%PDF-
%PDF-
Mini Shell
Mini Shell
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd" [
<!ENTITY vuln-2003 SYSTEM "vuln/2003.xml">
<!ENTITY vuln-2004 SYSTEM "vuln/2004.xml">
<!ENTITY vuln-2005 SYSTEM "vuln/2005.xml">
<!ENTITY vuln-2006 SYSTEM "vuln/2006.xml">
<!ENTITY vuln-2007 SYSTEM "vuln/2007.xml">
<!ENTITY vuln-2008 SYSTEM "vuln/2008.xml">
<!ENTITY vuln-2009 SYSTEM "vuln/2009.xml">
<!ENTITY vuln-2010 SYSTEM "vuln/2010.xml">
<!ENTITY vuln-2011 SYSTEM "vuln/2011.xml">
<!ENTITY vuln-2012 SYSTEM "vuln/2012.xml">
<!ENTITY vuln-2013 SYSTEM "vuln/2013.xml">
<!ENTITY vuln-2014 SYSTEM "vuln/2014.xml">
<!ENTITY vuln-2015 SYSTEM "vuln/2015.xml">
<!ENTITY vuln-2016 SYSTEM "vuln/2016.xml">
<!ENTITY vuln-2017 SYSTEM "vuln/2017.xml">
<!ENTITY vuln-2018 SYSTEM "vuln/2018.xml">
<!ENTITY vuln-2019 SYSTEM "vuln/2019.xml">
<!ENTITY vuln-2020 SYSTEM "vuln/2020.xml">
<!ENTITY vuln-2021 SYSTEM "vuln/2021.xml">
<!ENTITY vuln-2022 SYSTEM "vuln/2022.xml">
<!ENTITY vuln-2023 SYSTEM "vuln/2023.xml">
<!ENTITY vuln-2024 SYSTEM "vuln/2024.xml">
<!ENTITY vuln-2025 SYSTEM "vuln/2025.xml">
]>
<!--
Copyright 2003-2025 Jacques Vidrine and contributors
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
copyright notice, this list of conditions and the following
disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
published online in any format, converted to PDF, PostScript,
RTF and other formats) must reproduce the above copyright
notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
QUICK GUIDE TO ADDING A NEW ENTRY
1. run 'make newentry' to add a template to the top of the document
2. fill in the template
3. use 'make validate' to verify syntax correctness (you might need to install
textproc/libxml2 for parser, and this port for catalogs)
4. fix any errors
5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
6. profit!
Additional tests can be done this way:
$ make vuln-flat.xml
$ pkg audit -f ./vuln-flat.xml py26-django-1.6
$ pkg audit -f ./vuln-flat.xml py27-django-1.6.1
Extensive documentation of the format and help with writing and verifying
a new entry is available in The Porter's Handbook at:
https://docs.freebsd.org/en/books/porters-handbook/security/#security-notify
Help is also available from ports-security@freebsd.org.
Notes:
* Please add new entries to the beginning of the current year's file.
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="6989312e-8366-11f0-9bc6-b42e991fc52e">
<topic>SQLite -- application crash</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.49.1</lt></range>
</package>
<package>
<name>linux_base-rl9-9.6</name>
<range><lt>9.6</lt></range>
</package>
<package>
<name>linux-c7-sqlite</name>
<range><lt>3.7.17_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gist.github.com/ylwango613/d3883fb9f6ba8a78086356779ce88248">
<p>In SQLite 3.49.0 before 3.49.1, certain argument values
to sqlite3_db_config (in the C-language API) can cause a
denial of service (application crash). An sz*nBig
multiplication is not cast to a 64-bit integer, and
consequently some memory allocations may be incorrect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-29088</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-29088</url>
</references>
<dates>
<discovery>2025-04-10</discovery>
<entry>2025-08-27</entry>
</dates>
</vuln>
<vuln vid="c323bab5-80dd-11f0-97c4-40b034429ecf">
<topic>p5-Catalyst-Authentication-Credential-HTTP -- Insecure source of randomness</topic>
<affects>
<package>
<name>p5-Catalyst-Authentication-Credential-HTTP</name>
<range><lt>1.019</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>perl-catalyst project reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-40920">
<p>Catalyst::Authentication::Credential::HTTP versions 1.018
and earlier for Perl generate nonces using
the Perl Data::UUID library. * Data::UUID does not use a
strong cryptographic source for generating
UUIDs.* Data::UUID returns v3 UUIDs, which are generated
from known information and are unsuitable for
security, as per RFC 9562. * The nonces should be generated
from a strong cryptographic source, as per RFC 7616.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-40920</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-40920</url>
</references>
<dates>
<discovery>2025-08-11</discovery>
<entry>2025-08-24</entry>
</dates>
</vuln>
<vuln vid="07335fb9-7eb1-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1825621%2C1970079%2C1976736%2C1979072">
<p>Memory safety bugs present in Firefox 141 and Thunderbird
141. Some of these bugs showed evidence of memory corruption
and we presume that with enough effort some of these could
have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9187</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9187</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="feb359ef-7eb0-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.14</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>140.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166">
<p>Memory safety bugs present in Firefox ESR 115.26, Firefox
ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9184</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9184</url>
<cvename>CVE-2025-9185</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9185</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="fa7fd6d4-7eb0-11f0-ba14-b42e991fc52e">
<topic>Firefox -- Spoofing in the Address Bar</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1976102">
<p>Spoofing issue in the Address Bar component.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9183</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9183</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="f994cea5-7eb0-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- DoS in WebRender</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1975837">
<p>'Denial-of-service due to out-of-memory in the
Graphics: WebRender component.'</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9182</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9182</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="f7e8e9a3-7eb0-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- Uninitialized memory</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>140.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1977130">
<p>Uninitialized memory in the JavaScript Engine component.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9181</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9181</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="f6219d24-7eb0-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- Same-origin policy bypass</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979782">
<p>'Same-origin policy bypass in the Graphics: Canvas2D
component.'</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9180</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9180</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="f42ee983-7eb0-11f0-ba14-b42e991fc52e">
<topic>Mozilla -- memory corruption in GMP</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>142,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>140.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979527">
<p>An attacker was able to perform memory corruption in the GMP process
which processes encrypted media. This process is also heavily
sandboxed, but represents slightly different privileges from the
content process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-9179</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-9179</url>
</references>
<dates>
<discovery>2025-08-19</discovery>
<entry>2025-08-21</entry>
</dates>
</vuln>
<vuln vid="eb03714d-79f0-11f0-b4c1-ac5afc632ba3">
<topic>nginx -- worker process memory disclosure</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><lt>1.29.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>F5 reports:</p>
<blockquote cite="https://my.f5.com/manage/s/article/K000152786">
<p>NGINX Open Source and NGINX Plus have a vulnerability in the
ngx_mail_smtp_module that might allow an unauthenticated attacker to
over-read NGINX SMTP authentication process memory; as a result, the
server side may leak arbitrary bytes sent in a request to the
authentication server. This issue happens during the NGINX SMTP
authentication process and requires the attacker to make preparations
against the target system to extract the leaked data. The issue
affects NGINX only if (1) it is built with the ngx_mail_smtp_module,
(2) the smtp_auth directive is configured with method "none,"
and (3) the authentication server returns the "Auth-Wait" response
header.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-53859</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2025-53859</url>
</references>
<dates>
<discovery>2025-08-13</discovery>
<entry>2025-08-15</entry>
</dates>
</vuln>
<vuln vid="a60e73e0-7942-11f0-b3f7-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>139.0.7258.127</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>139.0.7258.127</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html">
<p>This update includes 6 security fixes:</p>
<ul>
<li>[432035817] High CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous on 2025-07-15</li>
<li>[433533359] High CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n) on 2025-07-23</li>
<li>[435139154] High CVE-2025-8901: Out of bounds write in ANGLE. Reported by Google Big Sleep on 2025-07-30</li>
<li>[433800617] Medium CVE-2025-8881: Inappropriate implementation in File Picker. Reported by Alesandro Ortiz on 2025-07-23</li>
<li>[435623339] Medium CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq on 2025-08-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8579</cvename>
<cvename>CVE-2025-8580</cvename>
<cvename>CVE-2025-8901</cvename>
<cvename>CVE-2025-8881</cvename>
<cvename>CVE-2025-8882</cvename>
<url>https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2025-08-12</discovery>
<entry>2025-08-14</entry>
</dates>
</vuln>
<vuln vid="fc048b51-7909-11f0-90a2-6cc21735f730">
<topic>PostgreSQL -- vulnerabilities</topic>
<affects>
<package>
<name>postgresql17-server</name>
<range><lt>17.6</lt></range>
</package>
<package>
<name>postgresql16-server</name>
<range><lt>16.10</lt></range>
</package>
<package>
<name>postgresql15-server</name>
<range><lt>14.14</lt></range>
</package>
<package>
<name>postgresql14-server</name>
<range><lt>14.19</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/">
<p>Tighten security checks in planner estimation functions.</p>
<p>Prevent pg_dump scripts from being used to attack the user running the restore.</p>
<p>Convert newlines to spaces in names included in comments in pg_dump output.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8713</cvename>
<cvename>CVE-2025-8714</cvename>
<cvename>CVE-2025-8715</cvename>
<url>https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/</url>
</references>
<dates>
<discovery>2025-08-11</discovery>
<entry>2025-08-14</entry>
</dates>
</vuln>
<vuln vid="7bfe6f39-78be-11f0-9d03-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.2.0</ge><lt>18.2.2</lt></range>
<range><ge>18.1.0</ge><lt>18.1.4</lt></range>
<range><ge>8.14.0</ge><lt>18.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/">
<p>Cross-site scripting issue in blob viewer impacts GitLab CE/EE</p>
<p>Cross-site scripting issue in labels impacts GitLab CE/EE</p>
<p>Cross-site scripting issue in Workitem impacts GitLab CE/EE</p>
<p>Improper Handling of Permissions issue in project API impacts GitLab CE/EE</p>
<p>Incorrect Privilege Assignment issue in delete issues operation impacts GitLab CE/EE</p>
<p>Allocation of Resources Without Limits issue in release name creation impacts GitLab CE/EE</p>
<p>Incorrect Authorization issue in jobs API impacts GitLab CE/EE</p>
<p>Authorization issue in Merge request approval policy impacts GitLab EE</p>
<p>Inefficient Regular Expression Complexity issue in wiki impacts GitLab CE/EE</p>
<p>Allocation of Resources Without Limits issue in Mattermost integration impacts GitLab CE/EE</p>
<p>Incorrect Permission Assignment issue in ID token impacts GitLab CE/EE</p>
<p>Insufficient Access Control issue in IP Restriction impacts GitLab EE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-7734</cvename>
<cvename>CVE-2025-7739</cvename>
<cvename>CVE-2025-6186</cvename>
<cvename>CVE-2025-8094</cvename>
<cvename>CVE-2024-12303</cvename>
<cvename>CVE-2025-2614</cvename>
<cvename>CVE-2024-10219</cvename>
<cvename>CVE-2025-8770</cvename>
<cvename>CVE-2025-2937</cvename>
<cvename>CVE-2025-1477</cvename>
<cvename>CVE-2025-5819</cvename>
<cvename>CVE-2025-2498</cvename>
<url>https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/</url>
</references>
<dates>
<discovery>2025-08-13</discovery>
<entry>2025-08-14</entry>
</dates>
</vuln>
<vuln vid="e2d49973-785a-11f0-a1c0-0050569f0b83">
<topic>www/varnish7 -- Denial of Service in HTTP/2</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Development Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00017.html#vsv00017">
<p>A denial of service attack can be performed on Varnish Cache servers
that have the HTTP/2 protocol turned on. An attacker can create a
large number of streams and immediately reset them without ever
reaching the maximum number of concurrent streams allowed for the
session, causing the Varnish server to consume unnecessary
resources processing requests for which the response will not be
delivered.</p>
<p>This attack is a variant of the HTTP/2 Rapid Reset Attack, which was
partially handled as VSV00013.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8671</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8671</url>
</references>
<dates>
<discovery>2025-08-13</discovery>
<entry>2025-08-13</entry>
</dates>
</vuln>
<vuln vid="defe9a20-781e-11f0-97c4-40b034429ecf">
<topic>p5-Authen-SASL -- Insecure source of randomness</topic>
<affects>
<package>
<name>p5-Authen-SASL</name>
<range><lt>2.1900</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>p5-Authen-SASL project reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-496q-8ph2-c4fj">
<p>Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.</p>
<p>The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function.
The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header.
The built-in rand function is unsuitable for cryptographic usage.</p>
<p>According to RFC 2831, The cnonce-value is an opaque quoted string value provided by the client and used by both client and server
to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation depends on a good choice.
It is RECOMMENDED that it contain at least 64 bits of entropy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-40918</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-40918</url>
</references>
<dates>
<discovery>2025-07-16</discovery>
<entry>2025-08-13</entry>
</dates>
</vuln>
<vuln vid="15fd1321-768a-11f0-b3f7-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>139.0.7258.66</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>139.0.7258.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[414760982] Medium CVE-2025-8576: Use after free in Extensions. Reported by asnine on 2025-04-30</li>
<li>[384050903] Medium CVE-2025-8577: Inappropriate implementation in Picture In Picture. Reported by Umar Farooq on 2024-12-14</li>
<li>[423387026] Medium CVE-2025-8578: Use after free in Cast. Reported by Fayez on 2025-06-09</li>
<li>[407791462] Low CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome. Reported by Alesandro Ortiz on 2025-04-02</li>
<li>[411544197] Low CVE-2025-8580: Inappropriate implementation in Filesystems. Reported by Huuuuu on 2025-04-18</li>
<li>[416942878] Low CVE-2025-8581: Inappropriate implementation in Extensions. Reported by Vincent Dragnea on 2025-05-11</li>
<li>[40089450] Low CVE-2025-8582: Insufficient validation of untrusted input in DOM. Reported by Anonymous on 2017-10-31</li>
<li>[373794472] Low CVE-2025-8583: Inappropriate implementation in Permissions. Reported by Shaheen Fazim on 2024-10-16</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8576</cvename>
<cvename>CVE-2025-8577</cvename>
<cvename>CVE-2025-8578</cvename>
<cvename>CVE-2025-8579</cvename>
<cvename>CVE-2025-8580</cvename>
<cvename>CVE-2025-8581</cvename>
<cvename>CVE-2025-8582</cvename>
<cvename>CVE-2025-8583</cvename>
<url>https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-08-05</discovery>
<entry>2025-08-11</entry>
</dates>
</vuln>
<vuln vid="fb08d146-752a-11f0-952c-8447094a420f">
<topic>Apache httpd -- evaluation always true</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.64</ge><lt>2.4.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.65">
<p>'RewriteCond expr' always evaluates to true in 2.4.64.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-54090</cvename>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.65</url>
</references>
<dates>
<discovery>2025-07-23</discovery>
<entry>2025-08-09</entry>
</dates>
</vuln>
<vuln vid="66f35fd9-73f5-11f0-8e0e-002590c1f29c">
<topic>FreeBSD -- Integer overflow in libarchive leading to double free</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.3</ge><lt>14.3_2</lt></range>
<range><ge>14.2</ge><lt>14.2_5</lt></range>
<range><ge>13.5</ge><lt>13.5_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An integer overflow in the archive_read_format_rar_seek_data()
function may lead to a double free problem.</p>
<h1>Impact:</h1>
<p>Exploiting a double free vulnerability can cause memory corruption.
This in turn could enable a threat actor to execute arbitrary code.
It might also result in denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2025-5914</cvename>
<freebsdsa>SA-25:07.libarchive</freebsdsa>
</references>
<dates>
<discovery>2025-08-08</discovery>
<entry>2025-08-08</entry>
</dates>
</vuln>
<vuln vid="b945ce3f-6f9b-11f0-bd96-b42e991fc52e">
<topic>sqlite -- integer overflow</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.49.1</lt></range>
</package>
<package>
<name>linux-c7-sqlite</name>
<range><lt>3.49.1</lt></range>
</package>
<package>
<name>linux_base-rl9</name>
<range><lt>3.49.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve-coordination@google.com reports:</p>
<blockquote cite="https://sqlite.org/src/info/498e3f1cf57f164f">
<p>An integer overflow can be triggered in SQLites `concat_ws()`
function. The resulting, truncated integer is then used to allocate
a buffer. When SQLite then writes the resulting string to the
buffer, it uses the original, untruncated size and thus a wild Heap
Buffer overflow of size ~4GB can be triggered. This can result in
arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3277</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3277</url>
</references>
<dates>
<discovery>2025-04-14</discovery>
<entry>2025-08-02</entry>
</dates>
</vuln>
<vuln vid="95480188-6ebc-11f0-8a78-bf201f293bce">
<topic>navidrome -- transcoding permission bypass vulnerability</topic>
<affects>
<package>
<name>navidrome</name>
<range><lt>0.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Deluan Quintão reports:</p>
<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3">
<p>A permission verification flaw in Navidrome allows any authenticated
regular user to bypass authorization checks and perform
administrator-only transcoding configuration operations, including
creating, modifying, and deleting transcoding settings.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-48948</cvename>
<url>https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3</url>
</references>
<dates>
<discovery>2025-05-29</discovery>
<entry>2025-08-01</entry>
</dates>
</vuln>
<vuln vid="f51077bd-6dd7-11f0-9d62-b42e991fc52e">
<topic>SQLite -- integer overflow in key info allocation</topic>
<affects>
<package>
<name>sqlite3</name>
<range><ge>3.39.2,1</ge><lt>3.41.2,1</lt></range>
</package>
<!-- as of 2025-08-01, sqlite in -c7 is 3.7.17 and matched by the <3.50.2 below,
and -rl9 aka linux_base ships 3.34.1 which is outside this range. -->
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve-coordination@google.com reports:</p>
<blockquote cite="https://sqlite.org/forum/forumpost/16ce2bb7a639e29b">
<p>An integer overflow in the sqlite3KeyInfoFromExprList function in
SQLite versions 3.39.2 through 3.41.1 allows an attacker with the
ability to execute arbitrary SQL statements to cause a denial of
service or disclose sensitive information from process memory via
a crafted SELECT statement with a large number of expressions in
the ORDER BY clause.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-7458</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-7458</url>
</references>
<dates>
<discovery>2025-07-29</discovery>
<entry>2025-07-31</entry>
<modified>2025-08-01</modified>
</dates>
</vuln>
<vuln vid="cd7f969e-6cb4-11f0-97c4-40b034429ecf">
<topic>p5-Crypt-CBC -- Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</topic>
<affects>
<package>
<name>p5-Crypt-CBC</name>
<range><lt>3.07</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lib-Crypt-CBC project reports:</p>
<blockquote cite="https://perldoc.perl.org/functions/rand">
<p>
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default
source of entropy, which is not cryptographically secure, for cryptographic functions.
This issue affects operating systems where "/dev/urandom'" is unavailable.
In that case, Crypt::CBC will fallback to use the insecure rand() function.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2814</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-2814</url>
</references>
<dates>
<discovery>2025-04-12</discovery>
<entry>2025-07-29</entry>
</dates>
</vuln>
<vuln vid="c37f29ba-6ae3-11f0-b4bf-ecf4bbefc954">
<topic>viewvc -- Arbitrary server filesystem content</topic>
<affects>
<package>
<name>viewvc</name>
<range><ge>1.1.0</ge><le>1.1.30</le></range>
</package>
<package>
<name>viewvc</name>
<range><ge>1.2.0</ge><le>1.2.3</le></range>
</package>
<package>
<name>viewvc-devel</name>
<range><lt>1.3.0.20250316_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cmpilato reports:</p>
<blockquote cite="https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397">
<p>
The ViewVC standalone web server (standalone.py) is a script provided in the ViewVC
distribution for the purposes of quickly testing a ViewVC configuration. This script
can in particular configurations expose the contents of the host server's filesystem
though a directory traversal-style attack.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-54141</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-54141</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-25</entry>
</dates>
</vuln>
<vuln vid="eed1a411-699b-11f0-91fe-000c295725e4">
<topic>rubygem-resolv -- Possible denial of service</topic>
<affects>
<package>
<name>rubygem-resolv</name>
<range><lt>0.6.2</lt></range>
</package>
<package>
<name>ruby</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.9,1</lt></range>
<range><ge>3.3.0.p1,1</ge><lt>3.3.9,1</lt></range>
<range><ge>3.4.0.p1,1</ge><lt>3.4.5,1</lt></range>
<range><ge>3.5.0.p1,1</ge><lt>3.5.0.p2,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><lt>3.2.9,1</lt></range>
</package>
<package>
<name>ruby33</name>
<range><lt>3.3.9,1</lt></range>
</package>
<package>
<name>ruby34</name>
<range><lt>3.4.5,1</lt></range>
</package>
<package>
<name>ruby35</name>
<range><lt>3.5.0.p2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manu reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/">
<p>
The vulnerability is caused by an insufficient check on
the length of a decompressed domain name within a DNS
packet.
</p>
<p>
An attacker can craft a malicious DNS packet containing a
highly compressed domain name. When the resolv library
parses such a packet, the name decompression process
consumes a large amount of CPU resources, as the library
does not limit the resulting length of the name.
</p>
<p>
This resource consumption can cause the application thread
to become unresponsive, resulting in a Denial of Service
condition.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-24294</cvename>
<url>https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/</url>
</references>
<dates>
<discovery>2025-07-08</discovery>
<entry>2025-07-25</entry>
</dates>
</vuln>
<vuln vid="67c6461f-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1933572%2C1971116">
<p>Memory safety bugs present in Firefox 140 and
Thunderbird 140. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort
some of these could have been exploited to run arbitrary
code.</p>
<p>Focus incorrectly truncated URLs towards the beginning instead of
around the origin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8044</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8044</url>
<cvename>CVE-2025-8043</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8043</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="62f1a68f-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975058%2C1975058%2C1975998%2C1975998">
<p>Memory safety bugs present in Firefox ESR 140.0,
Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8040</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8040</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="6088905c-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Persisted search terms in the URL bar</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970997">
<p>In some cases search terms persisted in the URL bar even after
navigating away from the search page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8039</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8039</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="5d91def0-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Ignored paths while checking navigations</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1808979">
<p>Thunderbird ignored paths when checking the validity of
navigations in a frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8038</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8038</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="5abc2187-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- cookie shadowing</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1964767">
<p>Setting a nameless cookie with an equals sign in the
value shadowed other cookies. Even if the nameless cookie
was set over HTTP and the shadowed cookie included the
`Secure` attribute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8037</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8037</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="58027367-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- CORS circumvention</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1960834">
<p>Thunderbird cached CORS preflight responses across IP
address changes. This allowed circumventing CORS with DNS
rebinding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8036</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8036</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="55096bd3-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975961%2C1975961%2C1975961">
<p>Memory safety bugs present in Firefox ESR 128.12,
Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR
140.0, Firefox 140 and Thunderbird 140. Some of these bugs
showed evidence of memory corruption and we presume that
with enough effort some of these could have been exploited
to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8035</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8035</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="4faa01cb-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970422%2C1970422%2C1970422%2C1970422">
<p>Memory safety bugs present in Firefox ESR 115.25, Firefox
ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0,
Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some
of these bugs showed evidence of memory corruption and we
presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8034</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8034</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="4d03efe7-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- nullptr dereference</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1973990">
<p>The JavaScript engine did not handle closed generators
correctly and it was possible to resume them leading to a
nullptr deref.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8033</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8033</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="4a357f4b-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- XSLT document CSP bypass</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1974407">
<p>XSLT document loading did not correctly propagate the
source document which bypassed its CSP.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8032</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8032</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="477e9eb3-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- HTTP Basic Authentication credentials leak</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971719">
<p>The `username:password` part was not correctly stripped
from URLs in CSP reports potentially leaking HTTP Basic
Authentication credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8031</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8031</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="44b3048b-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Insufficient input escaping</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1968414">
<p>Insufficient escaping in the Copy as cURL feature could
potentially be used to trick a user into executing
unexpected code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8030</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8030</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="419bcf99-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- 'javascript:' URLs execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1928021">
<p>Thunderbird executed `javascript:` URLs when used in
`object` and `embed` tags.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8029</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8029</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="3e9406a7-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- Incorrect computation of branch address</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971581">
<p>On arm64, a WASM `br_table` instruction with a lot of
entries could lead to the label being too far from the
instruction causing truncation and incorrect computation of
the branch address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8028</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8028</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="3c234220-685e-11f0-a12d-b42e991fc52e">
<topic>Mozilla -- IonMonkey-JIT bad stack write</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>141.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.13</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>141.0</lt></range>
</package>
<package>
<name>thunderbird-esr</name>
<range><lt>140.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1968423">
<p>On 64-bit platforms IonMonkey-JIT only wrote 32 bits of
the 64-bit return value space on the stack. Baseline-JIT,
however, read the entire 64 bits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-8027</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-8027</url>
</references>
<dates>
<discovery>2025-07-22</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="3d4393b2-68a5-11f0-b2b4-589cfc10832a">
<topic>gdk-pixbuf2 -- a heap buffer overflow</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.42.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2025-7345">
<p>A flaw exists in gdk-pixbuf within the gdk_pixbuf__jpeg_image_load_increment
function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c).
When processing maliciously crafted JPEG images, a heap buffer overflow can occur
during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially
causing application crashes or arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-7345</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2025-7345</url>
</references>
<dates>
<discovery>2025-07-24</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="b3948bf3-685e-11f0-bff5-6805ca2fa271">
<topic>powerdns-recursor -- cache pollution</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>5.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/powerdns-security-advisory-2025-04">
<p>An attacker spoofing answers to ECS enabled requests
sent out by the Recursor has a chance of success higher
than non-ECS enabled queries. The updated version include
various mitigations against spoofing attempts of ECS enabled
queries by chaining ECS enabled requests and enforcing
stricter validation of the received answers. The most strict
mitigation done when the new setting outgoing.edns_subnet_harden
(old style name edns-subnet-harden) is enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-30192</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-30192</url>
</references>
<dates>
<discovery>2025-07-21</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="5683b3a7-683d-11f0-966e-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
<range><ge>18.1.0</ge><lt>18.1.3</lt></range>
<range><ge>15.0.0</ge><lt>18.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/">
<p>Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE</p>
<p>Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE using CDNs</p>
<p>Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE</p>
<p>Improper Access Control issue impacts GitLab EE</p>
<p>Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE</p>
<p>Improper Access Control issue impacts GitLab CE/EE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4700</cvename>
<cvename>CVE-2025-4439</cvename>
<cvename>CVE-2025-7001</cvename>
<cvename>CVE-2025-4976</cvename>
<cvename>CVE-2025-0765</cvename>
<cvename>CVE-2025-1299</cvename>
<url>https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/</url>
</references>
<dates>
<discovery>2025-07-23</discovery>
<entry>2025-07-24</entry>
</dates>
</vuln>
<vuln vid="0f5bcba2-67fb-11f0-9ee5-b42e991fc52e">
<topic>sqlite -- Integer Truncation on SQLite</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.50.2,1</lt></range>
</package>
<package>
<name>linux-c7-sqlite</name>
<range><lt>3.50.2</lt></range>
</package>
<package>
<name>linux_base-rl9</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve-coordination@google.com reports:</p>
<blockquote cite="https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8">
<p>There exists a vulnerability in SQLite versions before
3.50.2 where the number of aggregate terms could exceed the
number of columns available. This could lead to a memory
corruption issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6965</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6965</url>
</references>
<dates>
<discovery>2025-07-15</discovery>
<entry>2025-07-23</entry>
<modified>2025-08-01</modified>
</dates>
</vuln>
<vuln vid="80411ba2-6729-11f0-a5cb-8c164580114f">
<topic>7-Zip -- Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder</topic>
<affects>
<package>
<name>7-zip</name>
<range><lt>25.00</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/">
<p>7-Zip is a file archiver with a high compression ratio. Zeroes
written outside heap buffer in RAR5 handler may lead to memory
corruption and denial of service in versions of 7-Zip prior to
25.0.0. Version 25.0.0 contains a fix for the issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-53816</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-53816</url>
</references>
<dates>
<discovery>2025-07-17</discovery>
<entry>2025-07-22</entry>
</dates>
</vuln>
<vuln vid="605a9d1e-6521-11f0-beb2-ac5afc632ba3">
<topic>libwasmtime -- host panic with fd_renumber WASIp1 function</topic>
<affects>
<package>
<name>libwasmtime</name>
<range><ge>24.0.0</ge><lt>24.0.4</lt></range>
<range><ge>33.0.0</ge><lt>33.0.2</lt></range>
<range><ge>34.0.0</ge><lt>34.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WasmTime development team reports:</p>
<blockquote cite="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc">
<p>A bug in Wasmtime's implementation of the WASIp1 set of import
functions can lead to a WebAssembly guest inducing a panic in the
host (embedder).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-53901</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-53901</url>
</references>
<dates>
<discovery>2025-07-18</discovery>
<entry>2025-07-20</entry>
</dates>
</vuln>
<vuln vid="e27ee4fc-cdc9-45a1-8242-09898cdbdc91">
<topic>unbound -- Cache poisoning via the ECS-enabled Rebirthday Attack</topic>
<affects>
<package>
<name>unbound</name>
<range><gt>1.6.1</gt><lt>1.23.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sep@nlnetlabs.nl reports:</p>
<blockquote cite="https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt">
<p>A multi-vendor cache poisoning vulnerability named 'Rebirthday
Attack' has been discovered in caching resolvers that support
EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled
with ECS support, i.e., '--enable-subnet', AND configured
to send ECS information along with queries to upstream name servers,
i.e., at least one of the 'send-client-subnet',
'client-subnet-zone' or 'client-subnet-always-forward'
options is used. Resolvers supporting ECS need to segregate outgoing
queries to accommodate for different outgoing ECS information. This
re-opens up resolvers to a birthday paradox attack (Rebirthday
Attack) that tries to match the DNS transaction ID in order to cache
non-ECS poisonous replies.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5994</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5994</url>
</references>
<dates>
<discovery>2025-07-16</discovery>
<entry>2025-07-18</entry>
</dates>
</vuln>
<vuln vid="aeac223e-60e1-11f0-8baa-8447094a420f">
<topic>liboqs -- Secret-dependent branching in HQC</topic>
<affects>
<package>
<name>liboqs</name>
<range><lt>0.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenQuantumSafe project reports:</p>
<blockquote cite="https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm">
<p>Secret-dependent branching in HQC reference implementation when compiled with Clang 17-20 for optimizations above -O0</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-52473</cvename>
<url>https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm</url>
</references>
<dates>
<discovery>2025-07-10</discovery>
<entry>2025-07-14</entry>
</dates>
</vuln>
<vuln vid="c3e1df74-5e73-11f0-95e5-74563cf9e4e9">
<topic>GnuTLS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daiki Ueno reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html">
<ul>
<li>libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS timestamps
Spotted by oss-fuzz and reported by OpenAI Security Research Team,
and fix developed by Andrew Hamilton. [GNUTLS-SA-2025-07-07-1,
CVSS: medium] [CVE-2025-32989]</li>
<li>libgnutls: Fix double-free upon error when exporting otherName in SAN
Reported by OpenAI Security Research Team. [GNUTLS-SA-2025-07-07-2,
CVSS: low] [CVE-2025-32988]</li>
<li>certtool: Fix 1-byte write buffer overrun when parsing template
Reported by David Aitel. [GNUTLS-SA-2025-07-07-3,
CVSS: low] [CVE-2025-32990]</li>
<li>libgnutls: Fix NULL pointer dereference when 2nd Client Hello omits PSK
Reported by Stefan Bühler. [GNUTLS-SA-2025-07-07-4, CVSS: medium]
[CVE-2025-6395]</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32989</cvename>
<cvename>CVE-2025-32988</cvename>
<cvename>CVE-2025-32990</cvename>
<cvename>CVE-2025-6395</cvename>
<url>https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html</url>
</references>
<dates>
<discovery>2025-07-09</discovery>
<entry>2025-07-14</entry>
</dates>
</vuln>
<vuln vid="b0a3466f-5efc-11f0-ae84-99047d0a6bcc">
<topic>libxslt -- unmaintained, with multiple unfixed vulnerabilities</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>2</lt></range> <!-- adjust should libxslt ever be fixed -->
</package>
<package>
<name>linux-c7-libxslt</name>
<range><lt>2</lt></range> <!-- adjust should libxslt ever be fixed -->
</package>
<package>
<name>linux-rl9-libxslt</name>
<range><lt>2</lt></range> <!-- adjust should libxslt ever be fixed -->
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="https://www.openwall.com/lists/oss-security/2025/07/11/2">
<p>On 6/16/25 15:12, Alan Coopersmith wrote:</p>
<p><em>
BTW, users of libxml2 may also be using its sibling project, libxslt,
which currently has no active maintainer, but has three unfixed security issues
reported against it according to
<a href="https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt">
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</a>
</em></p>
<p>2 of the 3 have now been disclosed:</p>
<p>(CVE-2025-7424) libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes<br/>
<a href="https://gitlab.gnome.org/GNOME/libxslt/-/issues/139">https://gitlab.gnome.org/GNOME/libxslt/-/issues/139</a>
<a href="https://project-zero.issues.chromium.org/issues/409761909">https://project-zero.issues.chromium.org/issues/409761909</a></p>
<p>(CVE-2025-7425) libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption<br/>
<a href="https://gitlab.gnome.org/GNOME/libxslt/-/issues/140">https://gitlab.gnome.org/GNOME/libxslt/-/issues/140</a><br/><a href="https://project-zero.issues.chromium.org/issues/410569369">https://project-zero.issues.chromium.org/issues/410569369</a></p>
<p>Engineers from Apple & Google have proposed patches in the GNOME gitlab issues,
but neither has had a fix applied to the git repo since there is currently no
maintainer for libxslt.</p>
</blockquote>
<p>Note that a fourth vulnerability was reported on June 18, 2025, which remains undisclosed to date (GNOME libxslt issue 148, link below), see
<a href="https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt">
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</a>
</p>
</body>
</description>
<references>
<cvename>CVE-2025-7424</cvename>
<cvename>CVE-2025-7425</cvename>
<url>https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</url>
<url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/139</url>
<url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/140</url>
<url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/144</url>
<url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/148</url>
<url>https://gitlab.gnome.org/GNOME/libxslt/-/commit/923903c59d668af42e3144bc623c9190a0f65988</url>
</references>
<dates>
<discovery>2025-04-10</discovery>
<entry>2025-07-12</entry>
</dates>
</vuln>
<vuln vid="abbc8912-5efa-11f0-ae84-99047d0a6bcc">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.14.5</lt></range>
</package>
<package>
<name>linux-c7-libxml2</name>
<range><lt>2.14.5</lt></range> <!-- needs update once fixed version appears -->
</package>
<package>
<name>linux-rl9-libxml2</name>
<range><lt>2.14.5</lt></range> <!-- needs update once fixed version appears -->
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="https://www.openwall.com/lists/oss-security/2025/06/16/6">
<p>As discussed in
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/913">https://gitlab.gnome.org/GNOME/libxml2/-/issues/913</a> the
security policy of libxml2 has been changed to disclose vulnerabilities
before fixes are available so that people other than the maintainer can
contribute to fixing security issues in this library.</p>
<p>As part of this, the following 5 CVE's have been disclosed recently:</p>
<p>(CVE-2025-49794) Heap use after free (UAF) leads to Denial of service (DoS)
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/931">https://gitlab.gnome.org/GNOME/libxml2/-/issues/931</a> [...]</p>
<p>(CVE-2025-49795) Null pointer dereference leads to Denial of service (DoS)
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/932">https://gitlab.gnome.org/GNOME/libxml2/-/issues/932</a> [...]</p>
<p>(CVE-2025-49796) Type confusion leads to Denial of service (DoS)
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/933">https://gitlab.gnome.org/GNOME/libxml2/-/issues/933</a> [...]</p>
<p>For all three of the above, note that upstream is considering removing Schematron support completely, as discussed in
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/935">https://gitlab.gnome.org/GNOME/libxml2/-/issues/935</a>.</p>
<p>(CVE-2025-6021) Integer Overflow Leading to Buffer Overflow in xmlBuildQName()
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/926">https://gitlab.gnome.org/GNOME/libxml2/-/issues/926</a> [...]</p>
<p>(CVE-2025-6170) Stack-based Buffer Overflow in xmllint Shell
<a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/941">https://gitlab.gnome.org/GNOME/libxml2/-/issues/941</a> [...]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6021</cvename>
<cvename>CVE-2025-6170</cvename>
<cvename>CVE-2025-49794</cvename>
<cvename>CVE-2025-49795</cvename>
<cvename>CVE-2025-49795</cvename>
<url>https://www.openwall.com/lists/oss-security/2025/06/16/6</url>
<url>https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/913</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/931</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/932</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/933</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/935</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/926</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/941</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-07-12</entry>
<modified>2025-07-15</modified>
</dates>
</vuln>
<vuln vid="61d74f80-5e9e-11f0-8baa-8447094a420f">
<topic>mod_http2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mod_http2</name>
<range><lt>2.0.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mod_http2 project reports:</p>
<blockquote cite="https://github.com/icing/mod_h2/releases/tag/v2.0.33">
<p>a client can increase memory consumption for a HTTP/2 connection
via repeated request header names,leading to denial of service</p>
<p>certain proxy configurations whith mod_proxy_http2 as the
backend, an assertion can be triggered by certain requests, leading
to denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-53020</cvename>
<cvename>CVE-2025-49630</cvename>
<url>https://github.com/icing/mod_h2/releases/tag/v2.0.33</url>
</references>
<dates>
<discovery>2025-07-10</discovery>
<entry>2025-07-11</entry>
</dates>
</vuln>
<vuln vid="342f2a0a-5e9b-11f0-8baa-8447094a420f">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>moderate: Apache HTTP Server: HTTP response splitting (CVE-2024-42516)</p>
<p>low: Apache HTTP Server: SSRF with mod_headers setting Content-Type header (CVE-2024-43204)</p>
<p>moderate: Apache HTTP Server: SSRF on Windows due to UNC paths (CVE-2024-43394)</p>
<p>low: Apache HTTP Server: mod_ssl error log variable escaping (CVE-2024-47252)</p>
<p>moderate: Apache HTTP Server: mod_ssl access control bypass with session resumption (CVE-2025-23048)</p>
<p>low: Apache HTTP Server: mod_proxy_http2 denial of service (CVE-2025-49630)</p>
<p>moderate: Apache HTTP Server: mod_ssl TLS upgrade attack (CVE-2025-49812)</p>
<p>moderate: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-42516</cvename>
<cvename>CVE-2024-43204</cvename>
<cvename>CVE-2024-43394</cvename>
<cvename>CVE-2024-47252</cvename>
<cvename>CVE-2025-23048</cvename>
<cvename>CVE-2025-49630</cvename>
<cvename>CVE-2025-49812</cvename>
<cvename>CVE-2025-53020</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2025-07-10</discovery>
<entry>2025-07-11</entry>
</dates>
</vuln>
<vuln vid="ef87346f-5dd0-11f0-beb2-ac5afc632ba3">
<topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>tomcat110</name>
<range><ge>11.0.0</ge><lt>11.0.9</lt></range>
</package>
<package>
<name>tomcat101</name>
<range><ge>10.1.0</ge><lt>10.1.43</lt></range>
</package>
<package>
<name>tomcat9</name>
<range><ge>9.0.0</ge><lt>9.0.107</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@apache.org reports:</p>
<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00710.html">
<p>A race condition on connection close could trigger a JVM crash when using the
APR/Native connector leading to a DoS. This was particularly noticeable with client
initiated closes of HTTP/2 connections.</p>
</blockquote>
<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00713.html">
<p>An uncontrolled resource consumption vulnerability if an HTTP/2 client did not
acknowledge the initial settings frame that reduces the maximum permitted
concurrent streams could result in a DoS.</p>
</blockquote>
<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00714.html">
<p>For some unlikely configurations of multipart upload, an Integer Overflow
vulnerability could lead to a DoS via bypassing of size limits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-52434</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-52434</url>
<cvename>CVE-2025-52520</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-52520</url>
<cvename>CVE-2025-53506</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-53506</url>
</references>
<dates>
<discovery>2025-07-10</discovery>
<entry>2025-07-10</entry>
<modified>2025-07-15</modified>
</dates>
</vuln>
<vuln vid="20823cc0-5d45-11f0-966e-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.1.0</ge><lt>18.1.2</lt></range>
<range><ge>18.0.0</ge><lt>18.0.4</lt></range>
<range><ge>13.3.0</ge><lt>17.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/">
<p>Cross-site scripting issue impacts GitLab CE/EE</p>
<p>Improper authorization issue impacts GitLab CE/EE</p>
<p>Improper authorization issue impacts GitLab EE</p>
<p>Improper authorization issue impacts GitLab EE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6948</cvename>
<cvename>CVE-2025-3396</cvename>
<cvename>CVE-2025-4972</cvename>
<cvename>CVE-2025-6168</cvename>
<url>https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/</url>
</references>
<dates>
<discovery>2025-07-09</discovery>
<entry>2025-07-10</entry>
</dates>
</vuln>
<vuln vid="2a4472ed-5c0d-11f0-b991-291fce777db8">
<topic>git -- multiple vulnerabilities</topic>
<affects>
<package>
<name>git</name>
<name>git-cvs</name>
<name>git-gui</name>
<name>git-p4</name>
<name>git-svn</name>
<range><lt>2.50.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git development team reports:</p>
<blockquote cite="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g">
<p>CVE-2025-27613: Gitk:
When a user clones an untrusted repository and runs Gitk without
additional command arguments, any writable file can be created and
truncated. The option "Support per-file encoding" must have been
enabled. The operation "Show origin of this line" is affected as
well, regardless of the option being enabled or not.
</p>
<p>CVE-2025-27614: Gitk:
A Git repository can be crafted in such a way that a user who has
cloned the repository can be tricked into running any script
supplied by the attacker by invoking `gitk filename`, where
`filename` has a particular structure.
</p>
<p>CVE-2025-46835: Git GUI:
When a user clones an untrusted repository and is tricked into
editing a file located in a maliciously named directory in the
repository, then Git GUI can create and overwrite any writable
file.
</p>
<p>CVE-2025-48384: Git:
When reading a config value, Git strips any trailing carriage
return and line feed (CRLF). When writing a config entry, values
with a trailing CR are not quoted, causing the CR to be lost when
the config is later read. When initializing a submodule, if the
submodule path contains a trailing CR, the altered path is read
resulting in the submodule being checked out to an incorrect
location. If a symlink exists that points the altered path to the
submodule hooks directory, and the submodule contains an executable
post-checkout hook, the script may be unintentionally executed
after checkout.
</p>
<p>CVE-2025-48385: Git:
When cloning a repository Git knows to optionally fetch a bundle
advertised by the remote server, which allows the server-side to
offload parts of the clone to a CDN. The Git client does not
perform sufficient validation of the advertised bundles, which
allows the remote side to perform protocol injection.
This protocol injection can cause the client to write the fetched
bundle to a location controlled by the adversary. The fetched
content is fully controlled by the server, which can in the worst
case lead to arbitrary code execution.
</p>
<p>CVE-2025-48386: Git:
The wincred credential helper uses a static buffer (`target`) as a
unique key for storing and comparing against internal storage. This
credential helper does not properly bounds check the available
space remaining in the buffer before appending to it with
`wcsncat()`, leading to potential buffer overflows.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27613</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27613</url>
<cvename>CVE-2025-27614</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27614</url>
<cvename>CVE-2025-46835</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46835</url>
<cvename>CVE-2025-48384</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48384</url>
<cvename>CVE-2025-48385</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48385</url>
<cvename>CVE-2025-48386</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48386</url>
</references>
<dates>
<discovery>2025-04-11</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="79251dc8-5bc5-11f0-834f-b42e991fc52e">
<topic>MongoDB -- Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections</topic>
<affects>
<package>
<name>mongodb60</name>
<range><lt>6.0.23</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.20</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-106753">
<p>MongoDB Server's mongos component can become
unresponsive to new connections due to incorrect handling of
incomplete data. This affects MongoDB when configured with
load balancer support.
Required Configuration:
This affects MongoDB sharded clusters when configured with load
balancer support for mongos using HAProxy on specified ports.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6714</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6714</url>
</references>
<dates>
<discovery>2025-07-07</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="77dc1fc4-5bc5-11f0-834f-b42e991fc52e">
<topic>MongoDB -- may be susceptible to privilege escalation due to $mergeCursors stage</topic>
<affects>
<package>
<name>mongodb60</name>
<range><lt>6.0.22</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-106752">
<p>An unauthorized user may leverage a specially crafted
aggregation pipeline to access data without proper
authorization due to improper handling of the $mergeCursors
stage in MongoDB Server. This may lead to access to data
without further authorisation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6713</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6713</url>
</references>
<dates>
<discovery>2025-07-07</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="764204eb-5bc5-11f0-834f-b42e991fc52e">
<topic>MongoDB -- may be susceptible to DoS due to Accumulated Memory Allocation</topic>
<affects>
<package>
<name>mongodb80</name>
<range><lt>8.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-106751">
<p>MongoDB Server may be susceptible to disruption caused by
high memory usage, potentially leading to server crash. This
condition is linked to inefficiencies in memory management
related to internal operations. In scenarios where certain
internal processes persist longer than anticipated, memory
consumption can increase, potentially impacting server
stability and availability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6712</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6712</url>
</references>
<dates>
<discovery>2025-07-07</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="72ddee1f-5bc5-11f0-834f-b42e991fc52e">
<topic>MongoDB -- Incomplete Redaction of Sensitive Information in MongoDB Server Logs</topic>
<affects>
<package>
<name>mongodb60</name>
<range><lt>6.0.21</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.18</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-98720">
<p>An issue has been identified in MongoDB Server where
unredacted queries may inadvertently appear in server logs
when certain error conditions are encountered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6711</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6711</url>
</references>
<dates>
<discovery>2025-07-07</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="c0f3f54c-5bc4-11f0-834f-b42e991fc52e">
<topic>ModSecurity -- empty XML tag causes segmentation fault</topic>
<affects>
<package>
<name>ap24-mod_security</name>
<range><lt>2.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/commit/ecd7b9736836eee391d25f35d5bd06a3ce35a45d">
<p>ModSecurity is an open source, cross platform web application
firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8
to before 2.9.11, an empty XML tag can cause a segmentation fault.
If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request
type is application/xml, and at least one XML tag is empty (eg
<foo></foo>), then a segmentation fault occurs. This
issue has been patched in version 2.9.11. A workaround involves
setting SecParseXmlIntoArgs to Off.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-52891</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-52891</url>
</references>
<dates>
<discovery>2025-07-02</discovery>
<entry>2025-07-08</entry>
</dates>
</vuln>
<vuln vid="7b3e7f71-5b30-11f0-b507-000c295725e4">
<topic>redis,valkey -- DoS Vulnerability due to bad connection error handling</topic>
<affects>
<package>
<name>redis</name>
<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
</package>
<package>
<name>redis74</name>
<range><ge>7.4.0</ge><lt>7.4.5</lt></range>
</package>
<package>
<name>redis72</name>
<range><ge>7.2.0</ge><lt>7.2.10</lt></range>
</package>
<package>
<name>redis62</name>
<range><ge>6.2.0</ge><lt>6.2.19</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>@julienperriercornet reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq">
<p>
An unauthenticated connection can cause repeated IP
protocol errors, leading to client starvation and,
ultimately, a denial of service.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-48367</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq</url>
</references>
<dates>
<discovery>2025-07-06</discovery>
<entry>2025-07-07</entry>
</dates>
</vuln>
<vuln vid="f11d0a69-5b2d-11f0-b507-000c295725e4">
<topic>redis,valkey -- Out of bounds write in hyperloglog commands leads to RCE</topic>
<affects>
<package>
<name>redis</name>
<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
</package>
<package>
<name>redis74</name>
<range><ge>7.4.0</ge><lt>7.4.5</lt></range>
</package>
<package>
<name>redis72</name>
<range><ge>7.2.0</ge><lt>7.2.10</lt></range>
</package>
<package>
<name>redis62</name>
<range><ge>6.2.0</ge><lt>6.2.19</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Seunghyun Lee reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43">
<p>
An authenticated user may use a specially crafted string
to trigger a stack/heap out of bounds write on hyperloglog
operations, potentially leading to remote code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32023</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43</url>
</references>
<dates>
<discovery>2025-07-06</discovery>
<entry>2025-07-07</entry>
</dates>
</vuln>
<vuln vid="4ea9cbc3-5b28-11f0-b507-000c295725e4">
<topic>redis,valkey -- {redis,valkey}-check-aof may lead to stack overflow and potential RCE</topic>
<affects>
<package>
<name>redis</name>
<range><ge>8.0.0</ge><lt>8.0.2</lt></range>
</package>
<package>
<name>redis74</name>
<range><ge>7.4.0</ge><lt>7.4.4</lt></range>
</package>
<package>
<name>redis72</name>
<range><ge>7.2.0</ge><lt>7.2.9</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simcha Kosman & CyberArk Labs reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm">
<p>A user can run the {redis,valkeyu}-check-aof cli and pass
a long file path to trigger a stack buffer overflow, which
may potentially lead to remote code execution.</p>
<p/>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27151</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm</url>
</references>
<dates>
<discovery>2025-05-28</discovery>
<entry>2025-07-07</entry>
</dates>
</vuln>
<vuln vid="7642ba72-5abf-11f0-87ba-002590c1f29c">
<topic>FreeBSD -- Use-after-free in multi-threaded xz decoder</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.2</ge><lt>14.2_4</lt></range>
<range><ge>13.5</ge><lt>13.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A worker thread could free its input buffer after decoding,
while the main thread might still be writing to it. This leads to
an use-after-free condition on heap memory.</p>
<h1>Impact:</h1>
<p>An attacker may use specifically crafted .xz file to cause
multi-threaded xz decoder to crash, or potentially run arbitrary
code under the credential the decoder was executed.</p>
</body>
</description>
<references>
<cvename>CVE-2025-31115</cvename>
<freebsdsa>SA-25:06.xz</freebsdsa>
</references>
<dates>
<discovery>2025-07-02</discovery>
<entry>2025-07-06</entry>
</dates>
</vuln>
<vuln vid="69bfe2a4-5a39-11f0-8792-4ccc6adda413">
<topic>gstreamer1-plugins-bad -- stack buffer overflow in H.266 video parser</topic>
<affects>
<package>
<name>gstreamer1-plugins-bad</name>
<range><lt>1.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2025-0007.html">
<p>It is possible for a malicious third party to trigger a buffer overflow that can
result in a crash of the application and possibly also allow code execution through
stack manipulation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6663</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2025-0007.html</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-07-06</entry>
</dates>
</vuln>
<vuln vid="a55d2120-58cf-11f0-b4ad-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>140.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1941377%2C1960948%2C1966187%2C1966505%2C1970764">
<p>An attacker was able to bypass the `connect-src`
directive of a Content Security Policy by manipulating
subdocuments. This would have also hidden the connections
from the Network tab in Devtools.</p>
<p>When Multi-Account Containers was enabled, DNS requests
could have bypassed a SOCKS proxy when the domain name was
invalid or the SOCKS proxy was not responding.</p>
<p>If a user visited a webpage with an invalid TLS
certificate, and granted an exception, the webpage was able to
provide a WebAuthn challenge that the user would be prompted
to complete. This is in violation of the WebAuthN spec which
requires "a secure transport established without
errors".</p>
<p>The exception page for the HTTPS-Only feature, displayed
when a website is opened via HTTP, lacked an anti-clickjacking
delay, potentially allowing an attacker to trick a user into
granting an exception and loading a webpage over HTTP.</p>
<p>If a user saved a response from the Network tab in Devtools
using the Save As context menu option, that file may not have
been saved with the `.download` file extension.
This could have led to the user inadvertently running a
malicious executable.</p>
<p>Memory safety bugs present in Firefox 139 and Thunderbird
139. Some of these bugs showed evidence of memory corruption
and we presume that with enough effort some of these could
have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6427</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6427</url>
<cvename>CVE-2025-6432</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6432</url>
<cvename>CVE-2025-6433</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6433</url>
<cvename>CVE-2025-6434</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6434</url>
<cvename>CVE-2025-6435</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6435</url>
<cvename>CVE-2025-6436</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6436</url>
</references>
<dates>
<discovery>2025-06-24</discovery>
<entry>2025-07-04</entry>
</dates>
</vuln>
<vuln vid="9bad6f79-58cf-11f0-b4ad-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>128.12.0,2</lt></range>
<range><lt>140.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971140">
<p>Firefox could have incorrectly parsed a URL and rewritten
it to the youtube.com domain when parsing the URL specified
in an `embed` tag. This could have bypassed website security
checks that restricted which domains users were allowed to
embed.</p>
<p>When a file download is specified via the
`Content-Disposition` header, that directive would be ignored
if the file was included via a `&lt;embed&gt;` or
`&lt;object&gt;` tag, potentially making a website
vulnerable to a cross-site scripting attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6429</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6429</url>
<cvename>CVE-2025-6430</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6430</url>
</references>
<dates>
<discovery>2025-06-24</discovery>
<entry>2025-07-04</entry>
</dates>
</vuln>
<vuln vid="9320590b-58cf-11f0-b4ad-b42e991fc52e">
<topic>Mozilla -- persistent UUID that identifies browser</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>140.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.25.0</lt></range>
<range><lt>128.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>140.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1717672">
<p>An attacker who enumerated resources from the WebCompat extension
could have obtained a persistent UUID that identified the browser,
and persisted between containers and normal/private browsing mode,
but not profiles. This vulnerability affects Firefox < 140,
Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird <
140, and Thunderbird < 128.12.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6425</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6425</url>
</references>
<dates>
<discovery>2025-06-24</discovery>
<entry>2025-07-04</entry>
</dates>
</vuln>
<vuln vid="d607b12c-5821-11f0-ab92-f02f7497ecda">
<topic>php -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php81</name>
<range><lt>8.1.33</lt></range>
</package>
<package>
<name>php82</name>
<range><lt>8.2.29</lt></range>
</package>
<package>
<name>php83</name>
<range><lt>8.3.23</lt></range>
</package>
<package>
<name>php84</name>
<range><lt>8.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php.net reports:</p>
<blockquote cite="https://www.php.net/ChangeLog-8.php">
<ul>
<li>
CVE-2025-1735: pgsql extension does not check for errors during escaping
</li>
<li>
CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
</li>
<li>
CVE-2025-1220: Null byte termination in hostnames
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1735</cvename>
<cvename>CVE-2025-6491</cvename>
<cvename>CVE-2025-1220</cvename>
</references>
<dates>
<discovery>2025-02-27</discovery>
<entry>2025-07-03</entry>
</dates>
</vuln>
<vuln vid="bab7386a-582f-11f0-97d0-b42e991fc52e">
<topic>Mozilla -- exploitable crash</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>140.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.25.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>140.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1966423">
<p>A use-after-free in FontFaceSet resulted in a potentially
exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6424</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6424</url>
</references>
<dates>
<discovery>2025-06-24</discovery>
<entry>2025-07-03</entry>
</dates>
</vuln>
<vuln vid="5c777f88-40ff-4e1e-884b-ad63dfb9bb15">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>138.0.7204.96</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>138.0.7204.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[427663123] High CVE-2025-6554: Type Confusion in V8.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6554</cvename>
<url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2025-06-30</discovery>
<entry>2025-07-02</entry>
</dates>
</vuln>
<vuln vid="9c91e1f8-f255-4b57-babe-2e385558f1dc">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>138.0.7204.49</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>138.0.7204.49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html">
<p>This update includes 11 security fixes:</p>
<ul>
<li>[407328533] Medium CVE-2025-6555: Use after free in Animation. Reported by Lyra Rebane (rebane2001) on 2025-03-30</li>
<li>[40062462] Low CVE-2025-6556: Insufficient policy enforcement in Loader. Reported by Shaheen Fazim on 2023-01-02</li>
<li>[406631048] Low CVE-2025-6557: Insufficient data validation in DevTools. Reported by Ameen Basha M K on 2025-03-27</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6555</cvename>
<cvename>CVE-2025-6556</cvename>
<cvename>CVE-2025-6557</cvename>
<url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2025-06-24</discovery>
<entry>2025-07-02</entry>
</dates>
</vuln>
<vuln vid="24f4b495-56a1-11f0-9621-93abbef07693">
<topic>sudo -- privilege escalation vulnerability through host and chroot options</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.9.17p1</lt></range>
</package>
<package>
<name>sudo-sssd</name>
<range><lt>1.9.17p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports, crediting Rich Mirch from Stratascale Cyber Research Unit (CRU):</p>
<blockquote cite="https://www.sudo.ws/releases/stable/">
<p>Sudo 1.9.17p1:</p>
<ul>
<li>
Fixed CVE-2025-32462. Sudo's -h (--host) option could be specified
when running a command or editing a file. This could enable a
local privilege escalation attack if the sudoers file allows the
user to run commands on a different host. For more information,
see Local Privilege Escalation via host option.
</li>
<li>
Fixed CVE-2025-32463. An attacker can leverage sudo's -R
(--chroot) option to run arbitrary commands as root, even if they
are not listed in the sudoers file. The chroot support has been
deprecated an will be removed entirely in a future release. For
more information, see Local Privilege Escalation via chroot
option.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32462</cvename>
<cvename>CVE-2025-32463</cvename>
<url>https://www.sudo.ws/releases/stable/</url>
<url>https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host</url>
<url>https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-07-01</entry>
</dates>
</vuln>
<vuln vid="8df49466-5664-11f0-943a-18c04d5ea3dc">
<topic>xorg server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.18,1</lt></range>
</package>
<package>
<name>xorg-nextserver</name>
<range><lt>21.1.18,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>24.1.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
<ul>
<li>
CVE-2025-49176: Integer overflow in Big Requests Extension
<p>The Big Requests extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-49176</cvename>
<url>https://lists.x.org/archives/xorg/2025-June/062055.html</url>
</references>
<dates>
<discovery>2025-06-17</discovery>
<entry>2025-07-01</entry>
</dates>
</vuln>
<vuln vid="b14cabf7-5663-11f0-943a-18c04d5ea3dc">
<topic>xorg server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.17,1</lt></range>
</package>
<package>
<name>xorg-nextserver</name>
<range><lt>21.1.17,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>24.1.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
<ul>
<li>
CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors)
<p>The X Rendering extension allows creating animated cursors providing a
list of cursors.
By default, the Xserver assumes at least one cursor is provided while a
client may actually pass no cursor at all, which causes an out-of-bound
read creating the animated cursor and a crash of the Xserver.</p>
</li>
<li>
CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode)
<p>The handler of XFixesSetClientDisconnectMode does not check the client
request length.
A client could send a shorter request and read data from a former
request.</p>
</li>
<li>
CVE-2025-49178: Unprocessed client request via bytes to ignore
<p>When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.</p>
</li>
<li>
CVE-2025-49179: Integer overflow in X Record extension
<p>The RecordSanityCheckRegisterClients() function in the X Record extension
implementation of the Xserver checks for the request length, but does not
check for integer overflow.
A client might send a very large value for either the number of clients
or the number of protocol ranges that will cause an integer overflow in
the request length computation, defeating the check for request length.</p>
</li>
<li>
CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty)
<p>A client might send a request causing an integer overflow when computing
the total size to allocate in RRChangeProviderProperty().</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-49175</cvename>
<cvename>CVE-2025-49177</cvename>
<cvename>CVE-2025-49178</cvename>
<cvename>CVE-2025-49179</cvename>
<cvename>CVE-2025-49180</cvename>
<url>https://lists.x.org/archives/xorg/2025-June/062055.html</url>
</references>
<dates>
<discovery>2025-06-17</discovery>
<entry>2025-07-01</entry>
</dates>
</vuln>
<vuln vid="6b1b8989-55b0-11f0-ac64-589cfc10a551">
<topic>podman -- TLS connection used to pull VM images was not validated</topic>
<affects>
<package>
<name>podman</name>
<range><lt>5.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat, Inc. reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6032">
<p>A flaw was found in Podman. The podman machine init command fails to verify the TLS
certificate when downloading the VM images from an OCI registry. This issue results
in a Man In The Middle attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6032</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6032</url>
</references>
<dates>
<discovery>2025-06-30</discovery>
<entry>2025-06-30</entry>
</dates>
</vuln>
<vuln vid="5e64770c-52aa-11f0-b522-b42e991fc52e">
<topic>MongoDB -- Running certain aggregation operations with the SBE engine may lead to unexpected behavior</topic>
<affects>
<package>
<name>mongodb60</name>
<range><lt>6.0.21</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.17</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-106746">
<p>An authenticated user may trigger a use after free that may result
in MongoDB Server crash and other unexpected behavior, even if the
user does not have authorization to shut down a server. The crash
is triggered on affected versions by issuing an aggregation framework
operation using a specific combination of rarely-used aggregation
pipeline expressions. This issue affects MongoDB Server v6.0 version
prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and
MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is
enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6706</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6706</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="5cd2bd2b-52aa-11f0-b522-b42e991fc52e">
<topic>MongoDB -- Race condition in privilege cache invalidation cycle</topic>
<affects>
<package>
<name>mongodb50</name>
<range><lt>5.0.31</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.24</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6707">
<p>Under certain conditions, an authenticated user request
may execute with stale privileges following an intentional
change by an authorized administrator.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6707</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6707</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="5b87eef6-52aa-11f0-b522-b42e991fc52e">
<topic>MongoDB -- Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication</topic>
<affects>
<package>
<name>mongodb60</name>
<range><lt>6.0.21</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.17</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6709">
<p>The MongoDB Server is susceptible to a denial of service
vulnerability due to improper handling of specific date
values in JSON input when using OIDC authentication.
This can be reproduced using the mongo shell to send a
malicious JSON payload leading to an invariant failure
and server crash. </p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6709</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6709</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="59ed4b19-52aa-11f0-b522-b42e991fc52e">
<topic>MongoDB -- Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB</topic>
<affects>
<package>
<name>mongodb70</name>
<range><lt>7.0.17</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-106749">
<p>MongoDB Server may be susceptible to stack overflow due to JSON
parsing mechanism, where specifically crafted JSON inputs may induce
unwarranted levels of recursion, resulting in excessive stack space
consumption. Such inputs can lead to a stack overflow that causes
the server to crash which could occur pre-authorisation. This issue
affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB
Server v8.0 versions prior to 8.0.5.
The same issue affects MongoDB Server v6.0 versions prior to 6.0.21,
but an attacker can only induce denial of service after authenticating.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6710</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6710</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="e26608ff-5266-11f0-b522-b42e991fc52e">
<topic>kanboard -- Password Reset Poisoning via Host Header Injection</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.2.45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Security Advisories reports:</p>
<blockquote cite="null">
<p>
Kanboard allows password reset emails to be sent with URLs
derived from the unvalidated Host header when the
application_url configuration is unset (default behavior).
This allows an attacker to craft a malicious password
reset link that leaks the token to an attacker-controlled
domain. If a victim (including an administrator) clicks
the poisoned link, their account can be taken over. This
affects all users who initiate a password reset while
application_url is not set.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-52560</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-52560</url>
</references>
<dates>
<discovery>2025-06-26</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="d45dabd9-5232-11f0-9ca4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.1.0</ge><lt>18.1.1</lt></range>
<range><ge>18.0.0</ge><lt>18.0.3</lt></range>
<range><ge>16.10.0</ge><lt>17.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/">
<p>Denial of Service impacts GitLab CE/EE</p>
<p>Missing Authentication issue impacts GitLab CE/EE</p>
<p>Improper access control issue impacts GitLab CE/EE</p>
<p>Elevation of Privilege impacts GitLab CE/EE</p>
<p>Improper access control issue impacts GitLab EE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3279</cvename>
<cvename>CVE-2025-1754</cvename>
<cvename>CVE-2025-5315</cvename>
<cvename>CVE-2025-2938</cvename>
<cvename>CVE-2025-5846</cvename>
<url>https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/</url>
</references>
<dates>
<discovery>2025-06-25</discovery>
<entry>2025-06-26</entry>
</dates>
</vuln>
<vuln vid="03ba1cdd-4faf-11f0-af06-00a098b42aeb">
<topic>cisco -- OpenH264 Decoding Functions Heap Overflow Vulnerability</topic>
<affects>
<package>
<name>openh264</name>
<range><lt>2.5.1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco reports:</p>
<blockquote cite="https://github.com/cisco/openh264/releases/tag/2.5.1">
<p>A vulnerability in the decoding functions
of OpenH264 codec library could allow a remote, unauthenticated
attacker to trigger a heap overflow. This vulnerability is due to
a race condition between a Sequence Parameter Set (SPS) memory
allocation and a subsequent non Instantaneous Decoder Refresh
(non-IDR) Network Abstraction Layer (NAL) unit memory usage. An
attacker could exploit this vulnerability by crafting a malicious
bitstream and tricking a victim user into processing an arbitrary
video containing the malicious bistream. An exploit could allow
the attacker to cause an unexpected crash in the victim's user
decoding client and, possibly, perform arbitrary commands on the
victim's host by abusing the heap overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27091</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27091</url>
</references>
<dates>
<discovery>2025-02-20</discovery>
<entry>2025-06-22</entry>
</dates>
</vuln>
<vuln vid="6c6c1507-4da5-11f0-afcc-f02f7432cf97">
<topic>clamav -- ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>1.2.0,1</ge><lt>1.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco reports:</p>
<blockquote cite="https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html">
<p>A vulnerability in Universal Disk Format (UDF) processing of ClamAV
could allow an unauthenticated, remote attacker to cause a denial
of service (DoS) condition on an affected device.
