If a malicious string is passed to the decode method of OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.

CVE-2017-14064: Heap exposure vulnerability in generating JSON

The generate method of JSON module optionally accepts an instance of JSON::Ext::Generator::State class. If a malicious instance is passed, the result may include contents of heap.

The Asterisk project reports:

This is a follow up advisory to AST-2017-005.

Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

The RTP stream qualification to learn the source address of media always accepted the first RTP packet as the new source and allowed what AST-2017-005 was mitigating. The intent was to qualify a series of packets before accepting the new source address.

The RTP/RTCP stack will now validate RTCP packets before processing them.

GitLab reports:

Cross-Site Scripting (XSS) vulnerability in profile names

An external security audit performed by Madison Gurkha disclosed a Cross-Site Scripting (XSS) vulnerability in user names that could be exploited in several locations.

Open Redirect in go-get middleware

Tim Goddard via HackerOne reported that GitLab was vulnerable to an open redirect vulnerability caused when a specific flag is passed to the go-get middleware. This vulnerability could also possibly be used to conduct Cross-Site Scripting attacks.

Race condition in project uploads

Jobert Abma from HackerOne reported that GitLab was vulnerable to a race condition in project uploads. While very difficult to exploit this race condition could potentially allow an attacker to overwrite a victim's uploaded project if the attacker can guess the name of the uploaded file before it is extracted.

Cross-Site Request Forgery (CSRF) token leakage

naure via HackerOne reported that GitLab was vulnerable to CSRF token leakage via improper filtering of external URLs in relative URL creation. A specially crafted link configured in a project's environments settings could be used to steal a visiting user's CSRF token.

Potential project disclosure via project deletion bug

An internal code review discovered that removed projects were not always being deleted from the file system. This could allow an attacker who knew the full path to a previously deleted project to steal a copy of the repository. These releases prevent the leftover repository from being accessed when creating a new project. The project deletion bug will be fixed in a later release.

White-listed style attribute for table contents in MD enables UI redressing

An external security audit performed by Recurity-Labs discovered a UI redressing vulnerability in the GitLab markdown sanitization library.

DOM clobbering in sanitized MD causes errors

An external security audit performed by Recurity-Labs discovered a DOM clobbering vulnerability in the GitLab markdown sanitization library that could be used to render project pages unreadable.

Nokogiri vendored libxslt library vulnerable to potential integer overflow (CVE-2017-5029 and CVE-2016-4738)

The bundled Nokogiri library has been updated to patch an integer overflow vulnerability. Details are available in the Nokogiri issue.

Security risk in recommended Geo configuration could give all users access to all repositories

An internal code review discovered that GitLab Geo instances could be vulnerable to an attack that would allow any user on the primary Geo instance to clone any repository on a secondary Geo instance.

GitLab Pages private certificate disclosure via symlinks

An external security review conducted by Recurity-Labs discovered a vulnerability in GitLab Pages that could be used to disclose the contents of private SSL keys.

Paul Eggert reports:

Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.

When Emacs renders MIME text/enriched data (Internet RFC 1896), it is vulnerable to arbitrary code execution. Since Emacs-based mail clients decode "Content-Type: text/enriched", this code is exploitable remotely. This bug affects GNU Emacs versions 19.29 through 25.2.

Adobe reports:

• These updates resolve memory corruption vulnerabilities that could lead to remote code execution (CVE-2017-11281, CVE-2017-11282).

Cyrus IMAP 3.0.4 Release Notes states:

Fixed Issue #2132: Broken "Other Users" behaviour

Django blog:

In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

Google Chrome releases reports:

22 security fixes in this release, including:

• [737023] High CVE-2017-5111: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-06-27
• [740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by Tobias Klein on 2017-07-10
• [747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by Anonymous on 2017-07-20
• [752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-08-07
• [744584] High CVE-2017-5115: Type confusion in V8. Reported by Marco Giovannini on 2017-07-17
• [759624] High CVE-2017-5116: Type confusion in V8. Reported by Anonymous on 2017-08-28
• [739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by Tobias Klein on 2017-07-04
• [747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24
• [725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by Anonymous on 2017-05-22
• [718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by Xiaoyin Liu on 2017-05-05
• [762099] Various fixes from internal audits, fuzzing and other initiatives

TALOS reports:

• An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality.

• An exploitable heap-overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality.

The Asterisk project reports:

AST-2017-005 - A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected the new code allowed a new source address to be learned at all times.

AST-2017-006 - The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

The Asterisk project reports:

A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.

GnuPG reports:

Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".

CVE Details reports:

• There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).
• There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).
• There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).
• There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).
• There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).
• There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).

Official blog of RubyGems reports:

The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files.

chbi reports:

an authenticated standard user could reset the password of another user (including admin) by altering form data.

Poppler developers report:

Poppler is prone to a stack-based buffer-overflow vulnerability.

Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

PHPMailer reports:

Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

PowerDNS Security Advisory reports:

The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website.

SaltStack reports:

Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com

SquirrelMail developers report:

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server.

Tobias Mueller reports:

libsoup is susceptible to a stack based buffer overflow attack when using chunked encoding. Regardless of libsoup being used as a server or client.

Drupal Security Team:

CVE-2017-6923: Views - Access Bypass - Moderately Critical

CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica

CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical

mitre reports:

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

GitLab reports:

Projects in subgroups authorization bypass with SQL wildcards (CVE-2017-11438)

An internal code review disclosed that by choosing a namespace with underscores an authenticated user could take advantage of a badly written SQL query to add themselves to any project inside a subgroup with permissions of their choice.

This vulnerability was caused by a SQL query that automatically adjusts project permissions but does not escape wildcards. This vulnerability was coincidentally patched when the affected code was rewritten for 9.3. Therefore, versions 9.3 and above are not vulnerable.



This issue has been assigned CVE-2017-11438.



Note: GitLab-CE+EE 8.17 is not vulnerable to this issue, however patches have been included to improve the security of the SQL queries in 8.17.7.

Symlink cleanup from a previous security release

The 9.2.5 security release contained a fix for a data corruption vulnerability involving file uploads. This fix utilized symlinks to migrate file uploads to a new directory. Due to a typo in the included migration a symlink was accidentally left behind after the migration finished. This symlink can cause problems with instance backups. A fix is included with these releases to remove the problematic symlink.

Accidental or malicious use of reserved names in group names could cause deletion of all snippet uploads

The 9.2.5 security release contained a fix for a data corruption vulnerability involving file uploads. After the release of 9.2.5 an internal code review determined that the recently introduced snippet file uploads feature was also vulnerable to file deletion. Snippet uploads have now been moved into the protected system namespace.

Project name leak on todos page

An internal code review discovered that forceful browsing could be utilized to disclose the names of private projects.

Denial of Service via regular expressions in CI process

Lukas Svoboda reported that regular expressions (regex) included with CI scripts could be utilized to perform a denial-of-service attack on GitLab instances. GitLab now uses the re2 Regex library to limit regex execution time.

Issue title leakage when external issue tracker is enabled

An internal code review determined that when an external issue tracker is configured it was possible to discover the titles of all issues in a given GitLab instance, including issues in private projects and confidential issues.

mnaberez reports:

supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.

This vulnerability can only be exploited by an authenticated client or if supervisord has been configured to run an HTTP server without authentication. If authentication has not been enabled, supervisord will log a message at the critical level every time it starts.

Guido Vranken reports:

Multiple vulnerabilities found via fuzzing: FR-GV-201 (v2,v3) Read / write overflow in make_secret() FR-GV-202 (v2) Write overflow in rad_coalesce() FR-GV-203 (v2) DHCP - Memory leak in decode_tlv() FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode() FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options() FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 FR-GV-207 (v2) Zero-length malloc in data2vp() FR-GV-301 (v3) Write overflow in data2vp_wimax() FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() FR-GV-305 (v3) Decode 'signed' attributes correctly FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data FR-AD-002 (v3) String lifetime issues in rlm_python FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare

Mercurial Release Notes:

CVE-2017-1000115

Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository.

CVE-2017-1000116

Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with -oProxyCommand. This is also present in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800), so please patch those tools as well if you have them installed.

Oracle reports:

• Reserved [CVE-2017-3629]
• A remote user can exploit a flaw in the Server: Memcached component to partially modify data and cause denial of service conditions [CVE-2017-3633].
• A remote authenticated user can exploit a flaw in the Server: DML component to cause denial of service conditions [CVE-2017-3634].
• A remote authenticated user can exploit a flaw in the Connector/C component to cause denial of service conditions [CVE-2017-3635].
• A remote authenticated user can exploit a flaw in the C API component to cause denial of service conditions [CVE-2017-3635].
• A local user can exploit a flaw in the Client programs component to partially access data, partially modify data, and partially deny service [CVE-2017-3636].
• A remote authenticated user can exploit a flaw in the Server: UDF component to cause denial of service conditions [CVE-2017-3529].
• A remote authenticated user can exploit a flaw in the X Plugin component to cause denial of service conditions [CVE-2017-3637].
• A remote authenticated user can exploit a flaw in the Server: DML component to cause denial of service conditions [CVE-2017-3639, CVE-2017-3640, CVE-2017-3641, CVE-2017-3643, CVE-2017-3644].
• A remote authenticated user can exploit a flaw in the Server: Optimizer component to cause denial of service conditions [CVE-2017-3638, CVE-2017-3642, CVE-2017-3645].
• A remote authenticated user can exploit a flaw in the X Plugin component to cause denial of service conditions [CVE-2017-3646].
• A remote authenticated user can exploit a flaw in the Server: Charsets component to cause denial of service conditions [CVE-2017-3648].
• A remote authenticated user can exploit a flaw in the Server: Replication component to cause denial of service conditions [CVE-2017-3647, CVE-2017-3649].
• A remote authenticated user can exploit a flaw in the Client mysqldump component to partially modify data [CVE-2017-3651].
• A remote authenticated user can exploit a flaw in the Server: DDL component to partially access and partially modify data [CVE-2017-3652].
• A remote user can exploit a flaw in the C API component to partially access data [CVE-2017-3650].
• A remote authenticated user can exploit a flaw in the Server: DDL component to partially modify data [CVE-2017-3653].

subversion team reports:

A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument.

A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.

The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.

An exploit has been tested.

GitLab reports:

Remote Command Execution in git client

An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command line arguments in URLs using the SSH protocol before invoking the SSH client. A specially crafted URL could be used to execute arbitrary shell commands on the GitLab server.

To fully patch this vulnerability two fixes were needed. The Omnibus versions of GitLab contain a patched git client. For source users who may still be running an older version of git, GitLab now also blocks import URLs containing invalid host and usernames.

This issue has been assigned CVE-2017-12426.

Improper sanitization of GitLab export files on import

GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a patch for a critical directory traversal vulnerability in the GitLab export feature that could be exploited by including symlinks in the export file and then re-importing it to a GitLab instance. This vulnerability was patched by checking for and removing symlinks in these files on import.

Recurity-Labs also determined that this fix did not properly remove symlinks for hidden files. Though not as dangerous as the original vulnerability hidden file symlinks could still be used to steal copies of git repositories belonging to other users if the path to the git repository was known by the attacker. An updated fix has been included in these releases that properly removes all symlinks.

This import option was not made available to non-admin users until GitLab 8.13.0.

Adobe reports:

• These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3085).
• These updates resolve type confusion vulnerability that could lead to remote code execution (CVE-2017-3106).

The PostgreSQL project reports:

• CVE-2017-7546: Empty password accepted in some authentication methods
• CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
• CVE-2017-7548: lo_put() function ignores ACLs

Mark Thomas reports:

CVE-2016-3092 is a denial of service vulnerability that has been corrected in the Apache Commons FileUpload component. It occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if the boundary length was the typical tens of bytes.

The cURL project reports:

• FILE buffer read out of bounds

  When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers.

  The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed.

  The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory.

• TFTP sends more than buffer size

  When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer.

  A malicious HTTP(S) server could redirect a vulnerable libcurl- using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

• URL globbing out of bounds read

  curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers.

  In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing.

  An example of a URL that triggers the flaw would be http://ur%20[0-60000000000000000000.

Apache Axis2 reports:

The commons-fileupload dependency has been updated to a version that fixes CVE-2016-1000031 (AXIS2-5853).