This vulnerability is due to a memory overread during UDF file
scanning. An attacker could exploit this vulnerability by submitting
a crafted file containing UDF content to be scanned by ClamAV on
an affected device. A successful exploit could allow the attacker
to terminate the ClamAV scanning process, resulting in a DoS condition
on the affected software. For a description of this vulnerability,
see the .</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-20234</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-20234</url>
</references>
<dates>
<discovery>2025-06-18</discovery>
<entry>2025-06-20</entry>
</dates>
</vuln>
<vuln vid="3dcc0812-4da5-11f0-afcc-f02f7432cf97">
<topic>clamav -- ClamAV PDF Scanning Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>1.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco reports:</p>
<blockquote cite="https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html">
<p>A vulnerability in the PDF scanning processes of ClamAV could allow
an unauthenticated, remote attacker to cause a buffer overflow
condition, cause a denial of service (DoS) condition, or execute
arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated
incorrectly when PDF files are processed. An attacker could exploit
this vulnerability by submitting a crafted PDF file to be scanned
by ClamAV on an affected device. A successful exploit could allow
the attacker to trigger a buffer overflow, likely resulting in the
termination of the ClamAV scanning process and a DoS condition on
the affected software. Although unproven, there is also a possibility
that an attacker could leverage the buffer overflow to execute
arbitrary code with the privileges of the ClamAV process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-20260</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-20260</url>
</references>
<dates>
<discovery>2025-06-18</discovery>
<entry>2025-06-20</entry>
</dates>
</vuln>
<vuln vid="333b4663-4cde-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.119</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>137.0.7151.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[420697404] High CVE-2025-6191: Integer overflow in V8. Reported by Shaheen Fazim on 2025-05-27</li>
<li>[421471016] High CVE-2025-6192: Use after free in Profiler. Reported by Chaoyuan Peng (@ret2happy) on 2025-05-31</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-6191</cvename>
<cvename>CVE-2025-6192</cvename>
<url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html</url>
</references>
<dates>
<discovery>2025-06-17</discovery>
<entry>2025-06-19</entry>
</dates>
</vuln>
<vuln vid="fc2d2fb8-4c83-11f0-8deb-f8f21e52f724">
<topic>Navidrome -- SQL Injection via role parameter</topic>
<affects>
<package>
<name>navidrome</name>
<range><gt>0.55.0</gt><lt>0.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Deluan reports:</p>
<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r">
<p>This vulnerability arises due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-48949</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-48949</url>
</references>
<dates>
<discovery>2025-05-29</discovery>
<entry>2025-06-18</entry>
</dates>
</vuln>
<vuln vid="6548cb01-4c33-11f0-8a97-6c3be5272acd">
<topic>Grafana -- DingDing contact points exposed in Grafana Alerting</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>10.4.19+security-01</lt></range>
<range><ge>11.0.0</ge><lt>11.2.10+security-01</lt></range>
<range><ge>11.3.0</ge><lt>11.3.7+security-01</lt></range>
<range><ge>11.4.0</ge><lt>11.4.5+security-01</lt></range>
<range><ge>11.5.0</ge><lt>11.5.5+security-01</lt></range>
<range><ge>11.6.0</ge><lt>11.6.2+security-01</lt></range>
<range><ge>12.0.0</ge><lt>12.0.1+security-01</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/">
<p>An incident occurred where the DingDing alerting integration URL
was inadvertently exposed to viewers due to a setting oversight,
which we learned about through a <a href="https://grafana.com/blog/2023/05/04/introducing-the-grafana-labs-bug-bounty-program/">bug bounty report</a>.</p>
<p>The CVSS 3.0 score for this vulnerability is 4.3 (Medium).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3415</cvename>
<url>https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/</url>
</references>
<dates>
<discovery>2025-04-05</discovery>
<entry>2025-06-18</entry>
</dates>
</vuln>
<vuln vid="ee046f5d-37a8-11f0-baaa-6c3be5272acd">
<topic>Grafana -- User deletion issue</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>5.4.0</ge><lt>10.4.18+security-01</lt></range>
<range><ge>11.0.0</ge><lt>11.2.9+security-01</lt></range>
<range><ge>11.3.0</ge><lt>11.3.6+security-01</lt></range>
<range><ge>11.4.0</ge><lt>11.4.4+security-01</lt></range>
<range><ge>11.5.0</ge><lt>11.5.4+security-01</lt></range>
<range><ge>11.6.0</ge><lt>11.6.1+security-01</lt></range>
<range><ge>12.0.0</ge><lt>12.0.0+security-01</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/">
<p>On April 15, we discovered a vulnerability that stems from the user
deletion logic associated with organization administrators.
An organization admin could remove any user from the specific
organization they manage. Additionally, they have the power to delete
users entirely from the system if they have no other org membership.
This leads to two situations:</p>
<ol>
<li>They can delete a server admin if the organization
the Organization Admin manages is the server admin’s final
organizational membership.</li>
<li>They can delete any user (regardless of whether they are a server
admin or not) if that user currently belongs to no organizations.</li>
</ol>
<p>These two situations allow an organization manager to disrupt
instance-wide activity by continually deleting server administrators
if there is only one organization or if the server administrators are
not part of any organization.</p>
<p>The CVSS score for this vulnerability is 5.5 Medium.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3580</cvename>
<url>https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/</url>
</references>
<dates>
<discovery>2025-04-15</discovery>
<entry>2025-05-23</entry>
</dates>
</vuln>
<vuln vid="b704d4b8-4b87-11f0-9605-b42e991fc52e">
<topic>Firefox -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>139.0.4,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970095">
<p>CVE-2025-49709: Certain canvas operations could have lead
to memory corruption.</p>
<p>CVE-2025-49710: An integer overflow was present in
`OrderedHashTable` used by the JavaScript engine.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-49709</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-49709</url>
<cvename>CVE-2025-49710</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-49710</url>
</references>
<dates>
<discovery>2025-06-11</discovery>
<entry>2025-06-17</entry>
</dates>
</vuln>
<vuln vid="e3d6d485-c93c-4ada-90b3-09f1c454fb8a">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.103</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>137.0.7151.103</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[$8000][420150619] High CVE-2025-5958: Use after free in Media. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2025-05-25</li>
<li>[NA][422313191] High CVE-2025-5959: Type Confusion in V8. Reported by Seunghyun Lee as part of TyphoonPWN 2025 on 2025-06-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5958</cvename>
<cvename>CVE-2025-5959</cvename>
<url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2025-06-10</discovery>
<entry>2025-06-17</entry>
</dates>
</vuln>
<vuln vid="4323e86c-2422-4fd7-8c8f-ec71c81ea7dd">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.68</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>137.0.7151.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[420636529] High CVE-2025-5419: Out of bounds read and write in V8. Reported by Clement Lecigne and Benoît Sevens of Google Threat Analysis Group on 2025-05-27. This issue was mitigated on 2025-05-28 by a configuration change pushed out to Stable across all Chrome platforms.</li>
<li>[409059706] Medium CVE-2025-5068: Use after free in Blink. Reported by Walkman on 2025-04-07</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5419</cvename>
<cvename>CVE-2025-5068</cvename>
<url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-06-02</discovery>
<entry>2025-06-17</entry>
</dates>
</vuln>
<vuln vid="201cccc1-4a01-11f0-b0f8-b42e991fc52e">
<topic>Mozilla -- control access bypass</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1917536">
<p>Thunderbird's update mechanism allowed a medium-integrity user
process to interfere with the SYSTEM-level updater by manipulating
the file-locking behavior. By injecting code into the user-privileged
process, an attacker could bypass intended access controls, allowing
SYSTEM-level file operations on paths controlled by a non-privileged
user and enabling privilege escalation. This vulnerability affects
Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23,
Thunderbird < 138, and Thunderbird < 128.10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2817</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-2817</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-06-15</entry>
</dates>
</vuln>
<vuln vid="805ad2e0-49da-11f0-87e8-bcaec55be5e5">
<topic>webmin -- CGI Command Injection Remote Code Execution</topic>
<affects>
<package>
<name>webmin</name>
<range><le>2.105</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webmin reports:</p>
<blockquote cite="https://webmin.com/security/">
<p>A less-privileged Webmin user can execute commands as root via a vulnerability in the shell autocomplete feature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12828</cvename>
<url>https://webmin.com/security/</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-12828</url>
</references>
<dates>
<discovery>2024-12-30</discovery>
<entry>2025-06-15</entry>
</dates>
</vuln>
<vuln vid="9449f018-84a3-490d-959f-38c05fbc77a7">
<topic>Yelp -- arbitrary file read</topic>
<affects>
<package>
<name>yelp-xsl</name>
<range><lt>42.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert@redhat.com reports:</p>
<blockquote cite="https://access.redhat.com/errata/RHSA-2025:4450">
<p>A flaw was found in Yelp. The Gnome user help application allows
the help document to execute arbitrary scripts. This vulnerability
allows malicious users to input help documents, which may exfiltrate
user files to an external environment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3155</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3155</url>
</references>
<dates>
<discovery>2025-04-03</discovery>
<entry>2025-06-14</entry>
</dates>
</vuln>
<vuln vid="0e200a73-289a-489e-b405-40b997911036">
<topic>Yelp -- arbitrary file read</topic>
<affects>
<package>
<name>yelp</name>
<range><lt>42.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert@redhat.com reports:</p>
<blockquote cite="https://access.redhat.com/errata/RHSA-2025:4450">
<p>A flaw was found in Yelp. The Gnome user help application allows
the help document to execute arbitrary scripts. This vulnerability
allows malicious users to input help documents, which may exfiltrate
user files to an external environment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3155</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3155</url>
</references>
<dates>
<discovery>2025-04-03</discovery>
<entry>2025-06-14</entry>
</dates>
</vuln>
<vuln vid="ae028662-475e-11f0-9ca4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.0.0</ge><lt>18.0.2</lt></range>
<range><ge>17.11.0</ge><lt>17.11.4</lt></range>
<range><ge>2.1.0</ge><lt>17.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/">
<p>HTML injection impacts GitLab CE/EE</p>
<p>Cross-site scripting issue impacts GitLab CE/EE</p>
<p>Missing authorization issue impacts GitLab Ultimate EE</p>
<p>Denial of Service impacts GitLab CE/EE</p>
<p>Denial of Service via unbounded Webhook token names impacts GitLab CE/EE</p>
<p>Denial of Service via unbounded Board Names impacts GitLab CE/EE</p>
<p>Information disclosure issue impacts GitLab CE/EE</p>
<p>Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE</p>
<p>Information disclosure via authorization bypass impacts GitLab CE/EE</p>
<p>Sensitive information disclosure via Group IP restriction bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4278</cvename>
<cvename>CVE-2025-2254</cvename>
<cvename>CVE-2025-5121</cvename>
<cvename>CVE-2025-0673</cvename>
<cvename>CVE-2025-1516</cvename>
<cvename>CVE-2025-1478</cvename>
<cvename>CVE-2024-9512</cvename>
<cvename>CVE-2025-5996</cvename>
<cvename>CVE-2025-5195</cvename>
<cvename>CVE-2025-5982</cvename>
<url>https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/</url>
</references>
<dates>
<discovery>2025-06-11</discovery>
<entry>2025-06-12</entry>
</dates>
</vuln>
<vuln vid="2a220a73-4759-11f0-a44a-6cc21735f730">
<topic>PostgreSQL JDBC library -- Improper Authentication</topic>
<affects>
<package>
<name>postgresql-jdbc</name>
<range><lt>42.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL JDBC Driver project reports:</p>
<blockquote cite="https://jdbc.postgresql.org/changelogs/2025-06-11-42">
<p>
Client Allows Fallback to Insecure Authentication Despite
channelBinding=require configuration. Fix channel binding
required handling to reject non-SASL authentication Previously,
when channel binding was set to "require", the driver
would silently ignore this requirement for non-SASL
authentication methods. This could lead to a false sense of
security when channel binding was explicitly requested but not
actually enforced. The fix ensures that when channel binding is
set to "require", the driver will reject connections that use
non-SASL authentication methods or when SASL authentication has
not completed properly.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-49146</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-49146</url>
</references>
<dates>
<discovery>2025-06-12</discovery>
<entry>2025-06-12</entry>
</dates>
</vuln>
<vuln vid="fa1d42c8-42fe-11f0-a9fa-b42e991fc52e">
<topic>ModSecurity -- possible DoS vulnerability</topic>
<affects>
<package>
<name>ap24-mod_security</name>
<range><lt>2.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e">
<p>
ModSecurity is an open source, cross platform web
application firewall (WAF) engine for Apache, IIS
and Nginx. Versions prior to 2.9.10 contain a denial of
service vulnerability similar to
GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg`
(and `sanitizeArg` - this is the same action but an
alias) is vulnerable to adding an excessive number
of arguments, thereby leading to denial of service.
Version 2.9.10 fixes the issue. As a workaround, avoid
using rules that contain the `sanitiseArg` (or
`sanitizeArg`) action.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-48866</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-48866</url>
</references>
<dates>
<discovery>2025-06-02</discovery>
<entry>2025-06-06</entry>
</dates>
</vuln>
<vuln vid="ecea70d2-42fe-11f0-a9fa-b42e991fc52e">
<topic>ModSecurity -- possible DoS vulnerability</topic>
<affects>
<package>
<name>ap24-mod_security</name>
<range><lt>2.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
<p>ModSecurity is an open source, cross platform web
application firewall (WAF) engine for Apache, IIS and Nginx.
Versions up to and including 2.9.8 are vulnerable to denial
of service in one special case (in stable released versions):
when the payload's content type is `application/json`,
and there is at least one rule which does a
`sanitiseMatchedBytes` action. A patch is available at
pull request 3389 and expected to be part of version 2.9.9.
No known workarounds are available.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-47947</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
</references>
<dates>
<discovery>2025-05-21</discovery>
<entry>2025-06-06</entry>
</dates>
</vuln>
<vuln vid="63268efe-4222-11f0-976e-b42e991fc52e">
<topic>Mozilla -- clickjacking vulnerability</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>128.11.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1954137">
<p>A clickjacking vulnerability could have been used to trick a user
into leaking saved payment card details to a malicious page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5267</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5267</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-06-05</entry>
</dates>
</vuln>
<vuln vid="61be5684-4222-11f0-976e-b42e991fc52e">
<topic>Mozilla -- XS-leak attack</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>128.11.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1965628">
<p>Script elements loading cross-origin resources generated load and
error events which leaked information enabling XS-Leaks attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5266</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5266</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-06-05</entry>
</dates>
</vuln>
<vuln vid="5ec0b4e5-4222-11f0-976e-b42e991fc52e">
<topic>Mozilla -- local code execution</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>115.24.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1950001">
<p>Due to insufficient escaping of the newline character in the Copy
as cURL feature, an attacker could trick a user into using this
command, potentially leading to local code execution on the user's
system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5264</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5264</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-06-05</entry>
</dates>
</vuln>
<vuln vid="5d1e56dc-4222-11f0-976e-b42e991fc52e">
<topic>Mozilla -- cross-origin leak attack</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>115.24.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1960745">
<p>Error handling for script execution was incorrectly isolated from
web content, which could have allowed cross-origin leak attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5263</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5263</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-06-05</entry>
</dates>
</vuln>
<vuln vid="5759c6e2-410a-11f0-a945-b42e991fc52e">
<topic>Chrome -- Out of bounds read</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chrome-cve-admin@google.com reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html">
<p>Out of bounds read and write in V8 in Google Chrome prior
to 137.0.7151.68 allowed a remote attacker to potentially
exploit heap corruption via a crafted HTML page.
(Chromium security severity: High)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5419</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5419</url>
</references>
<dates>
<discovery>2025-06-03</discovery>
<entry>2025-06-04</entry>
</dates>
</vuln>
<vuln vid="8c94ae2a-06f5-4383-9a7f-1211cb0dd476">
<topic>electron{34,35,36} -- Out of bounds read and write in V8</topic>
<affects>
<package>
<name>electron34</name>
<range><lt>34.5.8</lt></range>
</package>
<package>
<name>electron35</name>
<range><lt>35.5.1</lt></range>
</package>
<package>
<name>electron36</name>
<range><lt>36.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v35.5.1">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2025-5419.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5419</cvename>
<url>https://github.com/advisories/GHSA-x828-wp24-7h9m</url>
</references>
<dates>
<discovery>2025-06-04</discovery>
<entry>2025-06-04</entry>
<modified>2025-06-04</modified>
</dates>
</vuln>
<vuln vid="0d6094a2-4095-11f0-8c92-00d861a0e66d">
<topic>Post-Auth Remote Code Execution found in Roundcube Webmail</topic>
<affects>
<package>
<name>roundcube-php81</name>
<range><lt>1.6.11</lt></range>
</package>
<package>
<name>roundcube-php82</name>
<range><lt>1.6.11</lt></range>
</package>
<package>
<name>roundcube-php83</name>
<range><lt>1.6.11</lt></range>
</package>
<package>
<name>roundcube-php84</name>
<range><lt>1.6.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube Webmail reports:</p>
<blockquote cite="https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10">
<p>Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-49113</cvename>
<url>https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10</url>
</references>
<dates>
<discovery>2025-06-01</discovery>
<entry>2025-06-03</entry>
</dates>
</vuln>
<vuln vid="dc99c67a-3fc9-11f0-a39d-b42e991fc52e">
<topic>Gimp -- GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>3.0.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zdi-disclosures@trendmicro.com reports:</p>
<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-25-204/">
<p>GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution
Vulnerability. This vulnerability allows remote attackers to execute
arbitrary code on affected installations of GIMP. User interaction
is required to exploit this vulnerability in that the target must
visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of FLI files. The issue
results from the lack of proper validation of user-supplied data,
which can result in a write past the end of an allocated buffer.
An attacker can leverage this vulnerability to execute code in the
context of the current process. Was ZDI-CAN-25100.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2761</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-2761</url>
</references>
<dates>
<discovery>2025-04-23</discovery>
<entry>2025-06-02</entry>
</dates>
</vuln>
<vuln vid="da0a4374-3fc9-11f0-a39d-b42e991fc52e">
<topic>Gimp -- GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>3.0.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zdi-disclosures@trendmicro.com reports:</p>
<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-25-203/">
<p>GIMP XWD File Parsing Integer Overflow Remote Code Execution
Vulnerability. This vulnerability allows remote attackers to execute
arbitrary code on affected installations of GIMP. User interaction
is required to exploit this vulnerability in that the target must
visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XWD files. The issue
results from the lack of proper validation of user-supplied data,
which can result in an integer overflow before allocating a buffer.
An attacker can leverage this vulnerability to execute code in the
context of the current process. Was ZDI-CAN-25082.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2760</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-2760</url>
</references>
<dates>
<discovery>2025-04-23</discovery>
<entry>2025-06-02</entry>
</dates>
</vuln>
<vuln vid="533b4470-3f25-11f0-b440-f02f7432cf97">
<topic>curl -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>8.5.0</ge><lt>8.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security team reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<p>CVE-2025-5025: No QUIC certificate pinning with wolfSSL</p>
<p>CVE-2025-4947: QUIC certificate check skip with wolfSSL</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5025</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5025</url>
<cvename>CVE-2025-4947</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4947</url>
</references>
<dates>
<discovery>2025-05-28</discovery>
<entry>2025-06-01</entry>
</dates>
</vuln>
<vuln vid="2926c487-3e53-11f0-95d4-00a098b42aeb">
<topic>libxml2 -- Out-of-bounds memory access</topic>
<affects>
<package>
<name>py39-libxml2</name>
<name>py310-libxml2</name>
<name>py311-libxml2</name>
<name>py312-libxml2</name>
<range><lt>2.11.9_3</lt></range>
<range><ge>2.12.0</ge><lt>2.13.8</lt></range>
<range><ge>2.14.0</ge><lt>2.14.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/889">
<p>In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds
memory access can occur in the Python API (Python bindings) because
of an incorrect return value. This occurs in xmlPythonFileRead and
xmlPythonFileReadRaw because of a difference between bytes and
characters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32414</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-32414</url>
</references>
<dates>
<discovery>2025-04-08</discovery>
<entry>2025-05-31</entry>
</dates>
</vuln>
<vuln vid="fdd02be0-3e50-11f0-95d4-00a098b42aeb">
<topic>libxml2 -- Stack-based Buffer Overflow</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.11.9_1</lt></range>
<range><ge>2.12.0</ge><lt>2.12.10</lt></range>
<range><ge>2.13.0</ge><lt>2.13.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/847">
<p>libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based
buffer overflow in xmlSnprintfElements in valid.c. To exploit this,
DTD validation must occur for an untrusted document or untrusted
DTD. NOTE: this is similar to CVE-2017-9047.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-24928</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-24928</url>
</references>
<dates>
<discovery>2025-02-18</discovery>
<entry>2025-05-31</entry>
</dates>
</vuln>
<vuln vid="bd2af307-3e50-11f0-95d4-00a098b42aeb">
<topic>libxml2 -- Use After Free</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.11.9_1</lt></range>
<range><ge>2.12.0</ge><lt>2.12.10</lt></range>
<range><ge>2.13.0</ge><lt>2.13.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/828">
<p>libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free
in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in
xmlschemas.c. To exploit this, a crafted XML document must be
validated against an XML schema with certain identity constraints,
or a crafted XML schema must be used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-56171</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-56171</url>
</references>
<dates>
<discovery>2025-02-18</discovery>
<entry>2025-05-31</entry>
</dates>
</vuln>
<vuln vid="25acd603-3dde-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.55</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>137.0.7151.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html">
<p>This update includes 11 security fixes:</p>
<ul>
<li>[411573532] High CVE-2025-5063: Use after free in Compositing. Reported by Anonymous on 2025-04-18</li>
<li>[417169470] High CVE-2025-5280: Out of bounds write in V8. Reported by [pwn2car] on 2025-05-12</li>
<li>[40058068] Medium CVE-2025-5064: Inappropriate implementation in Background Fetch API. Reported by Maurice Dauer on 2021-11-29</li>
<li>[40059071] Medium CVE-2025-5065: Inappropriate implementation in FileSystemAccess API. Reported by NDevTK on 2022-03-11</li>
<li>[356658477] Medium CVE-2025-5066: Inappropriate implementation in Messages. Reported by Mohit Raj (shadow2639) on 2024-07-31</li>
<li>[417215501] Medium CVE-2025-5281: Inappropriate implementation in BFCache. Reported by Jesper van den Ende (Pelican Party Studios) on 2025-05-12</li>
<li>[419467315] Medium CVE-2025-5283: Use after free in libvpx. Reported by Mozilla on 2025-05-22</li>
<li>[40075024] Low CVE-2025-5067: Inappropriate implementation in Tab Strip. Reported by Khalil Zhani on 2023-10-17</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5063</cvename>
<cvename>CVE-2025-5280</cvename>
<cvename>CVE-2025-5064</cvename>
<cvename>CVE-2025-5065</cvename>
<cvename>CVE-2025-5066</cvename>
<cvename>CVE-2025-5281</cvename>
<cvename>CVE-2025-5283</cvename>
<cvename>CVE-2025-5067</cvename>
<url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-31</entry>
</dates>
</vuln>
<vuln vid="4864aec7-3d80-11f0-9a55-b42e991fc52e">
<topic>Chrome -- Heap corruption exploitation</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>137.0.7151.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chrome-cve-admin@google.com reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html">
<p>Use after free in Compositing in Google Chrome prior to
137.0.7151.55 allowed a remote attacker to potentially
exploit heap corruption via a crafted HTML page.
(Chromium security severity: High)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5063</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5063</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a6e1b7ee-3d7c-11f0-9a55-b42e991fc52e">
<topic>Mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>128.11.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.11.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1924108">
<p>Memory safety bug present in Firefox ESR 128.10, and
Thunderbird 128.10.
This bug showed evidence of memory corruption and we presume
that with enough effort this could have been exploited to run
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5269</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5269</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a5b553e5-3d7c-11f0-9a55-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1950136%2C1958121%2C1960499%2C1962634">
<p>Memory safety bugs present in Firefox 138, Thunderbird
138, Firefox ESR 128.10, and Thunderbird 128.10.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5268</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5268</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a470ac63-3d7c-11f0-9a55-b42e991fc52e">
<topic>Firefox -- unencrypted SNI</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1910298">
<p>In certain cases, SNI could have been sent unencrypted
even when encrypted DNS was enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5270</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5270</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a3291f81-3d7c-11f0-9a55-b42e991fc52e">
<topic>Firefox -- content injection attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1920348">
<p>Previewing a response in Devtools ignored CSP headers,
which could have allowed content injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5271</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5271</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a14dbea7-3d7c-11f0-9a55-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>139.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>129.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1726254%2C1742738%2C1960121">
<p>Memory safety bugs present in Firefox 138 and Thunderbird
138. Some of these bugs showed evidence of memory corruption
and we presume that with enough effort some of these could
have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-5272</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5272</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="a372abb0-3d3c-11f0-86e7-b42e991fc52e">
<topic>ModSecurity -- Possible DoS Vulnerability</topic>
<affects>
<package>
<name>ap24-mod_security</name>
<range><lt>2.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
<p>ModSecurity is an open source, cross platform web application
firewall (WAF) engine for Apache, IIS and Nginx. Versions up to
and including 2.9.8 are vulnerable to denial of service in one
special case (in stable released versions): when the payload's
content type is `application/json`, and there is at least one rule
which does a `sanitiseMatchedBytes` action. A patch is available
at pull request 3389 and expected to be part of version 2.9.9. No
known workarounds are available.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-47947</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
</references>
<dates>
<discovery>2025-05-21</discovery>
<entry>2025-05-30</entry>
</dates>
</vuln>
<vuln vid="67dd7a9e-3cd8-11f0-b601-5404a68ad561">
<topic>traefik -- Path traversal vulnerability</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik project reports:</p>
<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5">
<p>There is a potential vulnerability in Traefik managing the requests
using a PathPrefix, Path or PathRegex matcher. When Traefik is configured
to route the requests to a backend using a matcher based on the path, if
the URL contains a URL encoded string in its path, it's possible to target
a backend, exposed using another router, by-passing the middlewares chain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-47952</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-47952</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2025-05-29</entry>
</dates>
</vuln>
<vuln vid="c36decbe-3c84-11f0-8d29-b42e991fc52e">
<topic>glpi-project -- GLPI multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.18">
<p>
CVE-2024-11955: A vulnerability was found in GLPI up to
10.0.17. It has been declared as problematic. Affected by
this vulnerability is an unknown functionality of the file
/index.php.
The manipulation of the argument redirect leads to
open redirect. The attack can be launched remotely.
The exploit has been disclosed to the public and
may be used. Upgrading to version 10.0.18 is able to
address this issue.
It is recommended to upgrade the affected component.
</p>
<p>
CVE-2025-23024: Starting in version 0.72 and prior to
version 10.0.18, an anonymous user can disable all the
active plugins. Version 10.0.18 contains a patch.
As a workaround, one may delete the `install/update.php`
file.
</p>
<p>
CVE-2025-23046: Prior to version 10.0.18, a low privileged
user can enable debug mode and access sensitive information.
Version 10.0.18 contains a patch.
As a workaround, one may delete the `install/update.php`
file.
</p>
<p>
CVE-2025-25192: Starting in version 9.5.0 and prior to
version 10.0.18, if a "Mail servers"
authentication provider is configured to use an Oauth
connection provided by the OauthIMAP plugin, anyone can
connect to GLPI using a user name on which an Oauth
authorization has already been established.
Version 10.0.18 contains a patch. As a
workaround, one may disable any "Mail
servers" authentication provider configured to
use an Oauth connection provided by the OauthIMAP
plugin.
</p>
<p>
CVE-2025-21626: Starting in version 0.71 and prior to
version 10.0.18, an anonymous user can fetch sensitive
information from the `status.php` endpoint.
Version 10.0.18 contains a fix for the issue.
Some workarounds are available. One may delete the
`status.php` file, restrict its access, or
remove any sensitive values from the `name` field of
the active LDAP directories, mail servers authentication
providers and mail receivers.
</p>
<p>
CVE-2025-21627: In versions prior to 10.0.18, a malicious
link can be crafted to perform a reflected XSS attack on the
search page. If the anonymous ticket creation is enabled,
this attack can be performed by an unauthenticated
user. Version 10.0.18 contains a fix for the issue.
</p>
<p>
CVE-2025-21619: An administrator user can perfom a SQL
injection through the rules configuration forms.
This vulnerability is fixed in 10.0.18.
</p>
<p>
CVE-2025-24799: An unauthenticated user can perform a SQL
injection through the inventory endpoint.
This vulnerability is fixed in 10.0.18.
</p>
<p>
CVE-2025-24801: An authenticated user can upload and force
the execution of *.php files located on the GLPI server.
This vulnerability is fixed in 10.0.18.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11955</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11955</url>
<cvename>CVE-2025-23024</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-23024</url>
<cvename>CVE-2025-23046</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-23046</url>
<cvename>CVE-2025-25192</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-25192</url>
<cvename>CVE-2025-21626</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-21626</url>
<cvename>CVE-2025-21627</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-21627</url>
<cvename>CVE-2025-21619</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-21619</url>
<cvename>CVE-2025-24799</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-24799</url>
<cvename>CVE-2025-24801</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-24801</url>
</references>
<dates>
<discovery>2025-02-25</discovery>
<entry>2025-05-29</entry>
</dates>
</vuln>
<vuln vid="47ef0ac6-38fc-4b35-850b-c794f04619fe">
<topic>electron{34,35} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron34</name>
<range><lt>34.5.7</lt></range>
</package>
<package>
<name>electron35</name>
<range><lt>35.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v34.5.7">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2025-4609.</li>
<li>Security: backported fix for CVE-2025-4664.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4609</cvename>
<cvename>CVE-2025-4664</cvename>
<url>https://github.com/advisories/GHSA-vxhm-55mv-5fhx</url>
</references>
<dates>
<discovery>2025-05-29</discovery>
<entry>2025-05-29</entry>
</dates>
</vuln>
<vuln vid="34744aab-3bf7-11f0-b81c-001b217e4ee5">
<topic>ISC KEA -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>kea</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Internet Systems Consortium, Inc. reports:</p>
<blockquote cite="https://kb.isc.org/docs/">
<ul>
<li>Loading a malicious hook library can lead to local privilege escalation https://kb.isc.org/docs/cve-2025-32801</li>
<li>Insecure handling of file paths allows multiple local attacks https://kb.isc.org/docs/cve-2025-32802</li>
<li>Insecure file permissions can result in confidential information leakage https://kb.isc.org/docs/cve-2025-32803</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32801</cvename>
<cvename>CVE-2025-32802</cvename>
<cvename>CVE-2025-32803</cvename>
</references>
<dates>
<discovery>2025-05-28</discovery>
<entry>2025-05-28</entry>
</dates>
</vuln>
<vuln vid="45eb98d6-3b13-11f0-97f7-b42e991fc52e">
<topic>grafana -- XSS vulnerability</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>10.4.18+security-01</lt></range>
<range><ge>11.0.0</ge><lt>11.2.9+security-01</lt></range>
<range><ge>11.3.0</ge><lt>11.3.6+security-01</lt></range>
<range><ge>11.4.0</ge><lt>11.4.4+security-01</lt></range>
<range><ge>11.5.0</ge><lt>11.5.4+security-01</lt></range>
<range><ge>11.6.0</ge><lt>11.6.1+security-01</lt></range>
<range><ge>12.0.0</ge><lt>12.0.0+security-01</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@grafana.com reports:</p>
<blockquote cite="https://grafana.com/security/security-advisories/cve-2025-4123/">
<p>A cross-site scripting (XSS) vulnerability exists in Grafana caused
by combining a client path traversal and open redirect. This allows
attackers to redirect users to a website that hosts a frontend
plugin that will execute arbitrary JavaScript. This vulnerability
does not require editor permissions and if anonymous access is
enabled, the XSS will work. If the Grafana Image Renderer plugin
is installed, it is possible to exploit the open redirect to achieve
a full read SSRF.
The default Content-Security-Policy (CSP) in Grafana will block the
XSS though the `connect-src` directive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4123</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4123</url>
</references>
<dates>
<discovery>2025-04-26</discovery>
<entry>2025-05-27</entry>
</dates>
</vuln>
<vuln vid="e587b52d-38ac-11f0-b7b6-dcfe074bd614">
<topic>cpython -- Use-after-free in "unicode_escape" decoder with error handler</topic>
<affects>
<package>
<name>python39</name>
<range><lt>3.9.22_1</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.17_1</lt></range>
</package>
<package>
<name>python311</name>
<range><lt>3.11.12_1</lt></range>
</package>
<package>
<name>python312</name>
<range><lt>3.12.10_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@python.org reports:</p>
<blockquote cite="https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142">
<p>There is an issue in CPython when using
`bytes.decode("unicode_escape",
error="ignore|replace")`. If you are not using the
"unicode_escape" encoding or an error handler your
usage is not affected. To work-around this issue you may stop
using the error= handler and instead wrap the bytes.decode()
call in a try-except catching the DecodeError.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4516</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4516</url>
</references>
<dates>
<discovery>2025-05-15</discovery>
<entry>2025-05-24</entry>
</dates>
</vuln>
<vuln vid="5baa64d6-37ee-11f0-a116-8447094a420f">
<topic>OpenSSL -- Inverted security logic in x509 app</topic>
<affects>
<package>
<name>openssl35</name>
<range><lt>3.5.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://openssl-library.org/news/secadv/20250522.txt">
<p>The x509 application adds trusted use instead of rejected use (low)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4575</cvename>
<url>https://openssl-library.org/news/secadv/20250522.txt</url>
</references>
<dates>
<discovery>2025-05-23</discovery>
<entry>2025-05-23</entry>
</dates>
</vuln>
<vuln vid="6529e5e7-36d5-11f0-8f57-b42e991fc52e">
<topic>Firefox -- memory corruption due to race condition</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1951554">
<p>A race condition existed in nsHttpTransaction that could
have been exploited to cause memory corruption, potentially
leading to an exploitable condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3608</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3608</url>
</references>
<dates>
<discovery>2025-04-15</discovery>
<entry>2025-05-22</entry>
</dates>
</vuln>
<vuln vid="a1a1b0c2-3791-11f0-8600-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.0.0</ge><lt>18.0.1</lt></range>
<range><ge>17.11.0</ge><lt>17.11.3</lt></range>
<range><ge>10.2.0</ge><lt>17.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/">
<p>Unprotected large blob endpoint in GitLab allows Denial of Service</p>
<p>Improper XPath validation allows modified SAML response to bypass 2FA requirement</p>
<p>A Discord webhook integration may cause DoS</p>
<p>Unbounded Kubernetes cluster tokens may lead to DoS</p>
<p>Unvalidated notes position may lead to Denial of Service</p>
<p>Hidden/masked variables may get exposed in the UI</p>
<p>Two-factor authentication requirement bypass</p>
<p>View full email addresses that should be partially obscured</p>
<p>Branch name confusion in confidential MRs</p>
<p>Unauthorized access to job data via a GraphQL query</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0993</cvename>
<cvename>CVE-2024-12093</cvename>
<cvename>CVE-2024-7803</cvename>
<cvename>CVE-2025-3111</cvename>
<cvename>CVE-2025-2853</cvename>
<cvename>CVE-2025-4979</cvename>
<cvename>CVE-2025-0605</cvename>
<cvename>CVE-2025-0679</cvename>
<cvename>CVE-2024-9163</cvename>
<cvename>CVE-2025-1110</cvename>
<url>https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/</url>
</references>
<dates>
<discovery>2025-05-21</discovery>
<entry>2025-05-23</entry>
</dates>
</vuln>
<vuln vid="4abd86c1-366d-11f0-9c0c-000c29ffbb6c">
<topic>screen -- multiple vulnerabilities</topic>
<affects>
<package>
<name>screen</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The screen project reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html">
<p>Multiple security issues in screen.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-46805</cvename>
<cvename>CVE-2025-46804</cvename>
<cvename>CVE-2025-46803</cvename>
<cvename>CVE-2025-46802</cvename>
<cvename>CVE-2025-23395</cvename>
<url>https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html</url>
</references>
<dates>
<discovery>2025-05-12</discovery>
<entry>2025-05-21</entry>
</dates>
</vuln>
<vuln vid="07560111-34cc-11f0-af94-b42e991fc52e">
<topic>firefox -- out-of-bounds read/write</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0.4,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1966614">
<p>An attacker was able to perform an out-of-bounds read or
write on a JavaScript object by confusing array index sizes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4918</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4918</url>
<cvename>CVE-2025-4919</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4919</url>
</references>
<dates>
<discovery>2025-05-17</discovery>
<entry>2025-05-19</entry>
</dates>
</vuln>
<vuln vid="46594aa3-32f7-11f0-a116-8447094a420f">
<topic>WeeChat -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>4.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Weechat project reports:</p>
<blockquote cite="https://weechat.org/doc/weechat/security/">
<p>Multiple integer and buffer overflows in WeeChat core.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/doc/weechat/security/</url>
</references>
<dates>
<discovery>2025-05-11</discovery>
<entry>2025-05-17</entry>
</dates>
</vuln>
<vuln vid="79400d31-3166-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>136.0.7103.113</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>136.0.7103.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[415810136] High CVE-2025-4664: Insufficient policy enforcement in Loader. Source: X post from @slonser_ on 2025-05-05</li>
<li>[412578726] High CVE-2025-4609: Incorrect handle provided in unspecified circumstances in Mojo. Reported by Micky on 2025-04-22</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4664</cvename>
<cvename>CVE-2025-4609</cvename>
<url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2025-05-14</discovery>
<entry>2025-05-15</entry>
</dates>
</vuln>
<vuln vid="52efdd56-30bd-11f0-81be-b42e991fc52e">
<topic>Mozilla -- memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1951161%2C1952105">
<p>Memory safety bugs present in Firefox 137, Thunderbird 137,
Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs
showed evidence of memory corruption and we presume that
with enough effort some of these could have been exploited
to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4091</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4091</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-14</entry>
</dates>
</vuln>
<vuln vid="4f17db64-30bd-11f0-81be-b42e991fc52e">
<topic>Mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox-esr</name>
<range><lt>128.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1894100">
<p>Memory safety bug present in Firefox ESR 128.9, and
Thunderbird 128.9. This bug showed evidence of memory
corruption and we presume that with enough effort this could
have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4093</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4093</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-14</entry>
</dates>
</vuln>
<vuln vid="6f10b49d-07b1-4be4-8abf-edf880b16ad2">
<topic>vscode -- security feature bypass vulnerability</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VSCode developers report:</p>
<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-742r-ggwg-vqxm">
<p>A security feature bypass vulnerability exists in VS Code 1.100.0 and earlier versions where a maliciously crafted URL could be considered trusted when it should not have due to how VS Code handled glob patterns in the trusted domains feature. When paired with the #fetch tool in Chat, this scenario would require the attacker to convince an LLM (via prompt injection) to fetch the maliciously crafted URL but when fetched, the user would have no moment to confirm the flighting of the request.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-21264</cvename>
<url>https://github.com/microsoft/vscode/security/advisories/GHSA-742r-ggwg-vqxm</url>
<url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21264</url>
</references>
<dates>
<discovery>2025-05-13</discovery>
<entry>2025-05-14</entry>
</dates>
</vuln>
<vuln vid="a96cd659-303e-11f0-94b5-54ee755069b5">
<topic>libxslt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>[CVE-2024-55549] Fix UAF related to excluded namespaces</h1>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxslt/-/issues/127">
<p>xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.</p>
</blockquote>
<h1>[CVE-2025-24855] Fix use-after-free of XPath context node</h1>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxslt/-/issues/128">
<p>numbers.c in libxslt before 1.1.43 has a use-after-free because
, in nested XPath evaluations, an XPath context node can be
modified but never restored. This is related to
xsltNumberFormatGetValue, xsltEvalXPathPredicate,
xsltEvalXPathStringNs, and xsltComputeSortResultInternal.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-55549</cvename>
<cvename>CVE-2025-24855</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-55549</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-24855</url>
</references>
<dates>
<discovery>2025-03-13</discovery>
<entry>2025-05-13</entry>
</dates>
</vuln>
<vuln vid="89c668d5-2f80-11f0-9632-641c67a117d8">
<topic>www/varnish7 -- Request Smuggling Attack</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Varnish Development Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00016.html">
<p>A client-side desync vulnerability can be triggered in Varnish Cache
and Varnish Enterprise. This vulnerability can be triggered under
specific circumstances involving malformed HTTP/1 requests.</p>
<p>An attacker can abuse a flaw in Varnish's handling of chunked
transfer encoding which allows certain malformed HTTP/1 requests
to exploit improper framing of the message body to smuggle additional
requests. Specifically, Varnish incorrectly permits CRLF to be
skipped to delimit chunk boundaries.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00016.html</url>
</references>
<dates>
<discovery>2025-05-12</discovery>
<entry>2025-05-12</entry>
</dates>
</vuln>
<vuln vid="a8a1a8e7-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1924108%2C1950780%2C1959367">
<p>Memory safety bugs present in Firefox 137 and Thunderbird 137.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4092</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4092</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="a59bd59e-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- insufficient character escaping</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1949994%2C1956698%2C1960198">
<p>Due to insufficient escaping of special characters in the
"copy as cURL" feature, an attacker could trick
a user into using this command, potentially leading to local
code execution on the user's system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4089</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4089</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="a4422500-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- Cross-Site Request Forgery</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1953521">
<p>A security vulnerability in Thunderbird allowed malicious
sites to use redirects to send credentialed requests to
arbitrary endpoints on any site that had invoked the Storage
Access API. This enabled potential Cross-Site Request
Forgery attacks across origins.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4088</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4088</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="a2d5bd7b-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- XPath parsing undefined behavior</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.10,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1952465">
<p>A vulnerability was identified in Thunderbird where XPath
parsing could trigger undefined behavior due to missing null
checks during attribute access. This could lead to
out-of-bounds read access and potentially, memory
corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4087</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4087</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="9fa8c4a2-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- Information leak</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915280">
<p>An attacker with control over a content process could
potentially leverage the privileged UITour actor to leak
sensitive information or escalate privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4085</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4085</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="9c37a02e-2e85-11f0-a989-b42e991fc52e">
<topic>Mozilla -- javascript content execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>138.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.10,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>138.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1958350">
<p>A process isolation vulnerability in Thunderbird stemmed
from improper handling of javascript: URIs, which could
allow content to execute in the top-level document's
process instead of the intended frame, potentially enabling
a sandbox escape.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4083</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-4083</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-11</entry>
</dates>
</vuln>
<vuln vid="6943cbf2-2d55-11f0-9471-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.11.0</ge><lt>17.11.2</lt></range>
<range><ge>17.10.0</ge><lt>17.10.6</lt></range>
<range><ge>12.0.0</ge><lt>17.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/">
<p>Partial Bypass for Device OAuth flow using Cross Window Forgery</p>
<p>Denial of service by abusing Github import API</p>
<p>Group IP restriction bypass allows disclosing issue title of restricted project</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0549</cvename>
<cvename>CVE-2024-8973</cvename>
<cvename>CVE-2025-1278</cvename>
<url>https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/</url>
</references>
<dates>
<discovery>2025-05-07</discovery>
<entry>2025-05-10</entry>
</dates>
</vuln>
<vuln vid="78b8e808-2c45-11f0-9a65-6cc21735f730">
<topic>PostgreSQL -- PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation</topic>
<affects>
<package>
<name>postgresql17-client</name>
<range><lt>17.5</lt></range>
</package>
<package>
<name>postgresql16-client</name>
<range><lt>16.9</lt></range>
</package>
<package>
<name>postgresql15-client</name>
<range><lt>15.13</lt></range>
</package>
<package>
<name>postgresql14-client</name>
<range><lt>14.18</lt></range>
</package>
<package>
<name>postgresql13-client</name>
<range><lt>13.21</lt></range>
</package>
<package>
<name>postgresql17-server</name>
<range><lt>17.5</lt></range>
</package>
<package>
<name>postgresql16-server</name>
<range><lt>16.9</lt></range>
</package>
<package>
<name>postgresql15-server</name>
<range><lt>15.13</lt></range>
</package>
<package>
<name>postgresql14-server</name>
<range><lt>14.18</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2025-4207/">
<p>
A buffer over-read in PostgreSQL GB18030 encoding
validation allows a database input provider to achieve
temporary denial of service on platforms where a 1-byte
over-read can elicit process termination. This affects
the database server and also libpq. Versions before
PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are
affected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4207</cvename>
<url>https://www.postgresql.org/support/security/CVE-2025-4207/</url>
</references>
<dates>
<discovery>2025-05-08</discovery>
<entry>2025-05-08</entry>
</dates>
</vuln>
<vuln vid="db221414-2b0d-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>136.0.7103.92</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>136.0.7103.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[412057896] Medium CVE-2025-4372: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2025-04-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4372</cvename>
<url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-05-06</discovery>
<entry>2025-05-07</entry>
</dates>
</vuln>
<vuln vid="e195e915-2a43-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>136.0.7103.59</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>136.0.7103.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html">
<p>This update includes 8 security fixes:</p>
<ul>
<li>[409911705] High CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on 2025-04-11</li>
<li>[409342999] Medium CVE-2025-4050: Out of bounds memory access in DevTools. Reported by Anonymous on 2025-04-09</li>
<li>[404000989] Medium CVE-2025-4051: Insufficient data validation in DevTools. Reported by Daniel Fröjdendahl on 2025-03-16</li>
<li>[401927528] Low CVE-2025-4052: Inappropriate implementation in DevTools. Reported by vanillawebdev on 2025-03-10</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-4096</cvename>
<cvename>CVE-2025-4050</cvename>
<cvename>CVE-2025-4051</cvename>
<cvename>CVE-2025-4052</cvename>
<url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-06</entry>
</dates>
</vuln>
<vuln vid="5f868a5f-2943-11f0-bb22-f02f7432cf97">
<topic>fcgi -- Heap-based buffer overflow via crafted nameLen/valueLen in ReadParams</topic>
<affects>
<package>
<name>fcgi</name>
<range><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/FastCGI-Archives/fcgi2/issues/67">
<p>FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer
overflow (and resultant heap-based buffer overflow) via
crafted nameLen or valueLen values in data to the IPC socket.
This occurs in ReadParams in fcgiapp.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-23016</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-23016</url>
<url>https://github.com/FastCGI-Archives/fcgi2/issues/67</url>
</references>
<dates>
<discovery>2025-01-10</discovery>
<entry>2025-05-04</entry>
</dates>
</vuln>
<vuln vid="7e7a32e7-2901-11f0-ab20-b42e991fc52e">
<topic>dnsdist -- Denial of service via crafted DoH exchange</topic>
<affects>
<package>
<name>null</name>
<range><lt>null</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@open-xchange.com reports:</p>
<blockquote cite="https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-02.html">
<p>
When DNSdist is configured to provide DoH via the
nghttp2provider, an attacker can cause a denial of service by
crafting a DoH exchange that triggers an illegal memory
access (double-free) and crash of DNSdist, causing a denial
of service. The remedy is: upgrade to the patched 1.9.9
version. A workaround is to temporarily switch to the h2o
provider until DNSdist has been upgraded to a fixed version.
We would like to thank Charles Howes for bringing this issue
to our attention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-30194</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-30194</url>
</references>
<dates>
<discovery>2025-04-29</discovery>
<entry>2025-05-04</entry>
</dates>
</vuln>
<vuln vid="d70d5e0a-1f5e-11f0-9c67-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><eq>5.2.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/2025/04/07/powerdns-recursor-5-2-1-released">
<p>PowerDNS Security Advisory 2025-01: A crafted zone can
lead to an illegal memory access in the Recursor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-30195</cvename>
<url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html</url>
</references>
<dates>
<discovery>2025-04-07</discovery>
<entry>2025-04-22</entry>
</dates>
</vuln>
<vuln vid="409206f6-25e6-11f0-9360-b42e991fc52e">
<topic>sqlite -- integer overflow</topic>
<affects>
<package>
<name>sqlite</name>
<range><lt>3.49.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a">
<p>
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the
concat_ws() SQL function can cause memory to be written
beyond the end of a malloc-allocated buffer. If the
separator argument is attacker-controlled and has a large
string (e.g., 2MB or more), an integer overflow occurs in
calculating the size of the result buffer, and thus malloc
may not allocate enough memory.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-29087</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-29087</url>
</references>
<dates>
<discovery>2025-04-07</discovery>
<entry>2025-04-30</entry>
</dates>
</vuln>
<vuln vid="df126e23-24fa-11f0-ab92-f02f7497ecda">
<topic>h11 accepts some malformed Chunked-Encoding bodies</topic>
<affects>
<package>
<name>py39-h11</name>
<name>py310-h11</name>
<name>py311-h11</name>
<name>py312-h11</name>
<range><lt>0.16.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>h11 reports:</p>
<blockquote cite="https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj">
<p>h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-43859</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-43859</url>
</references>
<dates>
<discovery>2025-04-24</discovery>
<entry>2025-04-29</entry>
</dates>
</vuln>
<vuln vid="310f5923-211c-11f0-8ca6-6c3be5272acd">
<topic>Grafana -- Authorization bypass in data source proxy API</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>10.4.17+security-01</lt></range>
<range><ge>11.0.0</ge><lt>11.2.8+security-01</lt></range>
<range><ge>11.3.0</ge><lt>11.3.5+security-01</lt></range>
<range><ge>11.4.0</ge><lt>11.4.3+security-01</lt></range>
<range><ge>11.5.0</ge><lt>11.5.3+security-01</lt></range>
<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
<p>This vulnerability, which was discovered while reviewing a pull
request from an external contributor, effects Grafana’s data source
proxy API and allows authorization checks to be bypassed by adding
an extra slash character (/) in the URL path. Among Grafana-maintained
data sources, the vulnerability only affects the read paths
of Prometheus (all flavors) and Alertmanager when configured with
basic authorization.</p>
<p>The CVSS score for this vulnerability is
<a href="https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N">5.0 MEDIUM</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3454</cvename>
<url>https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/</url>
</references>
<dates>
<discovery>2025-03-25</discovery>
<entry>2025-04-24</entry>
</dates>
</vuln>
<vuln vid="6adfda5a-2118-11f0-8ca6-6c3be5272acd">
<topic>Grafana -- Bypass Viewer and Editor permissions</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
<p>During the development of a new feature in Grafana 11.6.x,
a security vulnerability was introduced that allows for Viewers
and Editors to bypass dashboard-specific permissions. As a result,
users with the Viewer role could view all the dashboards within their
org and users with the Editor role could view, edit, and delete all
the dashboards in their org.</p>
<p><em>Note: Organization isolation boundaries still apply, which
means viewers and editors in one organization cannot view or edit
dashboards in another org. Also this vulnerability does not allow
users to query data via data sources they don’t have access to.</em>
</p>
<p>The CVSS score for this vulnerability is
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L&version=3.1">8.3 HIGH</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3260</cvename>
<url>https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/</url>
</references>
<dates>
<discovery>2025-04-04</discovery>
<entry>2025-04-24</entry>
</dates>
</vuln>
<vuln vid="f8b7af82-2116-11f0-8ca6-6c3be5272acd">
<topic>Grafana -- DOM XSS vulnerability</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>11.1.0</ge><lt>11.2.8+security-01</lt></range>
<range><ge>11.3.0</ge><lt>11.3.5+security-01</lt></range>
<range><ge>11.4.0</ge><lt>11.4.3+security-01</lt></range>
<range><ge>11.5.0</ge><lt>11.5.3+security-01</lt></range>
<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
<p>An external security researcher responsibly reported a security
vulnerability in Grafana’s built-in
<a href="https://grafana.com/docs/grafana/latest/panels-visualizations/visualizations/xy-chart/">XY chart plugin</a>
that is vulnerable to a
<a href="https://grafana.com/blog/2023/07/11/trusted-types-how-we-mitigate-xss-threats-in-grafana-10/#what-is-dom-xss">DOM XSS vulnerability</a>.</p>
<p>The CVSS score for this vulnerability is
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L&version=3.1">6.8 MEDIUM</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2703</cvename>
<url>https://grafana.com/security/security-advisories/cve-2025-2703/</url>
</references>
<dates>
<discovery>2025-03-14</discovery>
<entry>2025-04-24</entry>
</dates>
</vuln>
<vuln vid="af8d043f-20df-11f0-b9c5-000c295725e4">
<topic>redis,valkey -- DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.4.3</lt></range>
</package>
<package>
<name>redis72</name>
<range><lt>7.2.8</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.18</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Axel Mierczuk reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff">
<p>
By default, the Redis configuration does not limit the
output buffer of normal clients (see
client-output-buffer-limit). Therefore, the output buffer
can grow unlimitedly over time. As a result, the service
is exhausted and the memory is unavailable.
</p>
<p>
When password authentication is enabled on the Redis
server, but no password is provided, the client can still
cause the output buffer to grow from "NOAUTH" responses
until the system will run out of memory.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-21605</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff</url>
</references>
<dates>
<discovery>2025-04-23</discovery>
<entry>2025-04-24</entry>
</dates>
</vuln>
<vuln vid="11b71871-20ba-11f0-9471-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.11.0</ge><lt>17.11.1</lt></range>
<range><ge>17.10.0</ge><lt>17.10.5</lt></range>
<range><ge>16.6.0</ge><lt>17.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/">
<p>Cross Site Scripting (XSS) in Maven Dependency Proxy through CSP directives</p>
<p>Cross Site Scripting (XSS) in Maven dependency proxy through cache headers</p>
<p>Network Error Logging (NEL) Header Injection in Maven Dependency Proxy Allows Browser Activity Monitoring</p>
<p>Denial of service (DOS) via issue preview</p>
<p>Unauthorized access to branch names when Repository assets are disabled in the project</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1763</cvename>
<cvename>CVE-2025-2443</cvename>
<cvename>CVE-2025-1908</cvename>
<cvename>CVE-2025-0639</cvename>
<cvename>CVE-2024-12244</cvename>
<url>https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/</url>
</references>
<dates>
<discovery>2025-04-23</discovery>
<entry>2025-04-24</entry>
</dates>
</vuln>
<vuln vid="194f79c3-1ffe-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>135.0.7049.114</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>135.0.7049.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_22.html">
<p>This update includes 1 security fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_22.html</url>
</references>
<dates>
<discovery>2025-04-22</discovery>
<entry>2025-04-23</entry>
</dates>
</vuln>
<vuln vid="5ca2cafa-1f24-11f0-ab07-f8f21e52f724">
<topic>Navidrome -- Authentication bypass in Subsonic API</topic>
<affects>
<package>
<name>navidrome</name>
<range><gt>0.52.0</gt><lt>0.54.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Deluan reports:</p>
<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p">
<p>In certain Subsonic API endpoints, authentication can be
bypassed by using a non-existent username combined with an
empty (salted) password hash. This allows read-only access to
the server’s resources, though attempts at write operations
fail with a “permission denied” error.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27112</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27112</url>
</references>
<dates>
<discovery>2025-02-25</discovery>
<entry>2025-04-22</entry>
</dates>
</vuln>
<vuln vid="06269ae8-1e0d-11f0-ad0b-b42e991fc52e">
<topic>Erlang -- Erlang/OTP SSH Vulnerable to Pre-Authentication RCE</topic>
<affects>
<package>
<name>erlang</name>
<range><lt>26.2.5.11</lt></range>
</package>
<package>
<name>erlang-runtime21</name>
<range><lt>25.3.2.20</lt></range>
</package>
<package>
<name>erlang-runtime22</name>
<range><lt>25.3.2.20</lt></range>
</package>
<package>
<name>erlang-runtime23</name>
<range><lt>25.3.2.20</lt></range>
</package>
<package>
<name>erlang-runtime24</name>
<range><lt>25.3.2.20</lt></range>
</package>
<package>
<name>erlang-runtime25</name>
<range><lt>25.3.2.20</lt></range>
</package>
<package>
<name>erlang-runtime26</name>
<range><lt>26.2.5.11</lt></range>
</package>
<package>
<name>erlang-runtime27</name>
<range><lt>27.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12">
<p>
Erlang/OTP is a set of libraries for the Erlang
programming language. Prior to versions OTP-27.3.3,
OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow
an attacker to perform unauthenticated remote code
execution (RCE). By exploiting a flaw in SSH protocol
message handling, a malicious actor could gain
unauthorized access to affected systems and execute
arbitrary commands without valid credentials. This issue
is patched in versions OTP-27.3.3, OTP-26.2.5.11, and
OTP-25.3.2.20. A temporary workaround involves disabling
the SSH server or to prevent access via firewall rules.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-32433</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-32433</url>
</references>
<dates>
<discovery>2025-04-16</discovery>
<entry>2025-04-20</entry>
</dates>
</vuln>
<vuln vid="1b8d502e-1cfd-11f0-944d-901b0e9408dc">
<topic>ejabberd -- mod_muc_occupantid: Fix handling multiple occupant-id</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>25.04</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ejabberd team reports:</p>
<blockquote cite="https://www.process-one.net/blog/ejabberd-25-04/#occupantid">
<p>Fixed issue with handling of user provided occupant-id in
messages and presences sent to muc room. Server was
replacing just first instance of occupant-id with its own
version, leaving other ones untouched. That would mean that
depending on order in which clients send occupant-id, they
could see value provided by sender, and that could be used
to spoof as different sender.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.process-one.net/blog/ejabberd-25-04/#occupantid</url>
</references>
<dates>
<discovery>2025-04-16</discovery>
<entry>2025-04-19</entry>
</dates>
</vuln>
<vuln vid="bf5d29ea-1a93-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>135.0.7049.95</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>135.0.7049.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[409619251] Critical CVE-2025-3619: Heap buffer overflow in Codecs. Reported by Elias Hohl on 2025-04-09</li>
<li>[405292639] High CVE-2025-3620: Use after free in USB. Reported by @retsew0x01 on 2025-03-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3619</cvename>
<cvename>CVE-2025-3620</cvename>
<url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2025-04-15</discovery>
<entry>2025-04-16</entry>
</dates>
</vuln>
<vuln vid="030778d5-19cc-11f0-8cb5-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>135.0.7049.84</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>135.0.7049.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_8.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[405140652] High CVE-2025-3066: Use after free in Site Isolation. Reported by Sven Dysthe (@svn-dys) on 2025-03-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3066</cvename>
<url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_8.html</url>
</references>
<dates>
<discovery>2025-04-08</discovery>
<entry>2025-04-15</entry>
</dates>
</vuln>
<vuln vid="e9b8e519-0d50-11f0-86d8-901b0e934d69">
<topic>py-matrix-synapse -- federation denial of service via malformed events</topic>
<affects>
<package>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<name>py311-matrix-synapse</name>
<range><lt>1.127.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>element-hq/synapse developers report:</p>
<blockquote cite="https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6">
<p>A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-30355</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6</url>
</references>
<dates>
<discovery>2025-03-26</discovery>
<entry>2025-03-26</entry>
</dates>
</vuln>
<vuln vid="45276ea6-1653-4240-9986-ccfc6fec7ece">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.504</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.492.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2025-04-02/">
<h1>Description</h1>
<h5>(Medium) SECURITY-3512 / CVE-2025-31720</h5>
<p>Missing permission check allows retrieving agent configurations</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3513 / CVE-2025-31721</h5>
<p>Missing permission check allows retrieving secrets from agent configurations</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-31720</cvename>
<cvename>CVE-2025-31721</cvename>
<url>https://www.jenkins.io/security/advisory/2025-04-02/</url>
</references>
<dates>
<discovery>2025-04-02</discovery>
<entry>2025-04-11</entry>
</dates>
</vuln>
<vuln vid="ed602f8b-15c2-11f0-b4e4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.10.0</ge><lt>17.10.4</lt></range>
<range><ge>17.9.0</ge><lt>17.9.6</lt></range>
<range><ge>7.7.0</ge><lt>17.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/">
<p>Denial of service via CI pipelines</p>
<p>Unintentionally authorizing sensitive actions on users behalf</p>
<p>IP Restriction Bypass through GraphQL Subscription</p>
<p>Unauthorized users can list the number of confidential issues</p>
<p>Debugging Information Disclosed</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1677</cvename>
<cvename>CVE-2025-0362</cvename>
<cvename>CVE-2025-2408</cvename>
<cvename>CVE-2024-11129</cvename>
<cvename>CVE-2025-2469</cvename>
<url>https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/</url>
</references>
<dates>
<discovery>2025-04-09</discovery>
<entry>2025-04-10</entry>
</dates>
</vuln>
<vuln vid="8f71ad3b-14f5-11f0-87ba-002590c1f29c">
<topic>expat: improper restriction of xml entity expansion depth</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert@redhat.com reports:</p>
<blockquote cite="https://access.redhat.com/errata/RHSA-2025:3531">
<p>A stack overflow vulnerability exists in the libexpat library due
to the way it handles recursive entity expansion in XML documents.
When parsing an XML document with deeply nested entity references,
libexpat can be forced to recurse indefinitely, exhausting the stack
space and causing a crash. This issue could lead to denial of
service (DoS) or, in some cases, exploitable memory corruption,
depending on the environment and library usage.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8176</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8176</url>
</references>
<dates>
<discovery>2025-03-14</discovery>
<entry>2025-04-09</entry>
</dates>
</vuln>
<vuln vid="34c51a2b-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1894100%2C1934086%2C1950360">
<p>Memory safety bugs present in Firefox 136 and Thunderbird 136.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3034</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3034</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="315f568e-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- privilege escalation attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1949987">
<p>Leaking of file descriptors from the fork server to web
content processes could allow for privilege escalation
attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3032</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3032</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="2fc74cae-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- stack memory read</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1947141">
<p>An attacker could read 32 bits of values spilled onto the stack in
a JIT compiled function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3031</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3031</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="2e0ff31b-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- Memory corruption</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.9.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494">
<p>Memory safety bugs present in Firefox 136, Thunderbird
136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these
bugs showed evidence of memory corruption and we presume
that with enough effort some of these could have been
exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3030</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3030</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="2c0180a5-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- URL spoofing attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.9</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1952213">
<p>A crafted URL containing specific Unicode characters
could have hidden the true origin of the page, resulting in
a potential spoofing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3029</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3029</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="28e5f7be-13c8-11f0-a5bd-b42e991fc52e">
<topic>Mozilla -- use-after-free error</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>137.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.22</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>137.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>137.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1941002">
<p>JavaScript code running while transforming a document
with the XSLTProcessor could lead to a use-after-free.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3028</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3028</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-07</entry>
</dates>
</vuln>
<vuln vid="789bcfb6-1224-11f0-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>135.0.7049.52</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>135.0.7049.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html">
<p>This update includes 13 security fixes:</p>
<ul>
<li>[376491759] Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer (TU Wien) on 2024-10-31</li>
<li>[401823929] Medium CVE-2025-3068: Inappropriate implementation in Intents. Reported by Simon Rawet on 2025-03-09</li>
<li>[40060076] Medium CVE-2025-3069: Inappropriate implementation in Extensions. Reported by NDevTK on 2022-06-26</li>
<li>[40086360] Medium CVE-2025-3070: Insufficient validation of untrusted input in Extensions. Reported by Anonymous on 2017-01-01</li>
<li>[40051596] Low CVE-2025-3071: Inappropriate implementation in Navigations. Reported by David Erceg on 2020-02-23</li>
<li>[362545037] Low CVE-2025-3072: Inappropriate implementation in Custom Tabs. Reported by Om Apip on 2024-08-27</li>
<li>[388680893] Low CVE-2025-3073: Inappropriate implementation in Autofill. Reported by Hafiizh on 2025-01-09</li>
<li>[392818696] Low CVE-2025-3074: Inappropriate implementation in Downloads. Reported by Farras Givari on 2025-01-28</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3067</cvename>
<cvename>CVE-2025-3068</cvename>
<cvename>CVE-2025-3069</cvename>
<cvename>CVE-2025-3070</cvename>
<cvename>CVE-2025-3071</cvename>
<cvename>CVE-2025-3072</cvename>
<cvename>CVE-2025-3073</cvename>
<cvename>CVE-2025-3074</cvename>
<url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-05</entry>
</dates>
</vuln>
<vuln vid="1205eccf-116d-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- Memory corruption bug</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1827142%2C1932783">
<p>Memory safety bugs present in Firefox 133, Thunderbird 133,
Firefox ESR 128.5, and Thunderbird 128.5. Some of these
bugs showed evidence of memory corruption and we presume
that with enough effort some of these could have been
exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0243</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0243</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f9d7b6ae-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1835193%2C1910021%2C1919803%2C1931576%2C1931948%2C1932173">
<p>Memory safety bugs present in Firefox 133 and Thunderbird 133.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0247</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0247</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f7d80111-116c-11f0-8b2c-b42e991fc52e">
<topic>firefox -- authentication bypass</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1895342">
<p>Under certain circumstances, a user opt-in setting that
Focus should require authentication before use could have
been be bypassed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0245</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0245</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f508f81e-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.19</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169">
<p>Memory safety bugs present in Firefox 133, Thunderbird 133,
Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18,
and Thunderbird 128.5. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort
some of these could have been exploited to run arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0242</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0242</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f38dd0f1-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- DoS via segmentation fault</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1933023">
<p>When segmenting specially crafted text, segmentation
would corrupt memory leading to a potentially exploitable
crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0241</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0241</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f1f92cd3-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- use-after-free while parsing JSON</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929623">
<p>Parsing a JavaScript module as JSON could, under some
circumstances, cause cross-compartment access, which may
result in a use-after-free.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0240</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0240</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="f02e3c59-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- redirection to insecure site</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>134.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929156">
<p>When using Alt-Svc, ALPN did not properly validate
certificates when the original server is redirecting to an
insecure site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0239</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0239</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="ee407762-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- use-after-free after failed memory allocation</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915535">
<p>Assuming a controlled failed memory allocation, an
attacker could have caused a use-after-free, leading to a
potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0238</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0238</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="ea51e89a-116c-11f0-8b2c-b42e991fc52e">
<topic>Mozilla -- privilege escalation attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>134.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>134.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.6.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915257">
<p>The WebChannel API, which is used to transport various
information across processes, did not check the sending
principal but rather accepted the principal being sent.