Mozilla Foundation reports:

CVE-2017-7798: XUL injection in the style editor in devtools

CVE-2017-7800: Use-after-free in WebSockets during disconnection

CVE-2017-7801: Use-after-free with marquee during window resizing

CVE-2017-7784: Use-after-free with image observers

CVE-2017-7802: Use-after-free resizing image elements

CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM

CVE-2017-7786: Buffer overflow while painting non-displayable SVG

CVE-2017-7806: Use-after-free in layer manager with SVG

CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements

CVE-2017-7787: Same-origin policy bypass with iframes through page reloads

CVE-2017-7807: Domain hijacking through AppCache fallback

CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID

CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher

CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts

CVE-2017-7808: CSP information leak with frame-ancestors containing paths

CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections

CVE-2017-7781: Elliptic curve point addition error when using mixed Jacobian-affine coordinates

CVE-2017-7794: Linux file truncation via sandbox broker

CVE-2017-7803: CSP containing 'sandbox' improperly applied

CVE-2017-7799: Self-XSS XUL injection in about:webrtc

CVE-2017-7783: DOS attack through long username in URL

CVE-2017-7788: Sandboxed about:srcdoc iframes do not inherit CSP directives

CVE-2017-7789: Failure to enable HSTS when two STS headers are sent for a connection

CVE-2017-7790: Windows crash reporter reads extra memory for some non-null-terminated registry values

CVE-2017-7796: Windows updater can delete any file named update.log

CVE-2017-7797: Response header name interning leaks across origins

CVE-2017-7780: Memory safety bugs fixed in Firefox 55

CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

phk reports:

A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert.

Google Chrome releases reports:

40 security fixes in this release, including:

• [728887] High CVE-2017-5091: Use after free in IndexedDB. Reported by Ned Williamson on 2017-06-02
• [733549] High CVE-2017-5092: Use after free un PPAPI. Reported by Yu Zhou, Yuan Deng of Ant-financial Light-Year Security Lab on 2017-06-15
• [550017] High CVE-2017-5093: UI spoofing in Blink. Reported by Luan Herrera on 2015-10-31
• [702946] High CVE-2017-5094: Type confusion in extensions. Reported by Anonymous on 2017-03-19
• [732661] High CVE-2017-5095: Out-of-bounds write in PDFium. Reported by Anonymous on 2017-06-13
• [714442] High CVE-2017-5096: User information leak via Android intents. Reported by Takeshi Terada on 2017-04-23
• [740789] High CVE-2017-5097: Out-of-bounds read in Skia. Reported by Anonymous on 2017-07-11
• [740803] High CVE-2017-5098: Use after free in V8. Reported by Jihoon Kim on 2017-07-11
• [733548] High CVE-2017-5099: Out-of-bounds write in PPAPI. Reported by Yuan Deng, Yu Zhou of Ant-financial Light-Year Security Lab on 2017-06-15
• [718292] Medium CVE-2017-5100: Use after free in Chrome Apps. Reported by Anonymous on 2017-05-04
• [681740] Medium CVE-2017-5101: URL spoofing in OmniBox. Reported by Luan Herrera on 2017-01-17
• [727678] Medium CVE-2017-5102: Uninitialized use in Skia. Reported by Anonymous on 2017-05-30
• [726199] Medium CVE-2017-5103: Uninitialized use in Skia. Reported by Anonymous on 2017-05-25
• [729105] Medium CVE-2017-5104: UI spoofing in browser. Reported by Khalil Zhani on 2017-06-02
• [742407] Medium CVE-2017-7000: Pointer disclosure in SQLite. Reported by Chaitin Security Research Lab working with Trend Micro's Zero Day Initiative
• [729979] Low CVE-2017-5105: URL spoofing in OmniBox. Reported by Rayyan Bijoora on 2017-06-06
• [714628] Medium CVE-2017-5106: URL spoofing in OmniBox. Reported by Jack Zac on 2017-04-24
• [686253] Low CVE-2017-5107: User information leak via SVG. Reported by David Kohlbrenner of UC San Diego on 2017-01-27
• [695830] Low CVE-2017-5108: Type of confusion in PDFium. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-02-24
• [710400] Low CVE-2017-5109: UI spoofing in browser. Reported by Jose Maria Acunia Morgado on 2017-04-11
• [717476] Low CVE-2017-5110: UI spoofing in payments dialog. Reported by xisigr of Tencent's Xuanwu Lab on 2017-05-02
• [748565] Various fixes from internal audits, fuzzing and other initiatives

kimiizhang reports:

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

NVD reports:

ProFTPD ... controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link.

SecurityFocus reports:

JabberD is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.

The Webkit gtk team reports:

CVE-2017-7006: Versions affected: WebKitGTK+ before 2.16.2.

Credit to David Kohlbrenner of UC San Diego, an anonymous researcher.

Impact: A malicious website may exfiltrate data cross-origin. Description: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.

CVE-2017-7011: Versions affected: WebKitGTK+ before 2.16.3.

Credit to xisigr of Tencent?s Xuanwu Lab (tencent.com).

Impact: Visiting a malicious website may lead to address bar spoofing. Description: A state management issue was addressed with improved frame handling.

CVE-2017-7012: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Apple.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7018: Versions affected: WebKitGTK+ before 2.16.6.

Credit to lokihardt of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7019: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Zhiyang Zeng of Tencent Security Platform Department.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7020: Versions affected: WebKitGTK+ before 2.16.1.

Credit to likemeng of Baidu Security Lab.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7030: Versions affected: WebKitGTK+ before 2.16.6.

Credit to chenqin of Ant-financial Light-Year Security Lab (?????????????).

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7034: Versions affected: WebKitGTK+ before 2.16.6.

Credit to chenqin of Ant-financial Light-Year Security Lab (?????????????).

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7037: Versions affected: WebKitGTK+ before 2.16.6.

Credit to lokihardt of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7038: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Neil Jenkins of FastMail Pty Ltd, Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security.

Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.

CVE-2017-7039: Versions affected: WebKitGTK+ before 2.16.6.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7040: Versions affected: WebKitGTK+ before 2.16.3.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7041: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7042: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7043: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7046: Versions affected: WebKitGTK+ before 2.16.6.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7048: Versions affected: WebKitGTK+ before 2.16.6.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7049: Versions affected: WebKitGTK+ before 2.16.2.

Credit to Ivan Fratric of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.

CVE-2017-7052: Versions affected: WebKitGTK+ before 2.16.4.

Credit to cc working with Trend Micro?s Zero Day Initiative.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7055: Versions affected: WebKitGTK+ before 2.16.6.

Credit to The UK?s National Cyber Security Centre (NCSC).

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7056: Versions affected: WebKitGTK+ before 2.16.6.

Credit to lokihardt of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7059: Versions affected: WebKitGTK+ before 2.16.3.

Credit to an anonymous researcher.

Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.

CVE-2017-7061: Versions affected: WebKitGTK+ before 2.16.6.

Credit to lokihardt of Google Project Zero.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7064: Versions affected: WebKitGTK+ before 2.16.6.

Credit to lokihardt of Google Project Zero.

Impact: An application may be able to read restricted memory. Description: A memory initialization issue was addressed through improved memory handling.

Senrio reports:

Genivia gSOAP is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

A remote attacker may exploit this issue to execute arbitrary code in the context of the affected device. Failed attempts will likely cause a denial-of-service condition.

marcinguy reports:

After sending this payload, collectd seems to be entering endless while() loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.

strongSwan security team reports:

• RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception. [CVE-2017-9022]
• ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate.

kimiizhang reports:

Cross-site scripting (XSS) vulnerability in link.php in Cacti

1.1.12 allows remote anonymous users to inject arbitrary web

script or HTML via the id parameter.

GNOME reports:

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.

The same vulnerabilty affects atril, the Evince fork.

The Apache httpd project reports:

important: Read after free in mod_http2 (CVE-2017-9789)

When under stress, closing many connections, the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.

important: Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788)

The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by mod_auth_digest.

Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault.

Adobe reports:

• These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3080).
• These updates resolve memory corruption vulnerability that could lead to remote code execution (CVE-2017-3099).
• These updates resolve memory corruption vulnerability that could lead to memory address disclosure (CVE-2017-3100).

Updates are now available for all active Node.js release lines as well as the 7.x line. These include the fix for the high severity vulnerability identified in the initial announcement, one additional lower priority Node.js vulnerability in the 4.x release line, as well as some lower priority fixes for Node.js dependencies across the current release lines.

Constant Hashtable Seeds (CVE pending)

Node.js was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. Thanks to Jann Horn of Google Project Zero for reporting this vulnerability.

This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.

http.get with numeric authorization options creates uninitialized buffers

Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string.

This is a low severity defect and only applies to the 4.x release line.

The samba project reports:

A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by returning malicious replication or authorization data.

Maxim Dounin reports:

A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).

irssi reports:

When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.

While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table.

The CodeIgniter changelog reports:

Form Validation Library rule valid_email could be bypassed if idn_to_ascii() is available.

the PHP project reports:

• A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer (CVE-2017-9224).
• A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption (CVE-2017-9226).
• A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer (CVE-2017-9227).
• A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption (CVE-2017-9228).
• A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition (CVE-2017-9228).

Drupal Security Team Reports:

CVE-2017-6920: PECL YAML parser unsafe object handling.

CVE-2017-6921: File REST resource does not properly validate

CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users.

Matt Johnston reports:

Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user.

Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys.

The smarty project reports:

bugfix {math} shell injection vulnerability

The Tor Project reports:

Tor 0.3.0.9 fixes a path selection bug that would allow a client to use a guard that was in the same network family as a chosen exit relay. This is a security regression; all clients running earlier versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or 0.3.1.4-alpha.

GitLab reports:

Cross-Site Scripting (XSS) vulnerability when editing comments

A GitLab.com user reported that recent changes to Markdown rendering designed to improve performance by allowing comments to be rendered client-side opened a persistent Cross-Site Scripting (XSS) vulnerability when comments are edited and then re-saved. This vulnerability is difficult to exploit because a victim must be tricked into editing and then saving another user's comment.

API vulnerable to embedding in iFrames using Session Auth

A tip from a Twitter user led to an internal code audit that discovered a malicious website could embed a GitLab API URL inside an iFrame, possibly tricking a user into thinking that the website had access to the user's GitLab user information. This attack would not disclose the user's data to the malicious website, but it could cause confusion and the API has added an X-Frame-Options header to prevent content from the API being included in iFrames.

Accidental or malicious use of reserved names in group names could cause deletion of all project avatars

A GitLab.com user reported that creating a group named project and then renaming the group would cause all project avatars to be deleted. This was due to an improperly constructed path variable when renaming files. To help prevent this from happening again all avatar uploads have been moved from /public/uploads/(user|group|project) to /public/uploads/system/(user|group|project) and system has been made a reserved namespace. A migration included with this release will rename any existing top-level system namespace to be system0 (or system1, system2, etc.)

Unauthenticated disclosure of usernames in autocomplete controller

HackerOne reporter Evelyn Lee reported that usernames could be enumerated using the autocomplete/users.json endpoint without authenticating. This could allow an unauthenticated attacker to gather a list of all valid usernames from a GitLab instance.

Information leakage with references to private project snippets

GitLab.com user Patrick Fiedler reported that titles of private project snippets could leak when they were referenced in other issues, merge requests, or comments.

Elasticsearch does not implement external user checks correctly

An internal code review discovered that on instances with Elasticsearch enabled GitLab allowed external users to view internal project data. This could unintentionally expose sensitive information to external users. This vulnerability only affects EE installations with Elasticsearch enabled.

GnuPG reports:

Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".

Michael J Rubinsky reports:

The second vulnerability (CVE-2017-9773) is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the "Null" image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL.

Qualsys reports:

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.

Samuli Seppänen reports:

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities:

• Remotely-triggerable ASSERT() on malformed IPv6 packet
• Pre-authentication remote crash/information disclosure for clients
• Potential double-free in --x509-alt-username
• Remote-triggerable memory leaks
• Post-authentication remote DoS when using the --x509-track option
• Null-pointer dereference in establish_http_proxy_passthru()

Michael J Rubinsky reports:

The fist vulnerability (CVE-2017-9774) is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server.

The Apache httpd project reports:

• ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):
  
  Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
• mod_ssl Null Pointer Dereference (CVE-2017-3169):
  
  mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
• mod_http2 Null Pointer Dereference (CVE-2017-7659):
  
  A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process.
• ap_find_token() Buffer Overread (CVE-2017-7668):
  
  The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
• mod_mime Buffer Overread (CVE-2017-7679):
  
  mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.

Google Chrome releases reports:

5 security fixes in this release, including:

• [725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by Ned Williamson on 2017-05-22
• [729991] High CVE-2017-5088: Out of bounds read in V8. Reported by Xiling Gong of Tencent Security Platform Department on 2017-06-06
• [714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by Michal Bentkowski on 2017-04-21
• [732498] Various fixes from internal audits, fuzzing and other initiatives

BestPractical reports:

RT 4.0.0 and above are vulnerable to an information leak of cross-site request forgery (CSRF) verification tokens if a user visits a specific URL crafted by an attacker. This vulnerability is assigned CVE-2017-5943. It was discovered by a third-party security researcher.

RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack if an attacker uploads a malicious file with a certain content type. Installations which use the AlwaysDownloadAttachments config setting are unaffected. This fix addresses all existant and future uploaded attachments. This vulnerability is assigned CVE-2016-6127. This was responsibly disclosed to us first by Scott Russo and the GE Application Security Assessment Team.

One of RT's dependencies, a Perl module named Email::Address, has a denial of service vulnerability which could induce a denial of service of RT itself. We recommend administrators install Email::Address version 1.908 or above, though we additionally provide a new workaround within RT. Tss vulnerability was assigned CVE-2015-7686. This vulnerability's application to RT was brought to our attention by Pali Rohár.

RT 4.0.0 and above are vulnerable to timing side-channel attacks for user passwords. By carefully measuring millions or billions of login attempts, an attacker could crack a user's password even over the internet. RT now uses a constant-time comparison algorithm for secrets to thwart such attacks. This vulnerability is assigned CVE-2017-5361. This was responsibly disclosed to us by Aaron Kondziela.

RT's ExternalAuth feature is vulnerable to a similar timing side-channel attack. Both RT 4.0/4.2 with the widely-deployed RT::Authen::ExternalAuth extension, as well as the core ExternalAuth feature in RT 4.4 are vulnerable. Installations which don't use ExternalAuth, or which use ExternalAuth for LDAP/ActiveDirectory authentication, or which use ExternalAuth for cookie-based authentication, are unaffected. Only ExternalAuth in DBI (database) mode is vulnerable.

RT 4.0.0 and above are potentially vulnerable to a remote code execution attack in the dashboard subscription interface. A privileged attacker can cause unexpected code to be executed through carefully-crafted saved search names. Though we have not been able to demonstrate an actual attack owing to other defenses in place, it could be possible. This fix addresses all existant and future saved searches. This vulnerability is assigned CVE-2017-5944. It was discovered by an internal security audit.

RT 4.0.0 and above have misleading documentation which could reduce system security. The RestrictLoginReferrer config setting (which has security implications) was inconsistent with its implementation, which checked for a slightly different variable name. RT will now check for the incorrect name and produce an error message. This was responsibly disclosed to us by Alex Vandiver.

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn't use two slashes following the colon, or

2. is told that file is the default scheme to use for URLs without scheme

... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.

We are not aware of any exploit of this flaw.

Adobe reports:

• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).

Roundcube reports:

Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Joseph Bisch reports:

When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer.

When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory.

The GnuTLS project reports:

It was found using the TLS fuzzer tools that decoding a status response TLS extension with valid contents could lead to a crash due to a null pointer dereference. The issue affects GnuTLS server applications.

Google Chrome releases reports:

30 security fixes in this release, including:

• [722756] High CVE-2017-5070: Type confusion in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-05-16
• [715582] High CVE-2017-5071: Out of bounds read in V8. Reported by Choongwood Han on 2017-04-26
• [709417] High CVE-2017-5072: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-04-07
• [716474] High CVE-2017-5073: Use after free in print preview. Reported by Khalil Zhani on 2017-04-28
• [700040] High CVE-2017-5074: Use after free in Apps Bluetooth. Reported by anonymous on 2017-03-09
• [678776] Medium CVE-2017-5075: Information leak in CSP reporting. Reported by Emmanuel Gil Peyrot on 2017-01-05
• [722639] Medium CVE-2017-5086: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-05-16
• [719199] Medium CVE-2017-5076: Address spoofing in Omnibox. Reported by Samuel Erb on 2017-05-06
• [716311] Medium CVE-2017-5077: Heap buffer overflow in Skia. Reported by Sweetchip on 2017-04-28
• [711020] Medium CVE-2017-5078: Possible command injection in mailto handling. Reported by Jose Carlos Exposito Bueno on 2017-04-12
• [713686] Medium CVE-2017-5079: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-20
• [708819] Medium CVE-2017-5080: Use after free in credit card autofill. Reported by Khalil Zhani on 2017-04-05
• [672008] Medium CVE-2017-5081: Extension verification bypass. Reported by Andrey Kovalev of Yandex Security Team on 2016-12-07
• [721579] Low CVE-2017-5082: Insufficient hardening in credit card editor. Reported by Nightwatch Cybersecurity Research on 2017-05-11
• [714849] Low CVE-2017-5083: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-24
• [692378] Low CVE-2017-5085: Inappropriate javascript execution on WebUI pages. Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15
• [729639] Various fixes from internal audits, fuzzing and other initiatives

RedHat security team reports:

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.

Stefan Winter reports:

The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

The duo security team reports:

An untrusted user may be able to set the http_proxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success.

Viktor Dukhovni reports:

Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. (CVE-2017-6594)

GitLab reports:

Information Disclosure in Issue and Merge Request Trackers

During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to disclose that user's private token, email token, email address, and encrypted OTP secret. Reporter-level access to a GitLab project is required to exploit this flaw.

SSRF when importing a project from a Repo by URL

GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services that are bound to the local interface of the server. These services often do not require authentication. Depending on the service an attacker might be able craft an attack using the project import request URL.

Links in Environments tab vulnerable to tabnabbing

edio via HackerOne reported that user-configured Environment links include target=_blank but do not also include rel: noopener noreferrer. Anyone clicking on these links may therefore be subjected to tabnabbing attacks where a link back to the requesting page is maintained and can be manipulated by the target server.

Accounts with email set to "Do not show on profile" have addresses exposed in public atom feed

Several GitLab users reported that even with "Do not show on profile" configured for their email addresses those addresses were still being leaked in Atom feeds if they commented on a public project.

GitLab reports:

Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types

Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new project import view for gitlab_project import types. This XSS vulnerability was caused by the use of Hamlit filters inside HAML views without manually escaping HTML. Unlike content outside of a filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) is not automatically escaped.

Cross-Site Scripting (XSS) vulnerability in git submodule support

Jobert Abma from HackerOne reported a persistent XSS vulnerability in the GitLab repository files view that could be exploited by injecting malicious script into a git submodule.

Cross-Site Scripting (XSS) vulnerability in repository "new branch" view

A GitLab user reported a persistent XSS vulnerability in the repository new branch view that allowed malicious branch names or git references to execute arbitrary Javascript.

Cross-Site Scripting (XSS) vulnerability in mirror errors display

While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters.

Potential XSS vulnerability in DropLab

An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future.

Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files

edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.

The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable.

Unauthorized disclosure of wiki pages in search

M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects.

External users can view internal snippets

Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets.

Subgroup visibility for private subgroups under a public parent group

Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public.

• CVE-2017-5506: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
• CVE-2017-5507: Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
• CVE-2017-5508: Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
• CVE-2017-5509: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
• CVE-2017-5510: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
• CVE-2017-5511: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
• CVE-2017-6497: An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).
• CVE-2017-6498: An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
• CVE-2017-6499: An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).
• CVE-2017-6500: An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.
• CVE-2017-6501: An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.
• CVE-2017-6502: An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).
• CVE-2017-7275: The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.
• CVE-2017-7606: coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
• CVE-2017-7619: In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.
• CVE-2017-7941: The ReadSGIImage function in sgi.c allows remote attackers to consume an amount of available memory via a crafted file.
• CVE-2017-7942: The ReadAVSImage function in avs.c allows remote attackers to consume an amount of available memory via a crafted file.
• CVE-2017-7943: The ReadSVGImage function in svg.c allows remote attackers to consume an amount of available memory via a crafted file.
• CVE-2017-8343: ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8344: ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file. The ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8345: ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8346: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8347: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8348: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8349: ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8350: ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8351: ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8352: ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8353: ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8354: ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8355: ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8356: ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8357: ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-8765: The function named ReadICONImage in coders\icon.c has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file.
• CVE-2017-8830: ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.
• CVE-2017-9141: A crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
• CVE-2017-9142: A crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
• CVE-2017-9143: ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.
• CVE-2017-9144: A crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.

Problem Description:

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6464]

A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. [CVE-2017-6462]

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6463]

A vulnerability was found in NTP, affecting the origin timestamp check function. [CVE-2016-9042]

Impact:

A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. [CVE-2017-6463, CVE-2017-6464]

A malicious device could send crafted messages, causing ntpd to crash. [CVE-2017-6462]

An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service. [CVE-2016-9042]

Problem Description:

ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed).

Impact:

Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.

The OpenSSL project reports:

• Truncated packet could crash via OOB read (CVE-2017-3731)
  
  Severity: Moderate
  
  If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash.
• Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
  
  Severity: Moderate
  
  If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
• BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
  
  Severity: Moderate
  
  There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.
• Montgomery multiplication may produce incorrect results (CVE-2016-7055)
  
  Severity: Low
  
  There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. (OpenSSL 1.0.2 only)
  
  This issue was previously fixed in 1.1.0c

Check Point research team reports:

Remote code execution via crafted subtitles

Brandon Perry reports:

[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).

• CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
• CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
• CVE-2017-9112 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
• CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
• CVE-2017-9114 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
• CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
• CVE-2017-9116 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.

The samba project reports:

Remote code execution from a writable share.

All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges.

Tintinweb reports:

An integer signedness error was found in miniupnp's miniwget allowing an unauthenticated remote entity typically located on the local network segment to trigger a heap corruption or an access violation in miniupnp's http response parser when processing a specially crafted chunked-encoded response to a request for the xml root description url.

WordPress versions 4.7.4 and earlier are affected by six security issues

• Insufficient redirect validation in the HTTP class.
• Improper handling of post meta data values in the XML-RPC API.
• Lack of capability checks for post meta data in the XML-RPC API.
• A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.
• A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.

The Asterisk project reports:

A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By overrunning the buffer, the memory allocation table becomes corrupted, leading to an eventual crash.

The multi-part body parser in PJSIP contains a logical error that can make certain multi-part body parts attempt to read memory from outside the allowed boundaries. A specially-crafted packet can trigger these invalid reads and potentially induce a crash.

This issues is in PJSIP, and so the issue can be fixed without performing an upgrade of Asterisk at all. However, we are releasing a new version of Asterisk with the bundled PJProject updated to include the fix.

If you are running Asterisk with chan_sip, this issue does not affect you.

The Asterisk project reports:

A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.

GitLab reports:

The import/export feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users.

JSST reports:

Inadequate filtering of request data leads to a SQL Injection vulnerability.

Werner Lemberg reports:

CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 fonts.

Samuli Seppänen reports:

OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities. Fixes to them have been backported to v2.3.15.

An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).

The PostgreSQL project reports:

Security Fixes nested CASE expressions + database and role names with embedded special characters

• CVE-2017-7484: selectivity estimators bypass SELECT privilege checks.
• CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
• CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.

Albert Astals Cid reports:

KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account.

rwhitworth reports:

I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here: https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse id_filename to cause seg faults.

NVD reports:

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.

Google Chrome Releases reports:

1 security fix in this release:

• [679306] High CVE-2017-5068: Race condition in WebRTC. Credit to Philipp Hancke

Timo Sirainen reports:

passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS.

Jakub Jirutka reports:

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

Jenkins Security Advisory:

Description

SECURITY-412 through SECURITY-420 / CVE-2017-1000356

CSRF: Multiple vulnerabilities

SECURITY-429 / CVE-2017-1000353

CLI: Unauthenticated remote code execution

SECURITY-466 / CVE-2017-1000354

CLI: Login command allowed impersonating any Jenkins user

SECURITY-503 / CVE-2017-1000355

XStream: Java crash when trying to instantiate void/Void

The CodeIgniter changelog reports:

Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).

Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.

Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.

Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.

Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.

ISC reports:

DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from sources that are not fully trusted (for example: providers of secondary name service). A party who is allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS updates) can overwhelm the server which is accepting data by intentionally or accidentally exhausting that server's memory.

Common Vulnerabilities and Exposures:

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

Drupal Security Team Reports:

CVE-2017-6919: Access bypass

Google Chrome Releases reports:

29 security fixes in this release, including:

• [695826] High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360
• [694382] High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani
• [684684] High CVE-2017-5059: Type confusion in Blink. Credit to SkyLined working with Trend Micro's Zero Day Initiative
• [683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to Xudong Zheng
• [672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)
• [702896] Medium CVE-2017-5062: Use after free in Chrome Apps. Credit to anonymous
• [700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to Sweetchip
• [693974] Medium CVE-2017-5064: Use after free in Blink. Credit to Wadih Matar
• [704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to Khalil Zhani
• [690821] Medium CVE-2017-5066: Incorrect signature handing in Networking. Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen (ICTT, Xidian University)
• [648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to Khalil Zhani
• [691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to Michael Reizelman
• [713205] Various fixes from internal audits, fuzzing and other initiatives

NVD reports:

LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.

The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.

The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.

The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

cURL security advisory:

libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).

libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.

This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

NVD reports:

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

Mozilla Foundation reports:

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products.

NVD reports:

In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.

Mozilla Foundation reports:

An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

Debian Security reports:

CVE-2016-10195: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

CVE-2016-10196: Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

CVE-2016-10197: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.

Oracle reports:

This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

ISC reports:

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.

An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.

A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks.

The cURL project reports:

There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..

This flaw only exists in the command line tool.

We are not aware of any exploit of this flaw.

The Xen Project reports:

The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where multiple integer overflows, improper access control, and improper validation of a user input may cause a denial of service or potential escalation of privileges.

The Asterisk project reports:

No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection.

Django team reports:

These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

• Open redirect and possible XSS attack via user-supplied numeric redirect URLs
• Open redirect vulnerability in django.views.static.serve()

The Xen Project reports:

Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host.

Google Chrome Releases reports:

5 security fixes in this release, including:

• [698622] Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar
• [699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs
• [662767] High CVE-2017-5052: Bad cast in Blink. Credit to JeongHoon Shin
• [705445] High CVE-2017-5056: Use after free in Blink. Credit to anonymous
• [702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)

The phpMyAdmin team reports:

Summary

Bypass $cfg['Servers'][$i]['AllowNoPassword']

Description

A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).

This behavior depends on the PHP version used (it seems PHP 5 is affected, while PHP 7.0 is not).

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

Set a password for all users.

Samba team reports:

A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks.

The Xen Project reports:

A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process.

Jouni Malinen reports:

psk configuration parameter update allowing arbitrary data to be written (2016-1 - CVE-2016-4476/CVE-2016-4477).

Jouni Malinen reports:

wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 - CVE-2015-5310)

EAP-pwd missing last fragment length validation. (2015-7 - CVE-2015-5315)

EAP-pwd peer error path failure on unexpected Confirm message. (2015-8 - CVE-2015-5316)

The irssi project reports:

Use after free while producing list of netjoins (CWE-416). This issue was found and reported to us by APic. This issue usually leads to segmentation faults. Targeted code execution should be difficult.

The Apache Software Foundation reports:

Important: Remote Code Execution CVE-2016-8735

Important: Information Disclosure CVE-2016-6816

The Apache Software Foundation reports:

When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service.

Mark Thomas reports:

• CVE-2015-5345 Apache Tomcat Directory disclosure

• CVE-2016-0706 Apache Tomcat Security Manager bypass

• CVE-2016-0714 Apache Tomcat Security Manager Bypass

Apache Software Foundation reports:

Low: Denial of Service CVE-2014-0230

When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection.

Moderate: Security Manager bypass CVE-2014-7810

Malicious web applications could use expression language to bypass the protections of a Security Manager as expressions were evaluated within a privileged code section.

The Apache Software Foundation reports:

Low: Unrestricted Access to Global Resources CVE-2016-6797

Low: Security Manager Bypass CVE-2016-6796

Low: System Property Disclosure CVE-2016-6794

Low: Security Manager Bypass CVE-2016-5018

Low: Timing Attack CVE-2016-0762

The Mozilla Foundation reports:

An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer.

Openwall reports:

C client library for MySQL (libmysqlclient.so) has use-after-free defect which can cause crash of applications using that MySQL client.

Tomcat Security Team reports:

Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

An integer overflow, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

An integer overflow in parseChunkHeader allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

The Apache Software Foundation reports:

The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.

Marina Glancy reports:

In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. We highly recommend that you upgrade your sites as soon as possible. Upgrading should be very straightforward. As per our usual policy, admins of all registered Moodle sites will be notified of security issue details directly via email and we'll publish details more widely in a week.

The Apache Software Foundation reports:

Important: Information Disclosure CVE-2016-8745

The Apache Software Foundation reports:

When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate().

Marina Glancy reports:

• MSA-17-0001: System file inclusion when adding own preset file in Boost theme

• MSA-17-0002: Incorrect sanitation of attributes in forums

• MSA-17-0003: PHPMailer vulnerability in no-reply address

• MSA-17-0004: XSS in assignment submission page

.

Drupal Security Team reports:

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

Adobe reports:

• These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).
• These updates resolve a random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003).

Simon G. Tatham reports:

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

Oracle reports:

No further details have been provided in the Critical Patch Update

The Legion of the Bouncy Castle reports:

Release: 1.56

2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)

Google Chrome Releases reports:

36 security fixes in this release, including:

• [682194] High CVE-2017-5030: Memory corruption in V8. Credit to Brendon Tiszka
• [682020] High CVE-2017-5031: Use after free in ANGLE. Credit to Looben Yang
• [668724] High CVE-2017-5032: Out of bounds write in PDFium. Credit to Ashfaq Ansari - Project Srishti
• [676623] High CVE-2017-5029: Integer overflow in libxslt. Credit to Holger Fuhrmannek
• [678461] High CVE-2017-5034: Use after free in PDFium. Credit to Ke Liu of Tencent's Xuanwu Lab
• [688425] High CVE-2017-5035: Incorrect security UI in Omnibox. Credit to Enzo Aguado
• [691371] High CVE-2017-5036: Use after free in PDFium. Credit to Anonymous
• [679640] High CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer. Credit to Yongke Wang of Tecent's Xuanwu Lab
• [679649] High CVE-2017-5039: Use after free in PDFium. Credit to jinmo123
• [691323] Medium CVE-2017-5040: Information disclosure in V8. Credit to Choongwoo Han
• [642490] Medium CVE-2017-5041: Address spoofing in Omnibox. Credit to Jordi Chancel
• [669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink. Credit to Nicolai Grodum
• [671932] Medium CVE-2017-5042: Incorrect handling of cookies in Cast. Credit to Mike Ruddy
• [695476] Medium CVE-2017-5038: Use after free in GuestView. Credit to Anonymous
• [683523] Medium CVE-2017-5043: Use after free in GuestView. Credit to Anonymous
• [688987] Medium CVE-2017-5044: Heap overflow in Skia. Credit to Kushal Arvind Shah of Fortinet's FortiGuard Labs
• [667079] Medium CVE-2017-5045: Information disclosure in XSS Auditor. Credit to Dhaval Kapil
• [680409] Medium CVE-2017-5046: Information disclosure in Blink. Credit to Masato Kinugawa
• [699618] Various fixes from internal audits, fuzzing and other initiatives

Janos Follath reports:

• If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
• If the client and the server both support MD5 and the client can be tricked to authenticate to a malicious server, then the malicious server can impersonate the client. To launch this man in the middle attack, the adversary has to compute a chosen-prefix MD5 collision in real time. This is very expensive computationally, but can be practical. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
• A bug in the logic of the parsing of a PEM encoded Certificate Revocation List in mbedtls_x509_crl_parse() can result in an infinite loop. In versions before 1.3.10 the same bug results in an infinite recursion stack overflow that usually crashes the application. Methods and means of acquiring the CRLs is not part of the TLS handshake and in the strict TLS setting this vulnerability cannot be triggered remotely. The vulnerability cannot be triggered unless the application explicitly calls mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM formatted CRL of untrusted origin. In which case the vulnerability can be exploited to launch a denial of service attack against the application.

Albert Aastals Cid reports:

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.

Albert Aastals Cid reports:

A directory traversal issue was found in KTNEF which can be exploited by tricking a user into opening a malicious winmail.dat file. The issue allows to write files with the permission of the user opening the winmail.dat file during extraction.

Albert Astals Cid reports:

Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs.

This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens).

This attack can be carried out remotely (over the LAN) since proxy settings allow "Detect Proxy Configuration Automatically". This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one.

WordPress versions 4.7.2 and earlier are affected by six security issues.

• Cross-site scripting (XSS) via media file metadata.
• Control characters can trick redirect URL validation.
• Unintended files can be deleted by administrators using the plugin deletion functionality.
• Cross-site scripting (XSS) via video URL in YouTube embeds.
• Cross-site scripting (XSS) via taxonomy term names.
• Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources.

Mozilla Foundation reports:

CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

CVE-2017-5401: Memory Corruption when handling ErrorResult

CVE-2017-5402: Use-after-free working with events in FontFace objects

CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object

CVE-2017-5404: Use-after-free working with ranges in selections

CVE-2017-5406: Segmentation fault in Skia with canvas operations

CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters

CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping

CVE-2017-5411: Use-after-free in Buffer Storage in libGLES

CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service

CVE-2017-5408: Cross-origin reading of video captions in violation of CORS

CVE-2017-5412: Buffer overflow read in SVG filters

CVE-2017-5413: Segmentation fault during bidirectional operations

CVE-2017-5414: File picker can choose incorrect default directory

CVE-2017-5415: Addressbar spoofing through blob URL

CVE-2017-5416: Null dereference crash in HttpChannel

CVE-2017-5417: Addressbar spoofing by draging and dropping URLs

CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access

CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running

CVE-2017-5427: Non-existent chrome.manifest file loaded during startup

CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses

CVE-2017-5419: Repeated authentication prompts lead to DOS attack

CVE-2017-5420: Javascript: URLs can obfuscate addressbar location

CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports

CVE-2017-5421: Print preview spoofing

CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink

CVE-2017-5399: Memory safety bugs fixed in Firefox 52

CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8

Mitre reports:

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

When CGI::FormBuilder->field("foo") is called in list context (and in particular in the arguments to a subroutine that takes named arguments), it can return zero or more values for foo from the CGI request, rather than the expected single value. This breaks the usual Perl parsing convention for named arguments, similar to CVE-2014-1572 in Bugzilla (which was caused by a similar API design issue in CGI.pm).

The CodeIgniter changelog reports:

Fixed an XSS vulnerability in Security Library method xss_clean().

Fixed a possible file inclusion vulnerability in Loader Library method vars().

Fixed a possible remote code execution vulnerability in the Email Library when ?mail? or ?sendmail? are used (thanks to Paul Buonopane from NamePros).

Added protection against timing side-channel attacks in Security Library method csrf_verify().

Added protection against BREACH attacks targeting the CSRF token field generated by Form Helper function form_open().

ikiwiki reports:

The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact:

An attacker who can log in to a site with a password can log in as a different and potentially more privileged user.

An attacker who can create a new account can set arbitrary fields in the user database for that account

Peter Bex reports:

A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn.

Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing.

Irregex versions before 0.9.6 contain a resource exhaustion vulnerability: when compiling deeply nested regexes containing the "+" operator due to exponential expansion behaviour.

potrace reports:

CVE-2016-8685: invalid memory access in findnext

CVE-2016-8686: memory allocation failure

The MPD project reports:

httpd: fix two buffer overflows in IcyMetaData length calculation

Problem Description:

Due to improper handling of alert packets, OpenSSL would consume an excessive amount of CPU time processing undefined alert messages.

Impact:

A remote attacker who can initiate handshakes with an OpenSSL based server can cause the server to consume a lot of computation power with very little bandwidth usage, and may be able to use this technique in a leveraged Denial of Service attack.