This could have led to privilege escalation attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0237</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-0237</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-04-04</entry>
</dates>
</vuln>
<vuln vid="37c368f1-10a2-11f0-8195-b42e991fc52e">
<topic>mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C1947281">
<p>Memory safety bugs present in Firefox 135 and Thunderbird
135. Some of these bugs showed evidence of memory corruption
and we presume that with enough effort some of these could
have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1943</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1943</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="b31a4e74-109d-11f0-8195-b42e991fc52e">
<topic>mozilla -- memory corruption</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.8,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1922889%2C1935004%2C1943586%2C1943912%2C1948111">
<p>CVE-2025-1938: Memory safety bugs present in Firefox 135,
Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
<p>CVE-2025-1935: A web page could trick a user into setting
that site as the default handler for a custom URL protocol.</p>
<p>CVE-2025-1934: It was possible to interrupt the processing
of a RegExp bailout and run additional JavaScript, potentially
triggering garbage collection when the engine was not
expecting it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1938</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1938</url>
<cvename>CVE-2025-1935</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1935</url>
<cvename>CVE-2025-1934</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1934</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="aeb2ca87-109d-11f0-8195-b42e991fc52e">
<topic>mozilla -- Memory safety bugs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.21,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716">
<p>Memory safety bugs present in Firefox 135, Thunderbird 135,
Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7.
Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have
been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1937</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1937</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="acf902f6-109d-11f0-8195-b42e991fc52e">
<topic>mozilla -- use-after-free in WebTransport connection</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.21,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1944126">
<p>It was possible to cause a use-after-free in the content
process side of a WebTransport connection, leading to a
potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1931</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1931</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="a93a1d2a-109d-11f0-8195-b42e991fc52e">
<topic>mozilla -- 64 bit JIT WASM read on left over memory</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.21,1</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1946004">
<p>On 64-bit CPUs, when the JIT compiles WASM i32 return
values they can pick up bits from left over memory.
This can potentially cause them to be treated as a different
type.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1933</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1933</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="350b3389-107f-11f0-8195-b42e991fc52e">
<topic>MongoDB -- crash due to improper validation of explain command</topic>
<affects>
<package>
<name>mongodb50</name>
<range><lt>5.0.31</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.20</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.16</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-103153">
<p>When run on commands with certain arguments set, explain may fail
to validate these arguments before using them. This can lead to
crashes in router servers. This affects MongoDB Server v5.0 prior
to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0
prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3084</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3084</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="32f5e57f-107f-11f0-8195-b42e991fc52e">
<topic>MongoDB -- Malformed wire protocol messages may cause mongos to crash</topic>
<affects>
<package>
<name>mongodb50</name>
<range><lt>5.0.31</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.20</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-103152">
<p>Specifically crafted MongoDB wire protocol messages can cause mongos
to crash during command validation. This can occur without using
an authenticated connection. This issue affects MongoDB v5.0
versions prior to 5.0.31, MongoDB v6.0 versions prior to6.0.20 and
MongoDB v7.0 versions prior to 7.0.16</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3083</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3083</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="30418b26-107f-11f0-8195-b42e991fc52e">
<topic>MongoDB -- Unauthorized access to underlying data</topic>
<affects>
<package>
<name>mongodb50</name>
<range><lt>5.0.31</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.20</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-103151">
<p>A user authorized to access a view may be able to alter the intended
collation, allowing them to access to a different or unintended
view of underlying data. This issue affects MongoDB Server v5.0
version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20,
MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3
versions prior to 7.3.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-3082</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-3082</url>
</references>
<dates>
<discovery>2025-04-01</discovery>
<entry>2025-04-03</entry>
</dates>
</vuln>
<vuln vid="2cad4541-0f5b-11f0-89f8-411aefea0df9">
<topic>openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.6.1</ge><lt>2.6.14</lt></range>
</package>
<package>
<name>openvpn-devel</name>
<range><lt>g20250402,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gert Doering reports:</p>
<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614">
<p>OpenVPN servers between 2.6.1 and 2.6.13 using
--tls-crypt-v2 can be made to abort with an ASSERT() message by
sending a particular combination of authenticated and malformed packets.</p>
<p>To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key</p>
<p>No crypto integrity is violated, no data is leaked, and no remote
code execution is possible.</p>
<p>This bug does not affect OpenVPN clients.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2704</cvename>
<url>https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614</url>
</references>
<dates>
<discovery>2025-03-26</discovery>
<entry>2025-04-02</entry>
</dates>
</vuln>
<vuln vid="300f86de-0e4d-11f0-ae40-b42e991fc52e">
<topic>gitea -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.23.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@golang.org reports:</p>
<blockquote cite="https://go.dev/cl/654697">
<p>Matching of hosts against proxy patterns can improperly treat an
IPv6 zone ID as a hostname component. For example, when the NO_PROXY
environment variable is set to "*.example.com", a request
to "[::1%25.example.com]:80` will incorrectly match and not
be proxied.</p>
<p>go-redis is the official Redis client library for the Go programming
language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially
responds out of order when `CLIENT SETINFO` times out during
connection establishment. This can happen when the client is
configured to transmit its identity, there are network connectivity
issues, or the client was configured with aggressive timeouts. The
problem occurs for multiple use cases. For sticky connections, you
receive persistent out-of-order responses for the lifetime of the
connection. All commands in the pipeline receive incorrect responses.
When used with the default ConnPool once a connection is returned
after use with ConnPool#Put the read buffer will be checked and the
connection will be marked as bad due to the unread data. This means
that at most one out-of-order response before the connection is
discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You
can prevent the vulnerability by setting the flag DisableIndentity
to true when constructing the client instance.</p>
<p>golang-jwt is a Go implementation of JSON Web Tokens. Prior to
5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a
call to strings.Split) its argument (which is untrusted data) on
periods. As a result, in the face of a malicious request whose
Authorization header consists of Bearer followed by many period
characters, a call to that function incurs allocations to the tune
of O(n) bytes (where n stands for the length of the function's
argument), with a constant factor of about 16. This issue is fixed
in 5.2.2 and 4.5.2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-22870</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-22870</url>
<cvename>CVE-2025-29923</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-29923</url>
<cvename>CVE-2025-30204</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-30204</url>
</references>
<dates>
<discovery>2025-03-12</discovery>
<entry>2025-03-31</entry>
</dates>
</vuln>
<vuln vid="1a67144d-0d86-11f0-8542-b42e991fc52e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>136.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.8,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>136.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.8</lt></range>
</package>
<package>
<name>librewolf</name>
<range><lt>136.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1945392">
<p>An inconsistent comparator in xslt/txNodeSorter could have resulted
in potentially exploitable out-of-bounds access. Only affected
version 122 and later. This vulnerability affects Firefox <
136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird
< 128.8.</p>
<p>Under certain circumstances, a user opt-in setting that Focus should
require authentication before use could have been be bypassed
(distinct from CVE-2025-0245). This vulnerability affects Firefox
< 136.</p>
<p>When String.toUpperCase() caused a string to get longer it was
possible for uninitialized memory to be incorporated into the result
string This vulnerability affects Firefox < 136 and Thunderbird
< 136.</p>
<p>Websites redirecting to a non-HTTP scheme URL could allow a website
address to be spoofed for a malicious page This vulnerability affects
Firefox for iOS < 136.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1932</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1932</url>
<cvename>CVE-2025-1941</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1941</url>
<cvename>CVE-2025-1942</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1942</url>
<cvename>CVE-2025-27424</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27424</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-03-30</entry>
</dates>
</vuln>
<vuln vid="1d53db32-0d60-11f0-8542-b42e991fc52e">
<topic>suricata -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>7.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Suricate team reports:</p>
<blockquote cite="https://forum.suricata.io/t/suricata-7-0-9-released/5495">
<p>Multiple vulnerabilities</p>
</blockquote>
<ul>
<li>
CVE-2025-29915: Severity HIGH. The AF_PACKET defrag option
is enabled by default and allows AF_PACKET to re-assemble
fragmented packets before reaching Suricata. However the
default packet size in Suricata is based on the network
interface MTU which leads to Suricata seeing truncated
packets.
</li>
<li>
CVE-2025-29916: Severity Moderate. Datasets declared in
rules have an option to specify the `hashsize` to use.
This size setting isn't properly limited, so the hash
table allocation can be large. Untrusted rules can lead to
large memory allocations, potentially leading to denial of
service due to resource starvation
</li>
<li>
CVE-2025-29917: Severity HIGH. The bytes setting in the
decode_base64 keyword is not properly limited. Due to
this, signatures using the keyword and setting can cause
large memory allocations of up to 4 GiB per thread.
</li>
<li>
CVE-2025-29918: Severity HIGH. A PCRE rule can be written
that leads to an infinite loop when negated PCRE is used.
Packet processing thread becomes stuck in infinite loop
limiting visibility and availability in inline mode.
</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2025-29915</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29915</url>
<cvename>CVE-2025-29916</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29916</url>
<cvename>CVE-2025-29917</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29917</url>
<cvename>CVE-2025-29918</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29918</url>
</references>
<dates>
<discovery>2025-03-12</discovery>
<entry>2025-03-30</entry>
</dates>
</vuln>
<vuln vid="7cb6642c-0c5a-11f0-8688-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-pdf</name>
<name>qt6-webengine</name>
<range><lt>6.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based">
<p>Backports for 11 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-11477: 7-Zip Zstd decompression integer underflow</li>
<li>CVE-2025-0762: Use after free in DevTools</li>
<li>CVE-2025-0996: Inappropriate implementation in Browser UI</li>
<li>CVE-2025-0998: Out of bounds memory access in V8</li>
<li>CVE-2025-0999: Heap buffer overflow in V8</li>
<li>CVE-2025-1006: Use after free in Network</li>
<li>CVE-2025-1426: Heap buffer overflow in GPU</li>
<li>CVE-2025-1918: Out of bounds read in Pdfium</li>
<li>CVE-2025-1919: Out of bounds read in Media</li>
<li>CVE-2025-1921: Inappropriate implementation in Media</li>
<li>CVE-2025-2036: Use after free in Inspector</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11477</cvename>
<cvename>CVE-2025-0762</cvename>
<cvename>CVE-2025-0996</cvename>
<cvename>CVE-2025-0998</cvename>
<cvename>CVE-2025-0999</cvename>
<cvename>CVE-2025-1006</cvename>
<cvename>CVE-2025-1426</cvename>
<cvename>CVE-2025-1918</cvename>
<cvename>CVE-2025-1919</cvename>
<cvename>CVE-2025-1921</cvename>
<cvename>CVE-2025-2036</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based</url>
</references>
<dates>
<discovery>2025-02-20</discovery>
<entry>2025-03-29</entry>
</dates>
</vuln>
<vuln vid="01a7e1e1-d249-4dd8-9a4a-ef95b5747afb">
<topic>electron{33,34} -- Incorrect handle provided in unspecified circumstances in Mojo</topic>
<affects>
<package>
<name>electron33</name>
<range><lt>33.4.8</lt></range>
</package>
<package>
<name>electron34</name>
<range><lt>34.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.8">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2025-2783.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2783</cvename>
<url>https://github.com/advisories/GHSA-hfqm-jfc6-rh2f</url>
</references>
<dates>
<discovery>2025-03-27</discovery>
<entry>2025-03-28</entry>
</dates>
</vuln>
<vuln vid="1daa2814-0a6c-11f0-b4e4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.10.0</ge><lt>17.10.1</lt></range>
<range><ge>17.9.0</ge><lt>17.9.3</lt></range>
<range><ge>12.10.0</ge><lt>17.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/">
<p>Cross-site Scripting (XSS) through merge-request error messages</p>
<p>Cross-site Scripting (XSS) through improper rendering of certain file types</p>
<p>Admin Privileges Persists After Role is Revoked</p>
<p>External user can access internal projects</p>
<p>Prompt injection in Amazon Q integration may allow unauthorized actions</p>
<p>Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request</p>
<p>Maintainer can inject shell code in Harbor project name configuration when using helper scripts</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2255</cvename>
<cvename>CVE-2025-0811</cvename>
<cvename>CVE-2025-2242</cvename>
<cvename>CVE-2024-12619</cvename>
<cvename>CVE-2024-10307</cvename>
<cvename>CVE-2024-9773</cvename>
<url>https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/</url>
</references>
<dates>
<discovery>2025-03-26</discovery>
<entry>2025-03-26</entry>
</dates>
</vuln>
<vuln vid="964aa5da-f094-47fe-9ebd-2142f9157440">
<topic>electron{33,34} -- Type Confusion in V8</topic>
<affects>
<package>
<name>electron33</name>
<range><lt>33.4.6</lt></range>
</package>
<package>
<name>electron34</name>
<range><lt>34.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.6">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2025-1920.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1920</cvename>
<url>https://github.com/advisories/GHSA-fhwv-7gx3-h767</url>
</references>
<dates>
<discovery>2025-03-20</discovery>
<entry>2025-03-25</entry>
</dates>
</vuln>
<vuln vid="a58fdfef-07c6-11f0-8688-4ccc6adda413">
<topic>qt5-webengine -- Use after free in Compositing</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.18p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 1 security bug in Chromium:</p>
<ul>
<li>CVE-2024-12694: Use after free in Compositing</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12694</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2025-02-14</discovery>
<entry>2025-03-23</entry>
</dates>
</vuln>
<vuln vid="26f6733d-06a9-11f0-ba0b-641c67a117d8">
<topic>www/varnish7 -- client-side desync vulnerability</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Varnish Development Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00015.html#vsv00015">
<p>A client-side desync vulnerability can be triggered in Varnish Cache
and Varnish Enterprise. This vulnerability can be triggered under
specific circumstances involving malformed HTTP/1 requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-30346</cvename>
<url>https://varnish-cache.org/security/VSV00015.html#vsv00015</url>
</references>
<dates>
<discovery>2024-12-17</discovery>
<entry>2025-03-22</entry>
</dates>
</vuln>
<vuln vid="9456d4e9-055f-11f0-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>134.0.6998.117</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>134.0.6998.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[401029609] Critical CVE-2025-2476: Use after free in Lens. Reported by SungKwon Lee of Enki Whitehat on 2025-03-05</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-2476</cvename>
<url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2025-03-19</discovery>
<entry>2025-03-20</entry>
</dates>
</vuln>
<vuln vid="2ac2ddc2-0051-11f0-8673-f02f7432cf97">
<topic>php -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php81</name>
<range>
<lt>8.1.32</lt>
</range>
</package>
<package>
<name>php82</name>
<range>
<lt>8.2.28</lt>
</range>
</package>
<package>
<name>php83</name>
<range>
<lt>8.3.19</lt>
</range>
</package>
<package>
<name>php84</name>
<range>
<lt>8.4.5</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php.net reports:</p>
<blockquote cite="https://www.php.net/ChangeLog-8.php">
<ul>
<li>
CVE-2024-11235: Core: Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free).
</li>
<li>
CVE-2025-1219: LibXML: Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource).
</li>
<li>
CVE-2025-1736: Streams: Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header).
</li>
<li>
CVE-2025-1861: Streams: Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes).
</li>
<li>
CVE-2025-1734: Streams: Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon).
</li>
<li>
CVE-2025-1217: Streams: Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers).
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11235</cvename>
<cvename>CVE-2025-1219</cvename>
<cvename>CVE-2025-1736</cvename>
<cvename>CVE-2025-1861</cvename>
<cvename>CVE-2025-1734</cvename>
<cvename>CVE-2025-1217</cvename>
<url>https://www.php.net/ChangeLog-8.php</url>
</references>
<dates>
<discovery>2025-03-13</discovery>
<entry>2025-03-13</entry>
</dates>
</vuln>
<vuln vid="0b43fac4-005d-11f0-a540-6cc21735f730">
<topic>shibboleth-sp -- Parameter manipulation allows the forging of signed SAML messages</topic>
<affects>
<package>
<name>opensaml</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Shibboleth Project reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20250313.txt">
<p>
An updated version of the OpenSAML C++ library is available
which corrects a parameter manipulation vulnerability when using
SAML bindings that rely on non-XML signatures. The Shibboleth
Service Provider is impacted by this issue, and it manifests as
a critical security issue in that context.
</p>
<p>
Parameter manipulation allows the forging of signed SAML messages
</p>
<p>
A number of vulnerabilities in the OpenSAML library used by the
Shibboleth Service Provider allowed for creative manipulation of
parameters combined with reuse of the contents of older requests
to fool the library's signature verification of non-XML based
signed messages.
</p>
<p>
Most uses of that feature involve very low or
low impact use cases without critical security implications;
however, there are two scenarios that are much more critical,
one affecting the SP and one affecting some implementers who
have implemented their own code on top of our OpenSAML library
and done so improperly.
</p>
<p>
The SP's support for the HTTP-POST-SimpleSign SAML binding for
Single Sign-On responses is its critical vulnerability, and it
is enabled by default (regardless of what one's published SAML
metadata may advertise).
</p>
<p>
The other critical case involves a mistake that
does *not* impact the Shibboleth SP, allowing SSO to occur over
the HTTP-Redirect binding contrary to the plain language of the
SAML Browser SSO profile. The SP does not support this, but
other implementers may have done so.
</p>
<p>
Prior to updating, it is possible to mitigate the POST-SimpleSign
vulnerability by editing the protocols.xml configuration file and
removing this line:
<code><Binding id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
path="/SAML2/POST-SimpleSign" /></code>
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20250313.txt</url>
</references>
<dates>
<discovery>2025-03-13</discovery>
<entry>2025-03-13</entry>
</dates>
</vuln>
<vuln vid="a435609c-ffd5-11ef-b4e4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.9.0</ge><lt>17.9.2</lt></range>
<range><ge>17.8.0</ge><lt>17.8.5</lt></range>
<range><ge>11.5</ge><lt>17.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/">
<p>CVE-2025-25291 and CVE-2025-25292 (third party gem ruby-saml)</p>
<p>CVE-2025-27407 (third party gem graphql)</p>
<p>Denial of Service Due to Inefficient Processing of Untrusted Input</p>
<p>Credentials disclosed when repository mirroring fails</p>
<p>Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field</p>
<p>Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission</p>
<p>Maintainer can inject shell code in Google integrations</p>
<p>Guest with custom Admin group member permissions can approve the users invitation despite user caps</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-25291</cvename>
<cvename>CVE-2025-25292</cvename>
<cvename>CVE-2025-27407</cvename>
<cvename>CVE-2024-13054</cvename>
<cvename>CVE-2024-12380</cvename>
<cvename>CVE-2025-1257</cvename>
<cvename>CVE-2025-0652</cvename>
<cvename>CVE-2024-8402</cvename>
<cvename>CVE-2024-7296</cvename>
<url>https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/</url>
</references>
<dates>
<discovery>2025-03-12</discovery>
<entry>2025-03-13</entry>
</dates>
</vuln>
<vuln vid="9cf03c96-ffa5-11ef-bb15-002590af0794">
<topic>vim -- potential data loss with zip.vim and specially crafted zip files</topic>
<affects>
<package>
<name>vim</name>
<range><lt>9.1.1198</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vim reports:</p>
<blockquote cite="https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf">
<p>See https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-29768</cvename>
<url>https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf</url>
</references>
<dates>
<discovery>2025-03-12</discovery>
<entry>2025-03-12</entry>
</dates>
</vuln>
<vuln vid="a02a6d94-fe53-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>134.0.6998.88</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>134.0.6998.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[398065918] High CVE-2025-1920: Type Confusion in V8. Reported by Excello s.r.o. on 2025-02-21</li>
<li>[400052777] High CVE-2025-2135: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2025-03-02</li>
<li>[401059730] High CVE-TBD: Out of bounds write in GPU. Reported on 2025-03-05</li>
<li>[395032416] Medium CVE-2025-2136: Use after free in Inspector. Reported by Sakana.S on 2025-02-10</li>
<li>[398999390] Medium CVE-2025-2137: Out of bounds read in V8. Reported by zeroxiaobai@ on 2025-02-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1920</cvename>
<cvename>CVE-2025-2135</cvename>
<cvename>CVE-2025-2136</cvename>
<cvename>CVE-2025-2137</cvename>
<url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2025-03-10</discovery>
<entry>2025-03-11</entry>
</dates>
</vuln>
<vuln vid="a86f9189-fdd9-11ef-91ff-b42e991fc52e">
<topic>libreoffice -- Macro URL arbitrary script execution</topic>
<affects>
<package>
<name>libreoffice</name>
<range><ge>24.8</ge><lt>24.8.5</lt></range>
<range><ge>25.2</ge><lt>25.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@documentfoundation.org reports:</p>
<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080">
<p>LibreOffice supports Office URI Schemes to enable browser integration
of LibreOffice with MS SharePoint server. An additional scheme
'vnd.libreoffice.command' specific to LibreOffice was
added. In the affected versions of LibreOffice a link in a browser
using that scheme could be constructed with an embedded inner URL
that when passed to LibreOffice could call internal macros with
arbitrary arguments. This issue affects LibreOffice: from 24.8
before < 24.8.5, from 25.2 before < 25.2.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1080</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1080</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-03-10</entry>
</dates>
</vuln>
<vuln vid="2ec7816d-fdb7-11ef-91ff-b42e991fc52e">
<topic>vim -- Improper Input Validation in Vim</topic>
<affects>
<package>
<name>vim</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-gtk2</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-gtk3</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-motif</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-tiny</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-x11</name>
<range><lt>9.1.1164</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29">
<p>Vim is distributed with the tar.vim plugin, that allows
easy editing and viewing of (compressed or uncompressed) tar
files. Starting with 9.1.0858, the tar.vim plugin uses the
":read" ex command line to append below the
cursor position, however the is not sanitized and is taken
literally from the tar archive. This allows to execute
shellcommands via special crafted tar archives. Whether
this really happens, depends on the shell being used
('shell' option, which is set using $SHELL).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27423</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27423</url>
</references>
<dates>
<discovery>2025-03-03</discovery>
<entry>2025-03-10</entry>
</dates>
</vuln>
<vuln vid="6ba9e26e-c9c6-49f7-ae43-47e5864f0b66">
<topic>electron33 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron33</name>
<range><lt>33.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron develpers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2025-0445.</li>
<li>Security: backported fix for CVE-2025-0995.</li>
<li>Security: backported fix for CVE-2025-0998.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0445</cvename>
<url>https://github.com/advisories/GHSA-q4fq-38gr-ccp3</url>
<cvename>CVE-2025-0995</cvename>
<url>https://github.com/advisories/GHSA-377p-4737-hx6m</url>
<cvename>CVE-2025-0998</cvename>
<url>https://github.com/advisories/GHSA-4v9x-qxmv-4h58</url>
</references>
<dates>
<discovery>2025-03-06</discovery>
<entry>2025-03-08</entry>
</dates>
</vuln>
<vuln vid="6e27040b-61b7-4989-9471-dfb10c3cd76e">
<topic>electron32 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2025-0445.</li>
<li>Security: backported fix for CVE-2025-0998.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0445</cvename>
<url>https://github.com/advisories/GHSA-q4fq-38gr-ccp3</url>
<cvename>CVE-2025-0998</cvename>
<url>https://github.com/advisories/GHSA-4v9x-qxmv-4h58</url>
</references>
<dates>
<discovery>2025-03-03</discovery>
<entry>2025-03-07</entry>
</dates>
</vuln>
<vuln vid="3299cbfd-fa6e-11ef-929d-b0416f0c4c67">
<topic>Jinja2 -- Sandbox breakout through attr filter selecting format method</topic>
<affects>
<package>
<name>py38-Jinja2</name>
<name>py39-Jinja2</name>
<name>py310-Jinja2</name>
<name>py311-Jinja2</name>
<range><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403">
<p>Jinja is an extensible templating engine. Prior to 3.1.6, an
oversight in how the Jinja sandboxed environment interacts with the
|attr filter allows an attacker that controls the content of a
template to execute arbitrary Python code. To exploit the
vulnerability, an attacker needs to control the content of a template.
Whether that is the case depends on the type of application using
Jinja. This vulnerability impacts users of applications which
execute untrusted templates. Jinja's sandbox does catch calls
to str.format and ensures they don't escape the sandbox.
However, it's possible to use the |attr filter to get a reference
to a string's plain format method, bypassing the sandbox.
After the fix, the |attr filter no longer bypasses the environment's
attribute lookup. This vulnerability is fixed in 3.1.6.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27516</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27516</url>
</references>
<dates>
<discovery>2025-03-05</discovery>
<entry>2025-03-06</entry>
</dates>
</vuln>
<vuln vid="f4297478-fa62-11ef-b597-001fc69cd6dc">
<topic>xorg server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.16,1</lt></range>
</package>
<package>
<name>xorg-nextserver</name>
<range><lt>21.1.16,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>24.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
<ul>
<li>
CVE-2025-26594: Use-after-free of the root cursor
<p>The root cursor is referenced in the xserver as a global variable. If
a client manages to free the root cursor, the internal reference points
to freed memory and causes a use-after-free.</p>
</li>
<li>
CVE-2025-26595: Buffer overflow in XkbVModMaskText()
<p>The code in XkbVModMaskText() allocates a fixed sized buffer on the
stack and copies the names of the virtual modifiers to that buffer.
The code however fails to check the bounds of the buffer correctly and
would copy the data regardless of the size, which may lead to a buffer
overflow.</p>
</li>
<li>
CVE-2025-26596: Heap overflow in XkbWriteKeySyms()
<p>The computation of the length in XkbSizeKeySyms() differs from what is
actually written in XkbWriteKeySyms(), which may lead to a heap based
buffer overflow.</p>
</li>
<li>
CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey()
<p>If XkbChangeTypesOfKey() is called with 0 group, it will resize the key
symbols table to 0 but leave the key actions unchanged.
If later, the same function is called with a non-zero value of groups,
this will cause a buffer overflow because the key actions are of the wrong
size.</p>
</li>
<li>
CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()
<p>The function GetBarrierDevice() searches for the pointer device based on
its device id and returns the matching value, or supposedly NULL if no
match was found.
However the code will return the last element of the list if no matching
device id was found which can lead to out of bounds memory access.</p>
</li>
<li>
CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()
<p>The function compCheckRedirect() may fail if it cannot allocate the backing
pixmap. In that case, compRedirectWindow() will return a BadAlloc error
without the validation of the window tree marked just before, which leaves
the validate data partly initialized, and the use of an uninitialized pointer
later.</p>
</li>
<li>
CVE-2025-26600: Use-after-free in PlayReleasedEvents()
<p>When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed and replaying the events
will cause a use after free.</p>
</li>
<li>
CVE-2025-26601: Use-after-free in SyncInitTrigger()
<p>When changing an alarm, the values of the change mask are evaluated one
after the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.
If one of the changes triggers an error, the function will return early,
not adding the new sync object.
This can be used to cause a use after free when the alarm eventually
triggers.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-26594</cvename>
<cvename>CVE-2025-26595</cvename>
<cvename>CVE-2025-26596</cvename>
<cvename>CVE-2025-26597</cvename>
<cvename>CVE-2025-26598</cvename>
<cvename>CVE-2025-26599</cvename>
<cvename>CVE-2025-26600</cvename>
<cvename>CVE-2025-26601</cvename>
<url>https://lists.x.org/archives/xorg-announce/2025-February/003584.html</url>
</references>
<dates>
<discovery>2025-02-25</discovery>
<entry>2025-03-06</entry>
</dates>
</vuln>
<vuln vid="d8bd20ae-fa48-11ef-ab7a-ace2d30de67a">
<topic>caldera -- Remote Code Execution</topic>
<affects>
<package>
<name>caldera</name>
<range><lt>5.2.0</lt></range>
</package>
<package>
<name>caldera4</name>
<range><le>4.2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Caldera contributor report:</p>
<blockquote cite="https://github.com/mitre/caldera/pull/3129">
<p>In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e,
a Remote Code Execution (RCE) vulnerability was found in the dynamic
agent (implant) compilation functionality of the server. This allows
remote attackers to execute arbitrary code on the server that Caldera
is running on via a crafted web request to the Caldera server API used
for compiling and downloading of Caldera's Sandcat or Manx agent
(implants). This web request can use the gcc -extldflags linker flag
with sub-commands.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27364</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27364</url>
</references>
<dates>
<discovery>2025-02-16</discovery>
<entry>2025-03-06</entry>
</dates>
</vuln>
<vuln vid="cb98d018-f9f5-11ef-a398-00e081b7aa2d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.500</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.492.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2025-03-05/">
<h1>Description</h1>
<h5>(Medium) SECURITY-3495 / CVE-2025-27622</h5>
<p>Encrypted values of secrets stored in agent configuration revealed to users with Agent/Extended Read permission</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3496 / CVE-2025-27623</h5>
<p>Encrypted values of secrets stored in view configuration revealed to users with View/Read permission</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3498 / CVE-2025-27624</h5>
<p>CSRF vulnerability</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3501 / CVE-2025-27625</h5>
<p>Open redirect vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27622</cvename>
<cvename>CVE-2025-27623</cvename>
<cvename>CVE-2025-27624</cvename>
<cvename>CVE-2025-27625</cvename>
<url>https://www.jenkins.io/security/advisory/2025-03-05/</url>
</references>
<dates>
<discovery>2025-03-05</discovery>
<entry>2025-03-05</entry>
</dates>
</vuln>
<vuln vid="475d1968-f99d-11ef-b382-b0416f0c4c67">
<topic>Spotipy -- Spotipy's cache file, containing spotify auth token, is created with overly broad permissions</topic>
<affects>
<package>
<name>py38-spotipy</name>
<name>py39-spotipy</name>
<name>py310-spotipy</name>
<name>py311-spotipy</name>
<range><lt>2.25.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98">
<p>Spotipy is a lightweight Python library for the Spotify Web API.
The `CacheHandler` class creates a cache file to store the auth
token. Prior to version 2.25.1, the file created has `rw-r--r--`
(644) permissions by default, when it could be locked down to
`rw-------` (600) permissions. This leads to overly broad exposure
of the spotify auth token. If this token can be read by an attacker
(another user on the machine, or a process running as another user),
it can be used to perform administrative actions on the Spotify
account, depending on the scope granted to the token. Version
2.25.1 tightens the cache file permissions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27154</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27154</url>
</references>
<dates>
<discovery>2025-02-27</discovery>
<entry>2025-03-05</entry>
</dates>
</vuln>
<vuln vid="9c62d3f0-f997-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>134.0.6998.35</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>134.0.6998.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html">
<p>This update includes 14 security fixes:</p>
<ul>
<li>[397731718] High CVE-2025-1914: Out of bounds read in V8. Reported by Zhenghang Xiao (@Kipreyyy) and Nan Wang (@eternalsakura13) on 2025-02-20</li>
<li>[391114799] Medium CVE-2025-1915: Improper Limitation of a Pathname to a Restricted Directory in DevTools. Reported by Topi Lassila on 2025-01-20</li>
<li>[376493203] Medium CVE-2025-1916: Use after free in Profiles. Reported by parkminchan, SSD Labs Korea on 2024-10-31</li>
<li>[329476341] Medium CVE-2025-1917: Inappropriate Implementation in Browser UI. Reported by Khalil Zhani on 2024-03-14</li>
<li>[388557904] Medium CVE-2025-1918: Out of bounds read in PDFium. Reported by asnine on 2025-01-09</li>
<li>[392375312] Medium CVE-2025-1919: Out of bounds read in Media. Reported by @Bl1nnnk and @Pisanbao on 2025-01-26</li>
<li>[387583503] Medium CVE-2025-1921: Inappropriate Implementation in Media Stream. Reported by Kaiido on 2025-01-04</li>
<li>[384033062] Low CVE-2025-1922: Inappropriate Implementation in Selection. Reported by Alesandro Ortiz on 2024-12-14</li>
<li>[382540635] Low CVE-2025-1923: Inappropriate Implementation in Permission Prompts. Reported by Khalil Zhani on 2024-12-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1914</cvename>
<cvename>CVE-2025-1915</cvename>
<cvename>CVE-2025-1916</cvename>
<cvename>CVE-2025-1917</cvename>
<cvename>CVE-2025-1918</cvename>
<cvename>CVE-2025-1919</cvename>
<cvename>CVE-2025-1921</cvename>
<cvename>CVE-2025-1922</cvename>
<cvename>CVE-2025-1923</cvename>
<url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-03-04</discovery>
<entry>2025-03-05</entry>
</dates>
</vuln>
<vuln vid="f4f3e001-402b-4d6d-8efa-ab11fcf8de2b">
<topic>electron{32,33} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.3.2</lt></range>
</package>
<package>
<name>electron33</name>
<range><lt>33.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2025-0611.</li>
<li>Security: backported fix for CVE-2025-0612.</li>
<li>Security: backported fix for CVE-2025-0999.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0611</cvename>
<url>https://github.com/advisories/GHSA-83vc-v46q-mv3w</url>
<cvename>CVE-2025-0612</cvename>
<url>https://github.com/advisories/GHSA-c6xg-jh94-mf2w</url>
<cvename>CVE-2025-0999</cvename>
<url>https://github.com/advisories/GHSA-f2jv-hxph-r5wm</url>
</references>
<dates>
<discovery>2025-02-27</discovery>
<entry>2025-03-04</entry>
</dates>
</vuln>
<vuln vid="6af5e3a3-f85a-11ef-95b9-589cfc10a551">
<topic>unit -- potential security issue</topic>
<affects>
<package>
<name>unit</name>
<name>unit-java</name>
<range><ge>1.11.0</ge><lt>1.34.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html">
<p>Unit 1.34.2 fixes two issues in the Java language module websocket code.</p>
<ol>
<li>It addresses a potential security issue where we could get a negative
payload length that could cause the Java language module process(es) to
enter an infinite loop and consume excess CPU. This was a bug carried
over from the initial Java websocket code import. It has been re-issued
a CVE number (CVE-2025-1695).</li>
<li>It addresses an issue whereby decoded payload lengths would be limited
to 32 bits.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1695</cvename>
<url>https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html</url>
</references>
<dates>
<discovery>2025-03-03</discovery>
<entry>2025-03-03</entry>
</dates>
</vuln>
<vuln vid="398d1ec1-f7e6-11ef-bb15-002590af0794">
<topic>vim -- Potential code execution</topic>
<affects>
<package>
<name>vim</name>
<name>vim-gtk2</name>
<name>vim-gtk3</name>
<name>vim-motif</name>
<name>vim-x11</name>
<name>vim-tiny</name>
<range><lt>9.1.1164</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>vim reports:</p>
<blockquote cite="https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3">
<h1>Summary</h1>
<p>Potential code execution with tar.vim and special crafted tar files</p>
<h1>Description</h1>
<p>Vim is distributed with the tar.vim plugin, that allows easy
editing and viewing of (compressed or uncompressed) tar files.</p>
<p>Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to
support permissions), the tar.vim plugin uses the ":read " ex command
line to append below the cursor position, however the is not sanitized
and is taken literaly from the tar archive. This allows to execute
shell commands via special crafted tar archives. Whether this really
happens, depends on the shell being used ('shell' option, which is set
using $SHELL).</p>
<h1>Impact</h1>
<p>Impact is high but a user must be convinced to edit such a file
using Vim which will reveal the filename, so a careful user may suspect
some strange things going on.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3</url>
</references>
<dates>
<discovery>2025-03-02</discovery>
<entry>2025-03-02</entry>
</dates>
</vuln>
<vuln vid="8fb9101e-f58a-11ef-b4e4-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.9.0</ge><lt>17.9.1</lt></range>
<range><ge>17.8.0</ge><lt>17.8.4</lt></range>
<range><ge>15.10.0</ge><lt>17.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/">
<p>XSS in k8s proxy endpoint</p>
<p>XSS Maven Dependency Proxy</p>
<p>HTML injection leads to XSS on self hosted instances</p>
<p>Improper Authorisation Check Allows Guest User to Read Security Policy</p>
<p>Planner role can read code review analytics in private projects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0475</cvename>
<cvename>CVE-2025-0555</cvename>
<cvename>CVE-2024-8186</cvename>
<cvename>CVE-2024-10925</cvename>
<cvename>CVE-2025-0307</cvename>
<url>https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/</url>
</references>
<dates>
<discovery>2025-02-26</discovery>
<entry>2025-02-28</entry>
</dates>
</vuln>
<vuln vid="a4cb7f9b-f506-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>133.0.6943.141</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>133.0.6943.141</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html">
<p>This update includes 1 security fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html</url>
</references>
<dates>
<discovery>2025-02-25</discovery>
<entry>2025-02-27</entry>
</dates>
</vuln>
<vuln vid="6ae77556-f31d-11ef-a695-4ccc6adda413">
<topic>exiv2 -- Use after free in TiffSubIfd</topic>
<affects>
<package>
<name>exiv2</name>
<range><ge>0.28.0</ge><lt>0.28.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin Backhouse reports:</p>
<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7">
<p>A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4.
Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a
command-line utility and C++ library for reading, writing, deleting, and
modifying the metadata of image files. The heap overflow is triggered when
Exiv2 is used to write metadata into a crafted image file. An attacker
could potentially exploit the vulnerability to gain code execution, if
they can trick the victim into running Exiv2 on a crafted image file.</p>
<p>Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata. For
example, to trigger the bug in the Exiv2 command-line application, you
need to add an extra command-line argument such as fixiso.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-26623</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7</url>
</references>
<dates>
<discovery>2025-02-18</discovery>
<entry>2025-02-25</entry>
</dates>
</vuln>
<vuln vid="e60e538f-e795-4a00-b475-cc85a7546e00">
<topic>Emacs -- Arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<name>emacs-wayland</name>
<range><lt>30.1,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<name>emacs-devel-nox</name>
<range><lt>30.0.50.20240115,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A shell injection vulnerability exists in GNU Emacs due to improper
handling of custom man URI schemes.</p>
<h1>Impact</h1>
<p>Initially considered low severity, as it required user interaction with
local files, it was later discovered that an attacker could exploit this
vulnerability by tricking a user into visiting a specially crafted
website or an HTTP URL with a redirect, leading to arbitrary shell
command execution without further user action.</p>
</body>
</description>
<references>
<cvename>CVE-2025-1244</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1244</url>
</references>
<dates>
<discovery>2025-02-11</discovery>
<entry>2025-02-24</entry>
<modified>2025-02-25</modified>
</dates>
</vuln>
<vuln vid="7ba6c085-1590-491a-98ce-5452646b196f">
<topic>Emacs -- Shell injection vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<name>emacs-wayland</name>
<range><lt>30.1,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<name>emacs-devel-nox</name>
<range><lt>31.0.50.20250101,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An Emacs user who chooses to invoke elisp-completion-at-point (for
code completion) on untrusted Emacs Lisp source code can trigger unsafe
Lisp macro expansion that allows attackers to execute arbitrary code.
This unsafe expansion also occurs if a user chooses to enable on-the-fly
diagnosis that byte compiles untrusted Emacs Lisp source code.</p>
</body>
</description>
<references>
<cvename>CVE-2024-53920</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-53920</url>
</references>
<dates>
<discovery>2024-11-27</discovery>
<entry>2025-02-24</entry>
</dates>
</vuln>
<vuln vid="07c34df5-f299-11ef-a441-b42e991fc52e">
<topic>exim -- SQL injection</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.98.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://bugzilla.suse.com/show_bug.cgi?id=1237424">
<p>Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization
are used, allows remote SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-26794</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-26794</url>
</references>
<dates>
<discovery>2025-02-21</discovery>
<entry>2025-02-24</entry>
</dates>
</vuln>
<vuln vid="a8f1ee74-f267-11ef-87ba-002590c1f29c">
<topic>FreeBSD -- Multiple vulnerabilities in OpenSSH</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.2</ge><lt>14.2_2</lt></range>
<range><ge>14.1</ge><lt>14.1_8</lt></range>
<range><ge>13.4</ge><lt>13.4_4</lt></range>
</package>
<package>
<name>openssh-portable</name>
<range><lt>9.9.p2_1,1</lt></range>
</package>
<package>
<name>openssh-portable-hpn</name>
<range><lt>9.9.p2_1,1</lt></range>
</package>
<package>
<name>openssh-portable-gssapi</name>
<range><lt>9.9.p2_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>OpenSSH client host verification error (CVE-2025-26465)</p>
<p>ssh(1) contains a logic error that allows an on-path attacker to
impersonate any server during certain conditions when the
VerifyHostKeyDNS option is enabled.</p>
<p>OpenSSH server denial of service (CVE-2025-26466)</p>
<p>The OpenSSH client and server are both vulnerable to a memory/CPU
denial of service while handling SSH2_MSG_PING packets.</p>
<h1>Impact:</h1>
<p>OpenSSH client host verification error (CVE-2025-26465)</p>
<p>Under specific circumstances, a machine-in-the-middle may impersonate
any server when the client has the VerifyHostKeyDNS option enabled.</p>
<p>OpenSSH server denial of service (CVE-2025-26466)</p>
<p>During the processing of SSH2_MSG_PING packets, a server may be
subject to a memory/CPU denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2025-26465</cvename>
<cvename>CVE-2025-26466</cvename>
<freebsdsa>SA-25:05.openssh</freebsdsa>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-26465</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-26466</url>
</references>
<dates>
<discovery>2025-02-21</discovery>
<entry>2025-02-24</entry>
<modified>2025-03-08</modified>
</dates>
</vuln>
<vuln vid="2a3be628-ef6e-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>133.0.6943.126</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>133.0.6943.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[394350433] High CVE-2025-0999: Heap buffer overflow in V8. Reported by Seunghyun Lee (@0x10n) on 2025-02-04</li>
<li>[383465163] High CVE-2025-1426: Heap buffer overflow in GPU. Reported by un3xploitable and GF on 2024-12-11</li>
<li>[390590778] Medium CVE-2025-1006: Use after free in Network. Reported by Tal Keren, Sam Agranat, Eran Rom, Edouard Bochin, Adam Hatsir of Palo Alto Networks on 2025-01-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0999</cvename>
<cvename>CVE-2025-1426</cvename>
<cvename>CVE-2025-1006</cvename>
<url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html</url>
</references>
<dates>
<discovery>2025-02-18</discovery>
<entry>2025-02-20</entry>
</dates>
</vuln>
<vuln vid="f572b9d1-ef6d-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>133.0.6943.98</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>133.0.6943.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[391907159] High CVE-2025-0995: Use after free in V8. Reported by Popax21 on 2025-01-24</li>
<li>[391788835] High CVE-2025-0996: Inappropriate implementation in Browser UI. Reported by yuki yamaoto on 2025-01-23</li>
<li>[391666328] High CVE-2025-0997: Use after free in Navigation. Reported by asnine on 2025-01-23</li>
<li>[386857213] High CVE-2025-0998: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-31</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0995</cvename>
<cvename>CVE-2025-0996</cvename>
<cvename>CVE-2025-0997</cvename>
<cvename>CVE-2025-0998</cvename>
<url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2025-02-12</discovery>
<entry>2025-02-20</entry>
</dates>
</vuln>
<vuln vid="b09d0b3b-ef6d-11ef-85f3-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>133.0.6943.53</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>133.0.6943.53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[390889644] High CVE-2025-0444: Use after free in Skia. Reported by Francisco Alonso (@revskills) on 2025-01-19</li>
<li>[392521083] High CVE-2025-0445: Use after free in V8. Reported by 303f06e3 on 2025-01-27</li>
<li>[40061026] Medium CVE-2025-0451: Inappropriate implementation in Extensions API. Reported by Vitor Torres and Alesandro Ortiz on 2022-09-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0444</cvename>
<cvename>CVE-2025-0445</cvename>
<cvename>CVE-2025-0451</cvename>
<url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-20</entry>
</dates>
</vuln>
<vuln vid="cbf5d976-656b-4bb6-805f-3af038e2de3e">
<topic>vscode -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.97.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VSCode developers report:</p>
<blockquote cite="https://github.com/microsoft/vscode/releases/tag/1.97.1">
<p>The update addresses these issues, including a fix for a security vulnerability.</p>
<ul>
<li>Scope node_module binary resolution in js-debug</li>
<li>Elevation of Privilege Vulnerability with VS Code server for web UI</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-24042</cvename>
<url>https://github.com/microsoft/vscode/security/advisories/GHSA-f85p-3684-2g3j</url>
<cvename>CVE-2025-24039</cvename>
<url>https://github.com/microsoft/vscode/security/advisories/GHSA-532g-4pv9-25f2</url>
</references>
<dates>
<discovery>2025-02-11</discovery>
<entry>2025-02-13</entry>
</dates>
</vuln>
<vuln vid="e915b60e-ea25-11ef-a1c0-0050569f0b83">
<topic>security/openvpn-auth-ldap -- Fix buffer overflow in challenge/response</topic>
<affects>
<package>
<name>openvpn-auth-ldap</name>
<range><lt>2.0.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Graham Northup reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-28820">
<p>A buffer overflow in extract_openvpn_cr allows attackers with a valid
LDAP username and who can control the challenge/response password field
to pass a string with more than 14 colons into this field and cause a
buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-28820</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-28820</url>
</references>
<dates>
<discovery>2024-06-27</discovery>
<entry>2025-02-13</entry>
</dates>
</vuln>
<vuln vid="fadf3b41-ea19-11ef-a540-6cc21735f730">
<topic>PostgreSQL -- PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation</topic>
<affects>
<package>
<name>postgresql17-client</name>
<range><lt>17.3</lt></range>
</package>
<package>
<name>postgresql16-client</name>
<range><lt>16.7</lt></range>
</package>
<package>
<name>postgresql15-client</name>
<range><lt>15.11</lt></range>
</package>
<package>
<name>postgresql14-client</name>
<range><lt>14.16</lt></range>
</package>
<package>
<name>postgresql13-client</name>
<range><lt>13.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2025-1094/">
<p>
Improper neutralization of quoting syntax in PostgreSQL
libpq functions PQescapeLiteral(), PQescapeIdentifier(),
PQescapeString(), and PQescapeStringConn() allows a
database input provider to achieve SQL injection in
certain usage patterns. Specifically, SQL injection
requires the application to use the function result to
construct input to psql, the PostgreSQL interactive
terminal. Similarly, improper neutralization of quoting
syntax in PostgreSQL command line utility programs
allows a source of command line arguments to achieve SQL
injection when client_encoding is BIG5 and
server_encoding is one of EUC_TW or MULE_INTERNAL.
Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and
13.19 are affected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1094</cvename>
<url>https://www.postgresql.org/support/security/CVE-2025-1094/</url>
</references>
<dates>
<discovery>2025-02-13</discovery>
<entry>2025-02-13</entry>
</dates>
</vuln>
<vuln vid="1a8c5720-e9cf-11ef-9e96-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.8.0</ge><lt>17.8.2</lt></range>
<range><ge>17.7.0</ge><lt>17.7.4</lt></range>
<range><ge>8.3.0</ge><lt>17.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/">
<p>A CSP-bypass XSS in merge-request page</p>
<p>Denial of Service due to Unbounded Symbol Creation</p>
<p>Exfiltrate content from private issues using Prompt Injection</p>
<p>A custom permission may allow overriding Repository settings</p>
<p>Internal HTTP header leak via route confusion in workhorse</p>
<p>SSRF via workspaces</p>
<p>Unauthorized Incident Closure and Deletion by Planner Role in GitLab</p>
<p>ActionCable does not invalidate tokens after revocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0376</cvename>
<cvename>CVE-2024-12379</cvename>
<cvename>CVE-2024-3303</cvename>
<cvename>CVE-2025-1042</cvename>
<cvename>CVE-2025-1212</cvename>
<cvename>CVE-2024-9870</cvename>
<cvename>CVE-2025-0516</cvename>
<cvename>CVE-2025-1198</cvename>
<url>https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/</url>
</references>
<dates>
<discovery>2025-02-12</discovery>
<entry>2025-02-13</entry>
</dates>
</vuln>
<vuln vid="d598266d-7772-4a31-9594-83b76b1fb837">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20250211</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html">
<p>
A potential security vulnerability in some Intel Processors may allow
denial of service. Intel released microcode updates to mitigate this
potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html">
<p>
A potential security vulnerability in some Intel Software Guard
Extensions (Intel SGX) Platforms may allow denial of service. Intel
is released microcode updates to mitigate this potential
vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html">
<p>
Potential security vulnerabilities in the UEFI firmware for some Intel
Processors may allow escalation of privilege, denial of service, or
information disclosure. Intel released UEFI firmware and CPU microcode
updates to mitigate these potential vulnerabilities.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01228.html">
<p>
A potential security vulnerability in some 13th and 14th Generation
Intel Core™ Processors may allow denial of service. Intel released
microcode and UEFI reference code updates to mitigate this potential
vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html">
<p>
A potential security vulnerability in the Intel Data Streaming
Accelerator (Intel DSA) for some Intel Xeon Processors may allow
denial of service. Intel released software updates to mitigate this
potential vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31068</cvename>
<cvename>CVE-2024-36293</cvename>
<cvename>CVE-2023-43758</cvename>
<cvename>CVE-2024-39355</cvename>
<cvename>CVE-2024-37020</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250211</url>
</references>
<dates>
<discovery>2025-02-11</discovery>
<entry>2025-02-12</entry>
</dates>
</vuln>
<vuln vid="a64761a1-e895-11ef-873e-8447094a420f">
<topic>OpenSSL -- Man-in-the-Middle vulnerability</topic>
<affects>
<package>
<name>openssl32</name>
<range><lt>3.2.4</lt></range>
</package>
<package>
<name>openssl33</name>
<range><lt>3.3.2</lt></range>
</package>
<package>
<name>openssl34</name>
<range><lt>3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://openssl-library.org/news/secadv/20250211.txt">
<p>RFC7250 handshakes with unauthenticated servers don't abort as expected (High).
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12797</cvename>
<url>https://openssl-library.org/news/secadv/20250211.txt</url>
</references>
<dates>
<discovery>2025-02-11</discovery>
<entry>2025-02-11</entry>
</dates>
</vuln>
<vuln vid="20485d27-e540-11ef-a845-b42e991fc52e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>135.0.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.7,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.7</lt></range>
<range><gt>129</gt><lt>135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471">
<p>A bug in WebAssembly code generation could have lead to a crash.
It may have been possible for an attacker to leverage this to achieve
code execution.</p>
<p>A race condition could have led to private browsing tabs being
opened in normal browsing windows. This could have resulted in a
potential privacy leak.</p>
<p>Certificate length was not properly checked when added to a certificate
store. In practice only trusted data was processed.</p>
<p>Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox
ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort some
of these could have been exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1011</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1011</url>
<cvename>CVE-2025-1013</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1013</url>
<cvename>CVE-2025-1014</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1014</url>
<cvename>CVE-2025-1017</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1017</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="f7ca4ff7-e53f-11ef-a845-b42e991fc52e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mozilla</name>
<range><lt>135.0.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169">
<p>Memory safety bugs present in Firefox 134 and Thunderbird 134. Some
of these bugs showed evidence of memory corruption and we presume
that with enough effort some of these could have been exploited to
run arbitrary code.</p>
<p>The fullscreen notification is prematurely hidden when fullscreen
is re-requested quickly by the user. This could have been leveraged
to perform a potential spoofing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1018</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1018</url>
<cvename>CVE-2025-1019</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1019</url>
<cvename>CVE-2025-1020</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1020</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="e54a1413-e539-11ef-a845-b42e991fc52e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>135.0.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>115.20,1</lt></range>
<range><gt>116.0,1</gt><lt>128.6,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.7</lt></range>
<range><gt>129</gt><lt>135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994">
<p>An attacker could have caused a use-after-free via crafted XSLT
data, leading to a potentially exploitable crash.</p>
<p>An attacker could have caused a use-after-free via the Custom
Highlight API, leading to a potentially exploitable crash.</p>
<p>A race during concurrent delazification could have led to a
use-after-free.</p>
<p>Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox
ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird
128.6. Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have been
exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1009</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1009</url>
<cvename>CVE-2025-1010</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1010</url>
<cvename>CVE-2025-1012</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1012</url>
<cvename>CVE-2025-1016</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1016</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="830381c7-e539-11ef-a845-b42e991fc52e">
<topic>Thundirbird -- unprivileged JavaScript code execution</topic>
<affects>
<package>
<name>mozilla</name>
<range><lt>128.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1939458">
<p>The Thunderbird Address Book URI fields contained unsanitized links.
This could be used by an attacker to create and export an address
book containing a malicious payload in a field. For example, in
the Other field of the Instant Messaging section. If another user
imported the address book, clicking on the link could result in
opening a web page inside Thunderbird, and that page could execute
(unprivileged) JavaScript.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1015</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-1015</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="7bcfca95-e563-11ef-873e-8447094a420f">
<topic>MariaDB -- DoS vulnerability in InnoDB</topic>
<affects>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.28</lt></range>
</package>
<package>
<name>mariadb106-server</name>
<range><lt>10.6.21</lt></range>
</package>
<package>
<name>mariadb1011-server</name>
<range><lt>10.11.11</lt></range>
</package>
<package>
<name>mariadb114-server</name>
<range><lt>11.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MariaDB reports:</p>
<blockquote cite="https://mariadb.com/kb/en/security/">
<p>Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-21490</cvename>
<url>http://mariadb.com/kb/en/security/</url>
</references>
<dates>
<discovery>2025-02-04</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="c10b639c-e51c-11ef-9e76-4ccc6adda413">
<topic>libcaca -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>libcaca</name>
<range><lt>0.99.b20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sam Hocevar reports:</p>
<blockquote cite="https://github.com/cacalabs/libcaca/releases/tag/v0.99.beta20">
<p>Multiple memory leaks and invalid memory accesses:</p>
<ul>
<li>CVE-2018-20545: Illegal WRITE memory access at common-image.c</li>
<li>CVE-2018-20546: Illegal READ memory access at caca/dither.c</li>
<li>CVE-2018-20547: Illegal READ memory access at caca/dither.c</li>
<li>CVE-2018-20548: Illegal WRITE memory access at common-image.c</li>
<li>CVE-2018-20549: Illegal WRITE memory access at caca/file.c</li>
<li>CVE-2021-3410: Buffer overflow in libcaca/caca/canvas.c in function caca_resize</li>
<li>CVE-2021-30498: Heap buffer overflow in export.c in function export_tga</li>
<li>CVE-2021-30499: Buffer overflow in export.c in function export_troff</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-20545</cvename>
<cvename>CVE-2018-20546</cvename>
<cvename>CVE-2018-20547</cvename>
<cvename>CVE-2018-20548</cvename>
<cvename>CVE-2018-20549</cvename>
<cvename>CVE-2021-3410</cvename>
<cvename>CVE-2021-30498</cvename>
<cvename>CVE-2021-30499</cvename>
<url>https://github.com/cacalabs/libcaca/releases/tag/v0.99.beta20</url>
</references>
<dates>
<discovery>2021-10-19</discovery>
<entry>2025-02-07</entry>
</dates>
</vuln>
<vuln vid="e7974ca5-e4c8-11ef-aab3-40b034429ecf">
<topic>cacti -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti repo reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.29">
<ul>
<li>security #GHSA-c5j8-jxj3-hh36: Authenticated RCE via multi-line SNMP responses</li>
<li>security #GHSA-f9c7-7rc3-574c: SQL Injection vulnerability when using tree rules through Automation API</li>
<li>security #GHSA-fh3x-69rr-qqpp: SQL Injection vulnerability when request automation devices</li>
<li>security #GHSA-fxrq-fr7h-9rqq: Arbitrary File Creation leading to RCE</li>
<li>security #GHSA-pv2c-97pp-vxwg: Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path</li>
<li>security #GHSA-vj9g-p7f2-4wqj: SQL Injection vulnerability when view host template</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-22604</cvename>
<cvename>CVE-2025-24368</cvename>
<cvename>CVE-2024-54145</cvename>
<cvename>CVE-2025-24367</cvename>
<cvename>CVE-2024-45598</cvename>
<cvename>CVE-2024-54146</cvename>
</references>
<dates>
<discovery>2025-02-02</discovery>
<entry>2025-02-05</entry>
</dates>
</vuln>
<vuln vid="9761af78-e3e4-11ef-9f4a-589cfc10a551">
<topic>nginx-devel -- SSL session reuse vulnerability</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><lt>1.27.4</lt></range>
</package>
<package>
<name>nginx</name>
<range><lt>1.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx development team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>This update fixes the SSL session reuse vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-23419</cvename>
</references>
<dates>
<discovery>2025-02-05</discovery>
<entry>2025-02-05</entry>
</dates>
</vuln>
<vuln vid="72b8729e-e134-11ef-9e76-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based">
<p>Backports for 9 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-12693: Out of bounds memory access in V8</li>
<li>CVE-2024-12694: Use after free in Compositing</li>
<li>CVE-2025-0436: Integer overflow in Skia</li>
<li>CVE-2025-0437: Out of bounds read in Metrics</li>
<li>CVE-2025-0438: Stack buffer overflow in Tracing</li>
<li>CVE-2025-0441: Inappropriate implementation in Fenced Frames</li>
<li>CVE-2025-0443: Insufficient data validation in Extensions</li>
<li>CVE-2025-0447: Inappropriate implementation in Navigation</li>
<li>CVE-2025-0611: Object corruption in V8</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12693</cvename>
<cvename>CVE-2024-12694</cvename>
<cvename>CVE-2025-0436</cvename>
<cvename>CVE-2025-0437</cvename>
<cvename>CVE-2025-0438</cvename>
<cvename>CVE-2025-0441</cvename>
<cvename>CVE-2025-0443</cvename>
<cvename>CVE-2025-0447</cvename>
<cvename>CVE-2025-0611</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based</url>
</references>
<dates>
<discovery>2025-01-09</discovery>
<entry>2025-02-02</entry>
</dates>
</vuln>
<vuln vid="186101b4-dfa6-11ef-8c1c-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>132.0.6834.159</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>132.0.6834.159</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[384844003] Medium CVE-2025-0762: Use after free in DevTools. Reported by Sakana.S on 2024-12-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0762</cvename>
<url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html</url>
</references>
<dates>
<discovery>2025-01-18</discovery>
<entry>2025-01-31</entry>
</dates>
</vuln>
<vuln vid="cd2ace09-df23-11ef-a205-901b0e9408dc">
<topic>dendrite -- Server-side request forgery vulnerability</topic>
<affects>
<package>
<name>dendrite</name>
<range><lt>0.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dendrite team reports:</p>
<blockquote cite="https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822">
<p>This is a security release, gomatrixserverlib was vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-52594</cvename>
<url>https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822</url>
</references>
<dates>
<discovery>2025-01-16</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="2830b374-debd-11ef-87ba-002590c1f29c">
<topic>FreeBSD -- Uninitialized kernel memory disclosure via ktrace(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.2</ge><lt>14.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In some cases, the ktrace facility will log the contents of
kernel structures to userspace. In one such case, ktrace dumps a
variable-sized sockaddr to userspace. There, the full sockaddr is
copied, even when it is shorter than the full size. This can result
in up to 14 uninitialized bytes of kernel memory being copied out
to userspace.</p>
<h1>Impact:</h1>
<p>It is possible for an unprivileged userspace program to leak
14 bytes of a kernel heap allocation to userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2025-0662</cvename>
<freebsdsa>SA-25:04.ktrace</freebsdsa>
</references>
<dates>
<discovery>2025-01-29</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="fa9ae646-debc-11ef-87ba-002590c1f29c">
<topic>FreeBSD -- Unprivileged access to system files</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.2</ge><lt>14.2_1</lt></range>
<range><ge>14.1</ge><lt>14.1_7</lt></range>
<range><ge>13.4</ge><lt>13.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When etcupdate encounters conflicts while merging files, it
saves a version containing conflict markers in /var/db/etcupdate/conflicts.
This version does not preserve the mode of the input file, and is
world-readable. This applies to files that would normally have
restricted visibility, such as /etc/master.passwd.</p>
<h1>Impact:</h1>
<p>An unprivileged local user may be able to read encrypted root
and user passwords from the temporary master.passwd file created
in /var/db/etcupdate/conflicts. This is possible only when conflicts
within the password file arise during an update, and the unprotected
file is deleted when conflicts are resolved.</p>
</body>
</description>
<references>
<cvename>CVE-2025-0374</cvename>
<freebsdsa>SA-25:03.etcupdate</freebsdsa>
</references>
<dates>
<discovery>2025-01-29</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="ab0cbe3f-debc-11ef-87ba-002590c1f29c">
<topic>FreeBSD -- Buffer overflow in some filesystems via NFS</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.2</ge><lt>14.2_1</lt></range>
<range><ge>14.1</ge><lt>14.1_7</lt></range>
<range><ge>13.4</ge><lt>13.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In order to export a file system via NFS, the file system must
define a file system identifier (FID) for all exported files. Each
FreeBSD file system implements operations to translate between FIDs
and vnodes, the kernel's in-memory representation of files. These
operations are VOP_VPTOFH(9) and VFS_FHTOVP(9).</p>
<p>On 64-bit systems, the implementation of VOP_VPTOFH() in the
cd9660, tarfs and ext2fs filesystems overflows the destination FID
buffer by 4 bytes, a stack buffer overflow.</p>
<h1>Impact:</h1>
<p>A NFS server that exports a cd9660, tarfs, or ext2fs file system
can be made to panic by mounting and accessing the export with an
NFS client. Further exploitation (e.g., bypassing file permission
checking or remote kernel code execution) is potentially possible,
though this has not been demonstrated. In particular, release
kernels are compiled with stack protection enabled, and some instances
of the overflow are caught by this mechanism, causing a panic.</p>
</body>
</description>
<references>
<cvename>CVE-2025-0373</cvename>
<freebsdsa>SA-25:02.fs</freebsdsa>
</references>
<dates>
<discovery>2025-01-29</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="69e19c0b-debc-11ef-87ba-002590c1f29c">
<topic>FreeBSD -- OpenSSH Keystroke Obfuscation Bypass</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A logic error in the ssh(1) ObscureKeystrokeTiming feature (on
by default) rendered this feature ineffective.</p>
<h1>Impact:</h1>
<p>A passive observer could detect which network packets contain
real keystrokes, and infer the specific characters being transmitted
from packet timing.</p>
</body>
</description>
<references>
<cvename>CVE-2024-39894</cvename>
<freebsdsa>SA-25:01.openssh</freebsdsa>
</references>
<dates>
<discovery>2025-01-29</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="258a58a9-6583-4808-986b-e785c27b0a18">
<topic>oauth2-proxy -- Non-linear parsing of case-insensitive content</topic>
<affects>
<package>
<name>oauth2-proxy</name>
<range><lt>7.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Golang reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-w32m-9786-jp63">
<p>This update include security fixes:</p>
<ul>
<li>CVE-2024-45338: Non-linear parsing of case-insensitive content</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-45338</cvename>
</references>
<dates>
<discovery>2025-01-14</discovery>
<entry>2025-01-30</entry>
</dates>
</vuln>
<vuln vid="41711c0d-db27-11ef-873e-8447094a420f">
<topic>Vaultwarden -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>vaultwarden</name>
<range><lt>1.33.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Vaultwarden project reports:</p>
<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0">
<p>RCE in the admin panel.</p>
<p>Getting access to the Admin Panel via CSRF.</p>
<p>Escalation of privilege via variable confusion in OrgHeaders trait.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-24364</cvename>
<url>https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797</url>
<cvename>CVE-2025-24365</cvename>
<url>https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4</url>
</references>
<dates>
<discovery>2025-01-25</discovery>
<entry>2025-01-25</entry>
</dates>
</vuln>
<vuln vid="c53cd328-8131-4fc2-a083-a9e9d45e3028">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>132.0.6834.110</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>132.0.6834.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[386143468] High CVE-2025-0611: Object corruption in V8. Reported by 303f06e3 on 2024-12-26</li>
<li>[385155406] High CVE-2025-0612: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0611</cvename>
<cvename>CVE-2025-0612</cvename>
<url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html</url>
</references>
<dates>
<discovery>2025-01-22</discovery>
<entry>2025-01-25</entry>
</dates>
</vuln>
<vuln vid="756839e1-cd78-4082-9f9e-d0da616ca8dd">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>132.0.6834.83</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>132.0.6834.83</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html">
<p>This update includes 16 security fixes:</p>
<ul>
<li>[374627491] High CVE-2025-0434: Out of bounds memory access in V8. Reported by ddme on 2024-10-21</li>
<li>[379652406] High CVE-2025-0435: Inappropriate implementation in Navigation. Reported by Alesandro Ortiz on 2024-11-18</li>
<li>[382786791] High CVE-2025-0436: Integer overflow in Skia. Reported by Han Zheng (HexHive) on 2024-12-08</li>
<li>[378623799] High CVE-2025-0437: Out of bounds read in Metrics. Reported by Xiantong Hou of Wuheng Lab and Pisanbao on 2024-11-12</li>
<li>[384186539] High CVE-2025-0438: Stack buffer overflow in Tracing. Reported by Han Zheng (HexHive) on 2024-12-15</li>
<li>[371247941] Medium CVE-2025-0439: Race in Frames. Reported by Hafiizh on 2024-10-03</li>
<li>[40067914] Medium CVE-2025-0440: Inappropriate implementation in Fullscreen. Reported by Umar Farooq on 2023-07-22</li>
<li>[368628042] Medium CVE-2025-0441: Inappropriate implementation in Fenced Frames. Reported by someoneverycurious on 2024-09-21</li>
<li>[40940854] Medium CVE-2025-0442: Inappropriate implementation in Payments. Reported by Ahmed ElMasry on 2023-11-08</li>
<li>[376625003] Medium CVE-2025-0443: Insufficient data validation in Extensions. Reported by Anonymous on 2024-10-31</li>
<li>[359949844] Low CVE-2025-0446: Inappropriate implementation in Extensions. Reported by Hafiizh on 2024-08-15</li>
<li>[375550814] Low CVE-2025-0447: Inappropriate implementation in Navigation. Reported by Khiem Tran (@duckhiem) on 2024-10-25</li>
<li>[377948403] Low CVE-2025-0448: Inappropriate implementation in Compositing. Reported by Dahyeon Park on 2024-11-08</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0434</cvename>
<cvename>CVE-2025-0435</cvename>
<cvename>CVE-2025-0436</cvename>
<cvename>CVE-2025-0437</cvename>
<cvename>CVE-2025-0438</cvename>
<cvename>CVE-2025-0439</cvename>
<cvename>CVE-2025-0440</cvename>
<cvename>CVE-2025-0441</cvename>
<cvename>CVE-2025-0442</cvename>
<cvename>CVE-2025-0443</cvename>
<cvename>CVE-2025-0446</cvename>
<cvename>CVE-2025-0447</cvename>
<cvename>CVE-2025-0448</cvename>
<url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2025-01-14</discovery>
<entry>2025-01-25</entry>
</dates>
</vuln>
<vuln vid="ef303b6a-7d9e-4e28-b92e-21f39d519d9e">
<topic>electron32 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.0">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-12693.</li>
<li>Security: backported fix for CVE-2024-12694.</li>
<li>Security: backported fix for CVE-2024-12695.</li>
<li>Security: backported fix for CVE-2025-0434.</li>
<li>Security: backported fix for CVE-2025-0436.</li>
<li>Security: backported fix for CVE-2025-0437.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12693</cvename>
<url>https://github.com/advisories/GHSA-m84q-p89f-6cc5</url>
<cvename>CVE-2024-12694</cvename>
<url>https://github.com/advisories/GHSA-cgc6-4xgf-5q5x</url>
<cvename>CVE-2024-12695</cvename>
<url>https://github.com/advisories/GHSA-6895-2frg-pq5j</url>
<cvename>CVE-2025-0434</cvename>
<url>https://github.com/advisories/GHSA-fpmx-pfpg-92xg</url>
<cvename>CVE-2025-0436</cvename>
<url>https://github.com/advisories/GHSA-ww3g-8h77-wr7v</url>
<cvename>CVE-2025-0437</cvename>
<url>https://github.com/advisories/GHSA-4353-vp82-4qq4</url>
</references>
<dates>
<discovery>2025-01-23</discovery>
<entry>2025-01-25</entry>
</dates>
</vuln>
<vuln vid="2def27c7-7dd0-42cb-adf6-8e5a7afe4db3">
<topic>electron33 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron33</name>
<range><lt>33.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v33.3.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2025-0434.</li>
<li>Security: backported fix for CVE-2025-0436.</li>
<li>Security: backported fix for CVE-2025-0437.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0434</cvename>
<url>https://github.com/advisories/GHSA-fpmx-pfpg-92xg</url>
<cvename>CVE-2025-0436</cvename>
<url>https://github.com/advisories/GHSA-ww3g-8h77-wr7v</url>
<cvename>CVE-2025-0437</cvename>
<url>https://github.com/advisories/GHSA-4353-vp82-4qq4</url>
</references>
<dates>
<discovery>2025-01-22</discovery>
<entry>2025-01-23</entry>
</dates>
</vuln>
<vuln vid="24c93a28-d95b-11ef-b6b2-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.8.0</ge><lt>17.8.1</lt></range>
<range><ge>17.7.0</ge><lt>17.7.3</lt></range>
<range><ge>15.7.0</ge><lt>17.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/">
<p>Stored XSS via Asciidoctor render</p>
<p>Developer could exfiltrate protected CI/CD variables via CI lint</p>
<p>Cyclic reference of epics leads resource exhaustion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0314</cvename>
<cvename>CVE-2024-11931</cvename>
<cvename>CVE-2024-6324</cvename>
<url>https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/</url>
</references>
<dates>
<discovery>2025-01-22</discovery>
<entry>2025-01-23</entry>
</dates>
</vuln>
<vuln vid="1e109b60-d92e-11ef-a661-08002784c58d">
<topic>clamav -- Possbile denial-of-service vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>1.0.0,1</ge><lt>1.4.2,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><ge>1.0.0,1</ge><lt>1.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ClamAV project reports:</p>
<blockquote cite="https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html">
<p>
A possible buffer overflow read bug is found in the OLE2
file parser that could cause a denial-of-service (DoS)
condition.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-20128</cvename>
<url>https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html</url>
</references>
<dates>
<discovery>2025-01-22</discovery>
<entry>2025-01-23</entry>
</dates>
</vuln>
<vuln vid="7d17676d-4828-4a43-85d6-1ee14362de6e">
<topic>electron32 -- Type Confusion in V8</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.8">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-12053.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12053</cvename>
<url>https://github.com/advisories/GHSA-wvx7-72hc-rp32</url>
</references>
<dates>
<discovery>2025-01-06</discovery>
<entry>2025-01-22</entry>
</dates>
</vuln>
<vuln vid="704aa72a-d840-11ef-a205-901b0e9408dc">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.11</lt></range>
</package>
<package>
<name>go123</name>
<range><lt>1.23.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/71156">
<p>crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints</p>
<p>A certificate with a URI which has a IPv6 address with a
zone ID may incorrectly satisfy a URI name constraint that
applies to the certificate chain.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/70530">
<p>net/http: sensitive headers incorrectly sent after cross-domain redirect</p>
<p>The HTTP client drops sensitive headers after following a
cross-domain redirect. For example, a request to a.com/
containing an Authorization header which is redirected to
b.com/ will not send that header to b.com.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-45341</cvename>
<cvename>CVE-2024-45336</cvename>
<url>https://go.dev/issue/71156</url>
<url>https://go.dev/issue/70530</url>
</references>
<dates>
<discovery>2025-01-07</discovery>
<entry>2025-01-21</entry>
</dates>
</vuln>
<vuln vid="3161429b-3897-4593-84a0-b41ffbbfa36b">
<topic>electron31 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.7">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-12053.</li>
<li>Security: backported fix for CVE-2024-12693.</li>
<li>Security: backported fix for CVE-2024-12694.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12053</cvename>
<url>https://github.com/advisories/GHSA-wvx7-72hc-rp32</url>
<cvename>CVE-2024-12693</cvename>
<url>https://github.com/advisories/GHSA-m84q-p89f-6cc5</url>
<cvename>CVE-2024-12694</cvename>
<url>https://github.com/advisories/GHSA-cgc6-4xgf-5q5x</url>
</references>
<dates>
<discovery>2025-01-14</discovery>
<entry>2025-01-20</entry>
</dates>
</vuln>
<vuln vid="d9b0fea0-d564-11ef-b9bc-d05099c0ae8c">
<topic>age -- age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution</topic>
<affects>
<package>
<name>age</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Filippo Valsorda reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-32gq-x56h-299c">
<p>A plugin name containing a path separator may allow an
attacker to execute an arbitrary binary.</p>
<p>Such a plugin name can be provided to the age CLI through
an attacker-controlled recipient or identity string, or to
the plugin.NewIdentity, plugin.NewIdentityWithoutData, or
plugin.NewRecipient APIs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/advisories/GHSA-32gq-x56h-299c</url>
</references>
<dates>
<discovery>2024-12-18</discovery>
<entry>2025-01-18</entry>
</dates>
</vuln>
<vuln vid="47bc292a-d472-11ef-aaab-7d43732cb6f5">
<topic>openvpn -- too long a username or password from a client can confuse openvpn servers</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Lichtenheld reports:</p>
<blockquote cite="https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13">
<p>[OpenVPN v2.6.13 ...] improve server-side handling of clients sending
usernames or passwords longer than USER_PASS_LEN - this would not
result in a crash, buffer overflow or other security issues, but the
server would then misparse incoming IV variables and produce misleading
error messages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13</url>
</references>
<dates>
<discovery>2024-10-28</discovery>
<entry>2025-01-17</entry>
</dates>
</vuln>
<vuln vid="163edccf-d2ba-11ef-b10e-589cfc10a551">
<topic>rsync -- Multiple security fixes</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>3.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rsync reports:</p>
<blockquote cite="https://kb.cert.org/vuls/id/952657">
<p>This update includes multiple security fixes:</p>
<ul>
<li>CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing</li>
<li>CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR</li>
<li>CVE-2024-12086: Server leaks arbitrary client files</li>
<li>CVE-2024-12087: Server can make client write files outside of destination directory using symbolic links</li>
<li>CVE-2024-12088: --safe-links Bypass</li>
<li>CVE-2024-12747: symlink race condition</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12084</cvename>
<cvename>CVE-2024-12085</cvename>
<cvename>CVE-2024-12086</cvename>
<cvename>CVE-2024-12087</cvename>
<cvename>CVE-2024-12088</cvename>
<cvename>CVE-2024-12747</cvename>
</references>
<dates>
<discovery>2025-01-14</discovery>
<entry>2025-01-14</entry>
</dates>
</vuln>
<vuln vid="3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8">
<topic>git -- multiple vulnerabilities</topic>
<affects>
<package>
<name>git</name>
<name>git-cvs</name>
<name>git-gui</name>
<name>git-p4</name>
<name>git-svn</name>
<range><lt>2.48.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git development team reports:</p>
<blockquote cite="https://lore.kernel.org/git/xmqq5xmh46oc.fsf@gitster.g/">
<p>CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the
user susceptible to crafted URLs (e.g. in recursive clones) that
mislead the user into typing in passwords for trusted sites that
would then be sent to untrusted sites instead.</p>
<p>CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to
credential helpers which use line-reading functions that
interpret said Carriage Returns as line endings, even though Git
did not intend that.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-50349</cvename>
<url>https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr</url>
<cvename>CVE-2024-52006</cvename>
<url>https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp</url>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2025-01-14</entry>
</dates>
</vuln>
<vuln vid="5e2bd238-d2bb-11ef-bc0e-1c697a616631">
<topic>keycloak -- Multiple security fixes</topic>
<affects>
<package>
<name>keycloak</name>
<range><lt>26.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Keycloak reports:</p>
<blockquote cite="https://www.keycloak.org/2024/11/keycloak-2606-released.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>CVE-2024-11734: Unrestricted admin use of system and environment variables</li>
<li>CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11734</cvename>
<cvename>CVE-2024-11736</cvename>
</references>
<dates>
<discovery>2025-01-13</discovery>
<entry>2025-01-13</entry>
</dates>
</vuln>
<vuln vid="7624c151-d116-11ef-b232-b42e991fc52e">
<topic>asterisk - path traversal</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>18.26.2</lt></range>
</package>
<package>
<name>asterisk20</name>
<range><lt>20.11.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://gist.github.com/hyp164D1/e7c0f44ffb38c00320aa1a6d98bee616">
<p>An issue in the action_listcategories() function of Sangoma Asterisk
v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to
execute a path traversal.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-53566</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-53566</url>
</references>
<dates>
<discovery>2024-12-02</discovery>
<entry>2025-01-12</entry>
</dates>
</vuln>
<vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d">
<topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic>
<affects>
<package>
<name>redis</name>
<range><ge>7.0.0</ge><lt>7.4.2</lt></range>
</package>
<package>
<name>redis72</name>
<range><lt>7.2.7</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.4.2.20250201</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9">
<p>
An authenticated with sufficient privileges may create a
malformed ACL selector which, when accessed, triggers a
server panic and subsequent denial of service.The problem
exists in Redis 7.0.0 or newer.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-51741</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9</url>
</references>
<dates>
<discovery>2025-01-06</discovery>
<entry>2025-01-10</entry>
</dates>
</vuln>
<vuln vid="5f19ac58-cc90-11ef-abed-08002784c58d">
<topic>redis,valkey -- Remote code execution valnerability</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.4.2</lt></range>
</package>
<package>
<name>redis72</name>
<range><lt>7.2.7</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.17</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.4.2.20250201</lt></range>
</package>
<package>
<name>valkey</name>
<range><lt>8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c">
<p>
An authenticated user may use a specially crafted Lua
script to manipulate the garbage collector and potentially
lead to remote code execution. The problem exists in all
versions of Redis with Lua scripting.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-46981</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c</url>
</references>
<dates>
<discovery>2025-01-06</discovery>
<entry>2025-01-10</entry>
</dates>
</vuln>
<vuln vid="2bfde261-cdf2-11ef-b6b2-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.7.0</ge><lt>17.7.1</lt></range>
<range><ge>17.6.0</ge><lt>17.6.3</lt></range>
<range><ge>11.0.0</ge><lt>17.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/">
<p>Possible access token exposure in GitLab logs</p>
<p>Cyclic reference of epics leads resource exhaustion</p>
<p>Unauthorized user can manipulate status of issues in public projects</p>
<p>Instance SAML does not respect external_provider configuration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-0194</cvename>
<cvename>CVE-2024-6324</cvename>
<cvename>CVE-2024-12431</cvename>
<cvename>CVE-2024-13041</cvename>
<url>https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/</url>
</references>
<dates>
<discovery>2025-01-08</discovery>
<entry>2025-01-08</entry>
</dates>
</vuln>
<vuln vid="a380f43e-19e5-11f0-9568-b42e991fc52e">
<topic>Perl -- heap buffer overflow when transliterating non-ASCII bytes</topic>
<affects>
<package>
<name>perl5.36</name>
<range><lt>5.36.3</lt></range>
</package>
<package>
<name>perl5.38</name>
<range><lt>5.38.4</lt></range>
</package>
<package>
<name>perl5.40</name>
<range><lt>5.40.2</lt></range>
</package>
<package>
<name>perl5-devel</name>
<range><lt>5.41.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>9b29abf9-4ab0-4765-b253-1875cd9b441e reports:</p>
<blockquote cite="https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch">
<p>A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the `tr`
operator, `S_do_trans_invmap` can overflow the destination pointer
`d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of
Service and possibly Code Execution attacks on platforms that
lack sufficient defenses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-56406</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-56406</url>
</references>
<dates>
<discovery>2025-04-13</discovery>
<entry>2025-04-15</entry>
</dates>
</vuln>
<vuln vid="0230343c-1908-11f0-accc-b42e991fc52e">
<topic>gogs -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gogs</name>
<range><lt>0.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/">
<p>CVE-2024-44625: Directory Traversal via the editFilePost
function of internal/route/repo/editor.go.</p>
<p>CVE-2024-39933: Gogs allows argument injection during the
tagging of a new release.</p>
<p>CVE-2024-39932: Gogs allows argument injection during the
previewing of changes.</p>
<p>CVE-2024-39931: Gogs allows deletion of internal files.</p>
<p>CVE-2024-39930: The built-in SSH server of Gogs allows
argument injection in internal/ssh/ssh.go, leading to remote
code execution. Authenticated attackers can exploit this by
opening an SSH connection and sending a malicious
--split-string env request if the built-in SSH server is
activated.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-44625</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-44625</url>
<cvename>CVE-2024-39933</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-39933</url>
<cvename>CVE-2024-39932</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-39932</url>
<cvename>CVE-2024-39931</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-39931</url>
<cvename>CVE-2024-39930</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-39930</url>
</references>
<dates>
<discovery>2024-11-15</discovery>
<entry>2025-04-14</entry>
</dates>
</vuln>
<vuln vid="ba6361be-1887-11f0-a8ce-b42e991fc52e">
<topic>Mozilla -- null pointer dereference</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>133.0,2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>133.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1923767">
<p>A null pointer dereference may have inadvertently
occurred in `pk12util`, and specifically in the
`SEC_ASN1DecodeItem_Util` function, when handling malformed
or improperly formatted input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11706</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11706</url>
</references>
<dates>
<discovery>2024-11-26</discovery>
<entry>2025-04-13</entry>
</dates>
</vuln>
<vuln vid="b65b1217-1887-11f0-a8ce-b42e991fc52e">
<topic>mozilla -- double free error</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>133.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.7.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>133.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1899402">
<p>A double-free issue could have occurred in
`sec_pkcs7_decoder_start_decrypt()` when handling an error
path. Under specific conditions, the same symmetric key
could have been freed twice, potentially leading to memory
corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11704</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11704</url>
</references>
<dates>
<discovery>2024-11-26</discovery>
<entry>2025-04-13</entry>
</dates>
</vuln>
<vuln vid="ed0a052a-c5e6-11ef-a457-b42e991fc52e">
<topic>Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation</topic>
<affects>
<package>
<name>tomcat110</name>
<range>
<gt>11.0.0</gt>
<lt>11.0.1</lt>
</range>
</package>
<package>
<name>tomcat101</name>
<range>
<gt>10.1.0</gt>
<lt>10.1.33</lt>
</range>
</package>
<package>
<name>tomcat9</name>
<range>
<gt>9.0.0</gt>
<lt>9.0.97</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@apache.org reports:</p>
<blockquote cite="https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp">
<p>Time-of-check Time-of-use (TOCTOU) Race Condition
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the
default servlet write enabled (readonly initialisation parameter
set to the non-default value of false) may need additional configuration
to fully mitigate CVE-2024-50379 depending on which version of Java
they are using with Tomcat: - running on Java 8 or Java 11: the
system propertysun.io.useCanonCaches must be explicitly set to false
(it defaults to true) - running on Java 17: thesystem property
sun.io.useCanonCaches, if set, must be set to false(it defaults to
false) - running on Java 21 onwards: no further configuration is
required(the system property and the problematic cache have been
removed)
Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks
thatsun.io.useCanonCaches is set appropriately before allowing the
default servlet to be write enabled on a case insensitive file
system. Tomcat will also setsun.io.useCanonCaches to false by
default where it can.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-56337</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-56337</url>
</references>
<dates>
<discovery>2024-12-20</discovery>
<entry>2024-12-29</entry>
</dates>
</vuln>
<vuln vid="94b2d58a-c1e9-11ef-aa3f-dcfe074bd614">
<topic>kanboard -- Insufficient session invalidation</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.2.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40">
<p>Kanboard is project management software that focuses on the Kanban
methodology. In affected versions sessions are still usable even
though their lifetime has exceeded. Kanboard implements a cutom
session handler (`app/Core/Session/SessionHandler.php`), to store
the session data in a database. Therefore, when a `session_id` is
given, kanboard queries the data from the `sessions` sql table. At
this point, it does not correctly verify, if a given `session_id`
has already exceeded its lifetime (`expires_at`). Thus, a session
which's lifetime is already `> time()`, is still queried
from the database and hence a valid login. The implemented
**SessionHandlerInterface::gc** function, that does remove invalid
sessions, is called only **with a certain probability** (_Cleans
up expired sessions. Called by `session_start()`, based on
`session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime`
settings_) accordingly to the php documentation. In the official
Kanboard docker image these values default to: session.gc_probability=1,
session.gc_divisor=1000. Thus, an expired session is only terminated
with probability 1/1000. There are no known workarounds for
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-55603</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-55603</url>
</references>
<dates>
<discovery>2024-12-19</discovery>
<entry>2024-12-24</entry>
</dates>
</vuln>
<vuln vid="0a8dbc7f-bedc-11ef-b5a1-000ec6d40964">
<topic>Vaultwarden -- Admin organization permissions</topic>
<affects>
<package>
<name>vaultwarden</name>
<range><lt>1.32.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Vaultwarden project reports:</p>
<blockquote cite="https://github.com/dani-garcia/vaultwarden/pull/5291">
<p>Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/dani-garcia/vaultwarden/pull/5291</url>
</references>
<dates>
<discovery>2024-12-20</discovery>
<entry>2024-12-20</entry>
</dates>
</vuln>
<vuln vid="e18c5c8d-be01-11ef-8c1c-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>131.0.6778.204</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>131.0.6778.204</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[382291459] High CVE-2024-12692: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-12-05</li>
<li>[382190919] High CVE-2024-12693: Out of bounds memory access in V8. Reported by 303f06e3 on 2024-12-04</li>
<li>[368222741] High CVE-2024-12694: Use after free in Compositing. Reported by Anonymous on 2024-09-19</li>
<li>[383647255] High CVE-2024-12695: Out of bounds write in V8. Reported by 303f06e3 on 2024-12-12</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12692</cvename>
<cvename>CVE-2024-12693</cvename>
<cvename>CVE-2024-12694</cvename>
<cvename>CVE-2024-12695</cvename>
<url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html</url>
</references>
<dates>
<discovery>2024-12-18</discovery>
<entry>2024-12-19</entry>
</dates>
</vuln>
<vuln vid="dc087dad-bd71-11ef-b5a1-000ec6d40964">
<topic>liboqs -- Correctness error in HQC decapsulation</topic>
<affects>
<package>
<name>liboqs</name>
<range><lt>0.12.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Open Quantum Safe project reports:</p>
<blockquote cite="https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7">
<p>A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext.</p>
<p>No concrete attack exploiting the error has been identified at this point. However, the error involves mishandling of the secret key, and in principle this presents a security vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-54137</cvename>
<url>https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7</url>
</references>
<dates>
<discovery>2024-11-29</discovery>
<entry>2024-12-18</entry>
</dates>
</vuln>
<vuln vid="38e6f778-bca3-11ef-8926-9b4f2d14eb53">
<topic>gitea -- Fix misuse of PublicKeyCallback</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Misuse of ServerConfig.PublicKeyCallback may cause authorization
bypass in golang.org/x/crypto</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/32810</url>
<url>https://github.com/advisories/GHSA-v778-237x-gjrc</url>
</references>
<dates>
<discovery>2024-12-12</discovery>
<entry>2024-12-17</entry>
</dates>
</vuln>
<vuln vid="453cd84e-bca4-11ef-8926-9b4f2d14eb53">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.22.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Fix delete branch perm checking</li>
<li>Upgrade crypto library</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/32791</url>
<url>https://github.com/go-gitea/gitea/pull/32654</url>
</references>
<dates>
<discovery>2024-11-27</discovery>
<entry>2024-12-17</entry>
</dates>
</vuln>
<vuln vid="6ea20f0c-bca3-11ef-8926-9b4f2d14eb53">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.22.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Fix basic auth with webauthn</li>
<li>Refactor internal routers (partial backport, auth token const time comparing)</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/32531</url>
<url>https://github.com/go-gitea/gitea/pull/32473</url>
</references>
<dates>
<discovery>2024-11-16</discovery>
<entry>2024-12-17</entry>
</dates>
</vuln>
<vuln vid="5ca064a6-bca1-11ef-8926-9b4f2d14eb53">
<topic>forgejo -- multiple vulnerabilities</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>9.0.2</lt></range>
</package>
<package>
<name>forgejo7</name>
<range><lt>7.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>It was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action (registration, password reset or secondary email validation) could be used to perform a different action. It is no longer possible to use a token for an action that is different from its original purpose.</li>
<li>A fork of a public repository would show in the list of forks, even if its owner was not a public user or organization. Such a fork is now hidden from the list of forks of the public repository.</li>
<li>The members of an organization team with read access to a repository (e.g. to read issues) but no read access to the code could read the RSS or atom feeds which include the commit activity. Reading the RSS or atom feeds is now denied unless the team has read permissions on the code.</li>
<li>The tokens used when replying by email to issues or pull requests were weaker than the rfc2104 recommendations. The tokens are now truncated to 128 bits instead of 80 bits. It is no longer possible to reply to emails sent before the upgrade because the weaker tokens are invalid.</li>
<li>A registered user could modify the update frequency of any push mirror (e.g. every 4h instead of every 8h). They are now only able to do that if they have administrative permissions on the repository.</li>
<li>It was possible to use basic authorization (i.e. user:password) for requests to the API even when security keys were enrolled for a user. It is no longer possible, an application token must be used instead.</li>
<li>Some markup sanitation rules were not as strong as they could be (e.g. allowing emoji somethingelse as well as emoji). The rules are now stricter and do not allow for such cases.</li>
<li>When Forgejo is configured to enable instance wide search (e.g. with bleve), results found in the repositories of private or limited users were displayed to anonymous visitors. The results found in private or limited organizations were not displayed. The search results found in the repositories of private or limited user are no longer displayed to anonymous visitors.</li>
</ul>
</body>
</description>
<references>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
</references>
<dates>
<discovery>2024-12-12</discovery>
<entry>2024-12-17</entry>
<modified>2024-12-18</modified>
</dates>
</vuln>
<vuln vid="25a697de-bca1-11ef-8926-9b4f2d14eb53">
<topic>forgejo -- unauthorized user impersonation</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>7.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>When Forgejo is configured to run the internal ssh server with
[server].START_SSH_SERVER=true, it was possible for a registered user
to impersonate another user. The rootless container image uses the
internal ssh server by default and was vulnerable. A Forgejo
instance running from a binary or from a root container image does
not use the internal ssh server by default and was not vulnerable.
The incorrect use of the crypto package is the root cause of the
vulnerability and was fixed for the internal ssh server.</li>
<li>Revert "allow synchronizing user status from OAuth2 login
providers"</li>
</ul>
</body>
</description>
<references>
<url>https://codeberg.org/forgejo/forgejo/pulls/6248</url>
</references>
<dates>
<discovery>2024-12-12</discovery>
<entry>2024-12-17</entry>
</dates>
</vuln>
<vuln vid="6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53">
<topic>forgejo -- multiple vulnerabilities</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>9.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>When Forgejo is configured to run the internal ssh server with
[server].START_SSH_SERVER=true, it was possible for a registered user
to impersonate another user. The rootless container image uses the
internal ssh server by default and was vulnerable. A Forgejo
instance running from a binary or from a root container image does
not use the internal ssh server by default and was not vulnerable.
The incorrect use of the crypto package is the root cause of the
vulnerability and was fixed for the internal ssh server.</li>
<li>Revert "allow synchronizing user status from OAuth2 login
providers"</li>
</ul>
</body>
</description>
<references>
<url>https://codeberg.org/forgejo/forgejo/pulls/6248</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/6249</url>
</references>
<dates>
<discovery>2024-12-12</discovery>
<entry>2024-12-17</entry>
</dates>
</vuln>
<vuln vid="71f3e9f0-bafc-11ef-885d-901b0e934d69">
<topic>py-matrix-synapse -- multiple vulnerabilities in versions prior to 1.120.1</topic>
<affects>
<package>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<name>py311-matrix-synapse</name>
<range><lt>1.120.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>element-hq/synapse developers report:</p>
<blockquote cite="https://github.com/element-hq/synapse/releases/tag/v1.120.2">
<p>[The 1.120.1] release fixes multiple security
vulnerabilities, some affecting all prior versions of
Synapse. Server administrators are encouraged to
update Synapse as soon as possible. We are not aware
of these vulnerabilities being exploited in the
wild.</p>
<p>Administrators who are unable to update Synapse may
use the workarounds described in the linked GitHub
Security Advisory below.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-52805</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2</url>
<cvename>CVE-2024-52815</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h</url>
<cvename>CVE-2024-53863</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g</url>
<cvename>CVE-2024-53867</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h</url>
<cvename>CVE-2024-37302</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x</url>
<cvename>CVE-2024-37303</cvename>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-15</entry>
</dates>
</vuln>
<vuln vid="ef56065e-81fe-4731-a1e3-606c55925bef">
<topic>zeek -- potential DoS vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>7.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.5">
<p> Large QUIC packets can cause Zeek to overflow memory
and potentially crash. Due to the possibility of receiving
these packets from remote hosts, this is a DoS risk. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v7.0.5</url>
</references>
<dates>
<discovery>2024-12-16</discovery>
<entry>2024-12-16</entry>
</dates>
</vuln>
<vuln vid="275ac414-b847-11ef-9877-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.6.0</ge><lt>17.6.2</lt></range>
<range><ge>17.5.0</ge><lt>17.5.4</lt></range>
<range><ge>9.4.0</ge><lt>17.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/">
<p>Injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to ATO abusing OAuth flows</p>
<p>Denial of Service by repeatedly sending unauthenticated requests for diff-files</p>
<p>CI_JOB_TOKEN could be used to obtain GitLab session</p>
<p>Open redirect in releases API</p>
<p>Client-Side Path Traversal in Harbor artifact links</p>
<p>HTML injection in vulnerability details could lead to Cross Site Scripting</p>
<p>Leak branch names of projects with confidential repository</p>
<p>Non member can view unresolved threads marked as internal notes</p>
<p>Uncontrolled Resource Consumption through a maliciously crafted file</p>
<p>Certain sensitive information passed as literals inside GraphQL mutations retained in GraphQL logs</p>
<p>Information disclosure of confidential incidents details to a group member in Gitlab Wiki</p>
<p>Domain Confusion in GitLab Pages Unique Domain Implementation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11274</cvename>
<cvename>CVE-2024-8233</cvename>
<cvename>CVE-2024-9387</cvename>
<cvename>CVE-2024-8647</cvename>
<cvename>CVE-2024-8179</cvename>
<cvename>CVE-2024-8116</cvename>
<cvename>CVE-2024-8650</cvename>
<cvename>CVE-2024-9367</cvename>
<cvename>CVE-2024-12292</cvename>
<cvename>CVE-2024-12292</cvename>
<cvename>CVE-2024-10043</cvename>
<url>https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/</url>
</references>
<dates>
<discovery>2024-12-11</discovery>
<entry>2024-12-12</entry>
</dates>
</vuln>
<vuln vid="aeee5ebd-356c-49c1-8959-7c88981de5fd">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>131.0.6778.139</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>131.0.6778.139</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[381696874] High CVE-2024-12381: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-12-02</li>
<li>[379516109] High CVE-2024-12382: Use after free in Translate. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-11-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12381</cvename>
<cvename>CVE-2024-12382</cvename>
<url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2024-12-10</discovery>
<entry>2024-12-11</entry>
</dates>
</vuln>
<vuln vid="3d5b7860-48ad-48c2-aa36-601b8ab9cc43">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>131.0.6778.108</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>131.0.6778.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[379009132] High CVE-2024-12053: Type Confusion in V8. Reported by gal1ium and chluo on 2024-11-14</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-12053</cvename>
<url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-11</entry>
</dates>
</vuln>
<vuln vid="0e20e42c-b728-11ef-805a-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>133.0.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.5,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.5</lt></range>
<range><ge>129</ge><lt>133</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929600">
<ul>
<li>CVE-2024-11692: An attacker could cause a select dropdown
to be shown over another tab; this could have led to user
confusion and possible spoofing attacks.</li>
<li>CVE-2024-11696: The application failed to account for
exceptions thrown by the `loadManifestFromFile` method during
add-on signature verification. This flaw, triggered by an
invalid or unsupported extension manifest, could have caused
runtime errors that disrupted the signature validation process.
As a result, the enforcement of signature validation for
unrelated add-ons may have been bypassed. Signature validation
in this context is used to ensure that third-party
applications on the user's computer have not tampered
with the user's extensions, limiting the impact of this
issue.</li>
<li>CVE-2024-11697: When handling keypress events, an attacker
may have been able to trick a user into bypassing the "
Open Executable File?" confirmation dialog. This could
have led to malicious code execution.</li>
<li>CVE-2024-11699: Memory safety bugs present in Firefox 132,
Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs
showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run
arbitrary code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11692</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11692</url>
<cvename>CVE-2024-11696</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11696</url>
<cvename>CVE-2024-11697</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11697</url>
<cvename>CVE-2024-11699</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-11699</url>
</references>
<dates>
<discovery>2024-11-26</discovery>
<entry>2024-12-10</entry>
</dates>
</vuln>
<vuln vid="c2fd83e4-b450-11ef-b680-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.7.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
<p>Backports for 5 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-11110: Inappropriate implementation in Blink</li>
<li>CVE-2024-11112: Use after free in Media</li>
<li>CVE-2024-11114: Inappropriate implementation in Views</li>
<li>CVE-2024-11116: Inappropriate implementation in Paint</li>
<li>CVE-2024-11117: Inappropriate implementation in FileSystem</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11110</cvename>
<cvename>CVE-2024-11112</cvename>
<cvename>CVE-2024-11114</cvename>
<cvename>CVE-2024-11116</cvename>
<cvename>CVE-2024-11117</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
</references>
<dates>
<discovery>2024-11-29</discovery>
<entry>2024-12-07</entry>
</dates>
</vuln>
<vuln vid="7f3a302b-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-vorbis -- Stack buffer-overflow in Vorbis decoder</topic>
<affects>
<package>
<name>gstreamer1-plugins-vorbis</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>Stack buffer-overflow in Vorbis decoder that can cause crashes for
certain input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47538</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0022.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="7d1b4e5d-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-opus -- Stack buffer-overflow in Opus decoder</topic>
<affects>
<package>
<name>gstreamer1-plugins-opus</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>Stack buffer-overflow in Opus decoder that can cause crashes for
certain input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47607</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0024.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="7b34ddf7-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-ogg -- Out-of-bounds write in Ogg demuxer</topic>
<affects>
<package>
<name>gstreamer1-plugins-ogg</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>An out-of-bounds write in the Ogg demuxer that can cause crashes
for certain input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47615</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0026.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="7945c543-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-jpeg -- NULL-pointer dereferences in JPEG decoder</topic>
<affects>
<package>
<name>gstreamer1-plugins-jpeg</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>Insufficient error handling in the JPEG decoder that can lead to
NULL-pointer dereferences, and that can cause crashes for certain
input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47599</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0016.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="772d8625-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-gdkpixbuf -- NULL-pointer dereference</topic>
<affects>
<package>
<name>gstreamer1-plugins-gdkpixbuf</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>A NULL-pointer dereference in the gdk-pixbuf decoder that can
cause crashes for certain input files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47613</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0025.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="750ab972-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins-good -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gstreamer1-plugins-good</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>20 security bugs.</p>
<ul>
<li>CVE-2024-47537: Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes</li>
<li>CVE-2024-47598: MP4/MOV sample table parser out-of-bounds read</li>
<li>CVE-2024-47539: MP4/MOV Closed Caption handling out-of-bounds write</li>
<li>CVE-2024-47543: MP4/MOV demuxer out-of-bounds read</li>
<li>CVE-2024-47545: Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read</li>
<li>CVE-2024-47544: NULL-pointer dereferences in MP4/MOV demuxer CENC handling</li>
<li>CVE-2024-47597: Out-of-bounds reads in MP4/MOV demuxer sample table parser</li>
<li>CVE-2024-47546: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads</li>
<li>CVE-2024-47606: Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes</li>
<li>CVE-2024-47596: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads</li>
<li>CVE-2024-47540: Usage of uninitialized stack memory in Matroska/WebM demuxer</li>
<li>CVE-2024-47602: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer</li>
<li>CVE-2024-47601: NULL-pointer dereference in Matroska/WebM demuxer</li>
<li>CVE-2024-47603: NULL-pointer dereference in Matroska/WebM demuxer</li>
<li>CVE-2024-47775: Out-of-bounds read in WAV parser</li>
<li>CVE-2024-47776: Out-of-bounds read in WAV parser</li>
<li>CVE-2024-47777: Out-of-bounds read in WAV parser</li>
<li>CVE-2024-47778: Out-of-bounds read in WAV parser</li>
<li>CVE-2024-47774: Integer overflow in AVI subtitle parser that leads to out-of-bounds reads</li>
<li>CVE-2024-47834: Use-after-free in Matroska demuxer</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47537</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0005.html</url>
<cvename>CVE-2024-47598</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0006.html</url>
<cvename>CVE-2024-47539</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0007.html</url>
<cvename>CVE-2024-47543</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0009.html</url>
<cvename>CVE-2024-47545</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0010.html</url>
<cvename>CVE-2024-47544</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0011.html</url>
<cvename>CVE-2024-47597</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0012.html</url>
<cvename>CVE-2024-47546</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0013.html</url>
<cvename>CVE-2024-47606</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0014.html</url>
<cvename>CVE-2024-47596</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0015.html</url>
<cvename>CVE-2024-47540</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0017.html</url>
<cvename>CVE-2024-47602</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0019.html</url>
<cvename>CVE-2024-47601</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0020.html</url>
<cvename>CVE-2024-47603</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0021.html</url>
<cvename>CVE-2024-47775</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
<cvename>CVE-2024-47776</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
<cvename>CVE-2024-47777</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
<cvename>CVE-2024-47778</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
<cvename>CVE-2024-47835</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0028.html</url>
<cvename>CVE-2024-47834</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0030.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="7256fae8-b3e8-11ef-b680-4ccc6adda413">
<topic>gstreamer1-plugins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gstreamer1-plugins</name>
<range><lt>1.24.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GStreamer Security Center reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/">
<p>3 security bugs.</p>
<ul>
<li>CVE-2024-47542: ID3v2 parser out-of-bounds read and NULL-pointer dereference</li>
<li>CVE-2024-47600: Out-of-bounds read in gst-discoverer-1.0 commandline tool</li>
<li>CVE-2024-47541: Out-of-bounds write in SSA subtitle parser</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47542</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0008.html</url>
<cvename>CVE-2024-47600</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0018.html</url>
<cvename>CVE-2024-47541</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0023.html</url>
</references>
<dates>
<discovery>2024-12-03</discovery>
<entry>2024-12-06</entry>
</dates>
</vuln>
<vuln vid="f0d33375-b0e0-11ef-a724-b42e991fc52e">
<topic>zabbix -- SQL injection in user.get API</topic>
<affects>
<package>
<name>zabbix6-frontend</name>
<range><lt>6.0.31</lt></range>
</package>
<package>
<name>zabbix64-frontend</name>
<range><lt>6.4.16</lt></range>
</package>
<package>
<name>zabbix7-frontend</name>
<range><lt>7.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@zabbix.com reports:</p>
<blockquote cite="https://support.zabbix.com/browse/ZBX-25623">
<p>A non-admin user account on the Zabbix frontend with the default
User role, or with any other role that gives API access can exploit
this vulnerability. An SQLi exists in the CUser class in the
addRelatedObjects function, this function is being called from the
CUser.get function which is available for every user who has API
access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-42327</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-42327</url>
</references>
<dates>
<discovery>2024-11-27</discovery>
<entry>2024-12-02</entry>
</dates>
</vuln>
<vuln vid="8b6e97a9-804e-4366-9f75-d102b22a716d">
<topic>electron33 -- Inappropriate implementation in Extensions</topic>
<affects>
<package>
<name>electron33</name>
<range><lt>33.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v33.2.1">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-11110.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11110</cvename>
<url>https://github.com/advisories/GHSA-4mww-gp9h-h59m</url>
</references>
<dates>
<discovery>2024-11-27</discovery>
<entry>2024-12-02</entry>
</dates>
</vuln>
<vuln vid="c5dafd73-adfd-11ef-af27-00e081b7aa2d">
<topic>jenkins -- Denial of service vulnerability in bundled json-lib</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.487</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.479.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-11-27/">
<h1>Description</h1>
<h5>(High) SECURITY-3463 / CVE-2024-47855</h5>
<p>Denial of service vulnerability in bundled json-lib</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47855</cvename>
<url>https://www.jenkins.io/security/advisory/2024-11-27/</url>
</references>
<dates>
<discovery>2024-11-27</discovery>
<entry>2024-11-29</entry>
</dates>
</vuln>
<vuln vid="7d7a28cd-7f5a-450a-852f-c49aaab3fa7e">
<topic>keycloak -- Multiple security fixes</topic>
<affects>
<package>
<name>keycloak</name>
<range><lt>26.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Keycloak reports:</p>
<blockquote cite="https://www.keycloak.org/2024/11/keycloak-2606-released.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>CVE-2024-10451: Sensitive Data Exposure in Keycloak Build Process</li>
<li>CVE-2024-10270: Potential Denial of Service</li>
<li>CVE-2024-10492: Keycloak path trasversal</li>
<li>CVE-2024-9666: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability</li>
<li>CVE-2024-10039: Bypassing mTLS validation</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-9666</cvename>
<cvename>CVE-2021-10039</cvename>
<cvename>CVE-2021-10270</cvename>
<cvename>CVE-2021-10451</cvename>
<cvename>CVE-2021-10492</cvename>
</references>
<dates>
<discovery>2024-11-22</discovery>
<entry>2024-11-25</entry>
</dates>
</vuln>
<vuln vid="2263ea04-ac81-11ef-998c-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.6.0</ge><lt>17.6.1</lt></range>
<range><ge>17.5.0</ge><lt>17.5.3</lt></range>
<range><ge>8.12.0</ge><lt>17.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/">
<p>Privilege Escalation via LFS Tokens</p>
<p>DoS through uncontrolled resource consumption when viewing a maliciously crafted cargo.toml file</p>
<p>Unintended Access to Usage Data via Scoped Tokens</p>
<p>Gitlab DOS via Harbor registry integration</p>
<p>Resource exhaustion and denial of service with test_report API calls</p>
<p>Streaming endpoint did not invalidate tokens after revocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8114</cvename>
<cvename>CVE-2024-8237</cvename>
<cvename>CVE-2024-11669</cvename>
<cvename>CVE-2024-8177</cvename>
<cvename>CVE-2024-11828</cvename>
<cvename>CVE-2024-11668</cvename>
<url>https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/</url>
</references>
<dates>
<discovery>2024-11-26</discovery>
<entry>2024-11-27</entry>
</dates>
</vuln>
<vuln vid="9dfca0cd-ab09-11ef-8c1c-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>131.0.6778.85</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>131.0.6778.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[377384894] High CVE-2024-11395: Type Confusion in V8. Reported by Anonymous on 2024-11-05</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11395</cvename>
<url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2024-11-19</discovery>
<entry>2024-11-25</entry>
</dates>
</vuln>
<vuln vid="889eddee-a964-11ef-b680-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.7.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
<p>Backports for 16 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-9120: Use after free in Dawn</li>
<li>CVE-2024-9122: Type Confusion in V8</li>
<li>CVE-2024-9123: Integer overflow in Skia</li>
<li>CVE-2024-9369: Insufficient data validation in Mojo</li>
<li>CVE-2024-9602: Type confusion in V8</li>
<li>CVE-2024-9603: Type confusion in V8</li>
<li>CVE-2024-9965: Insufficient data validation in DevTools</li>
<li>CVE-2024-9966: Inappropriate implementation in Navigations</li>
<li>CVE-2024-10229: Inappropriate implementation in Extensions</li>
<li>CVE-2024-10230: Type confusion in V8</li>
<li>CVE-2024-10231: Type confusion in V8</li>
<li>CVE-2024-10487: Out of bounds write in Dawn</li>
<li>CVE-2024-10827: Use after free in Serial</li>
<li>CVE-2024-45490: Negative length in libexpat</li>
<li>CVE-2024-45491: Integer overflow in libexpat</li>
<li>CVE-2024-45492: Integer overflow in libexpat</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9120</cvename>
<cvename>CVE-2024-9122</cvename>
<cvename>CVE-2024-9123</cvename>
<cvename>CVE-2024-9369</cvename>
<cvename>CVE-2024-9602</cvename>
<cvename>CVE-2024-9603</cvename>
<cvename>CVE-2024-9965</cvename>
<cvename>CVE-2024-9966</cvename>
<cvename>CVE-2024-10229</cvename>
<cvename>CVE-2024-10230</cvename>
<cvename>CVE-2024-10231</cvename>
<cvename>CVE-2024-10487</cvename>
<cvename>CVE-2024-10827</cvename>
<cvename>CVE-2024-45490</cvename>
<cvename>CVE-2024-45491</cvename>
<cvename>CVE-2024-45492</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
</references>
<dates>
<discovery>2024-09-26</discovery>
<entry>2024-11-23</entry>
</dates>
</vuln>
<vuln vid="16e472d5-a8aa-11ef-b680-4ccc6adda413">
<topic>qt5-webengine -- Use after free in Serial</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.18p5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 1 security bug in Chromium:</p>
<ul>
<li>CVE-2024-10827: Use after free in Serial</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10827</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-10-24</discovery>
<entry>2024-11-22</entry>
</dates>
</vuln>
<vuln vid="141f2a22-a6a7-11ef-b282-0c9d92850f7a">
<topic>xorg server -- _XkbSetCompatMap vulnerability</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>21.1.14,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>24.1.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2024-October/003545.html">
<ul>
<li>
CVE-2024-9632: Heap buffer Heap-based buffer overflow
privilege escalation in _XkbSetCompatMap
<p>The _XkbSetCompatMap() function attempts to resize
the `sym_interpret` buffer.
However, It didn't update its size properly.
It updated `num_si` only, without updating `size_si`.
This may lead to local privilege escalation if the
server is run as root or remote code execution
(e.g. x11 over ssh).</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9632</cvename>
<url>https://lists.x.org/archives/xorg-announce/2024-October/003545.html</url>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-19</entry>
</dates>
</vuln>
<vuln vid="28ffa931-a510-11ef-8109-b42e991fc52e">
<topic>mongodb -- Buffer over-reads in MongoDB Server</topic>
<affects>
<package>
<name>mongodb50</name>
<range><lt>5.0.30</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.19</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.15</lt></range>
</package>
<package>
<name>mongodb80</name>
<range><lt>8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cna@mongodb.com reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-96419">
<p>An authorized user may trigger crashes or receive the contents of
buffer over-reads of Server memory by issuing specially crafted
requests that construct malformed BSON in the MongoDB Server.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10921</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-10921</url>
</references>
<dates>
<discovery>2024-11-14</discovery>
<entry>2024-11-17</entry>
</dates>
</vuln>
<vuln vid="efd4537e-a5e8-11ef-bedb-180373b66b37">
<topic>Vaultwarden -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>vaultwarden</name>
<range><lt>1.32.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Vaultwarden project reports:</p>
<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5">
<p>This release further fixed some CVE Reports reported by a third
party security auditor and we recommend everybody to update to the
latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5</url>
</references>
<dates>
<discovery>2024-11-11</discovery>
<entry>2024-11-18</entry>
</dates>
</vuln>
<vuln vid="aba28514-a414-11ef-98e7-84a93843eb75">
<topic>Vaultwarden -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>vaultwarden</name>
<range><lt>1.32.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Vaultwarden project reports:</p>
<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4">
<p>This release has fixed some CVE Reports reported by a third party
security auditor and we recommend everybody to update to the
latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4</url>
</references>
<dates>
<discovery>2024-11-10</discovery>
<entry>2024-11-16</entry>
</dates>
</vuln>
<vuln vid="8fe4f296-a3ec-11ef-8c1c-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>131.0.6778.69</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>131.0.6778.69</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[373263969] High CVE-2024-11110: Inappropriate implementation in Blink. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2024-10-14</li>
<li>[360520331] Medium CVE-2024-11111: Inappropriate implementation in Autofill. Reported by Narendra Bhati, Suma Soft Pvt. Ltd - Pune (India) on 2024-08-18</li>
<li>[354824998] Medium CVE-2024-11112: Use after free in Media. Reported by Nan Wang(@eternalsakura13) and Zhenghang Xiao(@Kipreyyy) of 360 Vulnerability Research Institute on 2024-07-23</li>
<li>[360274917] Medium CVE-2024-11113: Use after free in Accessibility. Reported by Weipeng Jiang (@Krace) of VRI on 2024-08-16</li>
<li>[370856871] Medium CVE-2024-11114: Inappropriate implementation in Views. Reported by Micky on 2024-10-02</li>
<li>[371929521] Medium CVE-2024-11115: Insufficient policy enforcement in Navigation. Reported by mastersplinter on 2024-10-07</li>
<li>[40942531] Medium CVE-2024-11116: Inappropriate implementation in Paint. Reported by Thomas Orlita on 2023-11-14</li>
<li>[40062534] Low CVE-2024-11117: Inappropriate implementation in FileSystem. Reported by Ameen Basha M K on 2023-01-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-11110</cvename>
<cvename>CVE-2024-11111</cvename>
<cvename>CVE-2024-11112</cvename>
<cvename>CVE-2024-11113</cvename>
<cvename>CVE-2024-11114</cvename>
<cvename>CVE-2024-11115</cvename>
<cvename>CVE-2024-11116</cvename>
<cvename>CVE-2024-11117</cvename>
<url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2024-11-12</discovery>
<entry>2024-11-16</entry>
</dates>
</vuln>
<vuln vid="773e7eb2-af19-4fc7-be7f-0f6a2523b98b">
<topic>electron31 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.7.5</lt></range>
</package>
<package>
<name>electron32</name>
<range><lt>32.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.5">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-10827.</li>
<li>Security: backported fix for CVE-2024-11110.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10827</cvename>
<url>https://github.com/advisories/GHSA-58wv-w3hc-2c76</url>
<cvename>CVE-2024-11110</cvename>
<url>https://github.com/advisories/GHSA-4mww-gp9h-h59m</url>
</references>
<dates>
<discovery>2024-11-15</discovery>
<entry>2024-11-15</entry>
<modified>2024-11-16</modified>
</dates>
</vuln>
<vuln vid="a03636f4-a29f-11ef-af48-6cc21735f730">
<topic>PostgreSQL -- PL/Perl environment variable changes execute arbitrary code</topic>
<affects>
<package>
<name>postgresql17-plperl</name>
<range><lt>17.1</lt></range>
</package>
<package>
<name>postgresql16-plperl</name>
<range><lt>16.5</lt></range>
</package>
<package>
<name>postgresql15-plperl</name>
<range><lt>15.9</lt></range>
</package>
<package>
<name>postgresql14-plperl</name>
<range><lt>14.14</lt></range>
</package>
<package>
<name>postgresql13-plperl</name>
<range><lt>13.17</lt></range>
</package>
<package>
<name>postgresql12-plperl</name>
<range><lt>12.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10979/">
<p>
Incorrect control of environment variables in PostgreSQL
PL/Perl allows an unprivileged database user to change
sensitive process environment variables (e.g. PATH).
That often suffices to enable arbitrary code execution,
even if the attacker lacks a database server operating
system user.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10979</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-10979/</url>
</references>
<dates>
<discovery>2024-11-14</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="12e3feab-a29f-11ef-af48-6cc21735f730">
<topic>PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID</topic>
<affects>
<package>
<name>postgresql17-server</name>
<range><lt>17.1</lt></range>
</package>
<package>
<name>postgresql16-server</name>
<range><lt>16.5</lt></range>
</package>
<package>
<name>postgresql15-server</name>
<range><lt>15.9</lt></range>
</package>
<package>
<name>postgresql14-server</name>
<range><lt>14.14</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.17</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10978/">
<p>
Incorrect privilege assignment in PostgreSQL allows a
less-privileged application user to view or change
different rows from those intended. An attack requires
the application to use SET ROLE, SET SESSION
AUTHORIZATION, or an equivalent feature. The problem
arises when an application query uses parameters from
the attacker or conveys query results to the attacker.
If that query reacts to current_setting('role') or the
current user ID, it may modify or return data as though
the session had not used SET ROLE or SET SESSION
AUTHORIZATION. The attacker does not control which
incorrect user ID applies. Query text from
less-privileged sources is not a concern here, because
SET ROLE and SET SESSION AUTHORIZATION are not sandboxes
for unvetted queries
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10978</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-10978/</url>
</references>
<dates>
<discovery>2024-11-14</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="a61ef21b-a29e-11ef-af48-6cc21735f730">
<topic>PostgreSQL -- libpq retains an error message from man-in-the-middle</topic>
<affects>
<package>
<name>postgresql17-client</name>
<range><lt>17.1</lt></range>
</package>
<package>
<name>postgresql16-client</name>
<range><lt>16.5</lt></range>
</package>
<package>
<name>postgresql15-client</name>
<range><lt>15.9</lt></range>
</package>
<package>
<name>postgresql14-client</name>
<range><lt>14.14</lt></range>
</package>
<package>
<name>postgresql13-client</name>
<range><lt>13.17</lt></range>
</package>
<package>
<name>postgresql12-client</name>
<range><lt>12.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10977/">
<p>
Client use of server error message in PostgreSQL allows
a server not trusted under current SSL or GSS settings
to furnish arbitrary non-NUL bytes to the libpq
application. For example, a man-in-the-middle attacker
could send a long error message that a human or
screen-scraper user of psql mistakes for valid query
results. This is probably not a concern for clients
where the user interface unambiguously indicates the
boundary between one error message and other text.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10977</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-10977/</url>
</references>
<dates>
<discovery>2024-11-14</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="3831292b-a29d-11ef-af48-6cc21735f730">
<topic>PostgreSQL -- PostgreSQL row security below e.g. subqueries disregards user ID changes</topic>
<affects>
<package>
<name>postgresql17-server</name>
<range><lt>17.1</lt></range>
</package>
<package>
<name>postgresql16-server</name>
<range><lt>16.5</lt></range>
</package>
<package>
<name>postgresql15-server</name>
<range><lt>15.9</lt></range>
</package>
<package>
<name>postgresql14-server</name>
<range><lt>14.14</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.17</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10976/">
<p>
Incomplete tracking in PostgreSQL of tables with row
security allows a reused query to view or change
different rows from those intended. CVE-2023-2455 and
CVE-2016-2193 fixed most interaction between row
security and user ID changes. They missed cases where a
subquery, WITH query, security invoker view, or
SQL-language function references a table with a
row-level security policy. This has the same
consequences as the two earlier CVEs. That is to say, it
leads to potentially incorrect policies being applied in
cases where role-specific policies are used and a given
query is planned under one role and then executed under
other roles. This scenario can happen under security
definer functions or when a common user and query is
planned initially and then re-used across multiple SET
ROLEs.
Applying an incorrect policy may permit a user to complete
otherwise-forbidden reads and modifications. This affects only databases
that have used CREATE POLICY to define a row security policy. An
attacker must tailor an attack to a particular application's pattern of
query plan reuse, user ID changes, and role-specific row security
policies.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10976</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-10976/</url>
</references>
<dates>
<discovery>2024-11-14</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="6b591e05-971c-4077-8ae4-1310554971b7">
<topic>electron31 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.4">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-10231.</li>
<li>Security: backported fix for CVE-2024-10229.</li>
<li>Security: backported fix for CVE-2024-10487.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10231</cvename>
<url>https://github.com/advisories/GHSA-3wfx-mj93-vf8v</url>
<cvename>CVE-2024-10229</cvename>
<url>https://github.com/advisories/GHSA-3hjp-j522-245f</url>
<cvename>CVE-2024-10487</cvename>
<url>https://github.com/advisories/GHSA-h72p-7xmw-gpp8</url>
</references>
<dates>
<discovery>2024-11-12</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="1eb4d32c-a245-11ef-998c-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.5.0</ge><lt>17.5.2</lt></range>
<range><ge>17.4.0</ge><lt>17.4.4</lt></range>
<range><ge>16.0.0</ge><lt>17.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/">
<p>Unauthorized access to Kubernetes cluster agent</p>
<p>Device OAuth flow allows for cross window forgery</p>
<p>Denial of Service by importing malicious crafted FogBugz import payload</p>
<p>Stored XSS through javascript URL in Analytics dashboards</p>
<p>HTML injection in vulnerability Code flow could lead to XSS on self hosted instances</p>
<p>Information disclosure through an API endpoint</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9693</cvename>
<cvename>CVE-2024-7404</cvename>
<cvename>CVE-2024-8648</cvename>
<cvename>CVE-2024-8180</cvename>
<cvename>CVE-2024-10240</cvename>
<url>https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/</url>
</references>
<dates>
<discovery>2024-11-13</discovery>
<entry>2024-11-14</entry>
</dates>
</vuln>
<vuln vid="ce0f52e1-a174-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Certificate revocation list fetch(1) option fails</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_6</lt></range>
<range><ge>13.4</ge><lt>13.4_2</lt></range>
<range><ge>13.3</ge><lt>13.3_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The fetch(3) library uses environment variables for passing
certain information, including the revocation file pathname. The
environment variable name used by fetch(1) to pass the filename to
the library was incorrect, in effect ignoring the option.</p>
<h1>Impact:</h1>
<p>Fetch would still connect to a host presenting a certificate
included in the revocation file passed to the --crl option.</p>
</body>
</description>
<references>
<cvename>CVE-2024-45289</cvename>
<freebsdsa>SA-24:19.fetch</freebsdsa>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-13</entry>
</dates>
</vuln>
<vuln vid="8caa5d60-a174-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Unbounded allocation in ctl(4) CAM Target Layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_6</lt></range>
<range><ge>13.4</ge><lt>13.4_2</lt></range>
<range><ge>13.3</ge><lt>13.3_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The command ctl_persistent_reserve_out allows the caller to
specify an arbitrary size which will be passed to the kernel's
memory allocator.</p>
<h1>Impact:</h1>
<p>A malicious guest could cause a Denial of Service (DoS) on the
host.</p>
</body>
</description>
<references>
<cvename>CVE-2024-39281</cvename>
<freebsdsa>SA-24:18.ctl</freebsdsa>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-13</entry>
</dates>
</vuln>
<vuln vid="eb5c615d-a173-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Multiple issues in the bhyve hypervisor</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_6</lt></range>
<range><ge>13.4</ge><lt>13.4_2</lt></range>
<range><ge>13.3</ge><lt>13.3_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Several vulnerabilities were found in the bhyve hypervisor's
device models.</p>
<p>The NVMe driver function nvme_opc_get_log_page is vulnerable to a
buffer over- read from a guest-controlled value. (CVE-2024-51562)</p>
<p>The virtio_vq_recordon function is subject to a time-of-check to
time-of-use (TOCTOU) race condition. (CVE-2024-51563)</p>
<p>A guest can trigger an infinite loop in the hda audio driver.