The cURL project reports:

SSL_VERIFYSTATUS ignored

curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error.

Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work.

This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.

The Xen Project reports:

In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check whether the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.

Alan Somers reports:

The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.

Debian Security Team reports:

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

David Bryant reports:

global buffer overread in read_code / read_words.c

heap out of bounds read in WriteCaffHeader / caff.c

heap out of bounds read in unreorder_channels / wvunpack.c

heap oob read in read_new_config_info / open_utils.c

Ximin Luo reports:

[v67] introduced a security hole where diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive.

The OpenSSL project reports:

Severity: High

During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.

This issue does not affect OpenSSL version 1.0.2.

ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.

The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.

Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.

Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.

FFmpeg security reports:

FFmpeg 3.2.4 fixes the following vulnerabilities: CVE-2017-5024, CVE-2017-5025

Daniel P. Berrange reports:

CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings

CVE-2017-5885 - fix color map index bounds checking.

The Xen Project reports:

When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory.

A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation.

The cURL project reports:

libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer.

libtiff project reports:

Multiple flaws have been discovered in libtiff library and utilities.

wdollman reports:

The value of the view_type parameter on the view_all_bug_page.php page is not encoded before being displayed on the page.

TALOS reports:

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library.

Mortiz Bunkus reports:

Multiple invalid memory accesses vulnerabilities.

Ludovic Courtès reports:

The REPL server is vulnerable to the HTTP inter-protocol attack

The ?mkdir? procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process? umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

Jens Georg reports:

I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins.

Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade.

Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade.

Jenkins Security Advisory:

Description

SECURITY-304 / CVE-2017-2598

Use of AES ECB block cipher mode without IV for encrypting secrets

SECURITY-321 / CVE-2017-2599

Items could be created with same name as existing item

SECURITY-343 / CVE-2017-2600

Node monitor data could be viewed by low privilege users

SECURITY-349 / CVE-2011-4969

Possible cross-site scripting vulnerability in jQuery bundled with timeline widget

SECURITY-353 / CVE-2017-2601

Persisted cross-site scripting vulnerability in parameter names and descriptions

SECURITY-354 / CVE-2015-0886

Outdated jbcrypt version bundled with Jenkins

SECURITY-358 / CVE-2017-2602

Pipeline metadata files not blacklisted in agent-to-master security subsystem

SECURITY-362 / CVE-2017-2603

User data leak in disconnected agents' config.xml API

SECURITY-371 / CVE-2017-2604

Low privilege users were able to act on administrative monitors

SECURITY-376 / CVE-2017-2605

Re-key admin monitor leaves behind unencrypted credentials in upgraded installations

SECURITY-380 / CVE-2017-2606

Internal API allowed access to item names that should not be visible

SECURITY-382 / CVE-2017-2607

Persisted cross-site scripting vulnerability in console notes

SECURITY-383 / CVE-2017-2608

XStream remote code execution vulnerability

SECURITY-385 / CVE-2017-2609

Information disclosure vulnerability in search suggestions

SECURITY-388 / CVE-2017-2610

Persisted cross-site scripting vulnerability in search suggestions

SECURITY-389 / CVE-2017-2611

Insufficient permission check for periodic processes

SECURITY-392 / CVE-2017-2612

Low privilege users were able to override JDK download credentials

SECURITY-406 / CVE-2017-2613

User creation CSRF using GET by admins

Aaron D. Campbell reports:

WordPress versions 4.7.1 and earlier are affected by three security issues:

• The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.
• WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we?ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.
• A cross-site scripting (XSS) vulnerability was discovered in the posts list table.
• An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.

Peter Haag reports:

A remote attacker with access to the web interface to execute arbitrary commands on the host operating system.

Google Chrome Releases reports:

51 security fixes in this release, including:

• [671102] High CVE-2017-5007: Universal XSS in Blink. Credit to Mariusz Mlynski
• [673170] High CVE-2017-5006: Universal XSS in Blink. Credit to Mariusz Mlynski
• [668552] High CVE-2017-5008: Universal XSS in Blink. Credit to Mariusz Mlynski
• [663476] High CVE-2017-5010: Universal XSS in Blink. Credit to Mariusz Mlynski
• [662859] High CVE-2017-5011: Unauthorised file access in Devtools. Credit to Khalil Zhani
• [667504] High CVE-2017-5009: Out of bounds memory access in WebRTC. Credit to Sean Stanek and Chip Bradford
• [681843] High CVE-2017-5012: Heap overflow in V8. Credit to Gergely Nagy (Tresorit)
• [677716] Medium CVE-2017-5013: Address spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)
• [675332] Medium CVE-2017-5014: Heap overflow in Skia. Credit to sweetchip
• [673971] Medium CVE-2017-5015: Address spoofing in Omnibox. Credit to Armin Razmdjou
• [666714] Medium CVE-2017-5019: Use after free in Renderer. Credit to Wadih Matar
• [673163] Medium CVE-2017-5016: UI spoofing in Blink. Credit to Haosheng Wang (@gnehsoah)
• [676975] Medium CVE-2017-5017: Uninitialised memory access in webm video. Credit to danberm
• [668665] Medium CVE-2017-5018: Universal XSS in chrome://apps. Credit to Rob Wu
• [668653] Medium CVE-2017-5020: Universal XSS in chrome://downloads. Credit to Rob Wu
• [663726] Low CVE-2017-5021: Use after free in Extensions. Credit to Rob Wu
• [663620] Low CVE-2017-5022: Bypass of Content Security Policy in Blink. Credit to Pujun Li of PKAV Team
• [651443] Low CVE-2017-5023: Type confunsion in metrics. Credit to the UK's National Cyber Security Centre (NCSC)
• [643951] Low CVE-2017-5024: Heap overflow in FFmpeg. Credit to Paul Mehta
• [643950] Low CVE-2017-5025: Heap overflow in FFmpeg. Credit to Paul Mehta
• [634108] Low CVE-2017-5026: UI spoofing. Credit to Ronni Skansing
• [685349] Various fixes from internal audits, fuzzing and other initiatives

The phpMyAdmin development team reports:

Summary

Open redirect

Description

It was possible to trick phpMyAdmin to redirect to insecure using special request path.

Severity

We consider this vulnerability to be non critical.

Summary

php-gettext code execution

Description

The php-gettext library can suffer to code execution. However there is no way to trigger this inside phpMyAdmin.

Severity

We consider this to be minor.

Summary

DOS vulnerability in table editing

Description

It was possible to trigger recursive include operation by crafted parameters when editing table data.

Severity

We consider this to be non critical.

Summary

CSS injection in themes

Description

It was possible to cause CSS injection in themes by crafted cookie parameters.

Severity

We consider this to be non critical.

Summary

Cookie attribute injection attack

Description

A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. This was incompletely fixed in PMASA-2016-18.

Severity

We consider this to be non-critical.

Summary

SSRF in replication

Description

For a user with appropriate MySQL privileges it was possible to connect to arbitrary host.

Severity

We consider this to be non-critical.

Summary

DOS in replication status

Description

It was possible to trigger DOS in replication status by specially crafted table name.

Severity

We consider this to be non critical.

Mozilla Foundation reports:

CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7

CVE-2017-5374: Memory safety bugs fixed in Firefox 51

CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP

CVE-2017-5376: Use-after-free in XSL

CVE-2017-5377: Memory corruption with transforms to create gradients in Skia

CVE-2017-5378: Pointer and frame data leakage of Javascript objects

CVE-2017-5379: Use-after-free in Web Animations

CVE-2017-5380: Potential use-after-free during DOM manipulations

CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations

CVE-2017-5382: Feed preview can expose privileged content errors and exceptions

CVE-2017-5383: Location bar spoofing with unicode characters

CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)

CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers

CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions

CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages

CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks

CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests

CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer

CVE-2017-5391: Content about: pages can load privileged about: pages

CVE-2017-5392: Weak references using multiple threads on weak proxy objects lead to unsafe memory usage

CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager

CVE-2017-5394: Android location bar spoofing using fullscreen and JavaScript events

CVE-2017-5395: Android location bar spoofing during scrolling

CVE-2017-5396: Use-after-free with Media Decoder

Intel Corporation reports:

A security vulnerability in the Intel(R) Ethernet Controller X710 and Intel(R) Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.

The PHP project reports:

The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release.

The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several security bugs were fixed in this release.

Choongwoo Han reports:

An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int.

PowerDNS reports:

2016-02: Crafted queries can cause abnormal CPU usage

2016-03: Denial of service via the web server

2016-04: Insufficient validation of TSIG signatures

2016-05: Crafted zone record can cause a denial of service

Irssi reports:

Five vulnerabilities have been located in Irssi

• A NULL pointer dereference in the nickcmp function found by Joseph Bisch. (CWE-690)
• Use after free when receiving invalid nick message (Issue #466, CWE-146)
• Out of bounds read in certain incomplete control codes found by Joseph Bisch. (CWE-126)
• Out of bounds read in certain incomplete character sequences found by Hanno Böck and independently by J. Bisch. (CWE-126)
• Out of bounds read when Printing the value '%['. Found by Hanno Böck. (CWE-126)

These issues may result in denial of service (remote crash).

The Apache Groovy project reports:

When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. This is similar to CVE-2015-3253 but this exploit involves extra wrapping of objects and catching of exceptions which are now safe guarded against.

Pivotal.io reports:

MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Aaron D. Campbell reports:

WordPress versions 4.7 and earlier are affected by eight security issues...

Oracle reports:

Local security vulnerability in 'Server: Packaging' sub component.

The MySQL project reports:

• CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component.
• CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
• CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
• CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub component.
• CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub component.
• CVE-2016-5629: Remote security vulnerability in 'Server: Federated' sub component.
• CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub component.

Problem Description:

The ssh-agent(1) agent supports loading a PKCS#11 module from outside a trusted whitelist. An attacker can request loading of a PKCS#11 module across forwarded agent-socket. [CVE-2016-10009]

When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. [CVE-2016-10010]

Impact:

A remote attacker who have control of a forwarded agent-socket on a remote system and have the ability to write files on the system running ssh-agent(1) agent can run arbitrary code under the same user credential. Because the attacker must already have some control on both systems, it is relatively hard to exploit this vulnerability in a practical attack. [CVE-2016-10009]

When privilege separation is disabled (on FreeBSD, privilege separation is enabled by default and has to be explicitly disabled), an authenticated attacker can potentially gain root privileges on systems running OpenSSH server. [CVE-2016-10010]

SecurityFocus reports:

PHPMailer is prone to an local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

Computest reports:

Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.

ISC reports:

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers. DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

Adobe reports:

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931).

Cesar Pereida Garcia reports:

The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect omits setting the BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in the BN_mod_inverse method and therefore resulting in a cache-timing attack vulnerability.

A malicious user with local access can recover ECDSA P-256 private keys.

Peter Wu on Openwall mailing-list reports:

The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root. while any local user can connect to the Unix socket. Fixed by patch which is released with hpcsc-lite 1.8.20.

Oracle reports:

Lynx is vulnerable to POODLE by still supporting vulnerable version of SSL. Lynx is also vulnerable to URL attacks by incorrectly parsing hostnames ending with an '?'.

The GnuTLS project reports:

• It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. (GNUTLS-SA-2017-2)
• It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificate with Proxy Certificate Information extension present could lead to a double free. (GNUTLS-SA-2017-1)

libvnc server reports:

Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).

Christian Rebischke reports:

libdwarf is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

Talos Security reports:

• CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability

• CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability

• CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability

• CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability

Thomas Waldmann reports:

• fix XSS in AttachFile view (multifile related) CVE-2016-7148

• fix XSS in GUI editor's attachment dialogue CVE-2016-7146

• fix XSS in GUI editor's link dialogue CVE-2016-9119

Multiple remote code execution and denial of service conditions present.

The CodeIgniter changelog reports:

Fixed a number of new vulnerabilities in Security Library method xss_clean().

The CodeIgniter changelog reports:

Fixed an SQL injection in the ?odbc? database driver.

Updated set_realpath() Path Helper function to filter-out php:// wrapper inputs.

These packages have reached End of Life status and/or have been removed from the Ports Tree. They may contain undocumented security issues. Please take caution and find alternative software as soon as possible.

Check Point reports:

... discovered 3 fresh and previously unknown vulnerabilities (CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7 unserialize mechanism.

The first two vulnerabilities allow attackers to take full control over servers, allowing them to do anything they want with the website, from spreading malware to defacing it or stealing customer data.

The last vulnerability generates a Denial of Service attack which basically hangs the website, exhausts its memory consumption, and shuts it down.

The PHP security team issued fixes for two of the vulnerabilities on the 13th of October and 1st of December.

The PHP project reports:

• Use After Free Vulnerability in unserialize() (CVE-2016-9936)
• Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

Kazuho Oku reports:

A use-after-free vulnerability exists in H2O up to and including version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to mount DoS attacks and / or information theft.

Legal Hackers reports:

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

The first patch of the vulnerability CVE-2016-10033 was incomplete. This advisory demonstrates the bypass of the patch. The bypass allows to carry out Remote Code Execution on all current versions (including 5.2.19).

Matthew Garett reports:

Reported this to upstream 8 months ago without response, so: libupnp's default behaviour allows anyone to write to your filesystem. Seriously. Find a device running a libupnp based server (Shodan says there's rather a lot), and POST a file to /testfile. Then GET /testfile ... and yeah if the server is running as root (it is) and is using / as the web root (probably not, but maybe) this gives full host fs access.

Scott Tenaglia reports:

There is a heap buffer overflow vulnerability in the create_url_list function in upnp/src/gena/gena_device.c.

Legal Hackers reports:

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

Samba team reports:

[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes on DNS objects and trigger a controlled memory corruption.

[CVE-2016-2125] Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service.

[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

The Exim project reports:

Exim leaks the private DKIM signing key to the log files. Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used, the key material is included in the bounce message.

Project curl Security Advisory:

libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to.

This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable.

This function is brand new in 7.52.0 and is the result of an overhaul to make sure libcurl uses strong random as much as possible - provided by the backend TLS crypto libraries when present. The faulty function was introduced in this commit.

We are not aware of any exploit of this flaw.

Squid security advisory 2016:10 reports:

Due to incorrect comparison of request headers Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session. Potentially including credentials which allow access to further sensitive resources. This problem only affects Squid configured to use the Collapsed Forwarding feature. It is of particular importance for HTTPS reverse-proxy sites with Collapsed Forwarding.

Squid security advisory 2016:11 reports:

Due to incorrect HTTP conditional request handling Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session. Potentially including credentials which allow access to further sensitive resources..

Mitre reports:

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

The Xen Project reports:

Certain PV guest kernel operations (page table writes in particular) need emulation, and use Xen's general x86 instruction emulator. This allows a malicious guest kernel which asynchronously modifies its instruction stream to effect the clearing of EFLAGS.IF from the state used to return to guest context.

A malicious guest kernel administrator can cause a host hang or crash, resulting in a Denial of Service.

The cURL project reports:

printf floating point buffer overflow

libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes.

The JSST and the Joomla! Security Center report:

[20161201] - Core - Elevated Privileges

Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

[20161202] - Core - Shell Upload

Inadequate filesystem checks allowed files with alternative PHP file extensions to be uploaded.

[20161203] - Core - Information Disclosure

Inadequate ACL checks in the Beez3 com_content article layout override enables a user to view restricted content.

Apache Software Foundation reports:

• Important: Apache HTTP Request Parsing Whitespace Defects CVE-2016-8743
  
  Apache HTTP Server, prior to release 2.4.25, accepted a broad pattern of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB in parsing the request line and request header lines, as well as HTAB in parsing the request line. Any bare CR present in request lines was treated as whitespace and remained in the request field member "the_request", while a bare CR in the request header field name would be honored as whitespace, and a bare CR in the request header field value was retained the input headers array. Implied additional whitespace was accepted in the request line and prior to the ':' delimiter of any request header lines.
  
  
  
  RFC7230 Section 3.5 calls out some of these whitespace exceptions, and section 3.2.3 eliminated and clarified the role of implied whitespace in the grammar of this specification. Section 3.1.1 requires exactly one single SP between the method and request-target, and between the request-target and HTTP-version, followed immediately by a CRLF sequence. None of these fields permit any (unencoded) CTL character whatsoever. Section 3.2.4 explicitly disallowed any whitespace from the request header field prior to the ':' character, while Section 3.2 disallows all CTL characters in the request header line other than the HTAB character as whitespace.
  
  
  
  These defects represent a security concern when httpd is participating in any chain of proxies or interacting with back-end application servers, either through mod_proxy or using conventional CGI mechanisms. In each case where one agent accepts such CTL characters and does not treat them as whitespace, there is the possibility in a proxy chain of generating two responses from a server behind the uncautious proxy agent. In a sequence of two requests, this results in request A to the first proxy being interpreted as requests A + A' by the backend server, and if requests A and B were submitted to the first proxy in a keepalive connection, the proxy may interpret response A' as the response to request B, polluting the cache or potentially serving the A' content to a different downstream user-agent.
  
  
  
  These defects are addressed with the release of Apache HTTP Server 2.4.25 and coordinated by a new directive
  
  HttpProtocolOptions Strict
  
  

• low: DoS vulnerability in mod_auth_digest CVE-2016-2161
  
  Malicious input to mod_auth_digest will cause the server to crash, and each instance continues to crash even for subsequently valid requests.
  
  

• low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736
  
  Authenticate the session data/cookie presented to mod_session_crypto with a MAC (SipHash) to prevent deciphering or tampering with a padding oracle attack.
  
  

• low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736
  
  Authenticate the session data/cookie presented to mod_session_crypto with a MAC (SipHash) to prevent deciphering or tampering with a padding oracle attack.
  
  

• low: HTTP/2 CONTINUATION denial of service CVE-2016-8740
  
  The HTTP/2 protocol implementation (mod_http2) had an incomplete handling of the LimitRequestFields directive. This allowed an attacker to inject unlimited request headers into the server, leading to eventual memory exhaustion.
  
  

• n/a: HTTP_PROXY environment variable "httpoxy" mitigation CVE-2016-5387
  
  HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTP_PROXY" variable from a "Proxy:" header, which has never been registered by IANA.

The JSST and the Joomla! Security Center report:

[20161001] - Core - Account Creation

Inadequate checks allows for users to register on a site when registration has been disabled.

[20161002] - Core - Elevated Privilege

Incorrect use of unfiltered data allows for users to register on a site with elevated privileges.

[20161003] - Core - Account Modifications

Incorrect use of unfiltered data allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

The JSST and the Joomla! Security Center report:

[20151201] - Core - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability.

[20151202] - Core - CSRF Hardening

Add additional CSRF hardening in com_templates.

[20151203] - Core - Directory Traversal

Failure to properly sanitize input data from the XML install file located within an extension's package archive allows for directory traversal.

[20151204] - Core - Directory Traversal

Inadequate filtering of request data leads to a Directory Traversal vulnerability.

The JSST and the Joomla! Security Center report:

[20151206] - Core - Session Hardening

The Joomla Security Strike team has been following up on the critical security vulnerability patched last week. Since the recent update it has become clear that the root cause is a bug in PHP itself. This was fixed by PHP in September of 2015 with the releases of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all versions of PHP 7 and has been back-ported in some specific Linux LTS versions of PHP 5.3). This fixes the bug across all supported PHP versions.

[20151207] - Core - SQL Injection

Inadequate filtering of request data leads to a SQL Injection vulnerability.

Netsparker reports:

Proof of Concept URL for XSS in Pligg CMS:

Page: groups.php

Parameter Name: keyword

Parameter Type: GET

Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

The JSST and the Joomla! Security Center report:

[20160801] - Core - ACL Violation

Inadequate ACL checks in com_content provide potential read access to data which should be access restricted to users with edit_own level.

[20160802] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in mail component.

[20160803] - Core - CSRF

Add additional CSRF hardening in com_joomlaupdate.

Problem Description:

Multiple vulnerabilities have been discovered in the NTP suite:

CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7427: Broadcast Mode Replay Prevention DoS. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass. Reported by Sharon Goldberg and Aanchal Malhotra of Boston University.

CVE-2016-7434: Null pointer dereference in _IO_str_init_static_internal(). Reported by Magnus Stubman.

CVE-2016-7426: Client rate limiting and server responses. Reported by Miroslav Lichvar of Red Hat.

CVE-2016-7433: Reboot sync calculation problem. Reported independently by Brian Utterback of Oracle, and by Sharon Goldberg and Aanchal Malhotra of Boston University.

Impact:

A remote attacker who can send a specially crafted packet to cause a NULL pointer dereference that will crash ntpd, resulting in a Denial of Service. [CVE-2016-9311]

An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, "restrict default noquery ..." is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring by an attacker from remote. [CVE-2016-9310]

An attacker with access to the NTP broadcast domain can periodically inject specially crafted broadcast mode NTP packets into the broadcast domain which, while being logged by ntpd, can cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. [CVE-2016-7427]

An attacker with access to the NTP broadcast domain can send specially crafted broadcast mode NTP packets to the broadcast domain which, while being logged by ntpd, will cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. [CVE-2016-7428]

Origin timestamp problems were fixed in ntp 4.2.8p6. However, subsequent timestamp validation checks introduced a regression in the handling of some Zero origin timestamp checks. [CVE-2016-7431]

If ntpd is configured to allow mrulist query requests from a server that sends a crafted malicious packet, ntpd will crash on receipt of that crafted malicious mrulist query packet. [CVE-2016-7434]

An attacker who knows the sources (e.g., from an IPv4 refid in server response) and knows the system is (mis)configured in this way can periodically send packets with spoofed source address to keep the rate limiting activated and prevent ntpd from accepting valid responses from its sources. [CVE-2016-7426]

Ntp Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was incorrect, resulting in a root distance that did not include the peer dispersion. The calculations and formulas have been reviewed and reconciled, and the code has been updated accordingly. [CVE-2016-7433]

The OpenSSL team reports:

Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key.

The Xen Project reports:

The typical behaviour of singlestepping exceptions is determined at the start of the instruction, with a #DB trap being raised at the end of the instruction. SYSCALL (and SYSRET, although we don't implement it) behave differently because the typical behaviour allows userspace to escalate its privilege. (This difference in behaviour seems to be undocumented.) Xen wrongly raised the exception based on the flags at the start of the instruction.

Guest userspace which can invoke the instruction emulator can use this flaw to escalate its privilege to that of the guest kernel.

The Mozilla Foundation reports:

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.

Mitre reports:

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.

Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.

The Roundcube project reports

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

Mozilla Foundation reports:

CVE-2016-9894: Buffer overflow in SkiaGL

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

CVE-2016-9895: CSP bypass using marquee tag

CVE-2016-9896: Use-after-free with WebVR

CVE-2016-9897: Memory corruption in libGLES

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

CVE-2016-9904: Cross-origin information leak in shared atoms

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

CVE-2016-9902: Pocket extension does not validate the origin of events

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6

Jeremy Felt reports:

WordPress versions 4.6 and earlier are affected by two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher Cengiz Han Sahin; and a path traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team.

The Xen Project reports:

The x86 instruction CMPXCHG8B is supposed to ignore legacy operand size overrides; it only honors the REX.W override (making it CMPXCHG16B). So, the operand size is always 8 or 16. When support for CMPXCHG16B emulation was added to the instruction emulator, this restriction on the set of possible operand sizes was relied on in some parts of the emulation; but a wrong, fully general, operand size value was used for other parts of the emulation. As a result, if a guest uses a supposedly-ignored operand size prefix, a small amount of hypervisor stack data is leaked to the guests: a 96 bit leak to guests running in 64-bit mode; or, a 32 bit leak to other guests.

A malicious unprivileged guest may be able to obtain sensitive information from the host.

The PHP project reports:

This is a security release. Several security bugs were fixed in this release.

The Asterisk project reports:

If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.

The Asterisk project reports:

The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace.

This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication.

If you do not use a proxy for authentication, then this issue does not affect you.

If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you.

If you use chan_pjsip instead of chan_sip, then this issue does not affect you.

Problem Description:

A specially crafted argument can trigger a static buffer overflow in the library, with possibility to rewrite following static buffers that belong to other library functions.

Impact:

Due to very limited use of the function in the existing applications, and limited length of the overflow, exploitation of the vulnerability does not seem feasible. None of the utilities and daemons in the base system are known to be vulnerable. However, careful review of third party software that may use the function was not performed.