(CVE-2024-51564)</p>
<p>The hda driver is vulnerable to a buffer over-read from a
guest-controlled value. (CVE-2024-51565)</p>
<p>The NVMe driver queue processing is vulernable to guest-induced
infinite loops. (CVE-2024-51566)</p>
<h1>Impact:</h1>
<p>Malicious guest virtual machines may be able to perform a denial
of service (DoS) of the bhyve host, and may read memory within the
bhyve process that they should not be able to access.</p>
</body>
</description>
<references>
<cvename>CVE-2024-51562</cvename>
<cvename>CVE-2024-51563</cvename>
<cvename>CVE-2024-51564</cvename>
<cvename>CVE-2024-51565</cvename>
<cvename>CVE-2024-51566</cvename>
<freebsdsa>SA-24:17.bhyve</freebsdsa>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-13</entry>
</dates>
</vuln>
<vuln vid="ab4e6f65-a142-11ef-84e9-901b0e9408dc">
<topic>element-web -- several vulnerabilities</topic>
<affects>
<package>
<name>element-web</name>
<range><lt>1.11.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Element team reports:</p>
<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2">
<p>Versions of Element Web and Desktop earlier than 1.11.85 do
not check if thumbnails for attachments, stickers and images
are coherent. It is possible to add thumbnails to events
trigger a file download once clicked.</p>
</blockquote>
<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-w36j-v56h-q9pc">
<p>A malicious homeserver can send invalid messages over
federation which can prevent Element Web and Desktop from
rendering single messages or the entire room containing
them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-51749</cvename>
<cvename>CVE-2024-51750</cvename>
<url>https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2</url>
<url>https://github.com/element-hq/element-web/security/advisories/GHSA-w36j-v56h-q9pc</url>
</references>
<dates>
<discovery>2024-11-12</discovery>
<entry>2024-11-12</entry>
</dates>
</vuln>
<vuln vid="574f7bc9-a141-11ef-84e9-901b0e9408dc">
<topic>Matrix clients -- mxc uri validation in js sdk</topic>
<affects>
<package>
<name>cinny</name>
<range><lt>4.2.3</lt></range>
</package>
<package>
<name>element-web</name>
<range><lt>1.11.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>matrix-js-sdk upstream reports:</p>
<blockquote cite="https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr">
<p>matrix-js-sdk before 34.11.0 is vulnerable to client-side
path traversal via crafted MXC URIs. A malicious room member
can trigger clients based on the matrix-js-sdk to issue
arbitrary authenticated GET requests to the client's
homeserver.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-50336</cvename>
<url>https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr</url>
</references>
<dates>
<discovery>2024-11-12</discovery>
<entry>2024-11-12</entry>
</dates>
</vuln>
<vuln vid="0a82bc4d-a129-11ef-8351-589cfc0f81b0">
<topic>icinga2 -- TLS Certificate Validation Bypass</topic>
<affects>
<package>
<name>icinga2</name>
<range><lt>2.14.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Icinga project reports:</p>
<blockquote cite="https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c">
<p>Icinga is a monitoring system which checks the availability of
network resources, notifies users of outages, and generates performance
data for reporting. The TLS certificate validation in all Icinga
2 versions starting from 2.4.0 was flawed, allowing an attacker to
impersonate both trusted cluster nodes as well as any API users
that use TLS client certificates for authentication (ApiUser objects
with the client_cn attribute set). This vulnerability has been
fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-49369</cvename>
<url>https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3/</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-49369</url>
</references>
<dates>
<discovery>2024-11-12</discovery>
<entry>2024-11-12</entry>
</dates>
</vuln>
<vuln vid="33236f80-a11d-11ef-a964-1c697a616631">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20241112</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01101.html">
<p>
A potential security vulnerability in some 4th and 5th Generation
Intel Xeon Processors may allow denial of service. Intel released
microcode updates to mitigate this potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html">
<p>
Potential security vulnerabilities in some Intel Xeon processors using
Intel Software Guard Extensions (Intel SGX) may allow escalation of
privilege. Intel released firmware updates to mitigate these
potential vulnerabilities.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-21853</cvename>
<cvename>CVE-2024-23918</cvename>
<cvename>CVE-2024-21820</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20241112</url>
</references>
<dates>
<discovery>2024-09-10</discovery>
<entry>2024-09-10</entry>
</dates>
</vuln>
<vuln vid="305ceb2c-9df8-11ef-a660-d85ed309193e">
<topic>x11vnc -- access to shared memory segments</topic>
<affects>
<package>
<name>x11vnc</name>
<range><lt>0.9.16_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-29074">
<p>scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls,
which allows access by actors other than the current user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-29074</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-29074</url>
</references>
<dates>
<discovery>2020-11-18</discovery>
<entry>2024-11-08</entry>
</dates>
</vuln>
<vuln vid="adffe51e-9df5-11ef-a660-d85ed309193e">
<topic>lrzsz -- Integer overflow in zmodem, crash and information leak</topic>
<affects>
<package>
<name>lrzsz</name>
<range><lt>0.12.20_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-10195">
<p>Lrzsz has an integer overflow vulernability in the
src/zm.c:zsdata() function. An attacker could exploit this with
the sz command to cause a crash or potentially leak information
to the receiving server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10195</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-10195</url>
</references>
<dates>
<discovery>2018-04-26</discovery>
<entry>2024-11-08</entry>
</dates>
</vuln>
<vuln vid="776aaafc-939f-11ef-87ad-a8a15998b5cb">
<topic>tnef -- An attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message</topic>
<affects>
<package>
<name>tnef</name>
<range><lt>1.4.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18">
<p>In tnef before 1.4.18, an attacker may be able to write to the
victim's .ssh/authorized_keys file via an e-mail message with
a crafted winmail.dat application/ms-tnef attachment, because of a
heap-based buffer over-read involving strdup.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-18849</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-18849</url>
</references>
<dates>
<discovery>2019-11-11</discovery>
<entry>2024-10-26</entry>
</dates>
</vuln>
<vuln vid="70cf37c8-939b-11ef-87ad-a8a15998b5cb">
<topic>tnef -- Invalid read and write operations, controlled by an attacker</topic>
<affects>
<package>
<name>tnef</name>
<range><le>1.4.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
<p>CVE-2017-6307: An issue was discovered in tnef before
1.4.13. Two OOB Writes have been identified in
src/mapi_attr.c:mapi_attr_read(). These might lead to
invalid read and write operations, controlled by an
attacker.</p>
</blockquote>
<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
<p>CVE-2017-6308: An issue was discovered in tnef before
1.4.13. Several Integer Overflows, which can lead to Heap
Overflows, have been identified in the functions that wrap
memory allocation.</p>
</blockquote>
<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
<p>CVE-2017-6309: An issue was discovered in tnef before
1.4.13. Two type confusions have been identified in the
parse_file() function. These might lead to invalid read and
write operations, controlled by an attacker.</p>
</blockquote>
<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
<p>CVE-2017-6310: An issue was discovered in tnef before
1.4.13. Four type confusions have been identified in the
file_add_mapi_attrs() function. These might lead to invalid
read and write operations, controlled by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6307</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6307</url>
<cvename>CVE-2017-6308</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6308</url>
<cvename>CVE-2017-6309</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6309</url>
<cvename>CVE-2017-6310</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6310</url>
</references>
<dates>
<discovery>2017-02-24</discovery>
<entry>2024-10-26</entry>
</dates>
</vuln>
<vuln vid="96266fc9-1200-43b5-8393-4c51f54bb7bc">
<topic>electron32 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-10230.</li>
<li>Security: backported fix for CVE-2024-10231.</li>
<li>Security: backported fix for CVE-2024-10229.</li>
<li>Security: backported fix for CVE-2024-10487.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10230</cvename>
<url>https://github.com/advisories/GHSA-g4gj-m346-585c</url>
<cvename>CVE-2024-10231</cvename>
<url>https://github.com/advisories/GHSA-3wfx-mj93-vf8v</url>
<cvename>CVE-2024-10229</cvename>
<url>https://github.com/advisories/GHSA-3hjp-j522-245f</url>
<cvename>CVE-2024-10487</cvename>
<url>https://github.com/advisories/GHSA-h72p-7xmw-gpp8</url>
</references>
<dates>
<discovery>2024-11-08</discovery>
<entry>2024-11-08</entry>
</dates>
</vuln>
<vuln vid="d48a2224-9b4c-11ef-bdd9-4ccc6adda413">
<topic>gstreamer1-rtsp-server -- Potential Denial-of-Service (DoS) with specially crafted client requests</topic>
<affects>
<package>
<name>gstreamer1-rtsp-server</name>
<range><ge>1.18.0</ge><lt>1.24.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qingpeng Du reports:</p>
<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2024-0004.html">
<p>A series of specially crafted client requests during streaming setup
(post client authentication, if any) can cause the RTSP server library
to abort, if it has been compiled with assertions enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-44331</cvename>
<url>https://gstreamer.freedesktop.org/security/sa-2024-0004.html</url>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-07</entry>
</dates>
</vuln>
<vuln vid="ab254c9d-9c36-11ef-8c1c-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>130.0.6723.116</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>130.0.6723.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[370217726] High CVE-2024-10826: Use after free in Family Experiences. Reported by Anonymous on 2024-09-29</li>
<li>[375065084] High CVE-2024-10827: Use after free in Serial. Reported by Anonymous on 2024-10-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10826</cvename>
<cvename>CVE-2024-10827</cvename>
<url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-11-05</discovery>
<entry>2024-11-06</entry>
</dates>
</vuln>
<vuln vid="ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb">
<topic>libqb -- Buffer overflow</topic>
<affects>
<package>
<name>libqb</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8">
<p>log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via
long log messages because the header size is not considered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39976</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-39976</url>
</references>
<dates>
<discovery>2023-08-08</discovery>
<entry>2024-11-04</entry>
</dates>
</vuln>
<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>130.0.6723.91</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>130.0.6723.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[375123371] Critical CVE-2024-10487: Out of bounds write in Dawn. Reported by Apple Security Engineering and Architecture (SEAR) on 2024-10-23</li>
<li>[374310077] High CVE-2024-10488: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2024-10-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10487</cvename>
<cvename>CVE-2024-10488</cvename>
<url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2024-10-29</discovery>
<entry>2024-11-02</entry>
</dates>
</vuln>
<vuln vid="3092668e-97e4-11ef-bdd9-4ccc6adda413">
<topic>qt5-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.18p2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 15 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-4761: Out of bounds write in V8</li>
<li>CVE-2024-5158: Type confusion in V8</li>
<li>CVE-2024-7532: Out of bounds memory access in ANGLE</li>
<li>CVE-2024-7965: Inappropriate implementation in V8</li>
<li>CVE-2024-7967: Heap buffer overflow in Fonts</li>
<li>CVE-2024-7971: Type confusion in V8</li>
<li>CVE-2024-8198: Heap buffer overflow in Skia</li>
<li>CVE-2024-8636: Heap buffer overflow in Skia</li>
<li>CVE-2024-9123: Integer overflow in Skia</li>
<li>CVE-2024-9602: Type confusion in V8</li>
<li>CVE-2024-9603: Type confusion in V8</li>
<li>CVE-2024-10229: Inappropriate implementation in Extensions</li>
<li>CVE-2024-45490: Negative length in libexpat</li>
<li>CVE-2024-45491: Integer overflow in libexpat</li>
<li>CVE-2024-45492: Integer overflow in libexpat</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4761</cvename>
<cvename>CVE-2024-5158</cvename>
<cvename>CVE-2024-7532</cvename>
<cvename>CVE-2024-7965</cvename>
<cvename>CVE-2024-7967</cvename>
<cvename>CVE-2024-7971</cvename>
<cvename>CVE-2024-8198</cvename>
<cvename>CVE-2024-8636</cvename>
<cvename>CVE-2024-9123</cvename>
<cvename>CVE-2024-9602</cvename>
<cvename>CVE-2024-9603</cvename>
<cvename>CVE-2024-10229</cvename>
<cvename>CVE-2024-45490</cvename>
<cvename>CVE-2024-45491</cvename>
<cvename>CVE-2024-45492</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-09-18</discovery>
<entry>2024-10-31</entry>
</dates>
</vuln>
<vuln vid="fd538d14-5778-4764-b321-2ddd61a8a58f">
<topic>keycloak -- Missing server identity checks when sending mails via SMTPS</topic>
<affects>
<package>
<name>keycloak</name>
<range><lt>26.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2315808">
<p>A vulnerability was found in Apache Sling Commons Messaging
Mail(angus-mail), which provides a simple interface for sending
emails via SMTPS in OSGi, does not offer an option to enable
server identity checks, leaving connections vulnerable to
"man-in-the-middle" attacks and can allow insecure email
communication.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44549</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2021-44549</url>
</references>
<dates>
<discovery>2024-10-01</discovery>
<entry>2024-10-31</entry>
</dates>
</vuln>
<vuln vid="b73d1f2a-96de-11ef-9e71-00d8612f03c8">
<topic>librewolf -- Undefined behavior in selection node cache</topic>
<affects>
<package>
<name>librewolf</name>
<range><lt>131.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1920381">
<p>When manipulating the selection node cache, an attacker may have
been able to cause unexpected behavior, potentially leading to an
exploitable crash. This vulnerability affects Firefox < 131.0.3.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9936</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9936</url>
</references>
<dates>
<discovery>2024-10-14</discovery>
<entry>2024-10-30</entry>
</dates>
</vuln>
<vuln vid="4b3a8e7d-9372-11ef-87ad-a8a15998b5cb">
<topic>hwloc2 -- Denial of service or other unspecified impacts</topic>
<affects>
<package>
<name>hwloc2</name>
<range><ge>2.1.0</ge><le>2.9.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/open-mpi/hwloc/issues/544">
<p>An issue was discovered in open-mpi hwloc 2.1.0 allows attackers
to cause a denial of service or other unspecified impacts via
glibc-cpuset in topology-linux.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-47022</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-47022</url>
</references>
<dates>
<discovery>2023-08-22</discovery>
<entry>2024-10-29</entry>
</dates>
</vuln>
<vuln vid="f07c8f87-8e65-11ef-81b8-659bf0027d16">
<topic>forgejo -- multiple vulnerabilities</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>9.0.1</lt></range>
</package>
<package>
<name>forgejo7</name>
<range><lt>7.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Forgejo generates a token which is used to authenticate web
endpoints that are only meant to be used internally, for instance
when the SSH daemon is used to push a commit with Git. The
verification of this token was not done in constant time and was
susceptible to timing attacks. A pre-condition for such an attack is
the precise measurements of the time for each operation. Since it
requires observing the timing of network operations, the issue is
mitigated when a Forgejo instance is accessed over the internet
because the ISP introduce unpredictable random delays.</li>
<li>Because of a missing permission check, the branch used to propose
a pull request to a repository can always be deleted by the user
performing the merge. It was fixed so that such a deletion is only
allowed if the user performing the merge has write permission to the
repository from which the pull request was made.</li>
</ul>
</body>
</description>
<references>
<url>https://codeberg.org/forgejo/forgejo/milestone/8544</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5719</url>
<url>https://codeberg.org/forgejo/forgejo/pulls/5718</url>
</references>
<dates>
<discovery>2024-10-28</discovery>
<entry>2024-10-29</entry>
</dates>
</vuln>
<vuln vid="fafaef4d-f364-4a07-bbdd-bf53448c593c">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>130.0.6723.69</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>130.0.6723.69</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[371011220] High CVE-2024-10229: Inappropriate implementation in Extensions. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2024-10-02</li>
<li>[371565065] High CVE-2024-10230: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-10-05</li>
<li>[372269618] High CVE-2024-10231: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-10-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-10229</cvename>
<cvename>CVE-2024-10230</cvename>
<cvename>CVE-2024-10231</cvename>
<url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html</url>
</references>
<dates>
<discovery>2024-10-22</discovery>
<entry>2024-10-26</entry>
</dates>
</vuln>
<vuln vid="1e71e366-080b-4e8f-a9e6-150bf698186b">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>130.0.6723.58</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>130.0.6723.58</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html">
<p>This update includes 17 security fixes:</p>
<ul>
<li>[367755363] High CVE-2024-9954: Use after free in AI. Reported by DarkNavy on 2024-09-18</li>
<li>[370133761] Medium CVE-2024-9955: Use after free in Web Authentication. Reported by anonymous on 2024-09-29</li>
<li>[370482421] Medium CVE-2024-9956: Inappropriate implementation in Web Authentication. Reported by mastersplinter on 2024-09-30</li>
<li>[358151317] Medium CVE-2024-9957: Use after free in UI. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-08</li>
<li>[40076120] Medium CVE-2024-9958: Inappropriate implementation in PictureInPicture. Reported by Lyra Rebane (rebane2001) on 2023-11-02</li>
<li>[368672129] Medium CVE-2024-9959: Use after free in DevTools. Reported by Sakana.S on 2024-09-21</li>
<li>[354748063] Medium CVE-2024-9960: Use after free in Dawn. Reported by Anonymous on 2024-07-23</li>
<li>[357776197] Medium CVE-2024-9961: Use after free in Parcel Tracking. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-06</li>
<li>[364508693] Medium CVE-2024-9962: Inappropriate implementation in Permissions. Reported by Shaheen Fazim on 2024-09-04</li>
<li>[328278718] Medium CVE-2024-9963: Insufficient data validation in Downloads. Reported by Anonymous on 2024-03-06</li>
<li>[361711121] Low CVE-2024-9964: Inappropriate implementation in Payments. Reported by Hafiizh on 2024-08-23</li>
<li>[352651673] Low CVE-2024-9965: Insufficient data validation in DevTools. Reported by Shaheen Fazim on 2024-07-12</li>
<li>[364773822] Low CVE-2024-9966: Inappropriate implementation in Navigations. Reported by Harry Chen on 2024-09-05</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9954</cvename>
<cvename>CVE-2024-9955</cvename>
<cvename>CVE-2024-9956</cvename>
<cvename>CVE-2024-9957</cvename>
<cvename>CVE-2024-9958</cvename>
<cvename>CVE-2024-9959</cvename>
<cvename>CVE-2024-9960</cvename>
<cvename>CVE-2024-9961</cvename>
<cvename>CVE-2024-9962</cvename>
<cvename>CVE-2024-9963</cvename>
<cvename>CVE-2024-9964</cvename>
<cvename>CVE-2024-9965</cvename>
<cvename>CVE-2024-9966</cvename>
<url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2024-10-15</discovery>
<entry>2024-10-26</entry>
</dates>
</vuln>
<vuln vid="3152a474-9390-11ef-87ad-a8a15998b5cb">
<topic>halibut -- Segmentation fault, denial of service or possibly other unspecified impact via a crafted text document</topic>
<affects>
<package>
<name>halibut</name>
<range><eq>1.2</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-text-uaf">
<p>CVE-2021-42612: A use after free in cleanup_index in index.c in Halibut 1.2 allows
an attacker to cause a segmentation fault or possibly have other
unspecified impact via a crafted text document.</p>
</blockquote>
<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df">
<p>CVE-2021-42613: A double free in cleanup_index in index.c in Halibut 1.2 allows an
attacker to cause a denial of service or possibly have other
unspecified impact via a crafted text document.</p>
</blockquote>
<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf">
<p>CVE-2021-42614: A use after free in info_width_internal in bk_info.c in Halibut 1.2
allows an attacker to cause a segmentation fault or possibly have
unspecified other impact via a crafted text document.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-42612</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-42612</url>
<cvename>CVE-2021-42613</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-42613</url>
<cvename>CVE-2021-42614</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-42614</url>
</references>
<dates>
<discovery>2022-05-24</discovery>
<entry>2024-10-26</entry>
</dates>
</vuln>
<vuln vid="fcb0e00f-d7d3-49b6-a4a1-852528230912">
<topic>electron31 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-9121.</li>
<li>Security: backported fix for CVE-2024-9122.</li>
<li>Security: backported fix for CVE-2024-7025.</li>
<li>Security: backported fix for CVE-2024-9369.</li>
<li>Security: backported fix for CVE-2024-7965.</li>
<li>Security: backported fix for CVE-2024-7966.</li>
<li>Security: backported fix for CVE-2024-7967.</li>
<li>Security: backported fix for CVE-2024-8198.</li>
<li>Security: backported fix for CVE-2024-8193.</li>
<li>Security: backported fix for CVE-2024-7969.</li>
<li>Security: backported fix for CVE-2024-7970.</li>
<li>Security: backported fix for CVE-2024-8362.</li>
<li>Security: backported fix for CVE-2024-8636.</li>
<li>Security: backported fix for CVE-2024-9123.</li>
<li>Security: backported fix for CVE-2024-9120.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9121</cvename>
<url>https://github.com/advisories/GHSA-qcr8-x9j3-5j62</url>
<cvename>CVE-2024-9122</cvename>
<url>https://github.com/advisories/GHSA-4fw3-822r-pqw6</url>
<cvename>CVE-2024-7025</cvename>
<cvename>CVE-2024-9369</cvename>
<cvename>CVE-2024-7965</cvename>
<url>https://github.com/advisories/GHSA-x38q-hvmx-rwhg</url>
<cvename>CVE-2024-7966</cvename>
<url>https://github.com/advisories/GHSA-4pj3-wmgx-2h8r</url>
<cvename>CVE-2024-7967</cvename>
<url>https://github.com/advisories/GHSA-57cq-jgq2-x7vg</url>
<cvename>CVE-2024-8198</cvename>
<url>https://github.com/advisories/GHSA-76vg-grjj-w595</url>
<cvename>CVE-2024-8193</cvename>
<url>https://github.com/advisories/GHSA-5q6v-fp9h-6rjg</url>
<cvename>CVE-2024-7969</cvename>
<url>https://github.com/advisories/GHSA-p8h7-64p8-w5pq</url>
<cvename>CVE-2024-7970</cvename>
<url>https://github.com/advisories/GHSA-4c4w-77f9-v9mq</url>
<cvename>CVE-2024-8362</cvename>
<url>https://github.com/advisories/GHSA-rw7g-4966-p363</url>
<cvename>CVE-2024-8636</cvename>
<url>https://github.com/advisories/GHSA-r6cg-gw4p-5gmj</url>
<cvename>CVE-2024-9123</cvename>
<url>https://github.com/advisories/GHSA-xwv3-34j2-7jgx</url>
<cvename>CVE-2024-9120</cvename>
<url>https://github.com/advisories/GHSA-xh87-v57g-jhpw</url>
</references>
<dates>
<discovery>2024-10-24</discovery>
<entry>2024-10-24</entry>
</dates>
</vuln>
<vuln vid="78e6c113-91c1-11ef-a904-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.5.0</ge><lt>17.5.1</lt></range>
<range><ge>17.4.0</ge><lt>17.4.3</lt></range>
<range><ge>11.2.0</ge><lt>17.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/">
<p>HTML injection in Global Search may lead to XSS</p>
<p>DoS via XML manifest file import</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8312</cvename>
<cvename>CVE-2024-6826</cvename>
<url>https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/</url>
</references>
<dates>
<discovery>2024-10-23</discovery>
<entry>2024-10-24</entry>
</dates>
</vuln>
<vuln vid="cc068959-ce2b-42eb-81ed-055551fe0e51">
<topic>electron32 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron32</name>
<range><lt>32.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-7966.</li>
<li>Security: backported fix for CVE-2024-9370.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7966</cvename>
<url>https://github.com/advisories/GHSA-4pj3-wmgx-2h8r</url>
<cvename>CVE-2024-9370</cvename>
</references>
<dates>
<discovery>2024-10-23</discovery>
<entry>2024-10-23</entry>
</dates>
</vuln>
<vuln vid="dbe8c5bd-8d3f-11ef-8d2e-a04a5edf46d9">
<topic>oauth2-proxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>oauth2-proxy</name>
<range><lt>7.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The oauth2-proxy project reports:</p>
<blockquote cite="https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.7.0">
<p>Vulnerabilities have been addressed:</p>
<ul>
<li>CVE-2024-24786</li>
<li>CVE-2024-24791</li>
<li>CVE-2024-24790</li>
<li>CVE-2024-24784</li>
<li>CVE-2024-28180</li>
<li>CVE-2023-45288</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24786</cvename>
<cvename>CVE-2024-24791</cvename>
<cvename>CVE-2024-24790</cvename>
<cvename>CVE-2024-24784</cvename>
<cvename>CVE-2024-28180</cvename>
<cvename>CVE-2024-45288</cvename>
<url>https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.7.0</url>
</references>
<dates>
<discovery>2024-10-02</discovery>
<entry>2024-10-18</entry>
</dates>
</vuln>
<vuln vid="c6f4177c-8e29-11ef-98e7-84a93843eb75">
<topic>OpenSSL -- OOB memory access vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.15_1,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.7_1</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.3_1</lt></range>
</package>
<package>
<name>openssl33</name>
<range><lt>3.3.2_1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.15_1,1</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://openssl-library.org/news/secadv/20241016.txt">
<p>Low-level invalid GF(2^m) parameters lead to OOB memory access
(CVE-2024-9143) (Low)</p>
<p> Use of the low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial can lead to out-of-bounds
memory reads or writes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9143</cvename>
<url>https://openssl-library.org/news/secadv/20241016.txt</url>
</references>
<dates>
<discovery>2024-10-16</discovery>
<entry>2024-10-19</entry>
</dates>
</vuln>
<vuln vid="815bf172-ab9e-4c4b-9662-d18b0054330d">
<topic>electron{31,32} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.7.1</lt></range>
</package>
<package>
<name>electron32</name>
<range><lt>32.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.1">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-9602.</li>
<li>Security: backported fix for CVE-2024-9603.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9602</cvename>
<url>https://github.com/advisories/GHSA-4v8q-vp3v-vvxh</url>
<cvename>CVE-2024-9603</cvename>
<url>https://github.com/advisories/GHSA-92m3-m5pw-p2x9</url>
</references>
<dates>
<discovery>2024-10-16</discovery>
<entry>2024-10-18</entry>
</dates>
</vuln>
<vuln vid="851ce3e4-8b03-11ef-84e9-901b0e9408dc">
<topic>element-web -- Potential exposure of access token via authenticated media</topic>
<affects>
<package>
<name>element-web</name>
<range><ge>1.11.70</ge><lt>1.11.81</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Element team reports:</p>
<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-3jm3-x98c-r34x">
<p>Element Web versions 1.11.70 through 1.11.80 contain a
vulnerability which can, under specially crafted conditions,
lead to the access token becoming exposed to third
parties. At least one vector has been identified internally,
involving malicious widgets, but other vectors may
exist. Users are strongly advised to upgrade to version
1.11.81 to remediate the issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47779</cvename>
<url>https://github.com/element-hq/element-web/security/advisories/GHSA-3jm3-x98c-r34x</url>
</references>
<dates>
<discovery>2024-10-15</discovery>
<entry>2024-10-15</entry>
</dates>
</vuln>
<vuln vid="64e299b6-d12b-4a7a-a94f-ab133703925a">
<topic>vscode -- Visual Studio Code for Linux Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.94.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VSCode developers report:</p>
<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-g56j-w527-8x6f">
<p>Visual Studio Code for Linux Remote Code Execution Vulnerability</p>
<p>A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-43601</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-43601</url>
<url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43601</url>
</references>
<dates>
<discovery>2024-10-08</discovery>
<entry>2024-10-11</entry>
</dates>
</vuln>
<vuln vid="2fb13238-872d-11ef-bd1e-b42e991fc52e">
<topic>firefox -- use-after-free code execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>131.0.2,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.3.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1923344">
<p>An attacker was able to achieve code execution in the
content process by exploiting a use-after-free in Animation
timelines. We have had reports of this vulnerability being
exploited in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9680</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9680</url>
</references>
<dates>
<discovery>2024-10-09</discovery>
<entry>2024-10-10</entry>
</dates>
</vuln>
<vuln vid="cc1ac01e-86b0-11ef-9369-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.4.0</ge><lt>17.4.2</lt></range>
<range><ge>17.3.0</ge><lt>17.3.5</lt></range>
<range><ge>8.16</ge><lt>17.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/">
<p>Run pipelines on arbitrary branches</p>
<p>An attacker can impersonate arbitrary user</p>
<p>SSRF in Analytics Dashboard</p>
<p>Viewing diffs of MR with conflicts can be slow</p>
<p>HTMLi in OAuth page</p>
<p>Deploy Keys can push changes to an archived repository</p>
<p>Guests can disclose project templates</p>
<p>GitLab instance version disclosed to unauthorized users</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9164</cvename>
<cvename>CVE-2024-8970</cvename>
<cvename>CVE-2024-8977</cvename>
<cvename>CVE-2024-9631</cvename>
<cvename>CVE-2024-6530</cvename>
<cvename>CVE-2024-9623</cvename>
<cvename>CVE-2024-5005</cvename>
<cvename>CVE-2024-9596</cvename>
<url>https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/</url>
</references>
<dates>
<discovery>2024-10-09</discovery>
<entry>2024-10-10</entry>
</dates>
</vuln>
<vuln vid="79b1f4ee-860a-11ef-b2dc-cbccbf25b7ea">
<topic>gitea -- token missing access control for packages</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.22.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Fix bug when a token is given public only</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/32204</url>
</references>
<dates>
<discovery>2024-10-06</discovery>
<entry>2024-10-09</entry>
</dates>
</vuln>
<vuln vid="8727b513-855b-11ef-9e50-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released">
<p>PowerDNS Security Advisory 2024-04: Crafted responses can lead to
a denial of service due to cache inefficiencies in the Recursor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-25590</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-04.html</url>
</references>
<dates>
<discovery>2024-10-03</discovery>
<entry>2024-10-09</entry>
</dates>
</vuln>
<vuln vid="7217f6e8-3ff4-4387-845d-d1744bb7f95e">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>129.0.6668.100</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>129.0.6668.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[368241697] High CVE-2024-9602: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-09-20</li>
<li>[367818758] High CVE-2024-9603: Type Confusion in V8. Reported by @WeShotTheMoon and @Nguyen Hoang Thach of starlabs on 2024-09-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9602</cvename>
<cvename>CVE-2024-9603</cvename>
<url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html</url>
</references>
<dates>
<discovery>2024-10-08</discovery>
<entry>2024-10-09</entry>
</dates>
</vuln>
<vuln vid="83117378-f773-4617-bf74-477d569dcd74">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>129.0.6668.89</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>129.0.6668.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[367764861] High CVE-2024-7025: Integer overflow in Layout. Reported by Tashita Software Security on 2024-09-18</li>
<li>[368208152] High CVE-2024-9369: Insufficient data validation in Mojo. Reported by Xiantong Hou and Pisanbao of Wuheng Lab on 2024-09-19</li>
<li>[368311899] High CVE-2024-9370: Inappropriate implementation in V8. Reported by Nguyễn Hoàng Thạch, Đỗ Minh Tuấn, and Wu JinLin of STAR Labs SG Pte. Ltd. on 2024-09-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7025</cvename>
<cvename>CVE-2024-9369</cvename>
<cvename>CVE-2024-9370</cvename>
<url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-10-01</discovery>
<entry>2024-10-09</entry>
</dates>
</vuln>
<vuln vid="2368755b-83f6-11ef-8d2e-a04a5edf46d9">
<topic>Unbound -- Denial of service attack</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.21.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLnet labs report:</p>
<blockquote cite="https://nlnetlabs.nl/news/2024/Oct/03/unbound-1.21.1-released/">
<p>A vulnerability has been discovered in Unbound when handling
replies with very large RRsets that Unbound needs to perform name
compression for.</p>
<p>Malicious upstreams responses with very large RRsets can cause
Unbound to spend a considerable time applying name compression to
downstream replies. This can lead to degraded performance and
eventually denial of service in well orchestrated attacks.</p>
<p>Unbound version 1.21.1 introduces a hard limit on the number of
name compression calculations it is willing to do per packet.
Packets that need more compression will result in semi-compressed
packets or truncated packets, even on TCP for huge messages, to
avoid locking the CPU for long.</p>
<p>This change should not affect normal DNS traffic.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8508</cvename>
<url>https://nlnetlabs.nl/news/2024/Oct/03/unbound-1.21.1-released/</url>
</references>
<dates>
<discovery>2024-10-03</discovery>
<entry>2024-10-06</entry>
</dates>
</vuln>
<vuln vid="fe7031d3-3000-4b43-9fa6-52c2b624b8f9">
<topic>zeek -- potential DoS vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>7.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.3">
<p> Adding to the POP3 hardening in 7.0.2, the parser now
simply discards too many pending commands, rather than
any attempting to process them. Further, invalid server
responses do not result in command completion anymore.
Processing out-of-order commands or finishing commands
based on invalid server responses could result in
inconsistent analyzer state, potentially triggering null
pointer references for crafted traffic. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v7.0.3</url>
</references>
<dates>
<discovery>2024-10-05</discovery>
<entry>2024-10-05</entry>
</dates>
</vuln>
<vuln vid="0417d41a-8175-11ef-a5dc-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>131.0,2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>128.3.0,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>128.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476">
<ul>
<li>CVE-2024-9392: A compromised content process could have
allowed for the arbitrary loading of cross-origin pages.</li>
<li>CVE-2024-9396: It is currently unknown if this issue is
exploitable but a condition may arise where the structured
clone of certain objects could lead to memory corruption.</li>
<li>CVE-2024-9400: A potential memory corruption vulnerability
could be triggered if an attacker had the ability to trigger
an OOM at a specific moment during JIT compilation.</li>
<li>CVE-2024-9401: Memory safety bugs present in Firefox 130,
Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2.
Some of these bugs showed evidence of memory corruption and we
presume that with enough effort some of these could have been
exploited to run arbitrary code.</li>
<li>CVE-2024-9402: Memory safety bugs present in Firefox 130,
Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs
showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run
arbitrary code.</li>
<li>CVE-2024-9403: Memory safety bugs present in Firefox 130.
Some of these bugs showed evidence of memory corruption and we
presume that with enough effort some of these could have been
exploited to run arbitrary code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9392</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9392</url>
<cvename>CVE-2024-9396</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9396</url>
<cvename>CVE-2024-9400</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9400</url>
<cvename>CVE-2024-9401</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9401</url>
<cvename>CVE-2024-9402</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9402</url>
<cvename>CVE-2024-9403</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-9403</url>
</references>
<dates>
<discovery>2024-10-01</discovery>
<entry>2024-10-03</entry>
</dates>
</vuln>
<vuln vid="3c6f8270-3210-4e2f-ba72-a9cdca7417a0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.479</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.462.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-10-02/">
<h1>Description</h1>
<h5>(Medium) SECURITY-3451 / CVE-2024-47803</h5>
<p>Exposure of multi-line secrets through error messages in Jenkins</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3448 / CVE-2024-47804</h5>
<p>Item creation restriction bypass vulnerability in Jenkins</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-47803</cvename>
<cvename>CVE-2024-47804</cvename>
<url>https://www.jenkins.io/security/advisory/2024-10-02/</url>
</references>
<dates>
<discovery>2024-10-02</discovery>
<entry>2024-10-03</entry>
</dates>
</vuln>
<vuln vid="8b20f21a-8113-11ef-b988-08002784c58d">
<topic>redis,valkey -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>redis</name>
<range><ge>7.4.0</ge><lt>7.4.1</lt></range>
<range><ge>7.2.0</ge><lt>7.2.6</lt></range>
</package>
<package>
<name>redis72</name>
<range><ge>7.2.0</ge><lt>7.2.6</lt></range>
</package>
<package>
<name>redis62</name>
<range><ge>6.2.0</ge><lt>6.2.16</lt></range>
</package>
<package>
<name>valkey</name>
<range><ge>8,0,0</ge><lt>8.0.1</lt></range>
<range><ge>7.2.0</ge><lt>7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/releases/tag/7.4.1">
<dl>
<dt>CVE-2024-31449</dt>
<dd>Lua library commands may lead to stack overflow and potential RCE.</dd>
<dt>CVE-2024-31227</dt>
<dd>Potential Denial-of-service due to malformed ACL selectors.</dd>
<dt>CVE-2024-31228</dt>
<dd>Potential Denial-of-service due to unbounded pattern matching.</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31449</cvename>
<cvename>CVE-2024-31227</cvename>
<cvename>CVE-2024-31228</cvename>
<url>https://github.com/redis/redis/releases/tag/7.4.1</url>
</references>
<dates>
<discovery>2024-10-02</discovery>
<entry>2024-10-02</entry>
</dates>
</vuln>
<vuln vid="fe5c1e7a-7eed-11ef-9533-f875a43e1796">
<topic>php -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php81</name>
<range><lt>8.1.30</lt></range>
</package>
<package>
<name>php82</name>
<range><lt>8.2.24</lt></range>
</package>
<package>
<name>php83</name>
<range><lt>8.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php.net reports:</p>
<blockquote cite="https://www.php.net/ChangeLog-8.php">
<ul>
<li>CVE-2024-8926: CGI: Fixed bug GHSA-9pqp-7h25-4f32 (Bypass of CVE-2024-4577, Parameter Injection Vulnerability).</li>
<li>CVE-2024-8927: CGI: Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision).</li>
<li>CVE-2024-9026: FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).</li>
<li>CVE-2024-8925: SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8926</cvename>
<cvename>CVE-2024-8927</cvename>
<cvename>CVE-2024-9026</cvename>
<cvename>CVE-2024-8925</cvename>
<url>https://www.php.net/ChangeLog-8.php</url>
</references>
<dates>
<discovery>2024-09-26</discovery>
<entry>2024-09-30</entry>
</dates>
</vuln>
<vuln vid="f9cfdb00-7f43-11ef-9b27-592d55dd336d">
<topic>Slixmpp -- Lack of SSL Certificate hostname validation in XMLStream</topic>
<affects>
<package>
<name>py38-slixmpp</name>
<name>py39-slixmpp</name>
<name>py310-slixmpp</name>
<name>py311-slixmpp</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-45197">
<p>Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream,
allowing an attacker to pose as any server in the eyes of Slixmpp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-45197</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-45197</url>
</references>
<dates>
<discovery>2022-12-25</discovery>
<entry>2024-09-30</entry>
</dates>
</vuln>
<vuln vid="2f82696c-adad-447b-9938-c99441805fa3">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>129.0.6668.70</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>129.0.6668.70</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[365254285] High CVE-2024-9120: Use after free in Dawn. Reported by Anonymous on 2024-09-08</li>
<li>[363538434] High CVE-2024-9121: Inappropriate implementation in V8. Reported by Tashita Software Security on 2024-09-01</li>
<li>[365802567] High CVE-2024-9122: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-09-10</li>
<li>[365884464] High CVE-2024-9123: Integer overflow in Skia. Reported by raven at KunLun lab on 2024-09-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-9120</cvename>
<cvename>CVE-2024-9121</cvename>
<cvename>CVE-2024-9122</cvename>
<cvename>CVE-2024-9123</cvename>
<url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2024-09-24</discovery>
<entry>2024-09-30</entry>
</dates>
</vuln>
<vuln vid="42ec2207-7e85-11ef-89a4-b42e991fc52e">
<topic>sqlite -- use-after-free bug in jsonparseaddnodearray</topic>
<affects>
<package>
<name>sqlite3</name>
<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
</package>
<package>
<name>linux-rl9-sqlite</name>
<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
</package>
<package>
<name>linux-c7-sqlite</name>
<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert@redhat.com reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2024-0232">
<p>A heap use-after-free issue has been identified in SQLite in the
jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a
local attacker to leverage a victim to pass specially crafted
malicious input to the application, potentially causing a crash and
leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0232</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-0232</url>
</references>
<dates>
<discovery>2024-01-16</discovery>
<entry>2024-09-29</entry>
<modified>2025-08-01</modified>
</dates>
</vuln>
<vuln vid="24375796-7cbc-11ef-a3a9-001cc0382b2f">
<topic>cups-filters -- remote code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.28.17_6</lt></range>
</package>
<package>
<name>cups</name>
<range><lt>2.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenPrinting reports:</p>
<blockquote cite="https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8">
<p>Due to the service binding to *:631 ( INADDR_ANY ), multiple bugs
in cups-browsed can be exploited in sequence to introduce a
malicious printer to the system. This chain of exploits ultimately
enables an attacker to execute arbitrary commands remotely on the
target machine without authentication when a print job is started.
Posing a significant security risk over the network. Notably, this
vulnerability is particularly concerning as it can be exploited
from the public internet, potentially exposing a vast number of
systems to remote attacks if their CUPS services are enabled.</p>
</blockquote>
<p>The vulnerability allows an attacker on the internet to create a
new printer device with arbitrary commands in the PPD file of the
printer. Attacks using mDNS on the local network can also replace an
existing printer. The commands are executed when a user attempts to
print on the malicious device. They run with the privileges of the
user "cups".</p>
<p>It is recommended to disable the cups_browsed service until patches
become available. On FreeBSD this is the default. You can check the
status and disable the service with the following commands:</p>
<p><code># service cups_browsed status<br/>
# service cups_browsed stop<br/>
# service cups_browsed disable</code></p>
<p>If you choose to leave the service enabled, attacks from the
internet can be blocked by removing the "cups" protocol from the
BrowseRemoteProtocols and BrowseProtocols directives in
/usr/local/etc/cups/cups-browsed.conf. Attacks using mDNS can be
blocked by removing the "dnssd" protocol as well. Access can be
limited to specific IP addresses using BrowseAllow, BrowseDeny, and
BrowseOrder directives as documented in cups-browsed.conf(5). Then
restart the service with the following command:</p>
<p><code># service cups_browsed restart</code></p>
</body>
</description>
<references>
<cvename>CVE-2024-47076</cvename>
<cvename>CVE-2024-47175</cvename>
<cvename>CVE-2024-47176</cvename>
<url>https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8</url>
</references>
<dates>
<discovery>2024-09-26</discovery>
<entry>2024-09-27</entry>
<modified>2024-10-02</modified>
</dates>
</vuln>
<vuln vid="ca5f3bbc-7a62-11ef-9533-f875a43e1796">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libexpat reports:</p>
<blockquote cite="https://github.com/libexpat/libexpat/blob/master/expat/Changes">
<ul>
<li>CVE-2024-45490: Calling function XML_ParseBuffer with
len < 0 without noticing and then calling XML_GetBuffer
will have XML_ParseBuffer fail to recognize the problem
and XML_GetBuffer corrupt memory.
With the fix, XML_ParseBuffer now complains with error
XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
has been doing since Expat 2.2.1, and now documented.
Impact is denial of service to potentially artitrary code
execution.</li>
<li>CVE-2024-45491: Internal function dtdCopy can have an
integer overflow for nDefaultAtts on 32-bit platforms
(where UINT_MAX equals SIZE_MAX).
Impact is denial of service to potentially artitrary code
execution.</li>
<li>CVE-2024-45492: Internal function nextScaffoldPart can
have an integer overflow for m_groupSize on 32-bit
platforms (where UINT_MAX equals SIZE_MAX).
Impact is denial of service to potentially artitrary code
execution.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-45490</cvename>
<cvename>CVE-2024-45491</cvename>
<cvename>CVE-2024-45492</cvename>
<url>https://github.com/libexpat/libexpat/blob/master/expat/Changes</url>
</references>
<dates>
<discovery>2024-09-24</discovery>
<entry>2024-09-24</entry>
</dates>
</vuln>
<vuln vid="4b7ed61f-7bbf-11ef-9369-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.4.0</ge><lt>17.4.1</lt></range>
<range><ge>17.3.0</ge><lt>17.3.4</lt></range>
<range><ge>15.6.0</ge><lt>17.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/">
<p>Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request</p>
<p>AI feature reads unsanitized content, allowing for attacker to hide prompt injection</p>
<p>Project reference can be exposed in system notes</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4278</cvename>
<cvename>CVE-2024-4099</cvename>
<cvename>CVE-2024-8974</cvename>
<url>https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/</url>
</references>
<dates>
<discovery>2024-09-25</discovery>
<entry>2024-09-26</entry>
</dates>
</vuln>
<vuln vid="802961eb-7a89-11ef-bdd7-a0423f48a938">
<topic>frr - BGP</topic>
<affects>
<package>
<name>frr9</name>
<range><lt>9.1.2</lt></range>
</package>
<package>
<name>frr8</name>
<range><lt>8.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/FRRouting/frr/pull/16497">
<p>An issue was discovered in FRRouting (FRR). bgp_attr_encap
in bgpd/bgp_attr.c does not check the actual remaining stream length
before taking the TLV value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-44070</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-44070</url>
</references>
<dates>
<discovery>2024-08-19</discovery>
<entry>2024-09-24</entry>
</dates>
</vuln>
<vuln vid="d47b7ae7-fe1d-4f7f-919a-480ca8035f00">
<topic>zeek -- potential DoS vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>7.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.2">
<p> The POP3 parser has been hardened to avoid unbounded
state growth in the face of one-sided traffic capture or
when enabled for non-POP3 traffic. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v7.0.2</url>
</references>
<dates>
<discovery>2024-09-24</discovery>
<entry>2024-09-24</entry>
</dates>
</vuln>
<vuln vid="c02b8db5-771b-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- NFS client accepts file names containing path separators</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_3</lt></range>
<range><ge>14.0</ge><lt>14.0_9</lt></range>
<range><ge>13.3</ge><lt>13.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When mounting a remote filesystem using NFS, the kernel did not
sanitize remotely provided filenames for the path separator character,
"/". This allows readdir(3) and related functions to return
filesystem entries with names containing additional path components.</p>
<h1>Impact:</h1>
<p>The lack of validation described above gives rise to a confused
deputy problem. For example, a program copying files from an NFS
mount could be tricked into copying from outside the intended source
directory, and/or to a location outside the intended destination
directory.</p>
</body>
</description>
<references>
<cvename>CVE-2024-6759</cvename>
<freebsdsa>SA-24:07.nfsclient</freebsdsa>
</references>
<dates>
<discovery>2024-08-07</discovery>
<entry>2024-09-20</entry>
</dates>
</vuln>
<vuln vid="8fb61d94-771b-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- ktrace(2) fails to detach when executing a setuid binary</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_3</lt></range>
<range><ge>14.0</ge><lt>14.0_9</lt></range>
<range><ge>13.3</ge><lt>13.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A logic bug in the code which disables kernel tracing for setuid
programs meant that tracing was not disabled when it should have,
allowing unprivileged users to trace and inspect the behavior of
setuid programs.</p>
<h1>Impact:</h1>
<p>The bug may be used by an unprivileged user to read the contents
of files to which they would not otherwise have access, such as the
local password database.</p>
</body>
</description>
<references>
<cvename>CVE-2024-6760</cvename>
<freebsdsa>SA-24:06.ktrace</freebsdsa>
</references>
<dates>
<discovery>2024-08-07</discovery>
<entry>2024-09-20</entry>
</dates>
</vuln>
<vuln vid="f140cff0-771a-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- pf incorrectly matches different ICMPv6 states in the state table</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_3</lt></range>
<range><ge>14.0</ge><lt>14.0_9</lt></range>
<range><ge>13.3</ge><lt>13.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When
pf is configured to allow ND and block incoming Echo Requests, a
crafted Echo Request packet after a Neighbor Solicitation (NS) can
trigger an Echo Reply. The packet has to come from the same host
as the NS and have a zero as identifier to match the state created
by the Neighbor Discovery and allow replies to be generated.</p>
<h1>Impact:</h1>
<p>ICMPv6 packets with identifier value of zero bypass firewall
rules written on the assumption that the incoming packets are going
to create a state in the state table.</p>
<h1>Note:</h1>
<p>This advisory introduced additional issues that were addressed by
FreeBSD-EN-24:16.pf. Please refer to that erratum for additional
fixes.</p>
</body>
</description>
<references>
<cvename>CVE-2024-6640</cvename>
<freebsdsa>SA-24:05.pf</freebsdsa>
<url>https://www.freebsd.org/security/advisories/FreeBSD-EN-24:16.pf.asc</url>
</references>
<dates>
<discovery>2024-08-07</discovery>
<entry>2024-09-20</entry>
</dates>
</vuln>
<vuln vid="93c12fe5-7716-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Integer overflow in libnv</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_5</lt></range>
<range><ge>14.0</ge><lt>14.0_11</lt></range>
<range><ge>13.4</ge><lt>13.4_1</lt></range>
<range><ge>13.3</ge><lt>13.3_7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_5</lt></range>
<range><ge>14.0</ge><lt>14.0_11</lt></range>
<range><ge>13.4</ge><lt>13.4_1</lt></range>
<range><ge>13.3</ge><lt>13.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A malicious value of size in a structure of packed libnv can
cause an integer overflow, leading to the allocation of a smaller
buffer than required for the parsed data. The introduced check was
incorrect, as it took into account the size of the pointer, not the
structure. This vulnerability affects both kernel and userland.</p>
<p>This issue was originally intended to be addressed as part of
FreeBSD-SA-24:09.libnv, but due to a logic issue, this issue was
not properly addressed.</p>
<h1>Impact:</h1>
<p>It is possible for an attacker to overwrite portions of memory
(in userland or the kernel) as the allocated buffer might be smaller
than the data received from a malicious process. This vulnerability
could result in privilege escalation or cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2024-45287</cvename>
<freebsdsa>SA-24:16.libnv</freebsdsa>
</references>
<dates>
<discovery>2024-09-19</discovery>
<entry>2024-09-20</entry>
</dates>
</vuln>
<vuln vid="1febd09b-7716-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_5</lt></range>
<range><ge>14.0</ge><lt>14.0_11</lt></range>
<range><ge>13.4</ge><lt>13.4_1</lt></range>
<range><ge>13.3</ge><lt>13.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>bhyve can be configured to emulate devices on a virtual USB
controller (XHCI), such as USB tablet devices. An insufficient
boundary validation in the USB code could lead to an out-of-bounds read
on the heap, which could potentially lead to an arbitrary write and
remote code execution.</p>
<h1>Impact:</h1>
<p>A malicious, privileged software running in a guest VM can exploit
the vulnerability to crash the hypervisor process or potentially achieve
code execution on the host in the bhyve userspace process, which
typically runs as root. Note that bhyve runs in a Capsicum sandbox, so
malicious code is constrained by the capabilities available to the bhyve
process.</p>
</body>
</description>
<references>
<cvename>CVE-2024-41721</cvename>
<freebsdsa>SA-24:15.bhyve</freebsdsa>
</references>
<dates>
<discovery>2024-09-19</discovery>
<entry>2024-09-20</entry>
</dates>
</vuln>
<vuln vid="3e738678-7582-11ef-bece-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.3.0</ge><lt>17.3.3</lt></range>
<range><ge>17.2.0</ge><lt>17.2.7</lt></range>
<range><ge>0</ge><lt>17.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/">
<p>SAML authentication bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-45409</cvename>
<url>https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/</url>
</references>
<dates>
<discovery>2024-09-17</discovery>
<entry>2024-09-18</entry>
</dates>
</vuln>
<vuln vid="58750d49-7302-11ef-8c95-195d300202b3">
<topic>OpenSSH -- Pre-authentication async signal safety issue</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>9.8.p1_1,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_3</lt></range>
<range><ge>14.0</ge><lt>14.0_9</lt></range>
<range><ge>13.3</ge><lt>13.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeBSD Project reports:</p>
<blockquote cite="https://www.freebsd.org/security/advisories/FreeBSD-SA-24:08.openssh.asc">
<p>
A signal handler in sshd(8) may call a logging function that is not async-
signal-safe. The signal handler is invoked when a client does not
authenticate within the LoginGraceTime seconds (120 by default).
This signal handler executes in the context of the sshd(8)'s privileged
code, which is not sandboxed and runs with full root privileges.</p>
<p>This issue is another instance of the problem in CVE-2024-6387 addressed by
FreeBSD-SA-24:04.openssh. The faulty code in this case is from the
integration of blacklistd in OpenSSH in FreeBSD.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7589</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7589</url>
<freebsdsa>SA-24:08.openssh</freebsdsa>
</references>
<dates>
<discovery>2024-08-06</discovery>
<entry>2024-09-15</entry>
<modified>2024-09-20</modified>
</dates>
</vuln>
<vuln vid="bd940aba-7467-11ef-a5c4-08002784c58d">
<topic>SnappyMail -- multiple mXSS in HTML sanitizer</topic>
<affects>
<package>
<name>snappymail-php81</name>
<name>snappymail-php82</name>
<name>snappymail-php83</name>
<name>snappymail-php84</name>
<range><lt>2.38.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oskar reports:</p>
<blockquote cite="https://github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm">
<p>
SnappyMail uses the `cleanHtml()` function to cleanup HTML
and CSS in emails. Research discovered that the function
has a few bugs which cause an mXSS exploit. Because the
function allowed too many (invalid) HTML elements, it was
possible (with incorrect markup) to trick the browser to
"fix" the broken markup into valid markup. As a result a
motivated attacker may be able to inject javascript.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-45800</cvename>
<url>https://github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm</url>
</references>
<dates>
<discovery>2024-09-16</discovery>
<entry>2024-09-16</entry>
</dates>
</vuln>
<vuln vid="e464f777-719e-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>128.0.6613.137</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>128.0.6613.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[361461526] High CVE-2024-8636: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-22</li>
<li>[361784548] High CVE-2024-8637: Use after free in Media Router. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-23</li>
<li>[362539773] High CVE-2024-8638: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-08-28</li>
<li>[362658609] High CVE-2024-8639: Use after free in Autofill. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-28</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8636</cvename>
<cvename>CVE-2024-8637</cvename>
<cvename>CVE-2024-8638</cvename>
<cvename>CVE-2024-8639</cvename>
<url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2024-09-10</discovery>
<entry>2024-09-13</entry>
</dates>
</vuln>
<vuln vid="bcc8b21e-7122-11ef-bece-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.3.0</ge><lt>17.3.2</lt></range>
<range><ge>17.2.0</ge><lt>17.2.5</lt></range>
<range><ge>8.14.0</ge><lt>17.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/">
<p>Execute environment stop actions as the owner of the stop action job</p>
<p>Prevent code injection in Product Analytics funnels YAML</p>
<p>SSRF via Dependency Proxy</p>
<p>Denial of Service via sending a large glm_source parameter</p>
<p>CI_JOB_TOKEN can be used to obtain GitLab session token</p>
<p>Variables from settings are not overwritten by PEP if a template is included</p>
<p>Guests can disclose the full source code of projects using custom group-level templates</p>
<p>IdentitiesController allows linking of arbitrary unclaimed provider identities</p>
<p>Open redirect in repo/tree/:id endpoint can lead to account takeover through broken OAuth flow</p>
<p>Open redirect in release permanent links can lead to account takeover through broken OAuth flow</p>
<p>Guest user with Admin group member permission can edit custom role to gain other permissions</p>
<p>Exposure of protected and masked CI/CD variables by abusing on-demand DAST</p>
<p>Credentials disclosed when repository mirroring fails</p>
<p>Commit information visible through release atom endpoint for guest users</p>
<p>Dependency Proxy Credentials are Logged in Plaintext in graphql Logs</p>
<p>User Application can spoof the redirect url</p>
<p>Group Developers can view group runners information</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6678</cvename>
<cvename>CVE-2024-8640</cvename>
<cvename>CVE-2024-8635</cvename>
<cvename>CVE-2024-8124</cvename>
<cvename>CVE-2024-8641</cvename>
<cvename>CVE-2024-8311</cvename>
<cvename>CVE-2024-4660</cvename>
<cvename>CVE-2024-4283</cvename>
<cvename>CVE-2024-4612</cvename>
<cvename>CVE-2024-8631</cvename>
<cvename>CVE-2024-2743</cvename>
<cvename>CVE-2024-5435</cvename>
<cvename>CVE-2024-6389</cvename>
<cvename>CVE-2024-4472</cvename>
<cvename>CVE-2024-6446</cvename>
<cvename>CVE-2024-6685</cvename>
<url>https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/</url>
</references>
<dates>
<discovery>2024-09-11</discovery>
<entry>2024-09-12</entry>
</dates>
</vuln>
<vuln vid="d5026193-6fa2-11ef-99bc-1c697a616631">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20241112</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html">
<p>
A potential security vulnerability in the Running Average Power Limit
(RAPL) interface for some Intel Processors may allow information
disclosure. Intel has released firmware updates to mitigate this
potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html">
<p>
A potential security vulnerability in some Intel Processors may allow
denial of service. Intel has released firmware updates to mitigate
this potential vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-23984</cvename>
<cvename>CVE-2024-24968</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240910</url>
</references>
<dates>
<discovery>2024-09-10</discovery>
<entry>2024-09-10</entry>
<modified>2024-11-12</modified>
</dates>
</vuln>
<vuln vid="996518f3-6ef9-11ef-b01b-08002784c58d">
<topic>clamav -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>1.3.0,1</ge><lt>1.3.2,1</lt></range>
<range><ge>1.4.0,1</ge><lt>1.4.1,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><ge>1.0.0,1</ge><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ClamAV project reports:</p>
<blockquote cite="https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html">
<dl>
<dt>CVE-2024-20505</dt>
<dd>
A vulnerability in the PDF parsing module of Clam
AntiVirus (ClamAV) could allow an unauthenticated,
remote attacker to cause a denial of service (DoS)
condition on an affected device. The vulnerability is
due to an out of bounds read. An attacker could exploit
this vulnerability by submitting a crafted PDF file to
be scanned by ClamAV on an affected device. An exploit
could allow the attacker to terminate the scanning
process.
</dd>
<dt>CVE-2024-20506</dt>
<dd>
A vulnerability in the ClamD service module of Clam
AntiVirus (ClamAV) could allow an authenticated, local
attacker to corrupt critical system files. The
vulnerability is due to allowing the ClamD process to
write to its log file while privileged without checking
if the logfile has been replaced with a symbolic
link. An attacker could exploit this vulnerability if
they replace the ClamD log file with a symlink to a
critical system file and then find a way to restart the
ClamD process. An exploit could allow the attacker to
corrupt a critical system file by appending ClamD log
messages after restart.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-20505</cvename>
<cvename>CVE-2024-20506</cvename>
<url>https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html</url>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-09</entry>
</dates>
</vuln>
<vuln vid="8fbe81f7-6eb5-11ef-b7bd-00505632d232">
<topic>netatalk3 -- multiple WolfSSL vulnerabilities</topic>
<affects>
<package>
<name>netatalk3</name>
<range><lt>3.2.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netatalk release reports:</p>
<blockquote cite="https://github.com/Netatalk/netatalk/releases/tag/netatalk-3-2-8">
<p>WolfSSL 5.7.0 (included in netatalk) includes multiple security vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1544</cvename>
<cvename>CVE-2024-5288</cvename>
<cvename>CVE-2024-5991</cvename>
<cvename>CVE-2024-5814</cvename>
</references>
<dates>
<discovery>2024-09-08</discovery>
<entry>2024-09-09</entry>
</dates>
</vuln>
<vuln vid="80fbe184-2358-11ef-996e-40b034455553">
<topic>minio -- unintentional information disclosure</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2024.05.27.19.17.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Minio security advisory GHSA-95fr-cm4m-q5p9 reports:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9">
<p>when used with anonymous requests by sending a random
object name requests you can figure out if the object
exists or not on the server on a specific bucket and also
gain access to some amount of information.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-36107</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36107</url>
</references>
<dates>
<discovery>2024-05-28</discovery>
<entry>2024-06-05</entry>
</dates>
</vuln>
<vuln vid="144836e3-2358-11ef-996e-40b034455553">
<topic>minio -- privilege escalation via permissions inheritance</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2024.01.31.20.20.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Minio security advisory GHSA-xx8w-mq23-29g4 ports:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4">
<p>
When someone creates an access key, it inherits the
permissions of the parent key. Not only for s3:* actions,
but also admin:* actions. Which means unless somewhere
above in the access-key hierarchy, the admin rights are
denied, access keys will be able to simply override their
own s3 permissions to something more permissive.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24747</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24747</url>
</references>
<dates>
<discovery>2024-01-31</discovery>
<entry>2024-06-05</entry>
</dates>
</vuln>
<vuln vid="7ade3c38-6d1f-11ef-ae11-b42e991fc52e">
<topic>firefox -- Potential memory corruption and exploitable crash</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>128.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1901411">
<p>An error in the ECMA-262 specification relating to Async Generators
could have resulted in a type confusion, potentially leading to
memory corruption and an exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7652</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7652</url>
</references>
<dates>
<discovery>2024-09-06</discovery>
<entry>2024-09-07</entry>
</dates>
</vuln>
<vuln vid="3e44c35f-6cf4-11ef-b813-4ccc6adda413">
<topic>exiv2 -- Out-of-bounds read in AsfVideo::streamProperties</topic>
<affects>
<package>
<name>exiv2</name>
<range><ge>0.28.0,1</ge><lt>0.28.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin Backhouse reports:</p>
<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh">
<p>An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability
is in the parser for the ASF video format, which was a new feature in v0.28.0,
so Exiv2 versions before v0.28 are not affected. The out-of-bounds read is
triggered when Exiv2 is used to read the metadata of a crafted video file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-39695</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh</url>
</references>
<dates>
<discovery>2024-04-21</discovery>
<entry>2024-09-07</entry>
</dates>
</vuln>
<vuln vid="a5e13973-6c75-11ef-858b-23eeba13701a">
<topic>forgejo -- multiple vulnerabilities</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>8.0.3</lt></range>
</package>
<package>
<name>forgejo7</name>
<range><lt>7.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Replace v-html with v-text in search inputbox</li>
<li>Upgrade webpack to v5.94.0 as a precaution to mitigate
CVE-2024-43788, although we were not yet able to confirm that this
can be exploited in Forgejo.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2024-43788</cvename>
<url>https://codeberg.org/forgejo/forgejo/milestone/8231</url>
</references>
<dates>
<discovery>2024-09-03</discovery>
<entry>2024-09-06</entry>
</dates>
</vuln>
<vuln vid="943f8915-6c5d-11ef-810a-f8b46a88f42c">
<topic>binutils -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>binutils</name>
<range><lt>2.43,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>alster@vinterdalen.se reports PR/281070:</p>
<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281070">
<p>A new version of devel/binutils has been released fixing
CVE-2023-1972, CVE-2023-25585, CVE-2023-25586, and
CVE-2023-25588.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1972</cvename>
<cvename>CVE-2023-25585</cvename>
<cvename>CVE-2023-25586</cvename>
<cvename>CVE-2023-25588</cvename>
</references>
<dates>
<discovery>2024-08-25</discovery>
<entry>2024-09-06</entry>
</dates>
</vuln>
<vuln vid="f5d0cfe7-6ba6-11ef-858b-23eeba13701a">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.22.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>Replace v-html with v-text in search inputbox</li>
<li>Fix nuget/conan/container packages upload bugs</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.22.2</url>
</references>
<dates>
<discovery>2024-09-03</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="66907dab-6bb2-11ef-b813-4ccc6adda413">
<topic>qt5-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.17.p3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 6 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-5496: Use after free in Media Session</li>
<li>CVE-2024-5846: Use after free in PDFium</li>
<li>CVE-2024-6291: Use after free in Swiftshader</li>
<li>CVE-2024-6989: Use after free in Loader</li>
<li>CVE-2024-6996: Race in Frames</li>
<li>CVE-2024-7536: Use after free in WebAudio</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5496</cvename>
<cvename>CVE-2024-5846</cvename>
<cvename>CVE-2024-6291</cvename>
<cvename>CVE-2024-6989</cvename>
<cvename>CVE-2024-6996</cvename>
<cvename>CVE-2024-7536</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-08-05</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="a3a1caf5-6ba1-11ef-b9e8-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>130.0_1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1908496">
<p>This entry contains 8 vulnerabilities:</p>
<ul>
<li>CVE-2024-8381: A potentially exploitable type
confusion could be triggered when looking up a property
name on an object being used as the `with` environment.</li>
<li>CVE-2024-8382: Internal browser event interfaces were
exposed to web content when privileged EventHandler listener
callbacks ran for those events. Web content that tried to
use those interfaces would not be able to use them with
elevated privileges, but their presence would indicate
certain browser features had been used, such as when a user
opened the Dev Tools console.</li>
<li>CVE-2024-8383: Firefox normally asks for confirmation
before asking the operating system to find an application to
handle a scheme that the browser does not support. It did not
ask before doing so for the Usenet-related schemes news: and
snews:. Since most operating systems don't have a
trusted newsreader installed by default, an unscrupulous
program that the user downloaded could register itself as a
handler. The website that served the application download
could then launch that application at will.</li>
<li>CVE-2024-8384: The JavaScript garbage collector could
mis-color cross-compartment objects if OOM conditions were
detected at the right point between two passes. This could have
led to memory corruption.</li>
<li>CVE-2024-8385: A difference in the handling of
StructFields and ArrayTypes in WASM could be used to trigger
an exploitable type confusion vulnerability.</li>
<li>CVE-2024-8386: If a site had been granted the permission
to open popup windows, it could cause Select elements to
appear on top of another site to perform a spoofing attack.</li>
<li>CVE-2024-8387: Memory safety bugs present in Firefox 129,
Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs
showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run
arbitrary code.</li>
<li>CVE-2024-8389: Memory safety bugs present in Firefox 129.
Some of these bugs showed evidence of memory corruption and we
presume that with enough effort some of these could have been
exploited to run arbitrary code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8381</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8381</url>
<cvename>CVE-2024-8382</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8382</url>
<cvename>CVE-2024-8383</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8383</url>
<cvename>CVE-2024-8384</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8384</url>
<cvename>CVE-2024-8385</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8385</url>
<cvename>CVE-2024-8386</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8386</url>
<cvename>CVE-2024-8387</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8387</url>
<cvename>CVE-2024-8389</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-8389</url>
</references>
<dates>
<discovery>2024-09-03</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="7e079ce2-6b51-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- umtx Kernel panic or Use-After-Free</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
<range><ge>13.3</ge><lt>13.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY
sub-request of UMTX_OP_SHM can lead to decreasing the reference
count of the object representing the mapping too many times, causing
it to be freed too early.</p>
<h1>Impact:</h1>
<p>A malicious code exercizing the UMTX_SHM_DESTROY sub-request
in parallel can panic the kernel or enable further Use-After-Free
attacks, potentially including code execution or Capsicum sandbox
escape.</p>
</body>
</description>
<references>
<cvename>CVE-2024-43102</cvename>
<freebsdsa>SA-24:14.umtx</freebsdsa>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="4edaa9f4-6b51-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- bhyve(8) privileged guest escape via USB controller</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
<range><ge>13.3</ge><lt>13.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>bhyve can be configured to emulate devices on a virtual USB
controller (XHCI), such as USB tablet devices. An insufficient
boundary validation in the USB code could lead to an out-of-bounds
write on the heap, with data controlled by the caller.</p>
<h1>Impact:</h1>
<p>A malicious, privileged software running in a guest VM can
exploit the vulnerability to achieve code execution on the host in
the bhyve userspace process, which typically runs as root. Note
that bhyve runs in a Capsicum sandbox, so malicious code is constrained
by the capabilities available to the bhyve process.</p>
</body>
</description>
<references>
<cvename>CVE-2024-32668</cvename>
<freebsdsa>SA-24:12.bhyve</freebsdsa>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="9bd5e47b-6b50-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Multiple issues in ctl(4) CAM Target Layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
<range><ge>13.3</ge><lt>13.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Several vulnerabilities were found in the ctl subsystem.</p>
<p>The function ctl_write_buffer incorrectly set a flag which resulted
in a kernel Use-After-Free when a command finished processing
(CVE-2024-45063). The ctl_write_buffer and ctl_read_buffer functions
allocated memory to be returned to userspace, without initializing
it (CVE-2024-8178). The ctl_report_supported_opcodes function did
not sufficiently validate a field provided by userspace, allowing
an arbitrary write to a limited amount of kernel help memory
(CVE-2024-42416). The ctl_request_sense function could expose up
to three bytes of the kernel heap to userspace (CVE-2024-43110).</p>
<p>Guest virtual machines in the bhyve hypervisor can send SCSI commands
to the corresponding kernel driver via the virtio_scsi interface.
This provides guests with direct access to the vulnerabilities
covered by this advisory.</p>
<p>The CAM Target Layer iSCSI target daemon ctld(8) accepts incoming
iSCSI connections, performs authentication and passes connections
to the kernel ctl(4) target layer.</p>
<h1>Impact:</h1>
<p>Malicious software running in a guest VM that exposes virtio_scsi
can exploit the vulnerabilities to achieve code execution on the
host in the bhyve userspace process, which typically runs as root.
Note that bhyve runs in a Capsicum sandbox, so malicious code is
constrained by the capabilities available to the bhyve process.</p>
<p>A malicious iSCSI initiator could achieve remote code execution on
the iSCSI target host.</p>
</body>
</description>
<references>
<cvename>CVE-2024-8178</cvename>
<cvename>CVE-2024-42416</cvename>
<cvename>CVE-2024-43110</cvename>
<freebsdsa>SA-24:11.ctl</freebsdsa>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="56d76414-6b50-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- bhyve(8) privileged guest escape via TPM device passthrough</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>bhyve can be configured to provide access to the host's TPM
device, where it passes the communication through an emulated device
provided to the guest. This may be performed on the command-line
by starting bhyve with the `-l tpm,passthru,/dev/tpmX` parameters.</p>
<p>The MMIO handler for the emulated device did not validate the offset
and size of the memory access correctly, allowing guests to read
and write memory contents outside of the memory area effectively
allocated.</p>
<h1>Impact:</h1>
<p>Malicious software running in a guest VM can exploit the buffer
overflow to achieve code execution on the host in the bhyve userspace
process, which typically runs as root. Note that bhyve runs in a
Capsicum sandbox, so malicious code is constrained by the capabilities
available to the bhyve process.</p>
</body>
</description>
<references>
<cvename>CVE-2024-41928</cvename>
<freebsdsa>SA-24:10.bhyve</freebsdsa>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="8d1f9adf-6b4f-11ef-9a62-002590c1f29c">
<topic>FreeBSD -- Multiple vulnerabilities in libnv</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
<range><ge>13.3</ge><lt>13.3_6</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
<range><ge>13.3</ge><lt>13.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>CVE-2024-45287 is a vulnerability that affects both the kernel
and userland. A malicious value of size in a structure of packed
libnv can cause an integer overflow, leading to the allocation of
a smaller buffer than required for the parsed data.</p>
<p>CVE-2024-45288 is a vulnerability that affects both the kernel and
userland. A missing null-termination character in the last element
of an nvlist array string can lead to writing outside the allocated
buffer.</p>
<h1>Impact:</h1>
<p>It is possible for an attacker to overwrite portions of memory
(in userland or the kernel) as the allocated buffer might be smaller
than the data received from a malicious process. This vulnerability
could result in privilege escalation or cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2024-45287</cvename>
<cvename>CVE-2024-45288</cvename>
<freebsdsa>SA-24:09.libnv</freebsdsa>
</references>
<dates>
<discovery>2024-09-04</discovery>
<entry>2024-09-05</entry>
</dates>
</vuln>
<vuln vid="21f505f4-6a1c-11ef-b611-84a93843eb75">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.15,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.7</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.3</lt></range>
</package>
<package>
<name>openssl33</name>
<range><lt>3.3.2</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.15</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_4</lt></range>
<range><ge>14.0</ge><lt>14.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://openssl-library.org/news/secadv/20240903.txt">
<p>Possible denial of service in X.509 name checks [Moderate severity]
Applications performing certificate name checks (e.g., TLS clients
checking server certificates) may attempt to read an invalid
memory address resulting in abnormal termination of the application
process.</p>
<p>SSL_select_next_proto buffer overread [Low severity]
Calling the OpenSSL API function SSL_select_next_proto with an empty
supported client protocols buffer may cause a crash or memory
contents to be sent to the peer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5535</cvename>
<cvename>CVE-2024-6119</cvename>
<url>https://openssl-library.org/news/secadv/20240627.txt</url>
<url>https://openssl-library.org/news/secadv/20240903.txt</url>
<freebsdsa>SA-24:13.openssl</freebsdsa>
</references>
<dates>
<discovery>2024-09-03</discovery>
<entry>2024-09-03</entry>
<modified>2024-09-05</modified>
</dates>
</vuln>
<vuln vid="26125e09-69ca-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>128.0.6613.119</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>128.0.6613.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[357391257] High CVE-2024-8362: Use after free in WebAudio. Reported by Cassidy Kim(@cassidy6564) on 2024-08-05</li>
<li>[358485426] High CVE-2024-7970: Out of bounds write in V8. Reported by Cassidy Kim(@cassidy6564) on 2024-08-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-8362</cvename>
<cvename>CVE-2024-7970</cvename>
<url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-09-02</discovery>
<entry>2024-09-03</entry>
</dates>
</vuln>
<vuln vid="eb437e17-66a1-11ef-ac08-75165d18d8d2">
<topic>forgejo -- The scope of application tokens was not verified when writing containers or Conan packages.</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The forgejo team reports:</p>
<blockquote cite="https://codeberg.org/forgejo/forgejo/milestone/7728">
<p>The scope of application tokens was not verified when writing
containers or Conan packages. This is of no consequence when the
user associated with the application token does not have write
access to packages. If the user has write access to packages, such
a token can be used to write containers and Conan packages. An
application token that was used to write containers or Conan
packages without the package:write scope will now fail with an
unauthorized error. It must be re-created to include the
package:write scope.</p>
</blockquote>
</body>
</description>
<references>
<url>https://codeberg.org/forgejo/forgejo/pulls/5149</url>
</references>
<dates>
<discovery>2024-08-26</discovery>
<entry>2024-08-30</entry>
</dates>
</vuln>
<vuln vid="7e9cc7fd-6b3e-46c5-ad6d-409d90d41bbf">
<topic>RabbitMQ-C -- auth credentials visible in commandline tool options</topic>
<affects>
<package>
<name>rabbitmq-c</name>
<range><lt>0.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>hadmut reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-35789">
<p>This C library includes 2 command-line tools that can take
credentials as command-line options. The credentials are exposed
as plain-text in the process list. This could allow an attacker
with access to the process list to see the credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-35789</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-35789</url>
</references>
<dates>
<discovery>2019-09-19</discovery>
<entry>2024-08-30</entry>
</dates>
</vuln>
<vuln vid="5e4d7172-66b8-11ef-b104-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>129.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1909241">
<ul>
<li>Firefox adds web-compatibility shims in place of some
tracking scripts blocked by Enhanced Tracking Protection.
On a site protected by Content Security Policy in
"strict-dynamic" mode, an attacker able to
inject an HTML element could have used a DOM
Clobbering attack on some of the shims and achieved XSS,
bypassing the CSP strict-dynamic protection.</li>
<li>Form validation popups could capture escape key presses.
Therefore, spamming form validation messages could be used
to prevent users from exiting full-screen mode.</li>
<li>When almost out-of-memory an elliptic curve key which
was never allocated could have been freed again. </li>
<li>It was possible to move the cursor using pointerlock
from an iframe. This allowed moving the cursor outside
of the viewport and the Firefox window.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7524</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7524</url>
<cvename>CVE-2024-6610</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-6610</url>
<cvename>CVE-2024-6609</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-6609</url>
<cvename>CVE-2024-6608</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-6608</url>
</references>
<dates>
<discovery>2024-08-06</discovery>
<entry>2024-08-30</entry>
</dates>
</vuln>
<vuln vid="6f2545bb-65e8-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>128.0.6613.113</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>128.0.6613.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[351865302] High CVE-2024-7969: Type Confusion in V8. Reported by CFF of Topsec Alpha Team on 2024-07-09</li>
<li>[360265320] High CVE-2024-8193: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-16</li>
<li>[360533914] High CVE-2024-8194: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-08-18</li>
<li>[360758697] High CVE-2024-8198: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7969</cvename>
<cvename>CVE-2024-8193</cvename>
<cvename>CVE-2024-8194</cvename>
<cvename>CVE-2024-8198</cvename>
<url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html</url>
</references>
<dates>
<discovery>2024-08-28</discovery>
<entry>2024-08-29</entry>
</dates>
</vuln>
<vuln vid="46419e8c-65d9-11ef-ac06-b0416f0c4c67">
<topic>Configobj -- Regular Expression Denial of Service attack</topic>
<affects>
<package>
<name>py38-configobj</name>
<name>py39-configobj</name>
<name>py310-configobj</name>
<name>py311-configobj</name>
<range><le>5.0.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>report@snyk.io reports:</p>
<blockquote cite="https://github.com/DiffSK/configobj/issues/232">
<p>All versions of the package configobj are vulnerable to Regular
Expression Denial of Service (ReDoS) via the validate function,
using (.+?)\((.*)\).**Note:** This is only exploitable in the case
of a developer putting the offending value in a server side
configuration file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-26112</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-26112</url>
</references>
<dates>
<discovery>2023-04-03</discovery>
<entry>2024-08-29</entry>
</dates>
</vuln>
<vuln vid="49ef501c-62b6-11ef-bba5-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.3.0</ge><lt>17.3.1</lt></range>
<range><ge>17.2.0</ge><lt>17.2.4</lt></range>
<range><ge>8.2.0</ge><lt>17.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/">
<p>The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases</p>
<p>Denial of Service by importing maliciously crafted GitHub repository</p>
<p>Prompt injection in "Resolve Vulnerabilty" results in arbitrary command execution in victim's pipeline</p>
<p>An unauthorized user can perform certain actions through GraphQL after a group owner enables IP restrictions</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6502</cvename>
<cvename>CVE-2024-8041</cvename>
<cvename>CVE-2024-7110</cvename>
<cvename>CVE-2024-3127</cvename>
<url>https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/</url>
</references>
<dates>
<discovery>2024-08-21</discovery>
<entry>2024-08-25</entry>
</dates>
</vuln>
<vuln vid="7e6e932f-617b-11ef-8a7d-b42e991fc52e">
<topic>firefox -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>127,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1414937">
<ul>
<li>CVE-2024-5697: A website was able to detect when a
user took a screenshot of a page using the built-in
Screenshot functionality in Firefox.</li>
<li>CVE-2024-5698: By manipulating the fullscreen
feature while opening a data-list, an attacker could
have overlaid a text box over the address bar. This
could have led to user confusion and possible spoofing
attacks.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5697</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-5697</url>
<cvename>CVE-2024-5698</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-5698</url>
</references>
<dates>
<discovery>2024-06-11</discovery>
<entry>2024-08-23</entry>
</dates>
</vuln>
<vuln vid="6e8b9c75-6179-11ef-8a7d-b42e991fc52e">
<topic>mcpp -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>mcpp</name>
<range><lt>2.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00032.html">
<p>MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function
in support.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-14274</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-14274</url>
</references>
<dates>
<discovery>2019-07-26</discovery>
<entry>2024-08-23</entry>
</dates>
</vuln>
<vuln vid="f2b1da2e-6178-11ef-8a7d-b42e991fc52e">
<topic>md4c -- DoS attack</topic>
<affects>
<package>
<name>md4c</name>
<range><lt>0.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/mity/md4c/commit/4fc808d8fe8d8904f8525bb4231d854f45e23a19">
<p>md_analyze_line in md4c.c in md4c 0.4.7 allows attackers
to trigger use of uninitialized memory, and cause a denial
of service via a malformed Markdown document.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30027</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-30027</url>
</references>
<dates>
<discovery>2021-04-29</discovery>
<entry>2024-08-23</entry>
</dates>
</vuln>
<vuln vid="b339992e-6059-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>128.0.6613.84</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>128.0.6613.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html">
<p>This update includes 38 security fixes:</p>
<ul>
<li>[358296941] High CVE-2024-7964: Use after free in Passwords. Reported by Anonymous on 2024-08-08</li>
<li>[356196918] High CVE-2024-7965: Inappropriate implementation in V8. Reported by TheDog on 2024-07-30</li>
<li>[355465305] High CVE-2024-7966: Out of bounds memory access in Skia. Reported by Renan Rios (@HyHy100) on 2024-07-25</li>
<li>[355731798] High CVE-2024-7967: Heap buffer overflow in Fonts. Reported by Tashita Software Security on 2024-07-27</li>
<li>[349253666] High CVE-2024-7968: Use after free in Autofill. Reported by Han Zheng (HexHive) on 2024-06-25</li>
<li>[351865302] High CVE-2024-7969: Type Confusion in V8. Reported by CFF of Topsec Alpha Team on 2024-07-09</li>
<li>[360700873] High CVE-2024-7971: Type confusion in V8. Reported by Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC) on 2024-08-19</li>
<li>[345960102] Medium CVE-2024-7972: Inappropriate implementation in V8. Reported by Simon Gerst (intrigus-lgtm) on 2024-06-10</li>
<li>[345518608] Medium CVE-2024-7973: Heap buffer overflow in PDFium. Reported by soiax on 2024-06-06</li>
<li>[339141099] Medium CVE-2024-7974: Insufficient data validation in V8 API. Reported by bowu(@gocrashed) on 2024-05-07</li>
<li>[347588491] Medium CVE-2024-7975: Inappropriate implementation in Permissions. Reported by Thomas Orlita on 2024-06-16</li>
<li>[339654392] Medium CVE-2024-7976: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-10</li>
<li>[324770940] Medium CVE-2024-7977: Insufficient data validation in Installer. Reported by Kim Dong-uk (@justlikebono) on 2024-02-11</li>
<li>[40060358] Medium CVE-2024-7978: Insufficient policy enforcement in Data Transfer. Reported by NDevTK on 2022-07-21</li>
<li>[356064205] Medium CVE-2024-7979: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-29</li>
<li>[356328460] Medium CVE-2024-7980: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-30</li>
<li>[40067456] Low CVE-2024-7981: Inappropriate implementation in Views. Reported by Thomas Orlita on 2023-07-14</li>
<li>[350256139] Low CVE-2024-8033: Inappropriate implementation in WebApp Installs. Reported by Lijo A.T on 2024-06-30</li>
<li>[353858776] Low CVE-2024-8034: Inappropriate implementation in Custom Tabs. Reported by Bharat (mrnoob) on 2024-07-18</li>
<li>[40059470] Low CVE-2024-8035: Inappropriate implementation in Extensions. Reported by Microsoft on 2022-04-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7964</cvename>
<cvename>CVE-2024-7965</cvename>
<cvename>CVE-2024-7966</cvename>
<cvename>CVE-2024-7967</cvename>
<cvename>CVE-2024-7968</cvename>
<cvename>CVE-2024-7969</cvename>
<cvename>CVE-2024-7971</cvename>
<cvename>CVE-2024-7972</cvename>
<cvename>CVE-2024-7973</cvename>
<cvename>CVE-2024-7974</cvename>
<cvename>CVE-2024-7975</cvename>
<cvename>CVE-2024-7976</cvename>
<cvename>CVE-2024-7977</cvename>
<cvename>CVE-2024-7978</cvename>
<cvename>CVE-2024-7979</cvename>
<cvename>CVE-2024-7980</cvename>
<cvename>CVE-2024-7981</cvename>
<cvename>CVE-2024-8033</cvename>
<cvename>CVE-2024-8034</cvename>
<cvename>CVE-2024-8035</cvename>
<url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2024-08-21</discovery>
<entry>2024-08-22</entry>
</dates>
</vuln>
<vuln vid="addc71b8-6024-11ef-86a1-8c164567ca3c">
<topic>nginx -- Vulnerability in the ngx_http_mp4_module</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><ge>1.5.13,3</ge><lt>1.27.1,3</lt></range>
</package>
<package>
<name>nginx</name>
<range><ge>1.6.0,3</ge><lt>1.26.2,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx development team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>This update fixes the buffer overread vulnerability in the
ngx_http_mp4_module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7347</cvename>
</references>
<dates>
<discovery>2024-08-14</discovery>
<entry>2024-08-22</entry>
</dates>
</vuln>
<vuln vid="04c9c3f8-5ed3-11ef-8262-b0416f0c4c67">
<topic>Jinja2 -- Vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter</topic>
<affects>
<package>
<name>py38-Jinja2</name>
<name>py39-Jinja2</name>
<name>py310-Jinja2</name>
<name>py311-Jinja2</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb">
<p>Jinja is an extensible templating engine. The `xmlattr` filter in
affected versions of Jinja accepts keys containing non-attribute
characters. XML/HTML attributes cannot contain spaces, `/`, `>`,
or `=`, as each would then be interpreted as starting a separate
attribute. If an application accepts keys (as opposed to only
values) as user input, and renders these in pages that other users
see as well, an attacker could use this to inject other attributes
and perform XSS. The fix for CVE-2024-22195 only addressed spaces
but not other characters. Accepting keys as user input is now
explicitly considered an unintended use case of the `xmlattr` filter,
and code that does so without otherwise validating the input should
be flagged as insecure, regardless of Jinja version. Accepting
_values_ as user input continues to be safe. This vulnerability
is fixed in 3.1.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-34064</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-34064</url>
</references>
<dates>
<discovery>2024-05-06</discovery>
<entry>2024-08-20</entry>
</dates>
</vuln>
<vuln vid="d0ac9a17-5e68-11ef-b8cc-b42e991fc52e">
<topic>mozilla products -- spoofing attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>129,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1875354">
<p>Select options could obscure the fullscreen notification dialog.
This could be used by a malicious site to perform a spoofing attack.
This vulnerability affects Firefox < 129, Firefox ESR < 128.1,
and Thunderbird < 128.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7518</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7518</url>
</references>
<dates>
<discovery>2024-08-06</discovery>
<entry>2024-08-19</entry>
</dates>
</vuln>
<vuln vid="e61af8f4-455d-4f99-8d81-fbb004929dab">
<topic>electron31 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron31</name>
<range><lt>31.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v31.4.0">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-6989.</li>
<li>Security: backported fix for CVE-2024-6991.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6989</cvename>
<url>https://github.com/advisories/GHSA-32j6-235r-7fmm</url>
<cvename>CVE-2024-6991</cvename>
<url>https://github.com/advisories/GHSA-3v8g-fm64-g4mc</url>
</references>
<dates>
<discovery>2024-08-15</discovery>
<entry>2024-08-18</entry>
</dates>
</vuln>
<vuln vid="ac025402-4cbc-4177-bd99-c20c03a07f23">
<topic>electron{29,30} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.6</lt></range>
</package>
<package>
<name>electron30</name>
<range><lt>30.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.6">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-6776.</li>
<li>Security: backported fix for CVE-2024-6778.</li>
<li>Security: backported fix for CVE-2024-6777.</li>
<li>Security: backported fix for CVE-2024-6773.</li>
<li>Security: backported fix for CVE-2024-6774.</li>
<li>Security: backported fix for CVE-2024-6772.</li>
<li>Security: backported fix for CVE-2024-6775.</li>
<li>Security: backported fix for CVE-2024-6779.</li>
<li>Security: backported fix for CVE-2024-6989.</li>
<li>Security: backported fix for CVE-2024-6991.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6776</cvename>
<url>https://github.com/advisories/GHSA-7hjm-9cg2-rcg6</url>
<cvename>CVE-2024-6778</cvename>
<url>https://github.com/advisories/GHSA-9m98-937v-r97x</url>
<cvename>CVE-2024-6777</cvename>
<url>https://github.com/advisories/GHSA-w2v8-c457-cjvf</url>
<cvename>CVE-2024-6773</cvename>
<url>https://github.com/advisories/GHSA-7gj8-545r-5295</url>
<cvename>CVE-2024-6774</cvename>
<url>https://github.com/advisories/GHSA-cgm7-mqr6-f7vg</url>
<cvename>CVE-2024-6772</cvename>
<url>https://github.com/advisories/GHSA-cc8c-62x7-qwjr</url>
<cvename>CVE-2024-6775</cvename>
<url>https://github.com/advisories/GHSA-mxwm-jm3p-mh5m</url>
<cvename>CVE-2024-6779</cvename>
<url>https://github.com/advisories/GHSA-v4v9-v4wf-9c86</url>
<cvename>CVE-2024-6989</cvename>
<url>https://github.com/advisories/GHSA-32j6-235r-7fmm</url>
<cvename>CVE-2024-6991</cvename>
<url>https://github.com/advisories/GHSA-3v8g-fm64-g4mc</url>
</references>
<dates>
<discovery>2024-08-16</discovery>
<entry>2024-08-18</entry>
</dates>
</vuln>
<vuln vid="6a6ad6cb-5c6c-11ef-b456-001e676bf734">
<topic>Dovecot -- DoS</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.21.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot reports:</p>
<blockquote cite="https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/2CSVL56LFPAXVLWMGXEIWZL736PSYHP5/">
<p>A DoS is possible with a large number of address headers or abnormally large email headers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-23184</cvename>
<cvename>CVE-2024-23185</cvename>
<url>https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/2CSVL56LFPAXVLWMGXEIWZL736PSYHP5/</url>
</references>
<dates>
<discovery>2024-08-14</discovery>
<entry>2024-08-16</entry>
</dates>
</vuln>
<vuln vid="9d8e9952-5a42-11ef-a219-1c697a616631">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20240813</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html">
<p>
A potential security vulnerability in SMI Transfer monitor (STM) may
allow escalation of privilege. Intel has released microcode updates
to mitigate this potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html">
<p>
A potential security vulnerability in some 3rd Generation Intel Xeon
Scalable Processors may allow denial of service. Intel has released
microcode updates to mitigate this potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html">
<p>
A potential security vulnerability in some 3rd, 4th, and 5th
Generation Intel Xeon Processors may allow escalation of privilege.
Intel has released firmware updates to mitigate this potential
vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html">
<p>
A potential security vulnerability in the Intel Core Ultra Processor
stream cache mechanism may allow escalation of privilege. Intel has
released microcode updates to mitigate this potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html">
<p>
A potential security vulnerability in some Intel Processor stream
cache mechanisms may allow escalation of privilege. Intel has
released microcode updates to mitigate this potential vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24853</cvename>
<cvename>CVE-2024-25939</cvename>
<cvename>CVE-2024-24980</cvename>
<cvename>CVE-2023-42667</cvename>
<cvename>CVE-2023-49141</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240813</url>
</references>
<dates>
<discovery>2024-08-13</discovery>
<entry>2024-08-14</entry>
</dates>
</vuln>
<vuln vid="5d7939f6-5989-11ef-9793-b42e991fc52e">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>129.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1905691">
<ul>
<li>
CVE-2024-7531: Calling `PK11_Encrypt()` in NSS using
CKM_CHACHA20 and the same buffer for input and output can
result in plaintext on an Intel Sandy Bridge processor. In
Firefox this only affects the QUIC header protection
feature when the connection is using the ChaCha20-Poly1305
cipher suite. The most likely outcome is connection
failure, but if the connection persists despite the high
packet loss it could be possible for a network observer to
identify packets as coming from the same source despite a
network path change. This vulnerability affects Firefox
< 129, Firefox ESR < 115.14, and Firefox ESR <
128.1.
</li>
<li>
CVE-2024-7529: The date picker could partially obscure
security prompts. This could be used by a malicious site
to trick a user into granting permissions. This
vulnerability affects Firefox < 129, Firefox ESR <
115.14, Firefox ESR < 128.1, Thunderbird < 128.1,
and Thunderbird < 115.14.
</li>
<li>
CVE-2024-7525: It was possible for a web extension with
minimal permissions to create a `StreamFilter` which could
be used to read and modify the response body of requests
on any site. This vulnerability affects Firefox < 129,
Firefox ESR < 115.14, Firefox ESR < 128.1,
Thunderbird < 128.1, and Thunderbird < 115.14.
</li>
<li>
CVE-2024-7522: Editor code failed to check an attribute
value. This could have led to an out-of-bounds read. This
vulnerability affects Firefox < 129, Firefox ESR <
115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and
Thunderbird < 115.14.
</li>
<li>
CVE-2024-7520: A type confusion bug in WebAssembly could
be leveraged by an attacker to potentially achieve code
execution. This vulnerability affects Firefox < 129,
Firefox ESR < 128.1, and Thunderbird < 128.1.
</li>
<li>
CVE-2024-7521: Incomplete WebAssembly exception handing
could have led to a use-after-free. This vulnerability
affects Firefox < 129, Firefox ESR < 115.14,
Firefox ESR < 128.1, Thunderbird < 128.1, and
Thunderbird < 115.14.
</li>
<li>
CVE-2024-7530: Incorrect garbage collection interaction
could have led to a use-after-free. This vulnerability
affects Firefox < 129.
</li>
<li>
CVE-2024-7528: Incorrect garbage collection interaction in
IndexedDB could have led to a use-after-free. This
vulnerability affects Firefox < 129,
Firefox ESR < 128.1, and Thunderbird < 128.1.
</li>
<li>
CVE-2024-7527: Unexpected marking work at the start of
sweeping could have led to a use-after-free. This
vulnerability affects Firefox < 129,
Firefox ESR < 115.14, Firefox ESR < 128.1,
Thunderbird < 128.1, and Thunderbird < 115.14.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7531</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7531</url>
<cvename>CVE-2024-7529</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7529</url>
<cvename>CVE-2024-7525</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7525</url>
<cvename>CVE-2024-7522</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7522</url>
<cvename>CVE-2024-7520</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7520</url>
<cvename>CVE-2024-7521</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7521</url>
<cvename>CVE-2024-7530</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7530</url>
<cvename>CVE-2024-7528</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7528</url>
<cvename>CVE-2024-7527</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-7527</url>
</references>
<dates>
<discovery>2024-08-06</discovery>
<entry>2024-08-13</entry>
</dates>
</vuln>
<vuln vid="587ed8ac-5957-11ef-854a-001e676bf734">
<topic>OpenHAB CometVisu addon -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openhab-addons</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenHAB reports:</p>
<blockquote cite="https://github.com/openhab/openhab-distro/releases/tag/4.2.1">
<p>This patch release addresses the following security advisories:</p>
<ul>
<li>SSRF/XSS (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3">GHSA-v7gr-mqpj-wwh3</a></li>
<li>Sensitive information disclosure (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj">GHSA-3g4c-hjhr-73rj</a></li>
<li>RCE through path traversal (CometVisu) - <a href="https://github.com/openhab/openhab-webui/sec urity/advisories/GHSA-f729-58x4-gqgf">GHSA-f729-58x4-gqgf</a></li>
<li>Path traversal (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w">GHSA-pcwp-26pw-j98w</a></li>
</ul>
<p>
All of these are related to the CometVisu add-on for openHAB - if you are a user of CometVisu, we strongly recommend to upgrade your system to openHAB 4.2.1 in order to fix those vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/openhab/openhab-distro/releases/tag/4.2.1</url>
<url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3</url>
<url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj</url>
<url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf</url>
<url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w</url>
</references>
<dates>
<discovery>2024-08-09</discovery>
<entry>2024-08-09</entry>
</dates>
</vuln>
<vuln vid="d2723b0f-58d9-11ef-b611-84a93843eb75">
<topic>Vaultwarden -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>vaultwarden</name>
<range><lt>1.32.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0">
<p>This release has several CVE Reports fixed and we recommend
everybody to update to the latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-39924</cvename>
<cvename>CVE-2024-39925</cvename>
<cvename>CVE-2024-39926</cvename>
<url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0</url>
</references>
<dates>
<discovery>2024-08-11</discovery>
<entry>2024-08-12</entry>
</dates>
</vuln>
<vuln vid="7d631146-5769-11ef-b618-1c697a616631">
<topic>AMD CPUs -- Guest Memory Vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-amd</name>
<range><lt>20240810</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>AMD reports:</p>
<blockquote cite="https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html">
<p>
Researchers from IOActive have reported that it may be possible for
an attacker with ring 0 access to modify the configuration of System
Management Mode (SMM) even when SMM Lock is enabled. Improper
validation in a model specific register (MSR) could allow a malicious
program with ring0 access to modify SMM configuration while SMI lock
is enabled, potentially leading to arbitrary code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-31315</cvename>
<url>https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html</url>
</references>
<dates>
<discovery>2024-08-09</discovery>
<entry>2024-08-10</entry>
</dates>
</vuln>
<vuln vid="5776cc4f-5717-11ef-b611-84a93843eb75">
<topic>Roundcube -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.6.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8">
<p>XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]</p>
<p>XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]</p>
<p>information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-42009</cvename>
<cvename>CVE-2024-42008</cvename>
<cvename>CVE-2024-42010</cvename>
<url>https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8</url>
</references>
<dates>
<discovery>2024-08-04</discovery>
<entry>2024-08-10</entry>
</dates>
</vuln>
<vuln vid="aa1c7af9-570e-11ef-a43e-b42e991fc52e">
<topic>mozilla firefox -- protocol information guessing</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>127.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@mozilla.org reports:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1883693">
<p>By monitoring the time certain operations take, an attacker could
have guessed which external protocol handlers were functional on a
user's system. This vulnerability affects Firefox < 127,
Firefox ESR < 115.12, and Thunderbird < 115.12.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5690</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-5690</url>
</references>
<dates>
<discovery>2024-06-11</discovery>
<entry>2024-08-10</entry>
</dates>
</vuln>
<vuln vid="8c342a6c-563f-11ef-a77e-901b0e9408dc">
<topic>soft-serve -- Remote code execution vulnerability</topic>
<affects>
<package>
<name>soft-serve</name>
<range><lt>0.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>soft-serve team reports:</p>
<blockquote cite="https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f">
<p>Arbitrary code execution by crafting git ssh requests</p>
<p>It is possible for a user who can commit files to a
repository hosted by Soft Serve to execute arbitrary code
via environment manipulation and Git.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-41956</cvename>
<url>https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f</url>
</references>
<dates>
<discovery>2024-08-01</discovery>
<entry>2024-08-09</entry>
</dates>
</vuln>
<vuln vid="48e6d514-5568-11ef-af48-6cc21735f730">
<topic>PostgreSQL -- Prevent unauthorized code execution during pg_dump</topic>
<affects>
<package>
<name>postgresql12-client</name>
<range><lt>12.20</lt></range>
</package>
<package>
<name>postgresql13-client</name>
<range><lt>13.16</lt></range>
</package>
<package>
<name>postgresql14-client</name>
<range><lt>14.13</lt></range>
</package>
<package>
<name>postgresql15-client</name>
<range><lt>15.8</lt></range>
</package>
<package>
<name>postgresql16-client</name>
<range><lt>16.4</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.20</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.16</lt></range>
</package>
<package>
<name>postgresql14-server</name>
<range><lt>14.13</lt></range>
</package>
<package>
<name>postgresql15-server</name>
<range><lt>15.8</lt></range>
</package>
<package>
<name>postgresql16-server</name>
<range><lt>16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-7348/">
<p>
An attacker able to create and drop non-temporary objects could
inject SQL code that would be executed by a concurrent pg_dump
session with the privileges of the role running pg_dump
(which is often a superuser). The attack involves replacing a
sequence or similar object with a view or foreign table that will
execute malicious code. To prevent this, introduce a new server
parameter restrict_nonsystem_relation_kind that can disable
expansion of non-builtin views as well as access to foreign
tables, and teach pg_dump to set it when available. Note that the
attack is prevented only if both pg_dump and the server it is
dumping from are new enough to have this fix.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7348</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-7348/</url>
</references>
<dates>
<discovery>2024-08-08</discovery>
<entry>2024-08-08</entry>
</dates>
</vuln>
<vuln vid="db8fa362-0ccb-4aa8-9220-72b7763e9a4a">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.471</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.462.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-08-07/">
<h1>Description</h1>
<h5>(Critical) SECURITY-3430 / CVE-2024-43044</h5>
<p>Arbitrary file read vulnerability through agent connections can lead to RCE</p>
<h1>Description</h1>
<h5>(Medium) SECURITY-3349 / CVE-2024-43045</h5>
<p>Missing permission check allows accessing other users' "My Views"</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-43044</cvename>
<cvename>CVE-2024-43045</cvename>
<url>https://www.jenkins.io/security/advisory/2024-08-07/</url>
</references>
<dates>
<discovery>2024-08-07</discovery>
<entry>2024-08-07</entry>
</dates>
</vuln>
<vuln vid="729008b9-54bf-11ef-a61b-2cf05da270f3">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.2.0</ge><lt>17.2.2</lt></range>
<range><ge>17.1.0</ge><lt>17.1.4</lt></range>
<range><ge>12.0.0</ge><lt>17.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/">
<p>Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access</p>
<p>Cross project access of Security policy bot</p>
<p>Advanced search ReDOS in highlight for code results</p>
<p>Denial of Service via banzai pipeline</p>
<p>Denial of service using adoc files</p>
<p>ReDoS in RefMatcher when matching branch names using wildcards</p>
<p>Path encoding can cause the Web interface to not render diffs correctly</p>
<p>XSS while viewing raw XHTML files through API</p>
<p>Ambiguous tag name exploitation</p>
<p>Logs disclosings potentially sensitive data in query params</p>
<p>Password bypass on approvals using policy projects</p>
<p>ReDoS when parsing git push</p>
<p>Webhook deletion audit log can preserve auth credentials</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3035</cvename>
<cvename>CVE-2024-6356</cvename>
<cvename>CVE-2024-5423</cvename>
<cvename>CVE-2024-4210</cvename>
<cvename>CVE-2024-2800</cvename>
<cvename>CVE-2024-6329</cvename>
<cvename>CVE-2024-4207</cvename>
<cvename>CVE-2024-3958</cvename>
<cvename>CVE-2024-4784</cvename>
<cvename>CVE-2024-3114</cvename>
<cvename>CVE-2024-7586</cvename>
<url>https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/</url>
</references>
<dates>
<discovery>2024-08-07</discovery>
<entry>2024-08-07</entry>
</dates>
</vuln>
<vuln vid="94d441d2-5497-11ef-9d2f-080027836e8b">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>py310-django50</name>
<name>py311-django50</name>
<range><lt>5.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2024/aug/06/security-releases/">
<p>CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat().</p>
<p>CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize().</p>
<p>CVE-2024-41991: Potential denial-of-service vulnerability in
django.utils.html.urlize() and AdminURLFieldWidget.</p>
<p>CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-41989</cvename>
<cvename>CVE-2024-41990</cvename>
<cvename>CVE-2024-41991</cvename>
<cvename>CVE-2024-42005</cvename>
<url>https://www.djangoproject.com/weblog/2024/aug/06/security-releases/</url>
</references>
<dates>
<discovery>2024-08-01</discovery>
<entry>2024-08-07</entry>
</dates>
</vuln>
<vuln vid="05cd9f82-5426-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>127.0.6533.99</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>127.0.6533.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[350528343] Critical CVE-2024-7532: Out of bounds memory access in ANGLE. Reported by wgslfuzz on 2024-07-02</li>
<li>[353552540] High CVE-2024-7533: Use after free in Sharing. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-07-17</li>
<li>[355256380] High CVE-2024-7550: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-07-25</li>
<li>[352467338] High CVE-2024-7534: Heap buffer overflow in Layout. Reported by Tashita Software Security on 2024-07-11</li>
<li>[352690885] High CVE-2024-7535: Inappropriate implementation in V8. Reported by Tashita Software Security on 2024-07-12</li>
<li>[354847246] High CVE-2024-7536: Use after free in WebAudio. Reported by Cassidy Kim(@cassidy6564) on 2024-07-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-7532</cvename>
<cvename>CVE-2024-7550</cvename>
<cvename>CVE-2024-7534</cvename>
<cvename>CVE-2024-7535</cvename>
<cvename>CVE-2024-7536</cvename>
<url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-08-06</discovery>
<entry>2024-08-06</entry>
</dates>
</vuln>
<vuln vid="15d398ea-4f73-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>127.0.6533.88</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>127.0.6533.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[353034820] Critical CVE-2024-6990: Uninitialized Use in Dawn. Reported by gelatin dessert on 2024-07-15</li>
<li>[352872238] High CVE-2024-7255: Out of bounds read in WebTransport. Reported by Marten Richter on 2024-07-13</li>
<li>[354748060] High CVE-2024-7256: Insufficient data validation in Dawn. Reported by gelatin dessert on 2024-07-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6990</cvename>
<cvename>CVE-2024-7255</cvename>
<cvename>CVE-2024-7256</cvename>
<url>https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2024-07-30</discovery>
<entry>2024-07-31</entry>
</dates>
</vuln>
<vuln vid="fb0b5574-4e64-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>127.0.6533.72</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>127.0.6533.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html">
<p>This update includes 22 security fixes:</p>
<ul>
<li>[349198731] High CVE-2024-6988: Use after free in Downloads. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-06-25</li>
<li>[349342289] High CVE-2024-6989: Use after free in Loader. Reported by Anonymous on 2024-06-25</li>
<li>[346618785] High CVE-2024-6991: Use after free in Dawn. Reported by wgslfuzz on 2024-06-12</li>
<li>[339686368] Medium CVE-2024-6994: Heap buffer overflow in Layout. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2024-05-10</li>
<li>[343938078] Medium CVE-2024-6995: Inappropriate implementation in Fullscreen. Reported by Alesandro Ortiz on 2024-06-01</li>
<li>[333708039] Medium CVE-2024-6996: Race in Frames. Reported by Louis Jannett (Ruhr University Bochum) on 2024-04-10</li>
<li>[325293263] Medium CVE-2024-6997: Use after free in Tabs. Reported by Sven Dysthe (@svn-dys) on 2024-02-15</li>
<li>[340098902] Medium CVE-2024-6998: Use after free in User Education. Reported by Sven Dysthe (@svn-dys) on 2024-05-13</li>
<li>[340893685] Medium CVE-2024-6999: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-15</li>
<li>[339877158] Medium CVE-2024-7000: Use after free in CSS. Reported by Anonymous on 2024-05-11</li>
<li>[347509736] Medium CVE-2024-7001: Inappropriate implementation in HTML. Reported by Jake Archibald on 2024-06-17</li>
<li>[338233148] Low CVE-2024-7003: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-01</li>
<li>[40063014] Low CVE-2024-7004: Insufficient validation of untrusted input in Safe Browsing. Reported by Anonymous on 2023-02-10</li>
<li>[40068800] Low CVE-2024-7005: Insufficient validation of untrusted input in Safe Browsing. Reported by Umar Farooq on 2023-08-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6988</cvename>
<cvename>CVE-2024-6989</cvename>
<cvename>CVE-2024-6991</cvename>
<cvename>CVE-2024-6994</cvename>
<cvename>CVE-2024-6995</cvename>
<cvename>CVE-2024-6996</cvename>
<cvename>CVE-2024-6997</cvename>
<cvename>CVE-2024-6998</cvename>
<cvename>CVE-2024-6999</cvename>
<cvename>CVE-2024-7000</cvename>
<cvename>CVE-2024-7001</cvename>
<cvename>CVE-2024-7003</cvename>
<cvename>CVE-2024-7004</cvename>
<cvename>CVE-2024-7005</cvename>
<url>https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html</url>
</references>
<dates>
<discovery>2024-07-23</discovery>
<entry>2024-07-30</entry>
</dates>
</vuln>
<vuln vid="8057d198-4d26-11ef-8e64-641c67a117d8">
<topic>znc -- remote code execution vulnerability</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39844">
<p>In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-39844</cvename>
<url>https://wiki.znc.in/ChangeLog/1.9.1</url>
<url>https://www.openwall.com/lists/oss-security/2024/07/03/9</url>
</references>
<dates>
<discovery>2024-07-03</discovery>
<entry>2024-07-28</entry>
</dates>
</vuln>
<vuln vid="3e917407-4b3f-11ef-8e49-001999f8d30b">
<topic>Mailpit -- Content Security Policy XSS</topic>
<affects>
<package>
<name>mailpit</name>
<range><lt>1.19.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mailpit developer reports:</p>
<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.19.3">
<p>A vulnerability was discovered which allowed a bad
actor with SMTP access to Mailpit to bypass the Content
Security Policy headers using a series of crafted HTML
messages which could result in a stored XSS attack via
the web UI.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/axllent/mailpit/releases/tag/v1.19.3</url>
</references>
<dates>
<discovery>2024-07-26</discovery>
<entry>2024-07-26</entry>
</dates>
</vuln>
<vuln vid="24c88add-4a3e-11ef-86d7-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.2.0</ge><lt>17.2.1</lt></range>
<range><ge>17.1.0</ge><lt>17.1.3</lt></range>
<range><ge>12.0.0</ge><lt>17.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/">
<p>XSS via the Maven Dependency Proxy</p>
<p>Project level analytics settings leaked in DOM</p>
<p>Reports can access and download job artifacts despite use of settings to prevent it</p>
<p>Direct Transfer - Authorised project/group exports are accessible to other users</p>
<p>Bypassing tag check and branch check through imports</p>
<p>Project Import/Export - Make project/group export files hidden to everyone except user who initiated it</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5067</cvename>
<cvename>CVE-2024-7057</cvename>
<cvename>CVE-2024-0231</cvename>
<url>https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/</url>
</references>
<dates>
<discovery>2024-07-24</discovery>
<entry>2024-07-25</entry>
</dates>
</vuln>
<vuln vid="574028b4-a181-455b-a78b-ec5c62781235">
<topic>electron29 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.5">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-6291.</li>
<li>Security: backported fix for CVE-2024-6293.</li>
<li>Security: backported fix for CVE-2024-6290.</li>
<li>Security: backported fix for CVE-2024-6292.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6291</cvename>
<url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
<cvename>CVE-2024-6293</cvename>
<url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
<cvename>CVE-2024-6290</cvename>
<url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
<cvename>CVE-2024-6292</cvename>
<url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
</references>
<dates>
<discovery>2024-07-17</discovery>
<entry>2024-07-19</entry>
</dates>
</vuln>
<vuln vid="088b8b7d-446c-11ef-b611-84a93843eb75">
<topic>Apache httpd -- Source code disclosure with handlers configured via AddType</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.60</ge><lt>2.4.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>source code disclosure with handlers configured via AddType
(CVE-2024-40725) (Important): A partial fix for CVE-2024-39884
in the core of Apache HTTP Server 2.4.61 ignores some use of the
legacy content-type based configuration of handlers. "AddType"
and similar configuration, under some circumstances where files
are requested indirectly, result in source code disclosure of
local content. For example, PHP scripts may be served instead
of interpreted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-40725</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2024-07-17</discovery>
<entry>2024-07-17</entry>
</dates>
</vuln>
<vuln vid="3b018063-4358-11ef-b611-84a93843eb75">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql80-client</name>
<range><lt>8.0.38</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.38</lt></range>
</package>
<package>
<name>mysql81-client</name>
<range><lt>8.1.1</lt></range>
</package>
<package>
<name>mysql81-server</name>
<range><lt>8.1.1</lt></range>
</package>
<package>
<name>mysql84-client</name>
<range><lt>8.4.1</lt></range>
</package>
<package>
<name>mysql84-server</name>
<range><lt>8.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2024.html#MySQL">
<p>36 new security patches for Oracle MySQL. 11 of these vulnerabilities
may be remotely exploitable without authentication, i.e., may be
exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 9.8.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujul2024.html#MySQL</url>
</references>
<dates>
<discovery>2024-07-16</discovery>
<entry>2024-07-16</entry>
</dates>
</vuln>
<vuln vid="6091d1d8-4347-11ef-a4d4-080027957747">
<topic>GLPI -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.16,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GLPI team reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.16">
<p>GLPI 10.0.16 Changelog</p>
<ul>
<li>[SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)</li>
<li>[SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)</li>
<li>[SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-37148</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37148</url>
<cvename>CVE-2024-37149</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37149</url>
<cvename>CVE-2024-37147</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37147</url>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.16</url>
</references>
<dates>
<discovery>2024-06-03</discovery>
<entry>2024-07-16</entry>
</dates>
</vuln>
<vuln vid="6410f91d-1214-4f92-b7e0-852e39e265f9">
<topic>electron30 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron30</name>
<range><lt>30.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v30.2.0">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-5493.</li>
<li>Security: backported fix for CVE-2024-5831.</li>
<li>Security: backported fix for CVE-2024-5832.</li>
<li>Security: backported fix for CVE-2024-6100.</li>
<li>Security: backported fix for CVE-2024-6101.</li>
<li>Security: backported fix for CVE-2024-6103.</li>
<li>Security: backported fix for CVE-2024-6291.</li>
<li>Security: backported fix for CVE-2024-6293.</li>
<li>Security: backported fix for CVE-2024-6290.</li>
<li>Security: backported fix for CVE-2024-6292.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5493</cvename>
<url>https://github.com/advisories/GHSA-f6rr-qfxh-hcf9</url>
<cvename>CVE-2024-5831</cvename>
<url>https://github.com/advisories/GHSA-9pmm-wf44-xjqc</url>
<cvename>CVE-2024-5832</cvename>
<url>https://github.com/advisories/GHSA-rw9q-cwc5-qqp5</url>
<cvename>CVE-2024-6100</cvename>
<url>https://github.com/advisories/GHSA-g779-vpj7-v6c4</url>
<cvename>CVE-2024-6101</cvename>
<url>https://github.com/advisories/GHSA-rg42-f9ww-x3w7</url>
<cvename>CVE-2024-6103</cvename>
<url>https://github.com/advisories/GHSA-ph5m-227m-fc5g</url>
<cvename>CVE-2024-6291</cvename>
<url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
<cvename>CVE-2024-6293</cvename>
<url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
<cvename>CVE-2024-6290</cvename>
<url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
<cvename>CVE-2024-6292</cvename>
<url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
</references>
<dates>
<discovery>2024-07-10</discovery>
<entry>2024-07-13</entry>
</dates>
</vuln>
<vuln vid="55d4a92f-c75f-43e8-ab1f-4a0efc9795c4">
<topic>electron29 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.4">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-6291.</li>
<li>Security: backported fix for CVE-2024-6293.</li>
<li>Security: backported fix for CVE-2024-6290.</li>
<li>Security: backported fix for CVE-2024-6292.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6291</cvename>
<url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
<cvename>CVE-2024-6293</cvename>
<url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
<cvename>CVE-2024-6290</cvename>
<url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
<cvename>CVE-2024-6292</cvename>
<url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
</references>
<dates>
<discovery>2024-07-11</discovery>
<entry>2024-07-13</entry>
</dates>
</vuln>
<vuln vid="acb4eab6-3f6d-11ef-8657-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.1.0</ge><lt>17.1.2</lt></range>
<range><ge>17.0.0</ge><lt>17.0.4</lt></range>
<range><ge>11.8.0</ge><lt>16.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/">
<p>An attacker can run pipeline jobs as an arbitrary user</p>
<p>Developer user with admin_compliance_framework permission can change group URL</p>
<p>Admin push rules custom role allows creation of project level deploy token</p>
<p>Package registry vulnerable to manifest confusion</p>
<p>User with admin_group_member permission can ban group members</p>
<p>Subdomain takeover in GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6385</cvename>
<cvename>CVE-2024-5257</cvename>
<cvename>CVE-2024-5470</cvename>
<cvename>CVE-2024-6595</cvename>
<cvename>CVE-2024-2880</cvename>
<cvename>CVE-2024-5528</cvename>
<url>https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/</url>
</references>
<dates>
<discovery>2024-07-10</discovery>
<entry>2024-07-11</entry>
</dates>
</vuln>
<vuln vid="171afa61-3eba-11ef-a58f-080027836e8b">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.14</lt></range>
</package>
<package>
<name>py310-django50</name>
<name>py311-django50</name>
<range><lt>5.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2024/jul/09/security-releases/">
<p>CVE-2024-38875: Potential denial-of-service in django.utils.html.urlize().</p>
<p>CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords.</p>
<p>CVE-2024-39330: Potential directory-traversal in django.core.files.storage.Storage.save().</p>
<p>CVE-2024-39614: Potential denial-of-service in django.utils.translation.get_supported_language_variant().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-38875</cvename>
<cvename>CVE-2024-39329</cvename>
<cvename>CVE-2024-39330</cvename>
<cvename>CVE-2024-39614</cvename>
<url>https://www.djangoproject.com/weblog/2024/jul/09/security-releases/</url>
</references>
<dates>
<discovery>2024-07-01</discovery>
<entry>2024-07-10</entry>
</dates>
</vuln>
<vuln vid="767dfb2d-3c9e-11ef-a829-5404a68ad561">
<topic>traefik -- Bypassing IP allow-lists via HTTP/3 early data requests</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik authors report:</p>
<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9">
<p>There is a vulnerability in Traefik that allows bypassing IP allow-lists via HTTP/3 early
data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-39321</cvename>
<url>https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9</url>
</references>
<dates>
<discovery>2024-07-02</discovery>
<entry>2024-07-07</entry>
</dates>
</vuln>
<vuln vid="5d921a8c-3a43-11ef-b611-84a93843eb75">
<topic>Apache httpd -- source code disclosure</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.60</ge><lt>2.4.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>isource code disclosure with handlers configured via AddType
(CVE-2024-39884) (Important). A regression in the core of Apache HTTP
Server 2.4.60 ignores some use of the legacy content-type based
configuration of handlers. "AddType" and similar configuration,
under some circumstances where files are requested indirectly, result
in source code disclosure of local content. For example, PHP scripts
may be served instead of interpreted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-39884</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2024-07-04</discovery>
<entry>2024-07-04</entry>
</dates>
</vuln>
<vuln vid="51498ee4-39a1-11ef-b609-002590c1f29c">
<topic>Request Tracker -- information exposure vulnerability</topic>
<affects>
<package>
<name>rt50</name>
<range><lt>5.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Request Tracker reports:</p>
<p>CVE-2024-3262 describes previously viewed pages being stored in the
browser cache, which is the typical default behavior of most browsers to
enable the "back" button. Someone who gains access to a host computer could
potentially view ticket data using the back button, even after logging out
of RT. The CVE specifically references RT version 4.4.1, but this behavior
is present in most browsers viewing all versions of RT before 5.0.6.</p>
</body>
</description>
<references>
<cvename>CVE-2024-3262</cvename>
<url>https://github.com/advisories/GHSA-6426-p644-ffcf</url>
</references>
<dates>
<discovery>2024-04-04</discovery>
<entry>2024-07-04</entry>
</dates>
</vuln>
<vuln vid="b0374722-3912-11ef-a77e-901b0e9408dc">
<topic>go -- net/http: denial of service due to improper 100-continue handling</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.5</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/67555">
<p>net/http: denial of service due to improper 100-continue handling</p>
<p>The net/http HTTP/1.1 client mishandled the case where a
server responds to a request with an "Expect: 100-continue"
header with a non-informational (200 or higher) status. This
mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will
fail.</p>
<p>An attacker sending a request to a
net/http/httputil.ReverseProxy proxy can exploit this
mishandling to cause a denial of service by sending "Expect:
100-continue" requests which elicit a non-informational
response from the backend. Each such request leaves the
proxy with an invalid connection, and causes one subsequent
request using that connection to fail.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24791</cvename>
<url>https://go.dev/issue/67555</url>
</references>
<dates>
<discovery>2024-07-02</discovery>
<entry>2024-07-03</entry>
</dates>
</vuln>
<vuln vid="d7efc2ad-37af-11ef-b611-84a93843eb75">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387) (Low).
Serving WebSocket protocol upgrades over a HTTP/2 connection could
result in a Null Pointer dereference, leading to a crash of the server
process, degrading performance.</p>
<p>Proxy encoding problem (CVE-2024-38473) (Moderate).
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier
allows request URLs with incorrect encoding to be sent to backend
services, potentially bypassing authentication via crafted requests.</p>
<p>Weakness with encoded question marks in backreferences
(CVE-2024-38474) (Important). Substitution encoding issue in
mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker
to execute scripts in directories permitted by the configuration but
not directly reachable by any URL or source disclosure of scripts
meant to only to be executed as CGI.</p>
<p>Weakness in mod_rewrite when first segment of substitution matches
filesystem path (CVE-2024-38475) (Important). Improper escaping of
output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows
an attacker to map URLs to filesystem locations that are permitted to
be served by the server but are not intentionally/directly reachable
by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables
as the first segment of the substitution are affected. Some unsafe
RewiteRules will be broken by this change and the rewrite flag
"UnsafePrefixStat" can be used to opt back in once ensuring the
substitution is appropriately constrained.</p>
<p>may use exploitable/malicious backend application output to run local
handlers via internal redirect (CVE-2024-38476) (Important).
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are
vulnerable to information disclosure, SSRF or local script execution
via backend applications whose response headers are malicious or
exploitable.</p>
<p>Crash resulting in Denial of Service in mod_proxy via a malicious
request (CVE-2024-38477) (Important). Null pointer dereference in
mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker
to crash the server via a malicious request.</p>
<p>mod_rewrite proxy handler substitution (CVE-2024-39573) (Moderate).
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier
allows an attacker to cause unsafe RewriteRules to unexpectedly setup
URL's to be handled by mod_proxy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-36387</cvename>
<cvename>CVE-2024-38473</cvename>
<cvename>CVE-2024-38474</cvename>
<cvename>CVE-2024-38475</cvename>
<cvename>CVE-2024-38476</cvename>
<cvename>CVE-2024-38477</cvename>
<cvename>CVE-2024-39573</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2024-07-01</discovery>
<entry>2024-07-01</entry>
</dates>
</vuln>
<vuln vid="f1a00122-3797-11ef-b611-84a93843eb75">
<topic>OpenSSH -- Race condition resulting in potential remote code execution</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>9.7.p1_2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.1</ge><lt>14.1_2</lt></range>
<range><ge>14.0</ge><lt>14.0_8</lt></range>
<range><ge>13.3</ge><lt>13.3_4</lt></range>
<range><ge>13.2</ge><lt>13.2_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="https://www.openssh.com/security.html">
<p>A race condition in sshd(8) could allow remote code execution as root on non-OpenBSD systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6387</cvename>
<url>https://www.openssh.com/security.html</url>
<freebsdsa>SA-24:04.openssh</freebsdsa>
</references>
<dates>
<discovery>2024-07-01</discovery>
<entry>2024-07-01</entry>
<modified>2024-09-20</modified>
</dates>
</vuln>
<vuln vid="c742dbe8-3704-11ef-9e6e-b42e991fc52e">
<topic>netatalk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>netatalk3</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/afpd/directory.c#L2333">
<p>This entry documents the following three vulnerabilities:</p>
<ul>
<li>Netatalk before 3.2.1 has an off-by-one error and resultant heap-based
buffer overflow because of setting ibuf[len] to '\0' in
FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19
are also fixed versions.</li>
<li>Netatalk before 3.2.1 has an off-by-one error, and resultant
heap-based buffer overflow and segmentation violation, because of
incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c.
The original issue 1097 report stated: 'The latest version of
Netatalk (v3.2.0) contains a security vulnerability. This vulnerability
arises due to a lack of validation for the length field after parsing
user-provided data, leading to an out-of-bounds heap write of one
byte (\0). Under specific configurations, this can result in reading
metadata of the next heap block, potentially causing a Denial of
Service (DoS) under certain heap layouts or with ASAN enabled. ...
</li>
<li>Netatalk before 3.2.1 has an off-by-one error and resultant heap-based
buffer overflow because of setting ibuf[PASSWDLEN] to '\0'
in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19
are also fixed versions.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-38440</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-38440</url>
<cvename>CVE-2024-38441</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-38441</url>
<cvename>CVE-2024-38439</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-38439</url>
</references>
<dates>
<discovery>2024-06-16</discovery>
<entry>2024-06-30</entry>
</dates>
</vuln>
<vuln vid="0e73964d-053a-481a-bf1c-202948d68484">
<topic>electron29 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-5499.</li>
<li>Security: backported fix for CVE-2024-5493.</li>
<li>Security: backported fix for CVE-2024-5494.</li>
<li>Security: backported fix for CVE-2024-5495.</li>
<li>Security: backported fix for CVE-2024-5496.</li>
<li>Security: backported fix for CVE-2024-5158.</li>
<li>Security: backported fix for CVE-2024-5160.</li>
<li>Security: backported fix for CVE-2024-5157.</li>
<li>Security: backported fix for CVE-2024-5159.</li>
<li>Security: backported fix for CVE-2024-5831.</li>
<li>Security: backported fix for CVE-2024-5832.</li>
<li>Security: backported fix for CVE-2024-6100.</li>
<li>Security: backported fix for CVE-2024-6101.</li>
<li>Security: backported fix for CVE-2024-6103.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5499</cvename>
<url>https://github.com/advisories/GHSA-hqfv-mf6j-g3j6</url>
<cvename>CVE-2024-5493</cvename>
<url>https://github.com/advisories/GHSA-f6rr-qfxh-hcf9</url>
<cvename>CVE-2024-5494</cvename>
<url>https://github.com/advisories/GHSA-fv2x-w8xf-gxpq</url>
<cvename>CVE-2024-5495</cvename>
<url>https://github.com/advisories/GHSA-wrxh-8wc3-33rm</url>
<cvename>CVE-2024-5496</cvename>
<url>https://github.com/advisories/GHSA-8xgv-q88p-ghq4</url>
<cvename>CVE-2024-5158</cvename>
<url>https://github.com/advisories/GHSA-4433-jwm9-48r5</url>
<cvename>CVE-2024-5160</cvename>
<url>https://github.com/advisories/GHSA-c24q-2hx9-mjpc</url>
<cvename>CVE-2024-5157</cvename>
<url>https://github.com/advisories/GHSA-w7g4-69hj-jcrq</url>
<cvename>CVE-2024-5159</cvename>
<url>https://github.com/advisories/GHSA-qmp7-vwf7-6g2g</url>
<cvename>CVE-2024-5831</cvename>
<url>https://github.com/advisories/GHSA-9pmm-wf44-xjqc</url>
<cvename>CVE-2024-5832</cvename>
<url>https://github.com/advisories/GHSA-rw9q-cwc5-qqp5</url>
<cvename>CVE-2024-6100</cvename>
<url>https://github.com/advisories/GHSA-g779-vpj7-v6c4</url>
<cvename>CVE-2024-6101</cvename>
<url>https://github.com/advisories/GHSA-rg42-f9ww-x3w7</url>
<cvename>CVE-2024-6103</cvename>
<url>https://github.com/advisories/GHSA-ph5m-227m-fc5g</url>
</references>
<dates>
<discovery>2024-06-27</discovery>
<entry>2024-06-28</entry>
</dates>
</vuln>
<vuln vid="07f0ea8c-356a-11ef-ac6d-a0423f48a938">
<topic>frr - Multiple vulnerabilities</topic>
<affects>
<package>
<name>frr9</name>
<range><lt>9.1.1</lt></range>
</package>
<package>
<name>frr8</name>
<range><lt>8.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://frrouting.org/release/9.1.1/">
<p>In FRRouting (FRR) through 9.1, there are multiples vulnerabilities.</p>
<ul>
<li>CVE-2024-31950: buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets</li>
<li>CVE-2024-31951: buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31950</cvename>
<cvename>CVE-2024-31951</cvename>
<url>https://frrouting.org/release/9.1.1/</url>
</references>
<dates>
<discovery>2024-04-07</discovery>
<entry>2024-06-28</entry>
</dates>
</vuln>
<vuln vid="589de937-343f-11ef-8a7b-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.1.0</ge><lt>17.1.1</lt></range>
<range><ge>17.0.0</ge><lt>17.0.3</lt></range>
<range><ge>1.0.0</ge><lt>16.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/">
<p>Run pipelines as any user</p>
<p>Stored XSS injected in imported project's commit notes</p>
<p>CSRF on GraphQL API IntrospectionQuery</p>
<p>Remove search results from public projects with unauthorized repos</p>
<p>Cross window forgery in user application OAuth flow</p>
<p>Project maintainers can bypass group's merge request approval policy</p>
<p>ReDoS via custom built markdown page</p>
<p>Private job artifacts can be accessed by any user</p>
<p>Security fixes for banzai pipeline</p>
<p>ReDoS in dependency linker</p>
<p>Denial of service using a crafted OpenAPI file</p>
<p>Merge request title disclosure</p>
<p>Access issues and epics without having an SSO session</p>
<p>Non project member can promote key results to objectives</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5655</cvename>
<cvename>CVE-2024-4901</cvename>
<cvename>CVE-2024-4994</cvename>
<cvename>CVE-2024-6323</cvename>
<cvename>CVE-2024-2177</cvename>
<cvename>CVE-2024-5430</cvename>
<cvename>CVE-2024-4025</cvename>
<cvename>CVE-2024-3959</cvename>
<cvename>CVE-2024-4557</cvename>
<cvename>CVE-2024-1493</cvename>
<cvename>CVE-2024-1816</cvename>
<cvename>CVE-2024-2191</cvename>
<cvename>CVE-2024-3115</cvename>
<cvename>CVE-2024-4011</cvename>
<url>https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/</url>
</references>
<dates>
<discovery>2024-06-26</discovery>
<entry>2024-06-27</entry>
</dates>
</vuln>
<vuln vid="2b68c86a-32d5-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>126.0.6478.126</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>126.0.6478.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[342428008] High CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz on 2024-05-23</li>
<li>[40942995] High CVE-2024-6291: Use after free in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-15</li>
<li>[342545100] High CVE-2024-6292: Use after free in Dawn. Reported by wgslfuzz on 2024-05-24</li>
<li>[345993680] High CVE-2024-6293: Use after free in Dawn. Reported by wgslfuzz on 2024-06-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6290</cvename>
<cvename>CVE-2024-6291</cvename>
<cvename>CVE-2024-6292</cvename>
<cvename>CVE-2024-6293</cvename>
<url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2024-06-24</discovery>
<entry>2024-06-25</entry>
</dates>
</vuln>
<vuln vid="4f6c4c07-3179-11ef-9da5-1c697a616631">
<topic>emacs -- Arbitrary shell code evaluation vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<name>emacs-wayland</name>
<range><lt>29.3_3,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<name>emacs-devel-nox</name>
<range><lt>30.0.50.20240615_1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Emacs developers report:</p>
<blockquote cite="https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html">
<p>Emacs 29.4 is an emergency bugfix release intended to fix a security vulnerability. Arbitrary shell commands are no longer run when turning on Org mode in order to avoid running malicious code.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/oss-sec/2024/q2/296</url>
</references>
<dates>
<discovery>2024-06-22</discovery>
<entry>2024-06-23</entry>
</dates>
</vuln>
<vuln vid="82830965-3073-11ef-a17d-5404a68ad561">
<topic>traefik -- Azure Identity Libraries Elevation of Privilege Vulnerability</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik authors report:</p>
<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-rvj4-q8q5-8grf">
<p>There is a vulnerability in Azure Identity Libraries and
Microsoft Authentication Library Elevation of Privilege Vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-35255</cvename>
<url>https://github.com/traefik/traefik/security/advisories/GHSA-rvj4-q8q5-8grf</url>
</references>
<dates>
<discovery>2024-06-11</discovery>
<entry>2024-06-22</entry>
</dates>
</vuln>
<vuln vid="aa2b65e4-2f63-11ef-9cab-4ccc6adda413">
<topic>qt5-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.17.p2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 5 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-3837: Use after free in QUIC</li>
<li>CVE-2024-3839: Out of bounds read in Fonts</li>
<li>CVE-2024-3914: Use after free in V8</li>
<li>CVE-2024-4058: Type confusion in ANGLE</li>
<li>CVE-2024-4558: Use after free in ANGLE</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3837</cvename>
<cvename>CVE-2024-3839</cvename>
<cvename>CVE-2024-3914</cvename>
<cvename>CVE-2024-4058</cvename>
<cvename>CVE-2024-4558</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-05-31</discovery>
<entry>2024-06-20</entry>
</dates>
</vuln>
<vuln vid="c5415838-2f52-11ef-9cab-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
<p>Backports for 7 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-4948: Use after free in Dawn</li>
<li>CVE-2024-5274: Type Confusion in V8</li>
<li>CVE-2024-5493: Heap buffer overflow in WebRTC</li>
<li>CVE-2024-5494: Use after free in Dawn</li>
<li>CVE-2024-5495: Use after free in Dawn</li>
<li>CVE-2024-5496: Use after free in Media Session</li>
<li>CVE-2024-5499: Out of bounds write in Streams API</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4948</cvename>
<cvename>CVE-2024-5274</cvename>
<cvename>CVE-2024-5493</cvename>
<cvename>CVE-2024-5494</cvename>
<cvename>CVE-2024-5495</cvename>
<cvename>CVE-2024-5496</cvename>
<cvename>CVE-2024-5499</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
</references>
<dates>
<discovery>2024-05-31</discovery>
<entry>2024-06-20</entry>
</dates>
</vuln>
<vuln vid="142c538e-b18f-40a1-afac-c479effadd5c">
<topic>openvpn -- two security fixes</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.6.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gert Doering reports that OpenVPN 2.6.11 fixes two security bugs (three on Windows):</p>
<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#security-fixes">
<p>CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. (Reynir Björnsson)</p>
<p>CVE-2024-28882: only call schedule_exit() once (on a given peer). Security scope: an authenticated client can make the server "keep the session" even when the server has been told to disconnect this client. (Reynir Björnsson)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5594</cvename>
<cvename>CVE-2024-28882</cvename>
<url>https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#security-fixes</url>
</references>
<dates>
<discovery>2024-05-16</discovery>
<entry>2024-06-20</entry>
</dates>
</vuln>
<vuln vid="007e7e77-2f06-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>126.0.6478.114</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>126.0.6478.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html">
<p>This update includes 6 security fixes:</p>
<ul>
<li>[344608204] High CVE-2024-6100: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) participating in SSD Secure Disclosure's TyphoonPWN 2024 on 2024-06-04</li>
<li>[343748812] High CVE-2024-6101: Inappropriate implementation in WebAssembly. Reported by @ginggilBesel on 2024-05-31</li>
<li>[339169163] High CVE-2024-6102: Out of bounds memory access in Dawn. Reported by wgslfuzz on 2024-05-07</li>
<li>[344639860] High CVE-2024-6103: Use after free in Dawn. Reported by wgslfuzz on 2024-06-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-6100</cvename>
<cvename>CVE-2024-6101</cvename>
<cvename>CVE-2024-6102</cvename>
<cvename>CVE-2024-6103</cvename>
<url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html</url>
</references>
<dates>
<discovery>2024-06-18</discovery>
<entry>2024-06-20</entry>
</dates>
</vuln>
<vuln vid="453aa0fc-2d91-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>126.0.6478.54</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>126.0.6478.54</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html">
<p>This update includes 21 security fixes:</p>
<ul>
<li>[342456991] High CVE-2024-5830: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-05-24</li>
<li>[339171223] High CVE-2024-5831: Use after free in Dawn. Reported by wgslfuzz on 2024-05-07</li>
<li>[340196361] High CVE-2024-5832: Use after free in Dawn. Reported by wgslfuzz on 2024-05-13</li>
<li>[342602616] High CVE-2024-5833: Type Confusion in V8. Reported by @ginggilBesel on 2024-05-24</li>
<li>[342840932] High CVE-2024-5834: Inappropriate implementation in Dawn. Reported by gelatin dessert on 2024-05-26</li>
<li>[341991535] High CVE-2024-5835: Heap buffer overflow in Tab Groups. Reported by Weipeng Jiang (@Krace) of VRI on 2024-05-22</li>
<li>[341875171] High CVE-2024-5836: Inappropriate Implementation in DevTools. Reported by Allen Ding on 2024-05-21</li>
<li>[342415789] High CVE-2024-5837: Type Confusion in V8. Reported by Anonymous on 2024-05-23</li>
<li>[342522151] High CVE-2024-5838: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-05-24</li>
<li>[340122160] Medium CVE-2024-5839: Inappropriate Implementation in Memory Allocator. Reported by Micky on 2024-05-13</li>
<li>[41492103] Medium CVE-2024-5840: Policy Bypass in CORS. Reported by Matt Howard on 2024-01-17</li>
<li>[326765855] Medium CVE-2024-5841: Use after free in V8. Reported by Cassidy Kim(@cassidy6564) on 2024-02-26</li>
<li>[40062622] Medium CVE-2024-5842: Use after free in Browser UI. Reported by Sven Dysthe (@svn_dy) on 2023-01-12</li>
<li>[333940412] Medium CVE-2024-5843: Inappropriate implementation in Downloads. Reported by hjy79425575 on 2024-04-12</li>
<li>[331960660] Medium CVE-2024-5844: Heap buffer overflow in Tab Strip. Reported by Sri on 2024-04-01</li>
<li>[340178596] Medium CVE-2024-5845: Use after free in Audio. Reported by anonymous on 2024-05-13</li>
<li>[341095523] Medium CVE-2024-5846: Use after free in PDFium. Reported by Han Zheng (HexHive) on 2024-05-16</li>
<li>[341313077] Medium CVE-2024-5847: Use after free in PDFium. Reported by Han Zheng (HexHive) on 2024-05-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5830</cvename>
<cvename>CVE-2024-5831</cvename>
<cvename>CVE-2024-5832</cvename>
<cvename>CVE-2024-5833</cvename>
<cvename>CVE-2024-5834</cvename>
<cvename>CVE-2024-5835</cvename>
<cvename>CVE-2024-5836</cvename>
<cvename>CVE-2024-5837</cvename>
<cvename>CVE-2024-5838</cvename>
<cvename>CVE-2024-5839</cvename>
<cvename>CVE-2024-5840</cvename>
<cvename>CVE-2024-5841</cvename>
<cvename>CVE-2024-5842</cvename>
<cvename>CVE-2024-5843</cvename>
<cvename>CVE-2024-5844</cvename>
<cvename>CVE-2024-5845</cvename>
<cvename>CVE-2024-5846</cvename>
<cvename>CVE-2024-5847</cvename>
<url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-06-11</discovery>
<entry>2024-06-18</entry>
</dates>
</vuln>
<vuln vid="f0ba7008-2bbd-11ef-b4ca-814a3d504243">
<topic>forgejo -- multiple issues</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The forgejo team reports:</p>
<blockquote cite="https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-4">
<p><a href="https://pkg.go.dev/vuln/GO-2024-2888">CVE-2024-24789</a>:
The archive/zip package's handling of certain types of invalid
zip files differs from the behavior of most zip implementations.