Daniel P. Berrange reports:

The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM.

mod_http2 reports:

The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply limitations on request headers correctly when experimental module for the HTTP/2 protocol is used to access a resource.

The net result is that a the server allocates too much memory instead of denying the request. This can lead to memory exhaustion of the server by a properly crafted request.

Problem Description:

An unexpected sequence of memory allocation failures combined with insufficient error checking could result in the construction and execution of an argument sequence that was not intended.

Impact:

An attacker who controls the sequence of memory allocation failures and success may cause login(1) to run without authentication and may be able to cause misbehavior of login(1) replacements.

No practical way of controlling these memory allocation failures is known at this time.

Alex Gaynor reports:

Fixed a bug where ``HKDF`` would return an empty byte-string if used with a ``length`` less than ``algorithm.digest_size``.

Problem Description:

The bounds checking of accesses to guest memory greater than 4GB by device emulations is subject to integer overflow.

Impact:

For a bhyve virtual machine with more than 3GB of guest memory configured, a malicious guest could craft device descriptors that could give it access to the heap of the bhyve process. Since the bhyve process is running as root, this may allow guests to obtain full control of the hosts they're running on.

Multiple sources report:

CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack. Fixed in 5.6.3.

CVE-2016-3995: Incorrect implementation of Rijndael timing attack countermeasure. Fixed in 5.6.4.

CVE-2016-7420: Library built without -DNDEBUG could egress sensitive information to the filesystem via a core dump if an assert was triggered. Fixed in 5.6.5.

Google Chrome Releases reports:

36 security fixes in this release, including:

• [664411] High CVE-2016-9651: Private property access in V8. Credit to Guang Gong of Alpha Team Of Qihoo 360
• [658535] High CVE-2016-5208: Universal XSS in Blink. Credit to Mariusz Mlynski
• [655904] High CVE-2016-5207: Universal XSS in Blink. Credit to Mariusz Mlynski
• [653749] High CVE-2016-5206: Same-origin bypass in PDFium. Credit to Rob Wu (robwu.nl)
• [646610] High CVE-2016-5205: Universal XSS in Blink. Credit to Anonymous
• [630870] High CVE-2016-5204: Universal XSS in Blink. Credit to Mariusz Mlynski
• [664139] High CVE-2016-5209: Out of bounds write in Blink. Credit to Giwan Go of STEALIEN
• [644219] High CVE-2016-5203: Use after free in PDFium. Credit to Anonymous
• [654183] High CVE-2016-5210: Out of bounds write in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB
• [653134] High CVE-2016-5212: Local file disclosure in DevTools. Credit to Khalil Zhani
• [649229] High CVE-2016-5211: Use after free in PDFium. Credit to Anonymous
• [652548] High CVE-2016-5213: Use after free in V8. Credit to Khalil Zhani
• [601538] Medium CVE-2016-5214: File download protection bypass. Credit to Jonathan Birch and MSVR
• [653090] Medium CVE-2016-5216: Use after free in PDFium. Credit to Anonymous
• [619463] Medium CVE-2016-5215: Use after free in Webaudio. Credit to Looben Yang
• [654280] Medium CVE-2016-5217: Use of unvalidated data in PDFium. Credit to Rob Wu (robwu.nl)
• [660498] Medium CVE-2016-5218: Address spoofing in Omnibox. Credit to Abdulrahman Alqabandi (@qab)
• [657568] Medium CVE-2016-5219: Use after free in V8. Credit to Rob Wu (robwu.nl)
• [660854] Medium CVE-2016-5221: Integer overflow in ANGLE. Credit to Tim Becker of ForAllSecure
• [654279] Medium CVE-2016-5220: Local file access in PDFium. Credit to Rob Wu (robwu.nl)
• [657720] Medium CVE-2016-5222: Address spoofing in Omnibox. Credit to xisigr of Tencent's Xuanwu Lab
• [653034] Low CVE-2016-9650: CSP Referrer disclosure. Credit to Jakub ?oczek
• [652038] Low CVE-2016-5223: Integer overflow in PDFium. Credit to Hwiwon Lee
• [639750] Low CVE-2016-5226: Limited XSS in Blink. Credit to Jun Kokatsu (@shhnjk)
• [630332] Low CVE-2016-5225: CSP bypass in Blink. Credit to Scott Helme (@Scott_Helme, scotthelme.co.uk)
• [615851] Low CVE-2016-5224: Same-origin bypass in SVG. Credit to Roeland Krak
• [669928] CVE-2016-9652: Various fixes from internal audits, fuzzing and other initiatives

Bastien Roucaries reports:

Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b suffer from a heap overflow in WaveletDenoiseImage(). This problem is easily trigerrable from a Perl script.

The Xen Project reports:

On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. (The L3 entries are cached in processor registers, and don't actually form part of the pagewalk.)

When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR in the USER and RW bits for L3 updates for the guest to observe architectural behaviour. This is unsafe in combination with recursive pagetables.

As there is no way to construct an L3 recursive pagetable in native 32-bit PAE mode, disallow this option in 32-bit PV guests.

A malicious 32-bit PV guest administrator can escalate their privilege to that of the host.

The Xen Project reports:

When emulating HVM instructions, Xen uses a small i-cache for fetches from guest memory. The code that handles cache misses does not check if the address from which it fetched lies within the cache before blindly writing to it. As such it is possible for the guest to overwrite hypervisor memory.

It is currently believed that the only way to trigger this bug is to use the way that Xen currently incorrectly wraps CS:IP in 16 bit modes. The included patch prevents such wrapping.

A malicious HVM guest administrator can escalate their privilege to that of the host.

The Xen Project reports:

x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. There are situations a guest can provoke which result in exceeding the space allocated for internal state.

A malicious HVM guest administrator can cause Xen to fail a bug check, causing a denial of service to the host.

The Xen Project reports:

When the EVTCHNOP_init_control operation is called with a bad guest frame number, it takes an error path which frees a control structure without also clearing the corresponding pointer. Certain subsequent operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control), upon finding the non-NULL pointer, continue operation assuming it points to allocated memory.

A malicious guest administrator can crash the host, leading to a DoS. Arbitrary code execution (and therefore privilege escalation), and information leaks, cannot be excluded.

The Xen Project reports:

Instructions touching FPU, MMX, or XMM registers are required to raise a Device Not Available Exception (#NM) when either CR0.EM or CR0.TS are set. (Their AVX or AVX-512 extensions would consider only CR0.TS.) While during normal operation this is ensured by the hardware, if a guest modifies instructions while the hypervisor is preparing to emulate them, the #NM delivery could be missed.

Guest code in one task may thus (unintentionally or maliciously) read or modify register state belonging to another task in the same VM.

A malicious unprivileged guest user may be able to obtain or corrupt sensitive information (including cryptographic material) in other programs in the same guest.

The Xen Project reports:

The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses.

The intended behaviour is as follows: The user data segment (%ds, %es, %fs and %gs) selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a special meaning for user segments, and there is no way of preventing access. However, in both 32-bit and 64-bit, a NULL LDT system segment is intended to prevent access.

On Intel hardware, loading a NULL selector zeros the base as well as most attributes, but sets the limit field to its largest possible value. On AMD hardware, loading a NULL selector zeros the attributes, leaving the stale base and limit intact.

Xen may erroneously permit the access using unexpected base/limit values.

Ability to exploit this vulnerability on Intel is easy, but on AMD depends in a complicated way on how the guest kernel manages LDTs.

An unprivileged guest user program may be able to elevate its privilege to that of the guest operating system.

The Xen Project reports:

LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code.

On SVM (AMD hardware): a malicious unprivileged guest process can escalate its privilege to that of the guest operating system.

On both SVM and VMX (Intel hardware): a malicious unprivileged guest process can crash the guest.

The Xen Project reports:

Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a #GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against #GP faults (having recovery code attached) was accidentally removed.

A malicious guest administrator can crash the host, leading to a DoS.

The Xen Project reports:

Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load (kernel) symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused bytes were not properly cleared during symbol table loading.

A malicious unprivileged guest may be able to obtain sensitive information from the host.

The information leak is small and not under the control of the guest, so effectively exploiting this vulnerability is probably difficult.

The Xen Project reports:

The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source.

A malicious guest can modify arbitrary memory, allowing for arbitrary code execution (and therefore privilege escalation affecting the whole host), a crash of the host (leading to a DoS), or information leaks. The vulnerability is sometimes exploitable by unprivileged guest user processes.

The Xen Project reports:

The compiler can emit optimizations in qemu which can lead to double fetch vulnerabilities. Specifically data on the rings shared between qemu and the hypervisor (which the guest under control can obtain mappings of) can be fetched twice (during which time the guest can alter the contents) possibly leading to arbitrary code execution in qemu.

Malicious administrators can exploit this vulnerability to take over the qemu process, elevating its privilege to that of the qemu process.

In a system not using a device model stub domain (or other techniques for deprivileging qemu), malicious guest administrators can thus elevate their privilege to that of the host.

The Xen Project reports:

pygrub, the boot loader emulator, fails to quote (or sanity check) its results when reporting them to its caller.

A malicious guest administrator can obtain the contents of sensitive host files (an information leak). Additionally, a malicious guest administrator can cause files on the host to be removed, causing a denial of service. In some unusual host configurations, ability to remove certain files may be usable for privilege escalation.

Pillow reports:

Pillow prior to 3.3.2 may experience integer overflow errors in map.c when reading specially crafted image files. This may lead to memory disclosure or corruption.

Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check for negative image sizes in ImagingNew in Storage.c. A negative image size can lead to a smaller allocation than expected, leading to arbi trary writes.

Multiple sources report:

CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31

CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.

CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.

Wireshark project reports:

Wireshark project is releasing Wireshark 2.2.2, which addresses:

• wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372
• wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374
• wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376
• wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373
• wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375

Dawid Golunski reports:

GNU wget in version 1.17 and earlier, when used in mirroring/recursive mode, is affected by a Race Condition vulnerability that might allow remote attackers to bypass intended wget access list restrictions specified with -A parameter.

MITRE reports:

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.

Gustavo Grieco reports:

The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

Werner Koch reports:

There was a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions.

Adam Maris reports:

It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

Mitre reports:

The HTBoundary_put_block function in HTBound.c for W3C libwww (w3c-libwww) allows remote servers to cause a denial of service (segmentation fault) via a crafted multipart/byteranges MIME message that triggers an out-of-bounds read.

The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

The Apache Software Foundation reports:

The mod_dontdothat module of subversion and subversion clients using http(s):// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of resources. The attack is also known as the "billions of laughs attack."

The Mozilla Foundation reports:

Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them.

The Drupal development team reports:

Inconsistent name for term access query (Less critical - Drupal 7 and Drupal 8)

Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing hook_query_alter() or hook_query_TAG_alter() in order to add additional conditions. Queries can be distinguished by means of query tags. As the documentation on EntityFieldQuery::addTag() suggests, access-tags on entity queries normally follow the form ENTITY_TYPE_access (e.g. node_access). However, the taxonomy module's access query tag predated this system and used term_access as the query tag instead of taxonomy_term_access.

As a result, before this security release modules wishing to restrict access to taxonomy terms may have implemented an unsupported tag, or needed to look for both tags (term_access and taxonomy_term_access) in order to be compatible with queries generated both by Drupal core as well as those generated by contributed modules like Entity Reference. Otherwise information on taxonomy terms might have been disclosed to unprivileged users.

Incorrect cache context on password reset page (Less critical - Drupal 8)

The user password reset form does not specify a proper cache context, which can lead to cache poisoning and unwanted content on the page.

Confirmation forms allow external URLs to be injected (Moderately critical - Drupal 7)

Under certain circumstances, malicious users could construct a URL to a confirmation form that would trick users into being redirected to a 3rd party website after interacting with the form, thereby exposing the users to potential social engineering attacks.

Denial of service via transliterate mechanism (Moderately critical - Drupal 8)

A specially crafted URL can cause a denial of service via the transliterate mechanism.

Marina Glancy reports:

• MSA-16-0023: Question engine allows access to files that should not be available

• MSA-16-0024: Non-admin site managers may accidentally edit admins via web services

• MSA-16-0025: Capability to view course notes is checked in the wrong context

• MSA-16-0026: When debugging is enabled, error exceptions returned from webservices could contain private data

The phpMyAdmin development team reports:

Summary

Open redirection

Description

A vulnerability was discovered where a user can be tricked in to following a link leading to phpMyAdmin, which after authentication redirects to another malicious site.