This misalignment could be exploited to create an zip file with
contents that vary depending on the implementation reading the
file.</p>
<p>The OAuth2 implementation does not always require authentication
for public clients, a requirement of RFC 6749 Section 10.2. A
malicious client can impersonate another client and obtain access
to protected resources if the impersonated client fails to, or is
unable to, keep its client credentials confidential.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24789</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-24789</url>
</references>
<dates>
<discovery>2024-04-04</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="219aaa1e-2aff-11ef-ab37-5404a68ad561">
<topic>traefik -- Unexpected behavior with IPv4-mapped IPv6 addresses</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik authors report:</p>
<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx">
<p>There is a vulnerability in Go managing various Is methods
(IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses
which would return true in their traditional IPv4 forms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24790</cvename>
<url>https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx</url>
</references>
<dates>
<discovery>2024-06-05</discovery>
<entry>2024-06-15</entry>
</dates>
</vuln>
<vuln vid="a5c64f6f-2af3-11ef-a77e-901b0e9408dc">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.4</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/66869">
<p>archive/zip: mishandling of corrupt central directory record</p>
<p>The archive/zip package's handling of certain types of
invalid zip files differed from the behavior of most zip
implementations. This misalignment could be exploited to
create an zip file with contents that vary depending on the
implementation reading the file. The archive/zip package now
rejects files containing these errors.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/67680">
<p>net/netip: unexpected behavior from Is methods for
IPv4-mapped IPv6 addresses</p>
<p>The various Is methods (IsPrivate, IsLoopback, etc) did
not work as expected for IPv4-mapped IPv6 addresses,
returning false for addresses which would return true in
their traditional IPv4 forms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24789</cvename>
<cvename>CVE-2024-24790</cvename>
<url>https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ</url>
</references>
<dates>
<discovery>2024-06-04</discovery>
<entry>2024-06-15</entry>
</dates>
</vuln>
<vuln vid="92cd1c03-2940-11ef-bc02-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.0.0</ge><lt>17.0.2</lt></range>
<range><ge>16.11.0</ge><lt>16.11.4</lt></range>
<range><ge>5.1</ge><lt>16.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/">
<p>ReDoS in gomod dependency linker</p>
<p>ReDoS in CI interpolation (fix bypass)</p>
<p>ReDoS in Asana integration issue mapping when webhook is called</p>
<p>XSS and content injection when viewing raw XHTML files on iOS devices</p>
<p>Missing agentk request validation could cause KAS to panic</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1495</cvename>
<cvename>CVE-2024-1736</cvename>
<cvename>CVE-2024-1963</cvename>
<cvename>CVE-2024-4201</cvename>
<cvename>CVE-2024-5469</cvename>
<url>https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/</url>
</references>
<dates>
<discovery>2024-06-12</discovery>
<entry>2024-06-13</entry>
</dates>
</vuln>
<vuln vid="479df73e-2838-11ef-9cab-4ccc6adda413">
<topic>plasma[56]-plasma-workspace -- Unauthorized users can access session manager</topic>
<affects>
<package>
<name>plasma5-plasma-workspace</name>
<range><lt>5.27.11.1</lt></range>
</package>
<package>
<name>plasma6-plasma-workspace</name>
<range><lt>6.0.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Edmundson reports:</p>
<blockquote cite="https://kde.org/info/security/advisory-20240531-1.txt">
<p>KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE
based purely on the host, allowing all local connections. This allows
another user on the same machine to gain access to the session
manager.</p>
<p>A well crafted client could use the session restore feature to execute
arbitrary code as the user on the next boot.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-36041</cvename>
<url>https://kde.org/info/security/advisory-20240531-1.txt</url>
</references>
<dates>
<discovery>2024-05-31</discovery>
<entry>2024-06-11</entry>
</dates>
</vuln>
<vuln vid="5f608c68-276c-11ef-8caa-0897988a1c07">
<topic>Composer -- Multiple command injections via malicious git/hg branch names</topic>
<affects>
<package>
<name>php81-composer</name>
<range><lt>2.7.7</lt></range>
</package>
<package>
<name>php82-composer</name>
<range><lt>2.7.7</lt></range>
</package>
<package>
<name>php83-composer</name>
<range><lt>2.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Composer project reports:</p>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c">
<p>The status, reinstall and remove commands with packages
installed from source via git containing specially crafted
branch names in the repository can be used to execute
code.</p>
</blockquote>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf">
<p>The composer install command running inside a git/hg
repository which has specially crafted branch names can
lead to command injection. So this requires cloning
untrusted repositories.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-35241</cvename>
<url>https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c</url>
<cvename>CVE-2024-35242</cvename>
<url>https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf</url>
</references>
<dates>
<discovery>2024-06-10</discovery>
<entry>2024-06-10</entry>
</dates>
</vuln>
<vuln vid="91929399-249e-11ef-9296-b42e991fc52e">
<topic>kanboard -- Project Takeover via IDOR in ProjectPermissionController</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.2.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/kanboard/kanboard/commit/b6703688aac8187f5ea4d4d704fc7afeeffeafa7">
<p>Kanboard is project management software that focuses on the Kanban
methodology. The vuln is in app/Controller/ProjectPermissionController.php
function addUser(). The users permission to add users to a project
only get checked on the URL parameter project_id. If the user is
authorized to add users to this project the request gets processed.
The users permission for the POST BODY parameter project_id does
not get checked again while processing. An attacker with the
'Project Manager' on a single project may take over any
other project. The vulnerability is fixed in 1.2.37.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-36399</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-36399</url>
</references>
<dates>
<discovery>2024-06-06</discovery>
<entry>2024-06-07</entry>
</dates>
</vuln>
<vuln vid="14908bda-232b-11ef-b621-00155d645102">
<topic>cyrus-imapd -- unbounded memory allocation</topic>
<affects>
<package>
<name>cyrus-imapd38</name>
<range><lt>3.8.2_1</lt></range>
</package>
<package>
<name>cyrus-imapd36</name>
<range><lt>3.6.4_1</lt></range>
</package>
<package>
<name>cyrus-imapd34</name>
<range><lt>3.4.7_1</lt></range>
</package>
<package>
<name>cyrus-imapd32</name>
<name>cyrus-imapd30</name>
<name>cyrus-imapd25</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.8.3 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html">
<p>Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.</p>
<p>The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.</p>
<p>The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-34055</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055</url>
</references>
<dates>
<discovery>2024-04-30</discovery>
<entry>2024-06-05</entry>
</dates>
</vuln>
<vuln vid="b058380e-21a4-11ef-8a0f-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>125.0.6422.141</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>125.0.6422.141</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html">
<p>This update includes 11 security fixes:</p>
<ul>
<li>[339877165] High CVE-2024-5493: Heap buffer overflow in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2024-05-11</li>
<li>[338071106] High CVE-2024-5494: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01</li>
<li>[338103465] High CVE-2024-5495: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01</li>
<li>[338929744] High CVE-2024-5496: Use after free in Media Session. Reported by Cassidy Kim(@cassidy6564) on 2024-05-06</li>
<li>[339061099] High CVE-2024-5497: Out of bounds memory access in Keyboard Inputs. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2024-05-07</li>
<li>[339588211] High CVE-2024-5498: Use after free in Presentation API. Reported by anymous on 2024-05-09</li>
<li>[339877167] High CVE-2024-5499: Out of bounds write in Streams API. Reported by anonymous on 2024-05-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5493</cvename>
<cvename>CVE-2024-5494</cvename>
<cvename>CVE-2024-5495</cvename>
<cvename>CVE-2024-5496</cvename>
<cvename>CVE-2024-5497</cvename>
<cvename>CVE-2024-5498</cvename>
<cvename>CVE-2024-5499</cvename>
<url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2024-05-30</discovery>
<entry>2024-06-03</entry>
</dates>
</vuln>
<vuln vid="320a19f7-1ddd-11ef-a2ae-8c164567ca3c">
<topic>nginx -- Multiple Vulnerabilities in HTTP/3</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><ge>1.25.0</ge><lt>1.27.0</lt></range>
</package>
<package>
<name>nginx</name>
<range><ge>1.26.0</ge><lt>1.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx development team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Stack overflow and use-after-free in HTTP/3</li>
<li>Buffer overwrite in HTTP/3</li>
<li>Memory disclosure in HTTP/3</li>
<li>NULL pointer dereference in HTTP/3</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31079</cvename>
<cvename>CVE-2024-32760</cvename>
<cvename>CVE-2024-34161</cvename>
<cvename>CVE-2024-35200</cvename>
</references>
<dates>
<discovery>2024-05-29</discovery>
<entry>2024-05-29</entry>
</dates>
</vuln>
<vuln vid="6926d038-1db4-11ef-9f97-a8a1599412c6">
<topic>chromium -- security fix</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>125.0.6422.112</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>125.0.6422.112</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[341663589] High CVE-2024-5274: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group and Brendon Tiszka of Chrome Security on 2024-05-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5274</cvename>
<url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html</url>
</references>
<dates>
<discovery>2024-05-23</discovery>
<entry>2024-05-29</entry>
</dates>
</vuln>
<vuln vid="73a697d7-1d0f-11ef-a490-84a93843eb75">
<topic>OpenSSL -- Use after free vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.13_5,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.5_5</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.1_5</lt></range>
</package>
<package>
<name>openssl33</name>
<range><lt>3.3.0_2</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.13_5</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.5_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20240528.txt">
<p>Use After Free with SSL_free_buffers (low).</p>
<p>Calling the OpenSSL API function SSL_free_buffers may cause
memory to be accessed that was previously freed in some situations</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4741</cvename>
<url>https://www.openssl.org/news/secadv/20240528.txt</url>
</references>
<dates>
<discovery>2024-05-28</discovery>
<entry>2024-05-28</entry>
</dates>
</vuln>
<vuln vid="04e78f32-04b2-4c23-bfae-72600842d317">
<topic>electron29 -- use after free in Dawn</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.1">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-4948.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4948</cvename>
<url>https://github.com/advisories/GHSA-xvp9-87cv-m4fv</url>
</references>
<dates>
<discovery>2024-05-22</discovery>
<entry>2024-05-25</entry>
</dates>
</vuln>
<vuln vid="43d1c381-a3e5-4a1d-b3ed-f37b61a451af">
<topic>electron28 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron28</name>
<range><lt>28.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v28.3.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-4948.</li>
<li>Security: backported fix for CVE-2024-3914.</li>
<li>Security: backported fix for CVE-2024-4060.</li>
<li>Security: backported fix for CVE-2024-4058.</li>
<li>Security: backported fix for CVE-2024-4558.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4948</cvename>
<url>https://github.com/advisories/GHSA-xvp9-87cv-m4fv</url>
<cvename>CVE-2024-3914</cvename>
<url>https://github.com/advisories/GHSA-jv87-hfr8-8j2r</url>
<cvename>CVE-2024-4060</cvename>
<url>https://github.com/advisories/GHSA-4qw6-vwc8-mh38</url>
<cvename>CVE-2024-4058</cvename>
<url>https://github.com/advisories/GHSA-23rw-79p3-xgcm</url>
<cvename>CVE-2024-4558</cvename>
<url>https://github.com/advisories/GHSA-r4j8-j63p-24j8</url>
</references>
<dates>
<discovery>2024-05-22</discovery>
<entry>2024-05-25</entry>
</dates>
</vuln>
<vuln vid="f5fa174d-19de-11ef-83d8-4ccc6adda413">
<topic>QtNetworkAuth -- predictable seeding of PRNG in QAbstractOAuth</topic>
<affects>
<package>
<name>qt5-networkauth</name>
<range><lt>5.15.13_1</lt></range>
</package>
<package>
<name>qt6-networkauth</name>
<range><lt>6.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Shaw reports:</p>
<blockquote cite="https://www.qt.io/blog/security-advisory-qstringconverter-0">
<p>The OAuth1 implementation in QtNetworkAuth created nonces using
a PRNG that was seeded with a predictable seed.</p>
<p>This means that an attacker that can somehow control the time of
the first OAuth1 flow of the process has a high chance of predicting
the nonce used in said OAuth flow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-36048</cvename>
<url>https://www.qt.io/blog/security-advisory-qstringconverter-0</url>
<url>https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317</url>
</references>
<dates>
<discovery>2024-05-08</discovery>
<entry>2024-05-24</entry>
</dates>
</vuln>
<vuln vid="f848ef90-1848-11ef-9850-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>17.0.0</ge><lt>17.0.1</lt></range>
<range><ge>16.11.0</ge><lt>16.11.3</lt></range>
<range><ge>11.11</ge><lt>16.10.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/">
<p>1-click account takeover via XSS in the code editor in gitlab.com</p>
<p>A DOS vulnerability in the 'description' field of the runner</p>
<p>CSRF via K8s cluster-integration</p>
<p>Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipeline_id did not match</p>
<p>Redos on wiki render API/Page</p>
<p>Resource exhaustion and denial of service with test_report API calls</p>
<p>Guest user can view dependency lists of private projects through job artifacts</p>
<p>Stored XSS via PDFjs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4835</cvename>
<cvename>CVE-2024-2874</cvename>
<cvename>CVE-2023-7045</cvename>
<cvename>CVE-2023-6502</cvename>
<cvename>CVE-2024-1947</cvename>
<cvename>CVE-2024-4367</cvename>
<url>https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/</url>
</references>
<dates>
<discovery>2024-05-22</discovery>
<entry>2024-05-22</entry>
</dates>
</vuln>
<vuln vid="8247af0d-183b-11ef-9f97-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>125.0.6422.76</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>125.0.6422.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html">
<p>This update includes 15 security fixes:</p>
<ul>
<li>[336012573] High CVE-2024-5157: Use after free in Scheduling. Reported by Looben Yang on 2024-04-21</li>
<li>[338908243] High CVE-2024-5158: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-05-06</li>
<li>[335613092] High CVE-2024-5159: Heap buffer overflow in ANGLE. Reported by David Sievers (@loknop) on 2024-04-18</li>
<li>[338161969] High CVE-2024-5160: Heap buffer overflow in Dawn. Reported by wgslfuzz on 2024-05-01</li>
<li>[340221135] High CVE-2024-4947: Type Confusion in V8. Reported by Vasily Berdnikov (@vaber_b) and Boris Larin (@oct0xor) of Kaspersky on 2024-05-13</li>
<li>[333414294] High CVE-2024-4948: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
<li>[326607001] Medium CVE-2024-4949: Use after free in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2024-02-24</li>
<li>[40065403] Low CVE-2024-4950: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-06-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-5157</cvename>
<cvename>CVE-2024-5158</cvename>
<cvename>CVE-2024-5159</cvename>
<cvename>CVE-2024-5160</cvename>
<cvename>CVE-2024-4947</cvename>
<cvename>CVE-2024-4948</cvename>
<cvename>CVE-2024-4949</cvename>
<cvename>CVE-2024-4950</cvename>
<url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2024-05-21</discovery>
<entry>2024-05-22</entry>
</dates>
</vuln>
<vuln vid="9bcff2c4-1779-11ef-b489-b42e991fc52e">
<topic>Openfire administration console authentication bypass</topic>
<affects>
<package>
<name>openfire</name>
<range><lt>4.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html">
<p>Openfire's administrative console, a web-based
application, was found to be vulnerable to a path traversal attack
via the setup environment. This permitted an unauthenticated user
to use the unauthenticated Openfire Setup Environment in an already
configured Openfire environment to access restricted pages in the
Openfire Admin Console reserved for administrative users. This
vulnerability affects all versions of Openfire that have been
released since April 2015, starting with version 3.10.0. The problem
has been patched in Openfire release 4.7.5 and 4.6.8, and further
improvements will be included in the yet-to-be released first version
on the 4.8 branch (which is expected to be version 4.8.0). Users
are advised to upgrade. If an Openfire upgrade isnt available for
a specific release, or isnt quickly actionable, users may see the
linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-32315</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-32315</url>
</references>
<dates>
<discovery>2023-05-26</discovery>
<entry>2024-05-21</entry>
</dates>
</vuln>
<vuln vid="e020b0fd-1751-11ef-a490-84a93843eb75">
<topic>Roundcube -- Cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.6.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7">
<p>cross-site scripting (XSS) vulnerability in handling SVG
animate attributes.</p>
<p>cross-site scripting (XSS) vulnerability in handling list
columns from user preferences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7</url>
</references>
<dates>
<discovery>2024-05-19</discovery>
<entry>2024-05-21</entry>
</dates>
</vuln>
<vuln vid="d58455cc-159e-11ef-83d8-4ccc6adda413">
<topic>qt5-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 2 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-3157: Out of bounds write in Compositing</li>
<li>CVE-2024-3516: Heap buffer overflow in ANGLE</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3157</cvename>
<cvename>CVE-2024-3516</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-04-16</discovery>
<entry>2024-05-19</entry>
</dates>
</vuln>
<vuln vid="f393b5a7-1535-11ef-8064-c5610a6efffb">
<topic>Arti -- Security issues related to circuit construction</topic>
<affects>
<package>
<name>arti</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tor Project reports:</p>
<blockquote cite="https://blog.torproject.org/arti_1_2_3_released/">
<p>
When building anonymizing circuits to or from an onion
service with 'lite' vanguards (the default) enabled, the
circuit manager code would build the circuits with one
hop too few.
</p>
<p>
When 'full' vanguards are enabled, some circuits are
supposed to be built with an extra hop to minimize the
linkability of the guard nodes. In some circumstances,
the circuit manager would build circuits with one hop
too few, making it easier for an adversary to discover
the L2 and L3 guards of the affected clients and
services.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-35313</cvename>
<url>https://gitlab.torproject.org/tpo/core/arti/-/issues/1400</url>
<cvename>CVE-2024-35312</cvename>
<url>https://gitlab.torproject.org/tpo/core/arti/-/issues/1409</url>
</references>
<dates>
<discovery>2024-05-14</discovery>
<entry>2024-05-18</entry>
</dates>
</vuln>
<vuln vid="b88aa380-1442-11ef-a490-84a93843eb75">
<topic>OpenSSL -- Denial of Service vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.13_4,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.5_4</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.1_4</lt></range>
</package>
<package>
<name>openssl33</name>
<range><lt>3.3.0_1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.13_4</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20240516.txt">
<p>Excessive time spent checking DSA keys and parameters (Low)</p>
<p>Checking excessively long DSA keys or parameters may be very
slow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4603</cvename>
<url>https://www.openssl.org/news/secadv/20240516.txt</url>
</references>
<dates>
<discovery>2024-05-16</discovery>
<entry>2024-05-17</entry>
</dates>
</vuln>
<vuln vid="a431676c-f86c-4371-b48a-b7d2b0bec3a3">
<topic>electron29 -- setuid() does not affect libuv's internal io_uring</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.0">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Backported fix for CVE-2024-22017.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-22017</cvename>
<url>https://github.com/advisories/GHSA-vr4q-vx84-9g5x</url>
</references>
<dates>
<discovery>2024-05-15</discovery>
<entry>2024-05-17</entry>
</dates>
</vuln>
<vuln vid="c6f03ea6-12de-11ef-83d8-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
<p>Backports for 16 security bugs in Chromium:</p>
<ul>
<li>CVE-2024-2625: Object lifecycle issue in V8</li>
<li>CVE-2024-2626: Out of bounds read in Swiftshader</li>
<li>CVE-2024-2885: Use after free in Dawn</li>
<li>CVE-2024-2887: Type Confusion in WebAssembly</li>
<li>CVE-2024-3157: Out of bounds write in Compositing</li>
<li>CVE-2024-3159: Out of bounds memory access in V8</li>
<li>CVE-2024-3516: Heap buffer overflow in ANGLE</li>
<li>CVE-2024-3837: Use after free in QUIC</li>
<li>CVE-2024-3839: Out of bounds read in Fonts</li>
<li>CVE-2024-3914: Use after free in V8</li>
<li>CVE-2024-3840: Insufficient policy enforcement in Site Isolation</li>
<li>CVE-2024-4058: Type Confusion in ANGLE</li>
<li>CVE-2024-4060: Use after free in Dawn</li>
<li>CVE-2024-4331: Use after free in Picture In Picture</li>
<li>CVE-2024-4368: Use after free in Dawn</li>
<li>CVE-2024-4671: Use after free in Visuals</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2625</cvename>
<cvename>CVE-2024-2626</cvename>
<cvename>CVE-2024-2885</cvename>
<cvename>CVE-2024-2887</cvename>
<cvename>CVE-2024-3157</cvename>
<cvename>CVE-2024-3159</cvename>
<cvename>CVE-2024-3516</cvename>
<cvename>CVE-2024-3837</cvename>
<cvename>CVE-2024-3839</cvename>
<cvename>CVE-2024-3914</cvename>
<cvename>CVE-2024-3840</cvename>
<cvename>CVE-2024-4058</cvename>
<cvename>CVE-2024-4060</cvename>
<cvename>CVE-2024-4331</cvename>
<cvename>CVE-2024-4368</cvename>
<cvename>CVE-2024-4671</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
</references>
<dates>
<discovery>2024-04-03</discovery>
<entry>2024-05-15</entry>
</dates>
</vuln>
<vuln vid="e79cc4e2-12d7-11ef-83d8-4ccc6adda413">
<topic>qt6-base (core module) -- Invalid pointer in QStringConverter</topic>
<affects>
<package>
<name>qt6-base</name>
<range><ge>6.5.0</ge><le>6.5.5</le></range>
<range><ge>6.6.0</ge><lt>6.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Shaw reports:</p>
<blockquote cite="https://www.qt.io/blog/security-advisory-qstringconverter">
<p>QStringConverter has an invalid pointer being passed as a callback
which can allow modification of the stack. Qt itself is not vulnerable
to remote attack however an application using QStringDecoder either
directly or indirectly can be vulnerable.</p>
<p>This requires:</p>
<ol>
<li>the attacker be able to tell the application a specific codec to use</li>
<li>the attacker be able to feed the application data in a specific way to cause the desired modification</li>
<li>the attacker what in the stack will get modified, which requires knowing the build of the application (and not all builds will be vulnerable)</li>
<li>the modification do anything in particular that is useful to the attacker, besides maybe crashing the application</li>
</ol>
<p>Qt does not automatically use any of those codecs, so this needs the application
to implement something using QStringDecoder to be vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-33861</cvename>
<url>https://www.qt.io/blog/security-advisory-qstringconverter</url>
</references>
<dates>
<discovery>2024-05-02</discovery>
<entry>2024-05-15</entry>
</dates>
</vuln>
<vuln vid="f2d8342f-1134-11ef-8791-6805ca2fa271">
<topic>dnsdist -- Transfer requests received over DoH can lead to a denial of service</topic>
<affects>
<package>
<name>dnsdist</name>
<range><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://dnsdist.org/security-advisories/index.html">
<p>When incoming DNS over HTTPS support is enabled using the nghttp2 provider,
and queries are routed to a tcp-only or DNS over TLS backend, an attacker can
trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR
or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a
Denial of Service. DNS over HTTPS is not enabled by default, and backends are using
plain DNS (Do53) by default.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-25581</cvename>
<url>https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2024-03.html</url>
</references>
<dates>
<discovery>2024-05-13</discovery>
<entry>2024-05-13</entry>
</dates>
</vuln>
<vuln vid="5afd64ae-122a-11ef-8eed-1c697a616631">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20240514</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html">
<p>
Potential security vulnerabilities in some Intel Trust Domain
Extensions (TDX) module software may allow escalation of
privilege. Improper input validation in some Intel TDX module
software before version 1.5.05.46.698 may allow a privileged user to
potentially enable escalation of privilege via local access. Intel
is releasing firmware updates to mitigate these potential
vulnerabilities.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html">
<p>
A potential security vulnerability in some Intel Processors may
allow information disclosure. Hardware logic contains race
conditions in some Intel Processors that may allow an authenticated
user to potentially enable partial information disclosure via local
access. Intel is releasing microcode updates to mitigate this
potential vulnerability.
</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html">
<p>
A potential security vulnerability in Intel Core Ultra Processors
may allow denial of service. Sequence of processor instructions
leads to unexpected behavior in Intel Core Ultra Processors may
allow an authenticated user to potentially enable denial of service
via local access. Intel is releasing microcode updates to mitigate
this potential vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45745</cvename>
<cvename>CVE-2023-45733</cvename>
<cvename>CVE-2023-46103</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240514</url>
</references>
<dates>
<discovery>2024-05-14</discovery>
<entry>2024-05-14</entry>
</dates>
</vuln>
<vuln vid="8e0e8b56-11c6-11ef-9f97-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>124.0.6367.207</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>124.0.6367.207</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[339458194] High CVE-2024-4761: Out of bounds write in V8. Reported by Anonymous on 2024-05-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4761</cvename>
<url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2024-05-13</discovery>
<entry>2024-05-14</entry>
</dates>
</vuln>
<vuln vid="d3847eba-114b-11ef-9c21-901b0e9408dc">
<topic>go -- net: malformed DNS message can cause infinite loop</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.3</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/66754">
<p>net: malformed DNS message can cause infinite loop</p>
<p>A malformed DNS message in response to a query can cause
the Lookup functions to get stuck in an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24788</cvename>
<url>https://go.dev/issue/66754</url>
</references>
<dates>
<discovery>2024-04-25</discovery>
<entry>2024-05-13</entry>
</dates>
</vuln>
<vuln vid="3cf8ea44-1029-11ef-9f97-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>124.0.6367.201</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>124.0.6367.201</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[339266700] High CVE-2024-4671: Use after free in Visuals. Reported by Anonymous on 2024-05-07</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4671</cvename>
<url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html</url>
</references>
<dates>
<discovery>2024-05-09</discovery>
<entry>2024-05-12</entry>
</dates>
</vuln>
<vuln vid="d53c30c1-0d7b-11ef-ba02-6cc21735f730">
<topic>PostgreSQL server -- Potentially allowing authenicated database users to see data that they shouldn't.</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>16.3</lt></range>
<range><lt>15.7</lt></range>
<range><lt>14.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-4317/">
<p>
A security vulnerability was found in the system views pg_stats_ext
and pg_stats_ext_exprs, potentially allowing authenticated database
users to see data they shouldn't. If this is of concern in your
installation, run the SQL script /usr/local/share/postgresql/fix-CVE-2024-4317.sql
for each of your databases. See the link for details.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4317</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-4317/</url>
</references>
<dates>
<discovery>2024-05-09</discovery>
<entry>2024-05-09</entry>
</dates>
</vuln>
<vuln vid="ee6936da-0ddd-11ef-9c21-901b0e9408dc">
<topic>tailscale -- Insufficient inbound packet filtering in subnet routers and exit nodes</topic>
<affects>
<package>
<name>tailscale</name>
<range><lt>1.66.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tailscale team reports:</p>
<blockquote cite="https://tailscale.com/security-bulletins#ts-2024-005">
<p>In Tailscale versions earlier than 1.66.0, exit nodes,
subnet routers, and app connectors, could allow inbound
connections to other tailnet nodes from their local area
network (LAN). This vulnerability only affects Linux exit
nodes, subnet routers, and app connectors in tailnets where
ACLs allow "src": "*", such as with default ACLs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tailscale.com/security-bulletins#ts-2024-005</url>
</references>
<dates>
<discovery>2024-05-08</discovery>
<entry>2024-05-09</entry>
</dates>
</vuln>
<vuln vid="ec994672-5284-49a5-a7fc-93c02126e5fb">
<topic>electron29 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.3.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-3914.</li>
<li>Security: backported fix for CVE-2024-4558.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3914</cvename>
<url>https://github.com/advisories/GHSA-jv87-hfr8-8j2r</url>
<cvename>CVE-2024-4558</cvename>
<url>https://github.com/advisories/GHSA-r4j8-j63p-24j8</url>
</references>
<dates>
<discovery>2024-05-09</discovery>
<entry>2024-05-09</entry>
</dates>
</vuln>
<vuln vid="fbc2c629-0dc5-11ef-9850-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>16.11.0</ge><lt>16.11.2</lt></range>
<range><ge>16.10.0</ge><lt>16.10.5</lt></range>
<range><ge>10.6.0</ge><lt>16.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/">
<p>ReDoS in branch search when using wildcards</p>
<p>ReDoS in markdown render pipeline</p>
<p>Redos on Discord integrations</p>
<p>Redos on Google Chat Integration</p>
<p>Denial of Service Attack via Pin Menu</p>
<p>DoS by filtering tags and branches via the API</p>
<p>MR approval via CSRF in SAML SSO</p>
<p>Banned user from groups can read issues updates via the api</p>
<p>Require confirmation before linking JWT identity</p>
<p>View confidential issues title and description of any public project via export</p>
<p>SSRF via Github importer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2878</cvename>
<cvename>CVE-2024-2651</cvename>
<cvename>CVE-2023-6682</cvename>
<cvename>CVE-2023-6688</cvename>
<cvename>CVE-2024-2454</cvename>
<cvename>CVE-2024-4539</cvename>
<cvename>CVE-2024-4597</cvename>
<cvename>CVE-2024-1539</cvename>
<cvename>CVE-2024-1211</cvename>
<cvename>CVE-2024-3976</cvename>
<cvename>CVE-2023-6195</cvename>
<url>https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/</url>
</references>
<dates>
<discovery>2024-05-08</discovery>
<entry>2024-05-09</entry>
</dates>
</vuln>
<vuln vid="059a99a9-45e0-492b-b9f9-5a79573c8eb6">
<topic>electron29 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron29</name>
<range><lt>29.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v29.3.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-4060.</li>
<li>Security: backported fix for CVE-2024-4058.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4060</cvename>
<url>https://github.com/advisories/GHSA-4qw6-vwc8-mh38</url>
<cvename>CVE-2024-4058</cvename>
<url>https://github.com/advisories/GHSA-23rw-79p3-xgcm</url>
</references>
<dates>
<discovery>2024-05-03</discovery>
<entry>2024-05-08</entry>
</dates>
</vuln>
<vuln vid="f69415aa-086e-11ef-9f97-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>124.0.6367.118</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>124.0.6367.118</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[335003891] High CVE-2024-4331: Use after free in Picture In Picture. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-04-16</li>
<li>[333508731] High CVE-2024-4368: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4058</cvename>
<cvename>CVE-2024-4059</cvename>
<cvename>CVE-2024-4060</cvename>
<url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2024-04-30</discovery>
<entry>2024-05-02</entry>
</dates>
</vuln>
<vuln vid="4a1e2bad-0836-11ef-9fd2-1c697a616631">
<topic>R -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>R</name>
<range><lt>4.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HiddenLayer Research reports:</p>
<blockquote cite="https://hiddenlayer.com/research/r-bitrary-code-execution/">
<p>Deserialization of untrusted data can occur in the R statistical programming language, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user's system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-27322</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-27322</url>
</references>
<dates>
<discovery>2024-04-29</discovery>
<entry>2024-05-02</entry>
</dates>
</vuln>
<vuln vid="da4adc02-07f4-11ef-960d-5404a68ad561">
<topic>hcode -- buffer overflow in mail.c</topic>
<affects>
<package>
<name>ko-hcode</name>
<range><lt>2.1.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The openSUSE project reports:</p>
<blockquote cite="https://bugzilla.suse.com/show_bug.cgi?id=1223534">
<p>The problematic function in question is putSDN() in mail.c. The static variable `cp` is used as an index for a fixed-sized buffer `ibuf`. There is a range check: `if ( cp >= HDR_BUF_LEN ) ...` but under certain circumstances, cp can be incremented beyond the buffer size, leading to a buffer overwrite</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-34020</cvename>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1223534</url>
</references>
<dates>
<discovery>2024-04-29</discovery>
<entry>2024-05-01</entry>
</dates>
</vuln>
<vuln vid="5da8b1e6-0591-11ef-9e00-080027957747">
<topic>GLPI -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.15,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GLPI team reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.15">
<p>GLPI 10.0.15 Changelog</p>
<ul>
<li>[SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)</li>
<li>[SECURITY - high] Account takeover via SQL Injection in saved searches feature (CVE-2024-29889)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31456</cvename>
<cvename>CVE-2024-29889</cvename>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.15</url>
</references>
<dates>
<discovery>2024-04-03</discovery>
<entry>2024-04-28</entry>
</dates>
</vuln>
<vuln vid="b3affee8-04d1-11ef-8928-901b0ef714d4">
<topic>py-social-auth-app-django -- Improper Handling of Case Sensitivity</topic>
<affects>
<package>
<name>py38-social-auth-app-django</name>
<name>py39-social-auth-app-django</name>
<name>py310-social-auth-app-django</name>
<name>py311-social-auth-app-django</name>
<range><lt>5.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Advisory Database:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-32879">
<p>Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-32879</cvename>
<url>https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3</url>
</references>
<dates>
<discovery>2024-04-24</discovery>
<entry>2024-04-28</entry>
</dates>
</vuln>
<vuln vid="7a42852d-0347-11ef-9f97-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>124.0.6367.78</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>124.0.6367.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[332546345] Critical CVE-2024-4058: Type Confusion in ANGLE. Reported by Toan (suto) Pham and Bao (zx) Pham of Qrious Secure on 2024-04-02</li>
<li>[333182464] High CVE-2024-4059: Out of bounds read in V8 API. Reported by Eirik on 2024-04-08</li>
<li>[333420620] High CVE-2024-4060: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4058</cvename>
<cvename>CVE-2024-4059</cvename>
<cvename>CVE-2024-4060</cvename>
<url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2024-04-24</discovery>
<entry>2024-04-25</entry>
</dates>
</vuln>
<vuln vid="10e86b16-6836-11ee-b06f-0050569ceb3a">
<topic>Unallowed PHP script execution in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the GLPI 10.0.10 Changelog:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.10">
<p>You will find below security issues fixed in this bugfixes version:
[SECURITY - Critical] Unallowed PHP script execution (CVE-2023-42802).</p>
</blockquote>
<p>The mentioned CVE is invalid</p>
</body>
</description>
<references>
<cvename>CVE-2023-42802</cvename>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.10</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="894f2491-6834-11ee-b06f-0050569ceb3a">
<topic>glpi-project -- SQL injection in ITIL actors in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-x3jp-69f2-p84w">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. The ITIL
actors input field from the Ticket form can be used to perform a
SQL injection. Users are advised to upgrade to version 10.0.10.
There are no known workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-42461</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-42461</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="54e5573a-6834-11ee-b06f-0050569ceb3a">
<topic>Phishing through a login page malicious URL in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. The lack
of path filtering on the GLPI URL may allow an attacker to transmit
a malicious URL of login page that can be used to attempt a phishing
attack on user credentials. Users are advised to upgrade to version
10.0.10. There are no known workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41888</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41888</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="20302cbc-6834-11ee-b06f-0050569ceb3a">
<topic>Users login enumeration by unauthenticated user in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5cf4-6q6r-49x9">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. An
unauthenticated user can enumerate users logins. Users are advised
to upgrade to version 10.0.10. There are no known workarounds for
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41323</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41323</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="ae8b1445-6833-11ee-b06f-0050569ceb3a">
<topic>Privilege Escalation from technician to super-admin in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.1.0,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-9j8m-7563-8xvr">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. A user
with write access to another user can make requests to change the
latter's password and then take control of their account.
Users are advised to upgrade to version 10.0.10. There are no known
work around for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41322</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41322</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="6851f3bb-6833-11ee-b06f-0050569ceb3a">
<topic>Sensitive fields enumeration through API in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.1.1,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-3fxw-j5rj-w836">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. An API
user can enumerate sensitive fields values on resources on which
he has read access. Users are advised to upgrade to version 10.0.10.
There are no known workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41321</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41321</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="df71f5aa-6831-11ee-b06f-0050569ceb3a">
<topic>File deletion through document upload process in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. The document
upload process can be diverted to delete some files. Users are
advised to upgrade to version 10.0.10. There are no known workarounds
for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-42462</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-42462</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="95c4ec45-6831-11ee-b06f-0050569ceb3a">
<topic>Account takeover through API in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.3.0,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-58wj-8jhx-jpm3">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. An API
user that have read access on users resource can steal accounts of
other users. Users are advised to upgrade to version 10.0.10.
There are no known workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41324</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41324</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="040e69f1-6831-11ee-b06f-0050569ceb3a">
<topic>Account takeover via Kanban feature in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5wj6-hp4c-j5q9">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. A logged
user from any profile can hijack the Kanban feature to alter any
user field, and end-up with stealing its account. Users are advised
to upgrade to version 10.0.10. There are no known workarounds for
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41326</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41326</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="6f6518ab-6830-11ee-b06f-0050569ceb3a">
<topic>Account takeover via SQL Injection in UI layout preferences in GLPI</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-mv2r-gpw3-g476">
<p>GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
Asset and IT Management Software package, that provides ITIL Service
Desk features, licenses tracking and software auditing. UI layout
preferences management can be hijacked to lead to SQL injection.
This injection can be use to takeover an administrator account.
Users are advised to upgrade to version 10.0.10. There are no known
workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41320</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-41320</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="257e1bf0-682f-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to SQL injection via dashboard administration</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>10.0.9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.9">
<p>GLPI is a Free Asset and IT Management Software package, Data center
management, ITIL Service Desk, licenses tracking and software
auditing. An administrator can trigger SQL injection via dashboards
administration. This vulnerability has been patched in version
10.0.9.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-37278</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-37278</url>
</references>
<dates>
<discovery>2023-07-13</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="40173815-6827-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to unauthorized access to User data</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Versions
of the software starting with 0.68 and prior to 10.0.8 have an
incorrect rights check on a on a file accessible by an authenticated
user. This allows access to the list of all users and their personal
information. Users should upgrade to version 10.0.8 to receive a
patch.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-34106</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-34106</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="1fe40200-6823-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to unauthorized access to KnowbaseItem data</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.2.0,1</ge><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Versions
of the software starting with 9.2.0 and prior to 10.0.8 have an
incorrect rights check on a on a file accessible by an authenticated
user, allows access to the view all KnowbaseItems. Version 10.0.8
has a patch for this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-34107</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-34107</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="b14a6ddc-6821-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to reflected XSS in search pages</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.4.0,1</ge><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Starting
in version 9.4.0 and prior to version 10.0.8, a malicious link can
be crafted by an unauthenticated user that can exploit a reflected
XSS in case any authenticated user opens the crafted link. Users
should upgrade to version 10.0.8 to receive a patch.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-34244</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-34244</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="95fde6bc-6821-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to unauthenticated access to Dashboard data</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Starting
in version 9.5.0 and prior to version 10.0.8, an incorrect rights
check on a file allows an unauthenticated user to be able to access
dashboards data. Version 10.0.8 contains a patch for this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-35940</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-35940</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="717efd8a-6821-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to unauthorized access to Dashboard data</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Starting
in version 9.5.0 and prior to version 10.0.8, an incorrect rights
check on a on a file accessible by an authenticated user (or not
for certain actions), allows a threat actor to interact, modify,
or see Dashboard data. Version 10.0.8 contains a patch for this
issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-35939</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-35939</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="548a4163-6821-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to SQL injection through Computer Virtual Machine information</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Starting
in version 0.80 and prior to version 10.0.8, Computer Virtual Machine
form and GLPI inventory request can be used to perform a SQL injection
attack. Version 10.0.8 has a patch for this issue. As a workaround,
one may disable native inventory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36808</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-36808</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="e44e5ace-6820-11ee-b06f-0050569ceb3a">
<topic>GLPI vulnerable to SQL injection via inventory agent request</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>10.0.0,1</ge><lt>10.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
<p>GLPI is a free asset and IT management software package. Starting
in version 10.0.0 and prior to version 10.0.8, GLPI inventory
endpoint can be used to drive a SQL injection attack. By default,
GLPI inventory endpoint requires no authentication. Version 10.0.8
has a patch for this issue. As a workaround, one may disable native
inventory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-35924</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-35924</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="bdfa6c04-027a-11ef-9c21-901b0e9408dc">
<topic>py-matrix-synapse -- weakness in auth chain indexing allows DoS</topic>
<affects>
<package>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<name>py311-matrix-synapse</name>
<range><lt>1.105.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://element.io/blog/security-release-synapse-1-105-1/">
<p>Weakness in auth chain indexing allows DoS from remote
room members through disk fill and high CPU usage. (High severity)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31208</cvename>
<url>https://element.io/blog/security-release-synapse-1-105-1/</url>
<url>https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4v</url>
</references>
<dates>
<discovery>2024-04-23</discovery>
<entry>2024-04-24</entry>
</dates>
</vuln>
<vuln vid="b857606c-0266-11ef-8681-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>16.11.0</ge><lt>16.11.1</lt></range>
<range><ge>16.10.0</ge><lt>16.10.4</lt></range>
<range><ge>7.8.0</ge><lt>16.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/">
<p>GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider</p>
<p>Path Traversal leads to DoS and Restricted File Read</p>
<p>Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search</p>
<p>Personal Access Token scopes not honoured by GraphQL subscriptions</p>
<p>Domain based restrictions bypass using a crafted email address</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-4024</cvename>
<cvename>CVE-2024-2434</cvename>
<cvename>CVE-2024-2829</cvename>
<cvename>CVE-2024-4006</cvename>
<cvename>CVE-2024-1347</cvename>
<url>https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/</url>
</references>
<dates>
<discovery>2024-04-24</discovery>
<entry>2024-04-24</entry>
</dates>
</vuln>
<vuln vid="1af16f2b-023c-11ef-8791-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/2024/04/24/powerdns-recursor-4-8-8-4-9-5-5-0-4-released">
<p>PowerDNS Security Advisory 2024-02: if recursive forwarding is configured,
crafted responses can lead to a denial of service in Recursor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-25583</cvename>
<url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html</url>
</references>
<dates>
<discovery>2024-04-24</discovery>
<entry>2024-04-24</entry>
</dates>
</vuln>
<vuln vid="bb49f1fa-00da-11ef-92b7-589cfc023192">
<topic>GLPI -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.13,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GLPI team reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.13">
<p>GLPI 10.0.13 Changelog</p>
<ul>
<li>[SECURITY - high] SQL Injection in through the search engine (CVE-2024-27096)</li>
<li>[SECURITY - moderate] Blind SSRF using Arbitrary Object Instantiation (CVE-2024-27098)</li>
<li>[SECURITY - moderate] Stored XSS in dashboards (CVE-2024-27104)</li>
<li>[SECURITY - moderate] Reflected XSS in debug mode (CVE-2024-27914)</li>
<li>[SECURITY - moderate] Sensitive fields access through dropdowns (CVE-2024-27930)</li>
<li>[SECURITY - moderate] Users emails enumeration (CVE-2024-27937)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-27096</cvename>
<cvename>CVE-2024-27098</cvename>
<cvename>CVE-2024-27104</cvename>
<cvename>CVE-2024-27914</cvename>
<cvename>CVE-2024-27930</cvename>
<cvename>CVE-2024-27937</cvename>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.13</url>
</references>
<dates>
<discovery>2024-03-13</discovery>
<entry>2024-04-22</entry>
</dates>
</vuln>
<vuln vid="faccf131-00d9-11ef-92b7-589cfc023192">
<topic>GLPI -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GLPI team reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.12">
<p>GLPI 10.0.12 Changelog</p>
<ul>
<li>[SECURITY - moderate] Reflected XSS in reports pages (CVE-2024-23645)</li>
<li>[SECURITY - moderate] LDAP Injection during authentication (CVE-2023-51446)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-23645</cvename>
<cvename>CVE-2023-51446</cvename>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.12</url>
</references>
<dates>
<discovery>2024-02-01</discovery>
<entry>2024-04-22</entry>
</dates>
</vuln>
<vuln vid="ed688880-00c4-11ef-92b7-589cfc023192">
<topic>GLPI -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.11,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GLPI team reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.11">
<p>GLPI 10.0.11 Changelog</p>
<ul>
<li>[SECURITY - moderate] Authenticated SQL Injection (CVE-2023-43813)</li>
<li>[SECURITY - high] SQL injection through inventory agent request (CVE-2023-46727)</li>
<li>[SECURITY - high] Remote code execution from LDAP server configuration form on PHP 7.4 (CVE-2023-46726)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43813</cvename>
<cvename>CVE-2023-46727</cvename>
<cvename>CVE-2023-46726</cvename>
<url>https://github.com/glpi-project/glpi/releases/tag/10.0.11</url>
</references>
<dates>
<discovery>2023-12-13</discovery>
<entry>2024-04-22</entry>
</dates>
</vuln>
<vuln vid="2ce1a2f1-0177-11ef-a45e-08002784c58d">
<topic>ruby -- Arbitrary memory address read vulnerability with Regex search</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>3.1.0,1</ge><lt>3.1.5,1</lt></range>
<range><ge>3.2.0,1</ge><lt>3.2.4,1</lt></range>
<range><ge>3.3.0,1</ge><lt>3.3.1,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.5,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0,1</ge><lt>3.2.4,1</lt></range>
</package>
<package>
<name>ruby33</name>
<range><ge>3.3.0,1</ge><lt>3.3.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sp2ip reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/">
<p>
If attacker-supplied data is provided to the Ruby regex
compiler, it is possible to extract arbitrary heap data
relative to the start of the text, including pointers and
sensitive strings.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-27282</cvename>
<url>https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/</url>
</references>
<dates>
<discovery>2024-04-23</discovery>
<entry>2024-04-23</entry>
</dates>
</vuln>
<vuln vid="304d92c3-00c5-11ef-bd52-080027bff743">
<topic>sdl2_sound -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sdl2_sound</name>
<range><lt>2.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Security Lab reports:</p>
<blockquote cite="https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/">
<p>stb_image.h and stb_vorbis libraries contain several memory access violations of different severity</p>
<ol>
<li>Wild address read in stbi__gif_load_next (GHSL-2023-145).</li>
<li>Multi-byte read heap buffer overflow in stbi__vertical_flip (GHSL-2023-146).</li>
<li>Disclosure of uninitialized memory in stbi__tga_load (GHSL-2023-147).</li>
<li>Double-free in stbi__load_gif_main_outofmem (GHSL-2023-148).</li>
<li>Null pointer dereference in stbi__convert_format (GHSL-2023-149).</li>
<li>Possible double-free or memory leak in stbi__load_gif_main (GHSL-2023-150).</li>
<li>Null pointer dereference because of an uninitialized variable (GHSL-2023-151).</li>
<li>0 byte write heap buffer overflow in start_decoder (GHSL-2023-165)</li>
<li>Multi-byte write heap buffer overflow in start_decoder (GHSL-2023-166)</li>
<li>Heap buffer out of bounds write in start_decoder (GHSL-2023-167)</li>
<li>Off-by-one heap buffer write in start_decoder (GHSL-2023-168)</li>
<li>Attempt to free an uninitialized memory pointer in vorbis_deinit (GHSL-2023-169)</li>
<li>Null pointer dereference in vorbis_deinit (GHSL-2023-170)</li>
<li>Out of bounds heap buffer write (GHSL-2023-171)</li>
<li>Wild address read in vorbis_decode_packet_rest (GHSL-2023-172)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45676</cvename>
<cvename>CVE-2023-45677</cvename>
<cvename>CVE-2023-45680</cvename>
<cvename>CVE-2023-45681</cvename>
<cvename>CVE-2023-45682</cvename>
<url>https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/</url>
</references>
<dates>
<discovery>2023-10-20</discovery>
<entry>2024-04-22</entry>
</dates>
</vuln>
<vuln vid="9bed230f-ffc8-11ee-8e76-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>124.0.6367.60</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>124.0.6367.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html">
<p>This update includes 23 security fixes:</p>
<ul>
<li>[331358160] High CVE-2024-3832: Object corruption in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27</li>
<li>[331383939] High CVE-2024-3833: Object corruption in WebAssembly. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27</li>
<li>[330759272] High CVE-2024-3914: Use after free in V8. Reported by Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024 on 2024-03-21</li>
<li>[326607008] High CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang on 2024-02-24</li>
<li>[41491379] Medium CVE-2024-3837: Use after free in QUIC. Reported by {rotiple, dch3ck} of CW Research Inc. on 2024-01-15</li>
<li>[328278717] Medium CVE-2024-3838: Inappropriate implementation in Autofill. Reported by Ardyan Vicky Ramadhan on 2024-03-06</li>
<li>[41491859] Medium CVE-2024-3839: Out of bounds read in Fonts. Reported by Ronald Crane (Zippenhop LLC) on 2024-01-16</li>
<li>[41493458] Medium CVE-2024-3840: Insufficient policy enforcement in Site Isolation. Reported by Ahmed ElMasry on 2024-01-22</li>
<li>[330376742] Medium CVE-2024-3841: Insufficient data validation in Browser Switcher. Reported by Oleg on 2024-03-19</li>
<li>[41486690] Medium CVE-2024-3843: Insufficient data validation in Downloads. Reported by Azur on 2023-12-24</li>
<li>[40058873] Low CVE-2024-3844: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2022-02-23</li>
<li>[323583084] Low CVE-2024-3845: Inappropriate implementation in Network. Reported by Daniel Baulig on 2024-02-03</li>
<li>[40064754] Low CVE-2024-3846: Inappropriate implementation in Prompts. Reported by Ahmed ElMasry on 2023-05-23</li>
<li>[328690293] Low CVE-2024-3847: Insufficient policy enforcement in WebUI. Reported by Yan Zhu on 2024-03-08</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3832</cvename>
<cvename>CVE-2024-3833</cvename>
<cvename>CVE-2024-3914</cvename>
<cvename>CVE-2024-3834</cvename>
<cvename>CVE-2024-3837</cvename>
<cvename>CVE-2024-3838</cvename>
<cvename>CVE-2024-3839</cvename>
<cvename>CVE-2024-3840</cvename>
<cvename>CVE-2024-3841</cvename>
<cvename>CVE-2024-3843</cvename>
<cvename>CVE-2024-3844</cvename>
<cvename>CVE-2024-3845</cvename>
<cvename>CVE-2024-3846</cvename>
<cvename>CVE-2024-3847</cvename>
<url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html</url>
</references>
<dates>
<discovery>2024-04-16</discovery>
<entry>2024-04-21</entry>
</dates>
</vuln>
<vuln vid="ecafc4af-fe8a-11ee-890c-08002784c58d">
<topic>clamav -- Possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>1.3.0,1</ge><lt>1.3.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Błażej Pawłowski reports:</p>
<blockquote cite="https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html">
<p>
A vulnerability in the HTML parser of ClamAV could allow
an unauthenticated, remote attacker to cause a denial of
service (DoS) condition on an affected device. The
vulnerability is due to an issue in the C to Rust foreign
function interface. An attacker could exploit this
vulnerability by submitting a crafted file containing HTML
content to be scanned by ClamAV on an affected device. An
exploit could allow the attacker to cause the ClamAV
scanning process to terminate, resulting in a DoS
condition on the affected software.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-20380</cvename>
<url>https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html</url>
</references>
<dates>
<discovery>2024-04-17</discovery>
<entry>2024-04-19</entry>
</dates>
</vuln>
<vuln vid="4ebdd56b-fe72-11ee-bc57-00e081b7aa2d">
<topic>jenkins -- Terrapin SSH vulnerability in Jenkins CLI client</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.452</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.440.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-04-17/">
<h1>Description</h1>
<h5>(Medium) SECURITY-3386 / CVE-2023-48795</h5>
<p>Terrapin SSH vulnerability in Jenkins CLI client</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-48795</cvename>
<url>https://www.jenkins.io/security/advisory/2024-04-17/</url>
</references>
<dates>
<discovery>2024-04-17</discovery>
<entry>2024-04-19</entry>
</dates>
</vuln>
<vuln vid="f90bf863-e43c-4db3-b5a8-d9603684657a">
<topic>electron{27,28,29} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.11</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.3.1</lt></range>
</package>
<package>
<name>electron29</name>
<range><lt>29.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron develpers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.11">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-3515.</li>
<li>Security: backported fix for CVE-2024-3516.</li>
<li>Security: backported fix for CVE-2024-3157.</li>
<li>Security: backported fix for CVE-2024-1580.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3515</cvename>
<url>https://github.com/advisories/GHSA-x6cj-gx36-vcxv</url>
<cvename>CVE-2024-3516</cvename>
<url>https://github.com/advisories/GHSA-jf9g-42gm-v87w</url>
<cvename>CVE-2024-3157</cvename>
<url>https://github.com/advisories/GHSA-4m4g-p795-cmq7</url>
<cvename>CVE-2024-1580</cvename>
<url>https://github.com/advisories/GHSA-3p7f-4r2q-wxmm</url>
</references>
<dates>
<discovery>2024-04-16</discovery>
<entry>2024-04-18</entry>
</dates>
</vuln>
<vuln vid="6d82c5e9-fc24-11ee-a689-04421a1baf97">
<topic>php -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php81</name>
<range><lt>8.1.28</lt></range>
</package>
<package>
<name>php82</name>
<range><lt>8.2.18</lt></range>
</package>
<package>
<name>php83</name>
<range><lt>8.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>This update includes 3 security fixes:</p>
<blockquote cite="https://seclists.org/oss-sec/2024/q2/113/">
<ul>
<li>High CVE-2024-1874: Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows</li>
<li>High CVE-2024-1874: Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows</li>
<li>Medium CVE-2024-2756: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix</li>
<li>High CVE-2024-2757: mb_encode_mimeheader runs endlessly for some inputs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1874</cvename>
<url>https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7</url>
<cvename>CVE-2024-2756</cvename>
<url>https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4</url>
<cvename>CVE-2024-3096</cvename>
<url>https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr</url>
<cvename>CVE-2024-2757</cvename>
<url>https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq</url>
</references>
<dates>
<discovery>2024-04-11</discovery>
<entry>2024-04-16</entry>
</dates>
</vuln>
<vuln vid="cdb5e0e3-fafc-11ee-9c21-901b0e9408dc">
<topic>go -- http2: close connections when receiving too many headers</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.2</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/65051">
<p>http2: close connections when receiving too many headers</p>
<p>Maintaining HPACK state requires that we parse and
process all HEADERS and CONTINUATION frames on a
connection. When a request's headers exceed MaxHeaderBytes,
we don't allocate memory to store the excess headers but we
do parse them. This permits an attacker to cause an HTTP/2
endpoint to read arbitrary amounts of header data, all
associated with a request which is going to be
rejected. These headers can include Huffman-encoded data
which is significantly more expensive for the receiver to
decode than for an attacker to send.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45288</cvename>
<url>https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M/m/khALNYGdAAAJ</url>
</references>
<dates>
<discovery>2024-04-03</discovery>
<entry>2024-04-15</entry>
</dates>
</vuln>
<vuln vid="7314942b-0889-46f0-b02b-2c60aabe4a82">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>123.0.6312.122</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>123.0.6312.122</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[331237485] High CVE-2024-3157: Out of bounds write in Compositing. Reported by DarkNavy on 2024-03-26</li>
<li>[328859176] High CVE-2024-3516: Heap buffer overflow in ANGLE. Reported by Bao (zx) Pham and Toan (suto) Pham of Qrious Secure on 2024-03-09</li>
<li>[331123811] High CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz on 2024-03-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3157</cvename>
<cvename>CVE-2024-3516</cvename>
<cvename>CVE-2024-3515</cvename>
<url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2024-04-10</discovery>
<entry>2024-04-12</entry>
</dates>
</vuln>
<vuln vid="080936ba-fbb7-11ee-abc8-6960f2492b1d">
<topic>PuTTY and embedders (f.i., filezilla) -- biased RNG with NIST P521/ecdsa-sha2-nistp521 signatures permits recovering private key</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.68</ge><lt>0.81</lt></range>
</package>
<package>
<name>putty-nogtk</name>
<range><ge>0.68</ge><lt>0.81</lt></range>
</package>
<package>
<name>filezilla</name>
<range><lt>3.67.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2024/000038.html">
<p>ECDSA signatures using 521-bit keys (the NIST P521 curve,
otherwise known as ecdsa-sha2-nistp521) were generated with biased
random numbers. This permits an attacker in possession of a few
dozen signatures to RECOVER THE PRIVATE KEY.</p>
<p>Any 521-bit ECDSA private key that PuTTY or Pageant has used to
sign anything should be considered compromised.</p>
<p>Additionally, if you have any 521-bit ECDSA private keys that
you've used with PuTTY, you should consider them to be
compromised: generate new keys, and remove the old public keys
from any authorized_keys files.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-31497">
<p>
A second, independent scenario is that the adversary is an operator
of an SSH server to which the victim authenticates (for remote login
or file copy), [...] and the victim uses the same private key for
SSH connections to other services operated by other entities. Here,
the rogue server operator (who would otherwise have no way to
determine the victim's private key) can derive the victim's private
key, and then use it for unauthorized access to those other
services. If the other services include Git services, then again it
may be possible to conduct supply-chain attacks on software
maintained in Git. This also affects, for example, FileZilla before
3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and
TortoiseSVN through 1.14.6.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31497</cvename>
<url>https://lists.tartarus.org/pipermail/putty-announce/2024/000038.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html</url>
<url>https://git.tartarus.org/?h=c193fe9848f50a88a4089aac647fecc31ae96d27&p=simon/putty.git</url>
<url>https://filezilla-project.org/versions.php</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-31497</url>
</references>
<dates>
<discovery>2024-04-01</discovery> <!-- see git.tartarus.org link to commit c193fe9848f -->
<entry>2024-04-16</entry>
</dates>
</vuln>
<vuln vid="31617e47-7eec-4c60-9fdf-8aee61622bab">
<topic>electron{27,28} -- Out of bounds memory access in V8</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.10</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.10">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-3159.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3159</cvename>
<url>https://github.com/advisories/GHSA-mh2p-2x66-3hr4</url>
</references>
<dates>
<discovery>2024-04-10</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="7c217849-f7d7-11ee-a490-84a93843eb75">
<topic>OpenSSL -- Unbounded memory growth with session handling in TLSv1.3</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.13_3,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.5_3</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.1_2</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.13_3</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20240408.txt">
<p>Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2511</cvename>
<url>https://www.openssl.org/news/secadv/20240408.txt</url>
</references>
<dates>
<discovery>2024-04-08</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="c092be0e-f7cc-11ee-aa6b-b42e991fc52e">
<topic>forgejo -- HTTP/2 CONTINUATION flood in net/http</topic>
<affects>
<package>
<name>forgejo</name>
<range><lt>1.21.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@golang.org reports:</p>
<blockquote cite="https://go.dev/cl/576155">
<p>An attacker may cause an HTTP/2 endpoint to read arbitrary amounts
of header data by sending an excessive number of CONTINUATION frames.
Maintaining HPACK state requires parsing and processing all HEADERS
and CONTINUATION frames on a connection. When a request's
headers exceed MaxHeaderBytes, no memory is allocated to store the
excess headers, but they are still parsed. This permits an attacker
to cause an HTTP/2 endpoint to read arbitrary amounts of header
data, all associated with a request which is going to be rejected.
These headers can include Huffman-encoded data which is significantly
more expensive for the receiver to decode than for an attacker to
send. The fix sets a limit on the amount of excess header frames
we will process before closing a connection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45288</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-45288</url>
</references>
<dates>
<discovery>2024-04-04</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="02be46c1-f7cc-11ee-aa6b-b42e991fc52e">
<topic>jose -- DoS vulnerability</topic>
<affects>
<package>
<name>jose</name>
<range><lt>13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md">
<p>
latchset jose through version 11 allows attackers to cause
a denial of service (CPU consumption) via a large p2c (aka
PBES2 Count) value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-50967</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-50967</url>
</references>
<dates>
<discovery>2024-03-20</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="dad6294c-f7c1-11ee-bb77-001b217b3468">
<topic>Gitlab -- Patch Release: 16.10.2, 16.9.4, 16.8.6</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.10.0</ge><lt>16.10.2</lt></range>
<range><ge>16.9.0</ge><lt>16.9.4</lt></range>
<range><lt>16.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/">
<p>Stored XSS injected in diff viewer</p>
<p>Stored XSS via autocomplete results</p>
<p>Redos on Integrations Chat Messages</p>
<p>Redos During Parse Junit Test Report</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3092</cvename>
<cvename>CVE-2024-2279</cvename>
<cvename>CVE-2023-6489</cvename>
<cvename>CVE-2023-6678</cvename>
<url>https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/</url>
</references>
<dates>
<discovery>2024-04-10</discovery>
<entry>2024-04-11</entry>
</dates>
</vuln>
<vuln vid="ea4a2dfc-f761-11ee-af2c-589cfc0f81b0">
<topic>wordpress -- XSS</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress-fr_FR</name>
<range><ge>6.5.0,1</ge><lt>6.5.1,1</lt></range>
<range><lt>6.4.4,1</lt></range>
</package>
<package>
<name>ru-wordpress-ru_RU</name>
<name>ja-wordpress-ja</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<name>de-wordpress-de_DE</name>
<range><ge>6.5.0</ge><lt>6.5.1</lt></range>
<range><lt>6.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Wordpress team reports:</p>
<blockquote cite="https://wordpress.org/documentation/wordpress-version/version-6-4-4/">
<p>A cross-site scripting (XSS) vulnerability affecting the Avatar block type</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/documentation/wordpress-version/version-6-4-4/</url>
</references>
<dates>
<discovery>2024-04-09</discovery>
<entry>2024-04-10</entry>
</dates>
</vuln>
<vuln vid="8e6f684b-f333-11ee-a573-84a93843eb75">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.59</lt></range>
</package>
<package>
<name>mod_http2</name>
<range><lt>2.0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.59">
<p>HTTP/2 DoS by memory exhaustion on endless continuation frames</p>
<p>HTTP Response Splitting in multiple modules</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-27316</cvename>
<cvename>CVE-2024-24795</cvename>
<cvename>CVE-2024-38709</cvename>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.59</url>
</references>
<dates>
<discovery>2024-04-04</discovery>
<entry>2024-04-05</entry>
</dates>
</vuln>
<vuln vid="c2431c4e-622c-4d92-996d-d8b5258ae8c9">
<topic>electron{27,28} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.9</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.9">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-2885.</li>
<li>Security: backported fix for CVE-2024-2883.</li>
<li>Security: backported fix for CVE-2024-2887.</li>
<li>Security: backported fix for CVE-2024-2886.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2885</cvename>
<url>https://github.com/advisories/GHSA-qccw-wmvp-8pv9</url>
<cvename>CVE-2024-2883</cvename>
<url>https://github.com/advisories/GHSA-gg9c-7j6m-3qq2</url>
<cvename>CVE-2024-2887</cvename>
<url>https://github.com/advisories/GHSA-q75f-2pp5-9phj</url>
<cvename>CVE-2024-2886</cvename>
<url>https://github.com/advisories/GHSA-5pj4-f8gh-j3mr</url>
</references>
<dates>
<discovery>2024-04-03</discovery>
<entry>2024-04-05</entry>
</dates>
</vuln>
<vuln vid="4a026b6c-f2b8-11ee-8e76-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>123.0.6312.105</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>123.0.6312.105</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[329130358] High CVE-2024-3156: Inappropriate implementation in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-03-12</li>
<li>[329965696] High CVE-2024-3158: Use after free in Bookmarks. Reported by undoingfish on 2024-03-17</li>
<li>[330760873] High CVE-2024-3159: Out of bounds memory access in V8. Reported by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks, via Pwn2Own 2024 on 2024-03-22</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-3156</cvename>
<cvename>CVE-2024-3158</cvename>
<cvename>CVE-2024-3159</cvename>
<url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-04-02</discovery>
<entry>2024-04-04</entry>
</dates>
</vuln>
<vuln vid="57561cfc-f24b-11ee-9730-001fc69cd6dc">
<topic>xorg server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.12,1</lt></range>
</package>
<package>
<name>xorg-nextserver</name>
<range><lt>21.1.12,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>23.2.5</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><ge>21.0.99.1.672</ge><lt>21.0.99.1.841_1</lt></range>
<range><lt>21.0.99.1.671_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2024-April/003497.html">
<ul>
<li>
CVE-2024-31080: Heap buffer overread/data leakage in
ProcXIGetSelectedEvents
<p>The ProcXIGetSelectedEvents() function uses the byte-swapped
length of the return data for the amount of data to return to
the client, if the client has a different endianness than
the X server.</p>
</li>
<li>CVE-2024-31081: Heap buffer overread/data leakage in
ProcXIPassiveGrabDevice
<p>The ProcXIPassiveGrabDevice() function uses the byte-swapped
length of the return data for the amount of data to return to
the client, if the client has a different endianness than
the X server.</p>
</li>
<li>CVE-2024-31083: User-after-free in ProcRenderAddGlyphs
<p>The ProcRenderAddGlyphs() function calls the AllocateGlyph()
function to store new glyphs sent by the client to the X server.