The attacker must sniff the user's valid phpMyAdmin token.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Unsafe generation of blowfish secret

Description

When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created using a weak algorithm.

This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies.

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

This vulnerability only affects cookie authentication and only when a user has not defined a $cfg['blowfish_secret'] in their config.inc.php

Summary

phpinfo information leak value of sensitive (HttpOnly) cookies

Description

phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies.

Severity

We consider this vulnerability to be non-critical.

Mitigation factor

phpinfo in disabled by default and needs to be enabled explicitly.

Summary

Username deny rules bypass (AllowRoot & Others) by using Null Byte

Description

It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username.

Severity

We consider this vulnerability to be severe.

Summary

Username rule matching issues

Description

A vulnerability in username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time.

Severity

We consider this vulnerability to be severe.

Summary

Bypass logout timeout

Description

With a crafted request parameter value it is possible to bypass the logout timeout.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Multiple full path disclosure vulnerabilities

Description

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin is written to the export file.

Severity

We consider these vulnerability to be non-critical.

Summary

Multiple XSS vulnerabilities

Description

Several XSS vulnerabilities have been reported, including an improper fix for PMASA-2016-10 and a weakness in a regular expression using in some JavaScript processing.

Severity

We consider this vulnerability to be non-critical.

Summary

Multiple DOS vulnerabilities

Description

With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature.

With a crafted request parameter value it is possible to initiate a denial of service attack in import feature.

An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true;.

Severity

We consider these vulnerabilities to be of moderate severity.

Summary

Bypass white-list protection for URL redirection

Description

Due to the limitation in URL matching, it was possible to bypass the URL white-list protection.

Severity

We consider this vulnerability to be of moderate severity.

Summary

BBCode injection vulnerability

Description

With a crafted login request it is possible to inject BBCode in the login page.

Severity

We consider this vulnerability to be severe.

Mitigation factor

This exploit requires phpMyAdmin to be configured with the "cookie" auth_type; other authentication methods are not affected.

Summary

DOS vulnerability in table partitioning

Description

With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DOS) attack.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Multiple SQL injection vulnerabilities

Description

With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the mysql database.

Severity

We consider these vulnerabilities to be serious.

Summary

Incorrect serialized string parsing

Description

Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function.

Severity

We consider this vulnerability to be severe.

Summary

CSRF token not stripped from the URL

Description

When the arg_separator is different from its default value of &, the token was not properly stripped from the return URL of the preference import action.

Severity

We have not yet determined a severity for this issue.

LegalHackers' reports:

RCE Bugs discovered in MySQL and its variants like MariaDB. It works by manipulating my.cnf files and using --malloc-lib. The bug seems fixed in MySQL 5.7.15 by Oracle

Mozilla Foundation reports:

Mozilla has updated the version of Network Security Services (NSS) library used in Firefox to NSS 3.23. This addresses four moderate rated networking security issues reported by Mozilla engineers Tyson Smith and Jed Davis.

Network Time Foundation reports:

NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:

• 1 HIGH severity vulnerability that only affects Windows
• 2 MEDIUM severity vulnerabilities
• 2 MEDIUM/LOW severity vulnerabilities
• 5 LOW severity vulnerabilities
• 28 other non-security fixes and improvements

All of the security issues in this release are listed in VU#633847.

Teeworlds project reports:

Attacker controlled memory-writes and possibly arbitrary code execution on the client, abusable by any server the client joins

Jenkins Security Advisory:

An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, making Jenkins connect to an attacker-controlled LDAP server, which in turn can send a serialized payload leading to code execution, bypassing existing protection mechanisms.

Marina Glancy reports:

• MSA-16-0022: Web service tokens should be invalidated when the user password is changed or forced to be changed.

Mozilla Foundation reports:

CVE-2016-5289: Memory safety bugs fixed in Firefox 50

CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5

CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file

CVE-2016-5292: URL parsing causes crash

CVE-2016-5293: Write to arbitrary file with updater and moz maintenance service using updater.log h

CVE-2016-5294: Arbitrary target directory for result files of update process

CVE-2016-5295: Mozilla Maintenance Service: Ability to read arbitrary files as SYSTEM

CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1

CVE-2016-5297: Incorrect argument length checking in Javascript

CVE-2016-5298: SSL indicator can mislead the user about the real URL visited

CVE-2016-5299: Firefox AuthToken in broadcast protected with signature-level permission can be accessed by an app

CVE-2016-9061: API Key (glocation) in broadcast protected with signature-level permission can be accessed by an a

CVE-2016-9062: Private browsing browser traces (android) in browser.db and wal file

CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in expat

CVE-2016-9064: Addons update must verify IDs match between current and new versions

CVE-2016-9065: Firefox for Android location bar spoofing using fullscreen

CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler

CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore

CVE-2016-9068: heap-use-after-free in nsRefreshDriver

CVE-2016-9070: Sidebar bookmark can have reference to chrome window

CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP

CVE-2016-9072: 64-bit NPAPI sandbox isn't enabled on fresh profile

CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl"

CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler

CVE-2016-9075: WebExtensions can access the mozAddonManager API and use it to gain elevated privileges

CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on e10s

CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to cross-origin images, allowing timing atta

Debian reports:

smogrify script creates insecure temporary files.

lives creates and uses world-writable directory.

OpenSSL reports:

• ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
  
  Severity: High
  
  TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.
• CMS Null dereference (CVE-2016-7053)
  
  Severity: Medium
  
  Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.
• Montgomery multiplication may produce incorrect results (CVE-2016-7055)i
  
  Severity: Low
  
  There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits.

Adobe reports:

• These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).

Google Chrome Releases reports:

4 security fixes in this release, including:

• [643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to Paul Mehta
• [658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to Choongwoo Han
• [660678] Medium CVE-2016-5201: Info leak in extensions. Credit to Rob Wu
• [662843] CVE-2016-5202: Various fixes from internal audits, fuzzing and other initiatives

Sebastian Pipping reports:

CVE-2012-6702 -- Resolve troublesome internal call to srand that was introduced with Expat 2.1.0 when addressing CVE-2012-0876 (issue #496)

CVE-2016-5300 -- Use more entropy for hash initialization than the original fix to CVE-2012-0876.

Google Chrome Releases reports:

[659475] High CVE-2016-5198: Out of bounds memory access in V8. Credit to Tencent Keen Security Lab, working with Trend Micro's Zero Day Initiative.

ISC reports:

A defect in BIND's handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c

Problem Description:

When processing the SSH_MSG_KEXINIT message, the server could allocate up to a few hundreds of megabytes of memory per each connection, before any authentication take place.

Impact:

A remote attacker may be able to cause a SSH server to allocate an excessive amount of memory. Note that the default MaxStartups setting on FreeBSD will limit the effectiveness of this attack.

The cURL project reports

• cookie injection for other servers
• case insensitive password comparison
• OOB write via unchecked multiplication
• double-free in curl_maprintf
• double-free in krb5 code
• glob parser write/read out of bounds
• curl_getdate read out of bounds
• URL unescape heap overflow via integer truncation
• Use-after-free via shared cookies
• invalid URL parsing with '#'
• IDNA 2003 makes curl use wrong host

The Django project reports:

Today the Django team released Django 1.10.3, Django 1.9.11, and 1.8.16. These releases addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

• User with hardcoded password created when running tests on Oracle
• DNS rebinding vulnerability when DEBUG=True

Cisco Talos reports:

Multiple integer overflow vulnerabilities exist within Memcached that could be exploited to achieve remote code execution on the targeted system. These vulnerabilities manifest in various Memcached functions that are used in inserting, appending, prepending, or modifying key-value data pairs. Systems which also have Memcached compiled with support for SASL authentication are also vulnerable to a third flaw due to how Memcached handles SASL authentication commands.

An attacker could exploit these vulnerabilities by sending a specifically crafted Memcached command to the targeted server. Additionally, these vulnerabilities could also be exploited to leak sensitive process information which an attacker could use to bypass common exploitation mitigations, such as ASLR, and can be triggered multiple times. This enables reliable exploitation which makes these vulnerabilities severe.

The MariaDB project reports:

Fixes for the following security vulnerabilities:

• CVE-2016-7440
• CVE-2016-5584

Google Chrome Releases reports:

21 security fixes in this release, including:

• [645211] High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous
• [638615] High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN
• [645122] High CVE-2016-5183: Use after free in PDFium. Credit to Anonymous
• [630654] High CVE-2016-5184: Use after free in PDFium. Credit to Anonymous
• [621360] High CVE-2016-5185: Use after free in Blink. Credit to cloudfuzzer
• [639702] High CVE-2016-5187: URL spoofing. Credit to Luan Herrera
• [565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan Herrera
• [633885] Medium CVE-2016-5192: Cross-origin bypass in Blink. Credit to haojunhou@gmail.com
• [646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr of Tencent's Xuanwu Lab
• [644963] Medium CVE-2016-5186: Out of bounds read in DevTools. Credit to Abdulrahman Alqabandi (@qab)
• [639126] Medium CVE-2016-5191: Universal XSS in Bookmarks. Credit to Gareth Hughes
• [642067] Medium CVE-2016-5190: Use after free in Internals. Credit to Atte Kettunen of OUSPG
• [639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang ZHOU (martinzhou96)
• [654782] CVE-2016-5194: Various fixes from internal audits, fuzzing and other initiatives

Google Chrome Releases reports:

3 security fixes in this release, including:

• [642496] High CVE-2016-5177: Use after free in V8. Credit to Anonymous
• [651092] CVE-2016-5178: Various fixes from internal audits, fuzzing and other initiatives.

Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:

Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSL_CONF environment variable or from the default location for the current platform. Always triggering a configuration file load attempt may allow an attacker to load compromised OpenSSL configuration into a Node.js process if they are able to place a file in a default location.

Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes, potentially allowing an attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. This vulnerability would require an attacker to be able to execute arbitrary JavaScript code in a Node.js process.

Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of the inspector. This provides additional security to prevent unauthorized clients from connecting to the Node.js process via the v8_inspector port when running with --inspect. Since the debugging protocol allows extensive access to the internals of a running process, and the execution of arbitrary code, it is important to limit connections to authorized tools only. Note that the v8_inspector protocol in Node.js is still considered an experimental feature. Vulnerability originally reported by Jann Horn.

All of these vulnerabilities are considered low-severity for Node.js users, however, users of Node.js v6.x should upgrade at their earliest convenience.

Todd C. Miller reports:

A flaw exists in sudo's noexec functionality that may allow a user with sudo privileges to run additional commands even when the NOEXEC tag has been applied to a command that uses the wordexp() function.

Apache Axis2 reports:

Apache Axis2 1.7.4 is a maintenance release that includes fixes for several issues, including the following security issues: Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities affecting the admin console. A dependency on an Apache HttpClient version affected by known security vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.

urllib3 reports:

CVE-2016-9015: Certification verification failure

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address a critical vulnerability that could potentially allow an attacker to take control of the affected system.

Adobe is aware of a report that an exploit for CVE-2016-7855 exists in the wild, and is being used in limited, targeted attacks against users running Windows versions 7, 8.1 and 10.

Node.js has released new versions containing the following security fix:

The following releases all contain fixes for CVE-2016-5180 "ares_create_query single byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance), Node.js v4.6.1 (LTS "Argon")

While this is not a critical update, all users of these release lines should upgrade at their earliest convenience.

Problem Description:

A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.

Impact:

This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

Problem Description:

An unchecked array reference in the VGA device emulation code could potentially allow guests access to the heap of the bhyve process. Since the bhyve process is running as root, this may allow guests to obtain full control of the hosts they are running on.

Impact:

For bhyve virtual machines with the "fbuf" framebuffer device configured, if exploited, a malicious guest could obtain full access to not just the host system, but to other virtual machines running on the system.

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2016-6992).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-6981, CVE-2016-6987).

These updates resolve a security bypass vulnerability (CVE-2016-4286).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, CVE-2016-6990).

Mozilla Foundation reports:

CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]

CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]

CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]

CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]

CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]

CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]

CVE-2016-5281 - use-after-free in DOMSVGLength [high]

CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]

CVE-2016-5283 -