AllocateGlyph() would return a new glyph with refcount=0 and
a re-used glyph would end up not changing the refcount at all.
The resulting glyph_new array would thus have multiple entries
pointing to the same non-refcounted glyphs.
ProcRenderAddGlyphs() may free a glyph, resulting in a
use-after-free when the same glyph pointer is then later used.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-31080</cvename>
<cvename>CVE-2024-31081</cvename>
<cvename>CVE-2024-31083</cvename>
<url>https://lists.x.org/archives/xorg-announce/2024-April/003497.html</url>
</references>
<dates>
<discovery>2024-04-03</discovery>
<entry>2024-04-04</entry>
</dates>
</vuln>
<vuln vid="2e3bea0c-f110-11ee-bc57-00e081b7aa2d">
<topic>jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.444</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.440.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-03-20/">
<h1>Description</h1>
<h5>(High) SECURITY-3379 / CVE-2024-22201</h5>
<p>HTTP/2 denial of service vulnerability in bundled Jetty</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-22201</cvename>
<url>https://www.jenkins.io/security/advisory/2024-03-20/</url>
</references>
<dates>
<discovery>2024-03-20</discovery>
<entry>2024-04-02</entry>
</dates>
</vuln>
<vuln vid="d58726ff-ef5e-11ee-8d8e-080027a5b8e9">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki139</name>
<range><lt>1.39.7</lt></range>
</package>
<package>
<name>mediawiki140</name>
<range><lt>1.40.3</lt></range>
</package>
<package>
<name>mediawiki141</name>
<range><lt>1.41.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/">
<p>(T355538, CVE-2024-PENDING) SECURITY: XSS in edit summary parser.</p>
<p>(T357760, CVE-2024-PENDING) SECURITY: Denial of service vector via GET
request to Special:MovePage on pages with thousands of subpages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/</url>
</references>
<dates>
<discovery>2024-03-15</discovery>
<entry>2024-03-31</entry>
</dates>
</vuln>
<vuln vid="bdcd041e-5811-4da3-9243-573a9890fdb1">
<topic>electron{27,28} -- Object lifecycle issue in V8</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.8</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.8">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-2625.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2625</cvename>
<url>https://github.com/advisories/GHSA-j7h3-fcrw-g6j8</url>
</references>
<dates>
<discovery>2024-03-28</discovery>
<entry>2024-03-29</entry>
</dates>
</vuln>
<vuln vid="d2992bc2-ed18-11ee-96dc-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.10.0</ge><lt>16.10.1</lt></range>
<range><ge>16.9.0</ge><lt>16.9.3</lt></range>
<range><lt>16.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/">
<p>Stored-XSS injected in Wiki page via Banzai pipeline</p>
<p>DOS using crafted emojis</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6371</cvename>
<cvename>CVE-2024-2818</cvename>
<url>https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/</url>
</references>
<dates>
<discovery>2024-03-27</discovery>
<entry>2024-03-28</entry>
</dates>
</vuln>
<vuln vid="814af1be-ec63-11ee-8e76-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>123.0.6312.86</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>123.0.6312.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html">
<p>This update includes 7 security fixes:</p>
<ul>
<li>[327807820] Critical CVE-2024-2883: Use after free in ANGLE. Reported by Cassidy Kim(@cassidy6564) on 2024-03-03</li>
<li>[328958020] High CVE-2024-2885: Use after free in Dawn. Reported by wgslfuzz on 2024-03-11</li>
<li>[330575496] High CVE-2024-2886: Use after free in WebCodecs. Reported by Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024 on 2024-03-21</li>
<li>[330588502] High CVE-2024-2887: Type Confusion in WebAssembly. Reported by Manfred Paul, via Pwn2Own 2024 on 2024-03-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2883</cvename>
<cvename>CVE-2024-2885</cvename>
<cvename>CVE-2024-2886</cvename>
<cvename>CVE-2024-2887</cvename>
<url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2024-03-26</discovery>
<entry>2024-03-27</entry>
</dates>
</vuln>
<vuln vid="8b3be705-eba7-11ee-99b3-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq-php81</name>
<name>phpmyfaq-php82</name>
<name>phpmyfaq-php83</name>
<range><lt>3.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyFAQ team reports:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2024-03-25">
<p>The phpMyFAQ Team has learned of multiple security issues that'd
been discovered in phpMyFAQ 3.2.5 and earlier. phpMyFAQ contains
cross-site scripting (XSS), SQL injection and bypass
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mmh6-5cpf-2c72</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2grw-mc9r-822r</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392r</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pwh2-fpfr-x5gf</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-q7g6-xfh2-vhpx</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcw</url>
</references>
<dates>
<discovery>2024-03-25</discovery>
<entry>2024-03-26</entry>
</dates>
</vuln>
<vuln vid="f661184a-eb90-11ee-92fc-1c697a616631">
<topic>emacs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<range><lt>29.3,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Emacs developers report:</p>
<blockquote cite="https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3">
<p>Emacs 29.3 is an emergency bugfix release intended to fix several security vulnerabilities.</p>
<ul>
<li>Arbitrary Lisp code is no longer evaluated as part of turning on Org mode. This is for security reasons, to avoid evaluating malicious Lisp code.</li>
<li>New buffer-local variable 'untrusted-content'. When this is non-nil, Lisp programs should treat buffer contents with extra caution.</li>
<li>Gnus now treats inline MIME contents as untrusted. To get back previous insecure behavior, 'untrusted-content' should be reset to nil in the buffer.</li>
<li>LaTeX preview is now by default disabled for email attachments. To get back previous insecure behavior, set the variable 'org--latex-preview-when-risky' to a non-nil value.</li>
<li>Org mode now considers contents of remote files to be untrusted. Remote files are recognized by calling 'file-remote-p'.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-30202</cvename>
<cvename>CVE-2024-30203</cvename>
<cvename>CVE-2024-30204</cvename>
<cvename>CVE-2024-30205</cvename>
<url>https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3</url>
</references>
<dates>
<discovery>2024-03-24</discovery>
<entry>2024-03-26</entry>
</dates>
</vuln>
<vuln vid="34f98d06-eb56-11ee-8007-6805ca2fa271">
<topic>quiche -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>quiche</name>
<range><lt>0.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quiche Releases reports:</p>
<blockquote cite="https://github.com/cloudflare/quiche/releases/tag/0.20.1">
<p>This release includes 2 security fixes:</p>
<ul>
<li>
CVE-2024-1410: Unbounded storage of information related to
connection ID retirement, in quiche. Reported by Marten
Seeman (@marten-seeman)
</li>
<li>
CVE-2024-1765: Unlimited resource allocation by QUIC
CRYPTO frames flooding in quiche. Reported by Marten
Seeman (@marten-seeman)
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1410</cvename>
<cvename>CVE-2024-1765</cvename>
<url>https://github.com/cloudflare/quiche/releases/tag/0.20.1</url>
</references>
<dates>
<discovery>2024-03-12</discovery>
<entry>2024-03-26</entry>
</dates>
</vuln>
<vuln vid="80815c47-e84f-11ee-8e76-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>123.0.6312.58</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>123.0.6312.58</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[327740539] High CVE-2024-2625: Object lifecycle issue in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2024-03-01</li>
<li>[40945098] Medium CVE-2024-2626: Out of bounds read in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-22</li>
<li>[41493290] Medium CVE-2024-2627: Use after free in Canvas. Reported by Anonymous on 2024-01-21</li>
<li>[41487774] Medium CVE-2024-2628: Inappropriate implementation in Downloads. Reported by Ath3r1s on 2024-01-03</li>
<li>[41487721] Medium CVE-2024-2629: Incorrect security UI in iOS. Reported by Muneaki Nishimura (nishimunea) on 2024-01-02</li>
<li>[41481877] Medium CVE-2024-2630: Inappropriate implementation in iOS. Reported by James Lee (@Windowsrcer) on 2023-12-07</li>
<li>[41495878] Low CVE-2024-2631: Inappropriate implementation in iOS. Reported by Ramit Gangwar on 2024-01-29</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2625</cvename>
<cvename>CVE-2024-2626</cvename>
<cvename>CVE-2024-2627</cvename>
<cvename>CVE-2024-2628</cvename>
<cvename>CVE-2024-2629</cvename>
<cvename>CVE-2024-2630</cvename>
<cvename>CVE-2024-2631</cvename>
<url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2024-03-19</discovery>
<entry>2024-03-22</entry>
</dates>
</vuln>
<vuln vid="7a7129ef-e790-11ee-a1c0-0050569f0b83">
<topic>security/shibboleth-idp -- CAS service SSRF</topic>
<affects>
<package>
<name>shibboleth-idp</name>
<range><ge>4.3.0</ge><lt>4.3.2</lt></range>
<range><ge>5.0.0</ge><lt>5.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth Developers report:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20240320.txt">
<p>The Identity Provider's CAS support relies on a function in the
Spring Framework to parse CAS service URLs and append the ticket
parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20240320.txt</url>
</references>
<dates>
<discovery>2024-03-20</discovery>
<entry>2024-03-21</entry>
</dates>
</vuln>
<vuln vid="a8448963-e6f5-11ee-a784-dca632daf43b">
<topic>databases/mongodb* -- Improper Certificate Validation</topic>
<affects>
<package>
<name>mongodb44</name>
<range><lt>4.4.29</lt></range>
</package>
<package>
<name>mongodb50</name>
<range><lt>5.0.25</lt></range>
</package>
<package>
<name>mongodb60</name>
<range><lt>6.0.14</lt></range>
</package>
<package>
<name>mongodb70</name>
<range><lt>7.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MongoDB, Inc. reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-72839">
<p>A security vulnerability was found where a server process
running MongoDB 3.2.6 or later will allow incoming connections
to skip peer certificate validation if the server process was
started with TLS enabled (net.tls.mode set to allowTLS,
preferTLS, or requireTLS) and without a net.tls.CAFile
configured (CVE-2024-1351).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1351</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-1351</url>
</references>
<dates>
<discovery>2024-03-07</discovery>
<entry>2024-03-20</entry>
</dates>
</vuln>
<vuln vid="05b7180b-e571-11ee-a1c0-0050569f0b83">
<topic>www/varnish7 -- Denial of Service</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Varnish Development Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00014.html#vsv00014">
<p>A denial of service attack can be performed on Varnish Cacher servers
that have the HTTP/2 protocol turned on. An attacker can let the
servers HTTP/2 connection control flow window run out of credits
indefinitely and prevent progress in the processing of streams,
retaining the associated resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43622</cvename>
<url>https://varnish-cache.org/security/VSV00014.html#vsv00014</url>
</references>
<dates>
<discovery>2019-04-19</discovery>
<entry>2024-03-18</entry>
</dates>
</vuln>
<vuln vid="0a48e552-e470-11ee-99b3-589cfc0f81b0">
<topic>amavisd-new -- multipart boundary confusion</topic>
<affects>
<package>
<name>amavisd-new</name>
<range><lt>2.12.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Amavis project reports:</p>
<blockquote cite="https://gitlab.com/amavis/amavis/-/raw/v2.12.3/README_FILES/README.CVE-2024-28054">
<p>Emails which consist of multiple parts (`Content-Type: multipart/*`)
incorporate boundary information stating at which point one part ends and the
next part begins.</p>
<p>A boundary is announced by an Content-Type header's `boundary` parameter. To
our current knowledge, RFC2046 and RFC2045 do not explicitly specify how a
parser should handle multiple boundary parameters that contain conflicting
values. As a result, there is no canonical choice which of the values should or
should not be used for mime part decomposition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-28054</cvename>
<url>https://gitlab.com/amavis/amavis/-/raw/v2.12.3/README_FILES/README.CVE-2024-28054</url>
</references>
<dates>
<discovery>2024-03-14</discovery>
<entry>2024-03-17</entry>
</dates>
</vuln>
<vuln vid="1ad3d264-e36b-11ee-9c27-40b034429ecf">
<topic>typo3-{11,12} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-11</name>
<range><lt>11.5.35</lt></range>
</package>
<package>
<name>typo3-12</name>
<range><lt>12.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 developers reports:</p>
<blockquote cite="https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published">
<p>All versions are security releases and contain important security fixes - read the corresponding security advisories here:</p>
<ul>
<li>Path Traversal in TYPO3 File Abstraction Layer Storages CVE-2023-30451</li>
<li>Code Execution in TYPO3 Install Tool CVE-2024-22188</li>
<li>Information Disclosure of Hashed Passwords in TYPO3 Backend Forms CVE-2024-25118</li>
<li>Information Disclosure of Encryption Key in TYPO3 Install Tool CVE-2024-25119</li>
<li>Improper Access Control of Resources Referenced by t3:// URI Scheme CVE-2024-25120</li>
<li>Improper Access Control Persisting File Abstraction Layer Entities via Data Handler CVE-2024-25121</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-30451</cvename>
<cvename>CVE-2024-22188</cvename>
<cvename>CVE-2024-25118</cvename>
<cvename>CVE-2024-25119</cvename>
<cvename>CVE-2024-25120</cvename>
<cvename>CVE-2024-25121</cvename>
<url>https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published</url>
</references>
<dates>
<discovery>2024-02-13</discovery>
<entry>2024-03-16</entry>
</dates>
</vuln>
<vuln vid="49dd9362-4473-48ae-8fac-e1b69db2dedf">
<topic>electron{27,28} -- Out of bounds memory access in V8</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.6</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.6">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-2173.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2173</cvename>
<url>https://github.com/advisories/GHSA-6hhg-hj7x-7qv8</url>
</references>
<dates>
<discovery>2024-03-13</discovery>
<entry>2024-03-14</entry>
</dates>
</vuln>
<vuln vid="b6dd9d93-e09b-11ee-92fc-1c697a616631">
<topic>Intel CPUs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cpu-microcode-intel</name>
<range><lt>20240312</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html">
<p>2024.1 IPU - Intel Processor Bus Lock Advisory</p>
<p>A potential security vulnerability in the bus lock regulator
mechanism for some Intel Processors may allow denial of service. Intel
is releasing firmware updates to mitigate this potential
vulnerability.</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html">
<p>2024.1 IPU - Intel Processor Return Predictions Advisory</p>
<p>A potential security vulnerability in some Intel Processors may
allow information disclosure.</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html">
<p>2024.1 IPU - Intel Atom Processor Advisory</p>
<p>A potential security vulnerability in some Intel Atom Processors
may allow information disclosure.</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html">
<p>2024.1 IPU - Intel Xeon Processor Advisory</p>
<p>A potential security vulnerability in some 3rd and 4th Generation
Intel Xeon Processors when using Intel Software Guard Extensions (SGX)
or Intel Trust Domain Extensions (TDX) may allow escalation of
privilege.</p>
</blockquote>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html">
<p>2024.1 IPU OOB - Intel Xeon D Processor Advisory</p>
<p>A potential security vulnerability in some Intel Xeon D Processors
with Intel Software Guard Extensions (SGX) may allow information
disclosure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39368</cvename>
<cvename>CVE-2023-38575</cvename>
<cvename>CVE-2023-28746</cvename>
<cvename>CVE-2023-22655</cvename>
<cvename>CVE-2023-43490</cvename>
<url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240312</url>
</references>
<dates>
<discovery>2023-03-12</discovery>
<entry>2024-03-12</entry>
</dates>
</vuln>
<vuln vid="6d31ef38-df85-11ee-abf1-6c3be5272acd">
<topic>Grafana -- Data source permission escalation</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.5.0</ge><lt>9.5.17</lt></range>
<range><ge>10.0.0</ge><lt>10.0.12</lt></range>
<range><ge>10.1.0</ge><lt>10.1.8</lt></range>
<range><ge>10.2.0</ge><lt>10.2.5</lt></range>
<range><ge>10.3.0</ge><lt>10.3.4</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2024/03/07/grafana-security-release-medium-severity-security-fix-for-cve-2024-1442/">
<p>The vulnerability impacts Grafana Cloud and Grafana Enterprise instances,
and it is exploitable if a user who should not be able to access all data
sources is granted permissions to create a data source.</p>
<p>By default, only organization Administrators are allowed to create a data
source and have full access to all data sources. All other users need to be
explicitly granted permission to create a data source, which then means they
could exploit this vulnerability.</p>
<p>When a user creates a data source via the
<a href="https://grafana.com/docs/grafana/latest/developers/http_api/data_source/#create-a-data-source">API</a>,
they can specify data source UID. If the UID is set to an asterisk (*),
the user gains permissions to query, update, and delete all data sources
in the organization. The exploit, however, does not stretch across
organizations — to exploit the vulnerability in several organizations, a user
would need permissions to create data sources in each organization.</p>
<p>The vulnerability comes from a lack of UID validation. When evaluating
permissions, we interpret an asterisk (*) as a wild card for all resources.
Therefore, we should treat it as a reserved value, and not allow the creation
of a resource with the UID set to an asterisk.</p>
<p>The CVSS score for this vulnerability is
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L&version=3.1">6 Medium</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1442</cvename>
<url>https://grafana.com/security/security-advisories/cve-2024-1442/</url>
</references>
<dates>
<discovery>2024-02-12</discovery>
<entry>2024-03-11</entry>
<modified>2024-03-26</modified>
</dates>
</vuln>
<vuln vid="c2ad8700-de25-11ee-9190-84a93843eb75">
<topic>Unbound -- Denial-of-Service vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><gt>1.18.0</gt><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLNet Labs reports:</p>
<blockquote cite="https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt">
<p>Unbound 1.18.0 introduced a feature that removes EDE records from
responses with size higher than the client's advertised buffer size.
Before removing all the EDE records however, it would try to see if
trimming the extra text fields on those records would result in an
acceptable size while still retaining the EDE codes. Due to an
unchecked condition, the code that trims the text of the EDE records
could loop indefinitely. This happens when Unbound would reply with
attached EDE information on a positive reply and the client's buffer
size is smaller than the needed space to include EDE records.
The vulnerability can only be triggered when the 'ede: yes' option
is used; non default configuration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1931</cvename>
<url>https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt</url>
</references>
<dates>
<discovery>2024-03-07</discovery>
<entry>2024-03-09</entry>
</dates>
</vuln>
<vuln vid="e74da31b-276a-4a22-9772-17dd42b97559">
<topic>electron{27,28} -- vulnerability in libxml2</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.5</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.5">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-25062.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-25062</cvename>
<url>https://github.com/advisories/GHSA-x77r-6xxm-wjmx</url>
</references>
<dates>
<discovery>2024-03-06</discovery>
<entry>2024-03-07</entry>
</dates>
</vuln>
<vuln vid="b2caae55-dc38-11ee-96dc-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.9.0</ge><lt>16.9.2</lt></range>
<range><ge>16.8.0</ge><lt>16.8.4</lt></range>
<range><ge>11.3.0</ge><lt>16.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/">
<p>Bypassing CODEOWNERS approval allowing to steal protected variables</p>
<p>Guest with manage group access tokens can rotate and see group access token with owner permissions</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0199</cvename>
<cvename>CVE-2024-1299</cvename>
<url>https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/</url>
</references>
<dates>
<discovery>2024-03-06</discovery>
<entry>2024-03-07</entry>
</dates>
</vuln>
<vuln vid="b1b039ec-dbfc-11ee-9165-901b0e9408dc">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.1</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports reports:</p>
<blockquote cite="https://go.dev/issue/65390">
<p>crypto/x509: Verify panics on certificates with an
unknown public key algorithm</p>
<p>Verifying a certificate chain which contains a
certificate with an unknown public key algorithm will
cause Certificate.Verify to panic.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/65383">
<p>net/http: memory exhaustion in Request.ParseMultipartForm</p>
<p>When parsing a multipart form (either explicitly with
Request.ParseMultipartForm or implicitly with Request.FormValue,
Request.PostFormValue, or Request.FormFile), limits on the total
size of the parsed form were not applied to the memory consumed
while reading a single form line. This permitted a maliciously
crafted input containing very long lines to cause allocation of
arbitrarily large amounts of memory, potentially leading to memory
exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/65065">
<p>net/http, net/http/cookiejar: incorrect forwarding
of sensitive headers and cookies on HTTP redirect</p>
<p>When following an HTTP redirect to a domain which
is not a subdomain match or exact match of the initial
domain, an http.Client does not forward sensitive headers
such as "Authorization" or "Cookie". For example, a
redirect from foo.com to www.foo.com will forward the
Authorization header, but a redirect to bar.com will not.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/65697">
<p>html/template: errors returned from MarshalJSON methods
may break template escaping</p>
<p>If errors returned from MarshalJSON methods contain user
controlled data, they may be used to break the contextual
auto-escaping behavior of the html/template package, allowing
for subsequent actions to inject unexpected content into
templates.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/65083">
<p>net/mail: comments in display names are incorrectly handled</p>
<p>The ParseAddressList function incorrectly handles comments
(text within parentheses) within display names. Since this is a
misalignment with conforming address parsers, it can result in
different trust decisions being made by programs using different
parsers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45289</cvename>
<cvename>CVE-2023-45290</cvename>
<cvename>CVE-2024-24783</cvename>
<cvename>CVE-2024-24784</cvename>
<cvename>CVE-2024-24785</cvename>
<url>https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg/m/46oA5yPABQAJ</url>
</references>
<dates>
<discovery>2024-03-05</discovery>
<entry>2024-03-06</entry>
</dates>
</vuln>
<vuln vid="fd3401a1-b6df-4577-917a-2c22fee99d34">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>122.0.6261.111</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>122.0.6261.111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[325893559] High CVE-2024-2173: Out of bounds memory access in V8. Reported by 5fceb6172bbf7e2c5a948183b53565b9 on 2024-02-19</li>
<li>[325866363] High CVE-2024-2174: Inappropriate implementation in V8. Reported by 5f46f4ee2e17957ba7b39897fb376be8 on 2024-02-19</li>
<li>[325936438] High CVE-2024-2176: Use after free in FedCM. Reported by Anonymous on 2024-02-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-2173</cvename>
<cvename>CVE-2024-2174</cvename>
<cvename>CVE-2024-2176</cvename>
<url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-03-05</discovery>
<entry>2024-03-06</entry>
</dates>
</vuln>
<vuln vid="0ef3398e-da21-11ee-b23a-080027a5b8e9">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.25</lt></range>
</package>
<package>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.11</lt></range>
</package>
<package>
<name>py310-django50</name>
<name>py311-django50</name>
<range><lt>5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2024/mar/04/security-releases/">
<p>CVE-2024-27351: Potential regular expression denial-of-service in
django.utils.text.Truncator.words().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-27351</cvename>
<url>https://www.djangoproject.com/weblog/2024/mar/04/security-releases/</url>
</references>
<dates>
<discovery>2024-02-25</discovery>
<entry>2024-03-04</entry>
</dates>
</vuln>
<vuln vid="77a6f1c9-d7d2-11ee-bb12-001b217b3468">
<topic>NodeJS -- Vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><ge>21.0.0</ge><lt>21.6.2</lt></range>
<range><ge>20.0.0</ge><lt>20.11.1</lt></range>
<range><ge>18.0.0</ge><lt>18.19.1</lt></range>
<range><ge>16.0.0</ge><lt>16.20.3</lt></range>
</package>
<package>
<name>node16</name>
<range><ge>16.0.0</ge><lt>16.20.3</lt></range>
</package>
<package>
<name>node18</name>
<range><ge>18.0.0</ge><lt>18.19.1</lt></range>
</package>
<package>
<name>node20</name>
<range><ge>20.0.0</ge><lt>20.11.1</lt></range>
</package>
<package>
<name>node21</name>
<range><ge>21.0.0</ge><lt>21.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#2024-02-14-version-20111-iron-lts-rafaelgss-prepared-by-marco-ippolito">
<p>Code injection and privilege escalation through Linux capabilities- (High)</p>
<p>http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)</p>
<p>Path traversal by monkey-patching Buffer internals- (High)</p>
<p>setuid() does not drop all privileges due to io_uring - (High)</p>
<p>Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)</p>
<p>Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)</p>
<p>Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)</p>
<p>Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-21892</cvename>
<cvename>CVE-2024-22019</cvename>
<cvename>CVE-2024-21896</cvename>
<cvename>CVE-2024-22017</cvename>
<cvename>CVE-2023-46809</cvename>
<cvename>CVE-2024-21891</cvename>
<cvename>CVE-2024-21890</cvename>
<cvename>CVE-2024-22025</cvename>
<url>https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#2024-02-14-version-20111-iron-lts-rafaelgss-prepared-by-marco-ippolito</url>
</references>
<dates>
<discovery>2024-02-14</discovery>
<entry>2024-03-01</entry>
</dates>
</vuln>
<vuln vid="3567456a-6b17-41f7-ba7f-5cd3efb2b7c9">
<topic>electron{27,28} -- Use after free in Mojo</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.4</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.4">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-1670.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1670</cvename>
<url>https://github.com/advisories/GHSA-wjv4-j3hc-gxvv</url>
</references>
<dates>
<discovery>2024-02-28</discovery>
<entry>2024-02-29</entry>
</dates>
</vuln>
<vuln vid="31bb1b8d-d6dc-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>122.0.6261.94</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>122.0.6261.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[324596281] High CVE-2024-1938: Type Confusion in V8. Reported by 5f46f4ee2e17957ba7b39897fb376be8 on 2024-02-11</li>
<li>[323694592] High CVE-2024-1939: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2024-02-05</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1938</cvename>
<cvename>CVE-2024-1939</cvename>
<url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2024-02-27</discovery>
<entry>2024-02-29</entry>
</dates>
</vuln>
<vuln vid="3dada2d5-4e17-4e39-97dd-14fdbd4356fb">
<topic>null -- Routinator terminates when RTR connection is reset too quickly after opening</topic>
<affects>
<package>
<name>null</name>
<range><lt>null</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sep@nlnetlabs.nl reports:</p>
<blockquote cite="https://www.nlnetlabs.nl/downloads/routinator/CVE-2024-1622.txt">
<p>Due to a mistake in error checking, Routinator will terminate when
an incoming RTR connection is reset by the peer too quickly after
opening.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1622</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-1622</url>
</references>
<dates>
<discovery>2024-02-26</discovery>
<entry>2024-02-28</entry>
</dates>
</vuln>
<vuln vid="02e33cd1-c655-11ee-8613-08002784c58d">
<topic>curl -- OCSP verification bypass with TLS session reuse</topic>
<affects>
<package>
<name>curl</name>
<range><lt>8.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hiroki Kurosawa reports:</p>
<blockquote cite="https://curl.se/docs/CVE-2024-0853.html">
<p>
curl inadvertently kept the SSL session ID for connections
in its cache even when the verify status (OCSP stapling)
test failed. A subsequent transfer to the same hostname
could then succeed if the session ID cache was still
fresh, which then skipped the verify status check.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0853</cvename>
<url>https://curl.se/docs/CVE-2024-0853.html</url>
</references>
<dates>
<discovery>2024-01-31</discovery>
<entry>2024-02-28</entry>
</dates>
</vuln>
<vuln vid="5ecfb588-d2f4-11ee-ad82-dbdfaa8acfc2">
<topic>gitea -- Fix XSS vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.21.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<ul>
<li>The Wiki page did not sanitize author name</li>
<li>the reviewer name on a "dismiss review" comment is also affected</li>
<li>the migration page has some spots</li>
</ul>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.21.6/</url>
</references>
<dates>
<discovery>2024-02-23</discovery>
<entry>2024-02-24</entry>
</dates>
</vuln>
<vuln vid="2a470712-d351-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>122.0.6261.57</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>122.0.6261.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[41495060] High CVE-2024-1669: Out of bounds memory access in Blink. Reported by Anonymous on 2024-01-26</li>
<li>[41481374] High CVE-2024-1670: Use after free in Mojo. Reported by Cassidy Kim(@cassidy6564) on 2023-12-06</li>
<li>[41487933] Medium CVE-2024-1671: Inappropriate implementation in Site Isolation. Reported by Harry Chen on 2024-01-03</li>
<li>[41485789] Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy. Reported by Georg Felber (TU Wien) & Marco Squarcina (TU Wien) on 2023-12-19</li>
<li>[41490491] Medium CVE-2024-1673: Use after free in Accessibility. Reported by Weipeng Jiang (@Krace) of VRI on 2024-01-11</li>
<li>[40095183] Medium CVE-2024-1674: Inappropriate implementation in Navigation. Reported by David Erceg on 2019-05-27</li>
<li>[41486208] Medium CVE-2024-1675: Insufficient policy enforcement in Download. Reported by Bartłomiej Wacko on 2023-12-21</li>
<li>[40944847] Low CVE-2024-1676: Inappropriate implementation in Navigation. Reported by Khalil Zhani on 2023-11-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2024-02-20</discovery>
<entry>2024-02-24</entry>
</dates>
</vuln>
<vuln vid="6a851dc0-cfd2-11ee-ac09-6c3be5272acd">
<topic>Grafana -- Email verification is not required after email change</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>9.5.16</lt></range>
<range><ge>10.0.0</ge><lt>10.0.11</lt></range>
<range><ge>10.1.0</ge><lt>10.1.7</lt></range>
<range><ge>10.2.0</ge><lt>10.2.4</lt></range>
<range><ge>10.3.0</ge><lt>10.3.3</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.5.16</lt></range>
</package>
<package>
<name>grafana10</name>
<range><lt>10.0.11</lt></range>
<range><ge>10.1.0</ge><lt>10.1.7</lt></range>
<range><ge>10.2.0</ge><lt>10.2.4</lt></range>
<range><ge>10.3.0</ge><lt>10.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2024/02/14/grafana-security-release-medium-severity-security-fix-for-cve-2023-6152/">
<p>The vulnerability impacts instances where
<a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/grafana/">
Grafana basic authentication</a> is enabled.</p>
<p>Grafana has a
<a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#verify_email_enabled">
verify_email_enabled</a> configuration option. When this option is enabled,
users are required to confirm their email addresses before the sign-up process
is complete. However, the email is only checked at the time of the sign-up.
No further verification is carried out if a user’s email address is updated
after the initial sign-up. Moreover, Grafana allows using an email address
as the user’s login name, and no verification is ever carried out for this email
address.</p>
<p>This means that even if the
<a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#verify_email_enabled">
verify_email_enabled</a> configuration option is enabled, users can use
unverified email addresses to log into Grafana if the email address
has been changed after the sign up, or if an email address is set as the login
name.</p>
<p>The CVSS score for this vulnerability is [5.4 Medium] (CVSS).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6152</cvename>
<url>https://grafana.com/security/security-advisories/cve-2023-6152/</url>
</references>
<dates>
<discovery>2023-11-10</discovery>
<entry>2024-02-20</entry>
</dates>
</vuln>
<vuln vid="255bf44c-d298-11ee-9c27-40b034429ecf">
<topic>dns/c-ares -- malformatted file causes application crash</topic>
<affects>
<package>
<name>c-ares</name>
<range><lt>1.27.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>c-ares project reports:</p>
<blockquote cite="https://c-ares.org/changelog.html">
<p>Reading malformatted /etc/resolv.conf, /etc/nsswitch.conf or the HOSTALIASES file could result in a crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-25629</cvename>
<url>https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q</url>
</references>
<dates>
<discovery>2024-02-23</discovery>
<entry>2024-02-23</entry>
</dates>
</vuln>
<vuln vid="979dc373-d27d-11ee-8b84-b42e991fc52e">
<topic>suricata -- multiple vulnerabilities</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>7.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Suricata team reports:</p>
<blockquote cite="https://suricata.io/2024/02/08/suricata-7-0-3-and-6-0-16-released/">
<p>Multiple vulnerabilities fixed in the last release of suricata.</p>
</blockquote>
<p>No details have been disclosed yet</p>
</body>
</description>
<references>
<cvename>CVE-2024-23839</cvename>
<cvename>CVE-2024-23836</cvename>
<cvename>CVE-2024-23835</cvename>
<cvename>CVE-2024-24568</cvename>
<cvename>CVE-2024-23837</cvename>
</references>
<dates>
<discovery>2024-01-22</discovery>
<entry>2024-02-23</entry>
</dates>
</vuln>
<vuln vid="80ad6d6c-b398-457f-b88f-bf6be0bbad44">
<topic>electron27 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.3">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-1283.</li>
<li>Security: backported fix for CVE-2024-1284.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1283</cvename>
<url>https://github.com/advisories/GHSA-7mgj-p9v3-3vxr</url>
<cvename>CVE-2024-1284</cvename>
<url>https://github.com/advisories/GHSA-pf89-rhhw-xmhp</url>
</references>
<dates>
<discovery>2024-02-21</discovery>
<entry>2024-02-23</entry>
</dates>
</vuln>
<vuln vid="03bf5157-d145-11ee-acee-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.9.0</ge><lt>16.9.1</lt></range>
<range><ge>16.8.0</ge><lt>16.8.3</lt></range>
<range><ge>11.3.0</ge><lt>16.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/">
<p>Stored-XSS in user's profile page</p>
<p>User with "admin_group_members" permission can invite other groups to gain owner access</p>
<p>ReDoS issue in the Codeowners reference extractor</p>
<p>LDAP user can reset password using secondary email and login using direct authentication</p>
<p>Bypassing group ip restriction settings to access environment details of projects through Environments/Operations Dashboard</p>
<p>Users with the Guest role can change Custom dashboard projects settings for projects in the victim group</p>
<p>Group member with sub-maintainer role can change title of shared private deploy keys</p>
<p>Bypassing approvals of CODEOWNERS</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1451</cvename>
<cvename>CVE-2023-6477</cvename>
<cvename>CVE-2023-6736</cvename>
<cvename>CVE-2024-1525</cvename>
<cvename>CVE-2023-4895</cvename>
<cvename>CVE-2024-0861</cvename>
<cvename>CVE-2023-3509</cvename>
<cvename>CVE-2024-0410</cvename>
<url>https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/</url>
</references>
<dates>
<discovery>2024-02-21</discovery>
<entry>2024-02-22</entry>
</dates>
</vuln>
<vuln vid="e15ba624-cca8-11ee-84ca-b42e991fc52e">
<topic>powerdns-recursor -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2023-50868">
<p>CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155
when RFC 9276 guidance is skipped) allows remote attackers to cause
a denial of service (CPU consumption for SHA-1 computations) via
DNSSEC responses in a random subdomain attack, aka the "NSEC3"
issue. The RFC 5155 specification implies that an algorithm must
perform thousands of iterations of a hash function in certain
situations.</p>
<p>CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035,
6840, and related RFCs) allow remote attackers to cause a denial
of service (CPU consumption) via one or more DNSSEC responses, aka
the "KeyTrap" issue. One of the concerns is that, when
there is a zone with many DNSKEY and RRSIG records, the protocol
specification implies that an algorithm must evaluate all combinations
of DNSKEY and RRSIG records.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-50868</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-50868</url>
<cvename>CVE-2023-50387</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-50387</url>
</references>
<dates>
<discovery>2024-02-14</discovery>
<entry>2024-02-16</entry>
</dates>
</vuln>
<vuln vid="c97a4ecf-cc25-11ee-b0ee-0050569f0b83">
<topic>nginx-devel -- Multiple Vulnerabilities in HTTP/3</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><ge>1.25.0</ge><lt>1.25.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx development team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>When using HTTP/3 a segmentation fault might occur in a
worker process while processing a specially crafted QUIC session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24989</cvename>
<cvename>CVE-2024-24990</cvename>
</references>
<dates>
<discovery>2024-02-14</discovery>
<entry>2024-02-15</entry>
</dates>
</vuln>
<vuln vid="46a29f83-cb47-11ee-b609-002590c1f29c">
<topic>FreeBSD -- jail(2) information leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.0</ge><lt>14.0_5</lt></range>
<range><ge>13.2</ge><lt>13.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The jail(2) system call has not limited a visiblity of allocated
TTYs (the kern.ttys sysctl). This gives rise to an information
leak about processes outside the current jail.</p>
<h1>Impact:</h1>
<p>Attacker can get information about TTYs allocated on the host
or in other jails. Effectively, the information printed by "pstat
-t" may be leaked.</p>
</body>
</description>
<references>
<cvename>CVE-2024-25941</cvename>
<freebsdsa>SA-24:02.tty</freebsdsa>
</references>
<dates>
<discovery>2024-02-14</discovery>
<entry>2024-02-14</entry>
</dates>
</vuln>
<vuln vid="c62285cb-cb46-11ee-b609-002590c1f29c">
<topic>FreeBSD -- bhyveload(8) host file access</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.0</ge><lt>14.0_5</lt></range>
<range><ge>13.2</ge><lt>13.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>`bhyveload -h <host-path>` may be used to grant loader access
to the <host-path> directory tree on the host. Affected versions
of bhyveload(8) do not make any attempt to restrict loader's access
to <host-path>, allowing the loader to read any file the host user
has access to.</p>
<h1>Impact:</h1>
<p>In the bhyveload(8) model, the host supplies a userboot.so to
boot with, but the loader scripts generally come from the guest
image. A maliciously crafted script could be used to exfiltrate
sensitive data from the host accessible to the user running
bhyhveload(8), which is often the system root.</p>
</body>
</description>
<references>
<cvename>CVE-2024-25940</cvename>
<freebsdsa>SA-24:01.bhyveload</freebsdsa>
</references>
<dates>
<discovery>2024-02-14</discovery>
<entry>2024-02-14</entry>
</dates>
</vuln>
<vuln vid="4edbea45-cb0c-11ee-86bb-a8a1599412c6">
<topic>chromium -- security fix</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>121.0.6167.184</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>121.0.6167.184</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_13.html">
<p>This update includes 1 security fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2024-02-13</discovery>
<entry>2024-02-14</entry>
</dates>
</vuln>
<vuln vid="21a854cc-cac1-11ee-b7a7-353f1e043d9a">
<topic>DNSSEC validators -- denial-of-service/CPU exhaustion from KeyTrap and NSEC3 vulnerabilities</topic>
<affects>
<package>
<name>bind916</name>
<range><lt>9.16.48</lt></range>
</package>
<package>
<name>bind918</name>
<range><lt>9.18.24</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.19.21</lt></range>
</package>
<package>
<name>dnsmasq</name>
<range><lt>2.90</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.90</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>5.0.2</lt></range>
</package>
<package>
<name>unbound</name>
<range><lt>1.19.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>14.0</ge><lt>14.0_6</lt></range>
<range><ge>13.2</ge><lt>13.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html">
<p>If DNSSEC validation is enabled, then an attacker who can force a
DNS server to validate a specially crafted signed domain can use a
lot of CPU in the validator. This only affects dnsmasq installations
with DNSSEC enabled.</p>
</blockquote>
<p>Stichting NLnet Labs reports:</p>
<blockquote cite="https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/">
<p>
The KeyTrap [CVE-2023-50387] vulnerability works by using a
combination of Keys (also colliding Keys), Signatures and number of
RRSETs on a malicious zone. Answers from that zone can force a
DNSSEC validator down a very CPU intensive and time costly
validation path.
</p>
<p>
The NSEC3 [CVE-2023-50868] vulnerability uses specially crafted responses on a
malicious zone with multiple NSEC3 RRSETs to force a DNSSEC
validator down a very CPU intensive and time costly NSEC3 hash
calculation path.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-50387</cvename>
<cvename>CVE-2023-50868</cvename>
<url>https://kb.isc.org/docs/cve-2023-50387</url>
<url>https://kb.isc.org/docs/cve-2023-50868</url>
<url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html</url>
<url>https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released</url>
<url>https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/</url>
<freebsdsa>SA-24:03.unbound</freebsdsa>
</references>
<dates>
<discovery>2024-02-06</discovery>
<entry>2024-02-13</entry>
<modified>2024-04-01</modified>
</dates>
</vuln>
<vuln vid="cbfc1591-c8c0-11ee-b45a-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq-php81</name>
<name>phpmyfaq-php82</name>
<name>phpmyfaq-php83</name>
<range><lt>3.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyFAQ team reports:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2024-02-05">
<p>phpMyFAQ doesn't implement sufficient checks to avoid XSS when
storing on attachments filenames. The 'sharing FAQ' functionality
allows any unauthenticated actor to misuse the phpMyFAQ application
to send arbitrary emails to a large range of targets. phpMyFAQ's
user removal page allows an attacker to spoof another user's
detail, and in turn make a compelling phishing case for removing
another user's account.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9hhf-xmcw-r3xg</url>
<url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6648-6g96-mg35</url>
</references>
<dates>
<discovery>2024-02-05</discovery>
<entry>2024-02-11</entry>
</dates>
</vuln>
<vuln vid="f161a5ad-c9bd-11ee-b7a7-353f1e043d9a">
<topic>openexr -- Heap Overflow in Scanline Deep Data Parsing</topic>
<affects>
<package>
<name>openexr</name>
<range><lt>3.1.12</lt></range>
<range><ge>3.2.0</ge><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Austin Hackers Anonymous report:</p>
<blockquote cite="https://takeonme.org/cves/CVE-2023-5841.html">
<p>Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEXR image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability.</p>
</blockquote>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.2">
<p>[...] it is in a routine that is predominantly used for development and
testing. It is not likely to appear in production code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5841</cvename>
<url>https://takeonme.org/cves/CVE-2023-5841.html</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.2</url>
</references>
<dates>
<discovery>2023-10-26</discovery>
<entry>2024-02-12</entry>
</dates>
</vuln>
<vuln vid="388eefc0-c93f-11ee-92ce-4ccc6adda413">
<topic>readstat -- Heap buffer overflow in readstat_convert</topic>
<affects>
<package>
<name>readstat</name>
<range><lt>1.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33991">
<p>A heap buffer overflow exists in readstat_convert.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33991</url>
<url>https://osv.dev/vulnerability/OSV-2021-732</url>
<url>https://github.com/WizardMac/ReadStat/issues/285</url>
</references>
<dates>
<discovery>2021-05-05</discovery>
<entry>2024-02-12</entry>
</dates>
</vuln>
<vuln vid="cb22a9a6-c907-11ee-8d1c-40b034429ecf">
<topic>p5-Spreadsheet-ParseExcel -- Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>p5-Spreadsheet-ParseExcel</name>
<range><lt>0.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Spreadsheet-ParseExcel reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-7101">
<p>
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability
due to passing unvalidated input from a file into a string-type eval "eval".
Specifically, the issue stems from the evaluation of Number format strings
(not to be confused with printf-style format strings) within the Excel parsing logic.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-7101</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-7101</url>
</references>
<dates>
<discovery>2023-12-29</discovery>
<entry>2024-02-11</entry>
</dates>
</vuln>
<vuln vid="19e6dd1b-c6a5-11ee-9cd0-6cc21735f730">
<topic>postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>15.6</lt></range>
<range><lt>14.11</lt></range>
<range><lt>13.14</lt></range>
<range><lt>12.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-0985/">
<p>
One step of a concurrent refresh command was run under
weak security restrictions. If a materialized view's
owner could persuade a superuser or other
high-privileged user to perform a concurrent refresh on
that view, the view's owner could control code executed
with the privileges of the user running REFRESH. The fix
for the vulnerability makes is so that all
user-determined code is run as the view's owner, as
expected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0985</cvename>
<url>https://www.postgresql.org/support/security/CVE-2024-0985/</url>
</references>
<dates>
<discovery>2024-02-08</discovery>
<entry>2024-02-08</entry>
</dates>
</vuln>
<vuln vid="6b2cba6a-c6a5-11ee-97d0-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.8.0</ge><lt>16.8.2</lt></range>
<range><ge>16.7.0</ge><lt>16.7.5</lt></range>
<range><ge>13.3.0</ge><lt>16.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/">
<p>Restrict group access token creation for custom roles</p>
<p>Project maintainers can bypass group's scan result policy block_branch_modification setting</p>
<p>ReDoS in CI/CD Pipeline Editor while verifying Pipeline syntax</p>
<p>Resource exhaustion using GraphQL vulnerabilitiesCountByDay</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1250</cvename>
<cvename>CVE-2023-6840</cvename>
<cvename>CVE-2023-6386</cvename>
<cvename>CVE-2024-1066</cvename>
<url>https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/</url>
</references>
<dates>
<discovery>2024-02-07</discovery>
<entry>2024-02-08</entry>
</dates>
</vuln>
<vuln vid="33ba2241-c68e-11ee-9ef3-001999f8d30b">
<topic>Composer -- Code execution and possible privilege escalation</topic>
<affects>
<package>
<name>php81-composer</name>
<range><lt>2.7.0</lt></range>
</package>
<package>
<name>php82-composer</name>
<range><lt>2.7.0</lt></range>
</package>
<package>
<name>php83-composer</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Copmposer reports:</p>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h">
<p>Code execution and possible privilege escalation via
compromised InstalledVersions.php or installed.php.</p>
<p>Several files within the local working directory are
included during the invocation of Composer and in the
context of the executing user.</p>
<p>As such, under certain conditions arbitrary code
execution may lead to local privilege escalation, provide
lateral user movement or malicious code execution when
Composer is invoked within a directory with tampered
files.</p>
<p>All Composer CLI commands are affected, including
composer.phar's self-update.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24821</cvename>
<url>https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h</url>
</references>
<dates>
<discovery>2024-02-08</discovery>
<entry>2024-02-08</entry>
</dates>
</vuln>
<vuln vid="43768ff3-c683-11ee-97d0-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>eza</name>
<range><lt>0.18.2</lt></range>
</package>
<package>
<name>libgit2</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v1.7.2">
<p>A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application</p>
<p>A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application</p>
<p>A bug in the smart transport negotiation could have caused an out-of-bounds read when a remote server did not advertise capabilities</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24577</cvename>
<url>https://github.com/libgit2/libgit2/releases/tag/v1.7.2</url>
</references>
<dates>
<discovery>2024-02-06</discovery>
<entry>2024-02-08</entry>
<modified>2024-02-14</modified>
</dates>
</vuln>
<vuln vid="19047673-c680-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>121.0.6167.160</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>121.0.6167.160</lt></range>
</package>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_5</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.html">
<p>This update includes 3 security fixes:</p>
<ul>
<li>[41494539] High CVE-2024-1284: Use after free in Mojo. Reported by Anonymous on 2024-01-25</li>
<li>[41494860] High CVE-2024-1283: Heap buffer overflow in Skia. Reported by Jorge Buzeti (@r3tr074) on 2024-01-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1284</cvename>
<cvename>CVE-2024-1283</cvename>
<url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-02-06</discovery>
<entry>2024-02-08</entry>
</dates>
</vuln>
<vuln vid="68ae70c5-c5e5-11ee-9768-08002784c58d">
<topic>clamav -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>1.2.2,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ClamAV project reports:</p>
<blockquote cite="https://blog.clamav.net/2023/11/clamav-130-122-105-released.html">
<dl>
<dt>CVE-2024-20290</dt>
<dd>
A vulnerability in the OLE2 file format parser of ClamAV
could allow an unauthenticated, remote attacker to cause
a denial of service (DoS) condition on an affected
device. This vulnerability is due to an incorrect check
for end-of-string values during scanning, which may
result in a heap buffer over-read. An attacker could
exploit this vulnerability by submitting a crafted file
containing OLE2 content to be scanned by ClamAV on an
affected device. A successful exploit could allow the
attacker to cause the ClamAV scanning process to
terminate, resulting in a DoS condition on the affected
software and consuming available system resources.
</dd>
<dt>CVE-2024-20328</dt>
<dd>
Fixed a possible command injection vulnerability in the
"VirusEvent" feature of ClamAV's ClamD
service. To fix this issue, we disabled the '%f' format
string parameter. ClamD administrators may continue to
use the `CLAM_VIRUSEVENT_FILENAME` environment variable,
instead of '%f'. But you should do so only from within
an executable, such as a Python script, and not directly
in the clamd.conf "VirusEvent" command.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-20290</cvename>
<cvename>CVE-2024-20328</cvename>
<url>https://blog.clamav.net/2023/11/clamav-130-122-105-released.html</url>
</references>
<dates>
<discovery>2024-02-07</discovery>
<entry>2024-02-07</entry>
</dates>
</vuln>
<vuln vid="e0f6215b-c59e-11ee-a6db-080027a5b8e9">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.24</lt></range>
</package>
<package>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.8</lt></range>
</package>
<package>
<name>py311-django50</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2024/feb/06/security-releases/">
<p>CVE-2024-24680:Potential denial-of-service in intcomma template filter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24680</cvename>
<url>https://www.djangoproject.com/weblog/2024/feb/06/security-releases/</url>
</references>
<dates>
<discovery>2024-01-09</discovery>
<entry>2024-02-07</entry>
</dates>
</vuln>
<vuln vid="dc9e5237-c197-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>121.0.6167.139</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>121.0.6167.139</lt></range>
</package>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_5</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[1511567] High CVE-2024-1060: Use after free in Canvas. Reported by Anonymous on 2023-12-14</li>
<li>[1514777] High CVE-2024-1059: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-12-29</li>
<li>[1511085] High CVE-2024-1077: Use after free in Network. Reported by Microsoft Security Research Center on 2023-12-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-1060</cvename>
<cvename>CVE-2024-1059</cvename>
<cvename>CVE-2024-1077</cvename>
<url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2024-01-30</discovery>
<entry>2024-02-02</entry>
</dates>
</vuln>
<vuln vid="72d6d757-c197-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>121.0.6167.85</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>121.0.6167.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html">
<p>This update includes 17 security fixes:</p>
<ul>
<li>[1484394] High CVE-2024-0812: Inappropriate implementation in Accessibility. Reported by Anonymous on 2023-09-19</li>
<li>[1504936] High CVE-2024-0808: Integer underflow in WebUI. Reported by Lyra Rebane (rebane2001) on 2023-11-24</li>
<li>[1496250] Medium CVE-2024-0810: Insufficient policy enforcement in DevTools. Reported by Shaheen Fazim on 2023-10-26</li>
<li>[1463935] Medium CVE-2024-0814: Incorrect security UI in Payments. Reported by Muneaki Nishimura (nishimunea) on 2023-07-11</li>
<li>[1477151] Medium CVE-2024-0813: Use after free in Reading Mode. Reported by @retsew0x01 on 2023-08-30</li>
<li>[1505176] Medium CVE-2024-0806: Use after free in Passwords. Reported by 18楼梦想改造家 on 2023-11-25</li>
<li>[1514925] Medium CVE-2024-0805: Inappropriate implementation in Downloads. Reported by Om Apip on 2024-01-01</li>
<li>[1515137] Medium CVE-2024-0804: Insufficient policy enforcement in iOS Security UI. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2024-01-03</li>
<li>[1494490] Low CVE-2024-0811: Inappropriate implementation in Extensions API. Reported by Jann Horn of Google Project Zero on 2023-10-21</li>
<li>[1497985] Low CVE-2024-0809: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-10-31</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0812</cvename>
<cvename>CVE-2024-0808</cvename>
<cvename>CVE-2024-0810</cvename>
<cvename>CVE-2024-0814</cvename>
<cvename>CVE-2024-0813</cvename>
<cvename>CVE-2024-0806</cvename>
<cvename>CVE-2024-0805</cvename>
<cvename>CVE-2024-0804</cvename>
<cvename>CVE-2024-0811</cvename>
<cvename>CVE-2024-0809</cvename>
<url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html</url>
</references>
<dates>
<discovery>2024-01-23</discovery>
<entry>2024-02-02</entry>
</dates>
</vuln>
<vuln vid="13a8c4bf-cb2b-48ec-b49c-a3875c72b3e8">
<topic>electron{26,27,28} -- Use after free in Web Audio</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.8</lt></range>
</package>
<package>
<name>electron27</name>
<range><lt>27.3.1</lt></range>
</package>
<package>
<name>electron28</name>
<range><lt>28.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers reports:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.8">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-0807.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0807</cvename>
<url>https://github.com/advisories/GHSA-hjm7-v5pw-x89r</url>
</references>
<dates>
<discovery>2024-01-31</discovery>
<entry>2024-02-01</entry>
</dates>
</vuln>
<vuln vid="bbcb1584-c068-11ee-bdd6-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_5</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based">
<p>Backports for 3 security bugs in Chromium:</p>
<ul>
<li>[1505080] High CVE-2024-0807: Use after free in WebAudio</li>
<li>[1504936] Critical CVE-2024-0808: Integer underflow in WebUI</li>
<li>[1496250] Medium CVE-2024-0810: Insufficient policy enforcement in DevTools</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0807</cvename>
<cvename>CVE-2024-0808</cvename>
<cvename>CVE-2024-0810</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based</url>
</references>
<dates>
<discovery>2024-01-30</discovery>
<entry>2024-01-31</entry>
</dates>
</vuln>
<vuln vid="10dee731-c069-11ee-9190-84a93843eb75">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.13,1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.13</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20240125.txt">
<p>Excessive time spent checking invalid RSA public keys (CVE-2023-6237)</p>
<p>PKCS12 Decoding crashes (CVE-2024-0727)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0727</cvename>
<cvename>CVE-2023-6237</cvename>
<url>https://www.openssl.org/news/secadv/20240125.txt</url>
<url>https://www.openssl.org/news/secadv/20240115.txt</url>
<url>https://www.openssl.org/news/openssl-3.0-notes.html</url>
<url>https://www.openssl.org/news/openssl-3.1-notes.html</url>
<url>https://www.openssl.org/news/openssl-3.2-notes.html</url>
</references>
<dates>
<discovery>2024-01-30</discovery>
<entry>2024-01-31</entry>
</dates>
</vuln>
<vuln vid="67c2eb06-5579-4595-801b-30355be24654">
<topic>lizard -- Negative size passed to memcpy resulting in memory corruption</topic>
<affects>
<package>
<name>lizard</name>
<range><lt>1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/inikep/lizard/issues/16">
<p>In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product
was renamed), there is an unchecked buffer size during a memcpy in
the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h).
Remote attackers can leverage this vulnerability to cause a denial
of service via a crafted input file, as well as achieve remote code
execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-11498</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-11498</url>
</references>
<dates>
<discovery>2018-05-26</discovery>
<entry>2024-01-31</entry>
</dates>
</vuln>
<vuln vid="a25b323a-bed9-11ee-bdd6-4ccc6adda413">
<topic>qt6-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based">
<p>Backports for 15 security bugs in Chromium:</p>
<ul>
<li>[1505053] High CVE-2023-6345: Integer overflow in Skia</li>
<li>[1500856] High CVE-2023-6346: Use after free in WebAudio</li>
<li>[1494461] High CVE-2023-6347: Use after free in Mojo</li>
<li>[1501326] High CVE-2023-6702: Type Confusion in V8</li>
<li>[1502102] High CVE-2023-6703: Use after free in Blink</li>
<li>[1505708] High CVE-2023-6705: Use after free in WebRTC</li>
<li>[1500921] High CVE-2023-6706: Use after free in FedCM</li>
<li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC</li>
<li>[1501798] High CVE-2024-0222: Use after free in ANGLE</li>
<li>[1505009] High CVE-2024-0223: Heap buffer overflow in ANGLE</li>
<li>[1505086] High CVE-2024-0224: Use after free in WebAudio</li>
<li>[1506923] High CVE-2024-0225: Use after free in WebGPU</li>
<li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions</li>
<li>[1507412] High CVE-2024-0518: Type Confusion in V8</li>
<li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6345</cvename>
<cvename>CVE-2023-6346</cvename>
<cvename>CVE-2023-6347</cvename>
<cvename>CVE-2023-6702</cvename>
<cvename>CVE-2023-6703</cvename>
<cvename>CVE-2023-6705</cvename>
<cvename>CVE-2023-6706</cvename>
<cvename>CVE-2023-7024</cvename>
<cvename>CVE-2024-0222</cvename>
<cvename>CVE-2024-0223</cvename>
<cvename>CVE-2024-0224</cvename>
<cvename>CVE-2024-0225</cvename>
<cvename>CVE-2024-0333</cvename>
<cvename>CVE-2024-0518</cvename>
<cvename>CVE-2024-0519</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based</url>
</references>
<dates>
<discovery>2024-01-08</discovery>
<entry>2024-01-29</entry>
</dates>
</vuln>
<vuln vid="a11e7dd1-bed4-11ee-bdd6-4ccc6adda413">
<topic>qt5-webengine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt qtwebengine-chromium repo reports:</p>
<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
<p>Backports for 8 security bugs in Chromium:</p>
<ul>
<li>[1505053] High CVE-2023-6345: Integer overflow in Skia</li>
<li>[1501326] High CVE-2023-6702: Type Confusion in V8</li>
<li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC</li>
<li>[1501798] High CVE-2024-0222: Use after free in ANGLE</li>
<li>[1505086] High CVE-2024-0224: Use after free in WebAudio</li>
<li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions</li>
<li>[1507412] High CVE-2024-0518: Type Confusion in V8</li>
<li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6345</cvename>
<cvename>CVE-2023-6702</cvename>
<cvename>CVE-2023-7024</cvename>
<cvename>CVE-2024-0222</cvename>
<cvename>CVE-2024-0224</cvename>
<cvename>CVE-2024-0333</cvename>
<cvename>CVE-2024-0518</cvename>
<cvename>CVE-2024-0519</cvename>
<url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
</references>
<dates>
<discovery>2024-01-08</discovery>
<entry>2024-01-29</entry>
</dates>
</vuln>
<vuln vid="b5e22ec5-bc4b-11ee-b0b5-b42e991fc52e">
<topic>rclone -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>rclone</name>
<range><lt>1.65.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities in ssh and golang</p>
<blockquote cite="https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e">
<ul>
<li>
CVE-2023-45286: HTTP request body disclosure in go-resty
disclosure across requests.
</li>
<li>
CVE-2023-48795: The SSH transport protocol with certain
OpenSSH extensions, found in OpenSSH before 9.6 and
other products, allows remote attackers to bypass
integrity checks.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45286</cvename>
<cvename>CVE-2023-48795</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-45286</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-48795</url>
</references>
<dates>
<discovery>2023-11-28</discovery>
<entry>2024-01-26</entry>
</dates>
</vuln>
<vuln vid="61fe903b-bc2e-11ee-b06e-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.8.0</ge><lt>16.8.1</lt></range>
<range><ge>16.7.0</ge><lt>16.7.4</lt></range>
<range><ge>16.6.0</ge><lt>16.6.6</lt></range>
<range><ge>12.7.0</ge><lt>16.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/">
<p>Arbitrary file write while creating workspace</p>
<p>ReDoS in Cargo.toml blob viewer</p>
<p>Arbitrary API PUT requests via HTML injection in user's name</p>
<p>Disclosure of the public email in Tags RSS Feed</p>
<p>Non-Member can update MR Assignees of owned MRs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0402</cvename>
<cvename>CVE-2023-6159</cvename>
<cvename>CVE-2023-5933</cvename>
<cvename>CVE-2023-5612</cvename>
<cvename>CVE-2024-0456</cvename>
<url>https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/</url>
</references>
<dates>
<discovery>2024-01-25</discovery>
<entry>2024-01-26</entry>
</dates>
</vuln>
<vuln vid="8b03d274-56ca-489e-821a-cf32f07643f0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.422</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.426.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2024-01-24/">
<h1>Description</h1>
<h5>(Critical) SECURITY-3314 / CVE-2024-23897</h5>
<p>Arbitrary file read vulnerability through the CLI can lead to RCE</p>
<h1>Description</h1>
<h5>(High) SECURITY-3315 / CVE-2024-23898</h5>
<p>Cross-site WebSocket hijacking vulnerability in the CLI</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-23897</cvename>
<cvename>CVE-2024-23898</cvename>
<url>https://www.jenkins.io/security/advisory/2024-01-24/</url>
</references>
<dates>
<discovery>2024-01-24</discovery>
<entry>2024-01-24</entry>
</dates>
</vuln>
<vuln vid="9532a361-b84d-11ee-b0d7-84a93843eb75">
<topic>TinyMCE -- mXSS in multiple plugins</topic>
<affects>
<package>
<name>tinymce</name>
<range><lt>6.7.3</lt></range>
</package>
<package>
<name>roundcube</name>
<range><lt>1.6.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TinyMCE reports:</p>
<blockquote cite="https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8">
<p>Special characters in unescaped text nodes can trigger mXSS
when using TinyMCE undo/redo, getContentAPI, resetContentAPI,
and Autosave plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-48219</cvename>
<url>https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8</url>
<url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.6</url>
</references>
<dates>
<discovery>2023-11-15</discovery>
<entry>2024-01-23</entry>
</dates>
</vuln>
<vuln vid="fedf7e71-61bd-49ec-aaf0-6da14bdbb319">
<topic>zeek -- potential DoS vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>6.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.3">
<p>A specially-crafted series of packets containing nested
MIME entities can cause Zeek to spend large amounts of
time parsing the entities. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v6.0.3</url>
</references>
<dates>
<discovery>2024-01-22</discovery>
<entry>2024-01-22</entry>
</dates>
</vuln>
<vuln vid="2264566a-a890-46eb-a895-7881dd220bd0">
<topic>electron26 -- Out of bounds memory access in V8</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.7">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2024-0519.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0519</cvename>
<url>https://github.com/advisories/GHSA-vg6w-jr5m-86c8</url>
</references>
<dates>
<discovery>2024-01-18</discovery>
<entry>2024-01-19</entry>
</dates>
</vuln>
<vuln vid="a8326b61-eda0-4c03-9a5b-49ebd8f41c1a">
<topic>electron{26,27} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.6</lt></range>
</package>
<package>
<name>electron27</name>
<range><lt>27.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.2.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-0518.</li>
<li>Security: backported fix for CVE-2024-0517.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0518</cvename>
<url>https://github.com/advisories/GHSA-4pvg-f3m8-ff3j</url>
<cvename>CVE-2024-0517</cvename>
<url>https://github.com/advisories/GHSA-v39r-662x-j524</url>
</references>
<dates>
<discovery>2024-01-17</discovery>
<entry>2024-01-17</entry>
<modified>2024-01-18</modified>
</dates>
</vuln>
<vuln vid="1bc07be0-b514-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.224</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[1515930] High CVE-2024-0517: Out of bounds write in V8. Reported by Toan (suto) Pham of Qrious Secure on 2024-01-06</li>
<li>[1507412] High CVE-2024-0518: Type Confusion in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2023-12-03</li>
<li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8. Reported by Anonymous on 2024-01-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0517</cvename>
<cvename>CVE-2024-0518</cvename>
<cvename>CVE-2024-0519</cvename>
<url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html</url>
</references>
<dates>
<discovery>2024-01-16</discovery>
<entry>2024-01-17</entry>
</dates>
</vuln>
<vuln vid="7467c611-b490-11ee-b903-001fc69cd6dc">
<topic>xorg server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.11,1</lt></range>
</package>
<package>
<name>xorg-nextserver</name>
<range><lt>21.1.11,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>23.2.4</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.653</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg/2024-January/061525.html">
<ul>
<li>CVE-2023-6816: Heap buffer overflow in DeviceFocusEvent
and ProcXIQueryPointer
<p>Both DeviceFocusEvent and the XIQueryPointer reply contain a bit
for each logical button currently down. Buttons can be arbitrarily
mapped to any value up to 255 but the X.Org Server was only
allocating space for the device's number of buttons,
leading to a heap overflow if a bigger value was used.</p></li>
<li>CVE-2024-0229: Reattaching to different master device may lead
to out-of-bounds memory access
<p>If a device has both a button class and a key class and
numButtons is zero, we can get an out-of-bounds write due
to event under-allocation in the DeliverStateNotifyEvent
function.</p></li>
<li>CVE-2024-21885: Heap buffer overflow in
XISendDeviceHierarchyEvent
<p>The XISendDeviceHierarchyEvent() function allocates space to
store up to MAXDEVICES (256) xXIHierarchyInfo structures in info.
If a device with a given ID was removed and a new device with
the same ID added both in the same operation,
the single device ID will lead to two info structures being
written to info.
Since this case can occur for every device ID at once,
a total of two times MAXDEVICES info structures might be written
to the allocation, leading to a heap buffer overflow.</p></li>
<li>CVE-2024-21886: Heap buffer overflow in DisableDevice
<p>The DisableDevice() function is called whenever an enabled device
is disabled and it moves the device from the inputInfo.devices
linked list to the inputInfo.off_devices linked list.
However, its link/unlink operation has an issue during the recursive
call to DisableDevice() due to the prev pointer pointing to a
removed device.
This issue leads to a length mismatch between the total number of
devices and the number of device in the list, leading to a heap
overflow and, possibly, to local privilege escalation.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6816</cvename>
<cvename>CVE-2024-0229</cvename>
<cvename>CVE-2024-21885</cvename>
<cvename>CVE-2024-21886</cvename>
<url>https://lists.x.org/archives/xorg/2024-January/061525.html</url>
</references>
<dates>
<discovery>2024-01-16</discovery>
<entry>2024-01-16</entry>
</dates>
</vuln>
<vuln vid="28b42ef5-80cd-440c-904b-b7fbca74c73d">
<topic>electron{26,27} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.5</lt></range>
</package>
<package>
<name>electron27</name>
<range><lt>27.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.5">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2024-0224.</li>
<li>Security: backported fix for CVE-2024-0225.</li>
<li>Security: backported fix for CVE-2024-0223.</li>
<li>Security: backported fix for CVE-2024-0222.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0224</cvename>
<url>https://github.com/advisories/GHSA-83wx-v283-85g9</url>
<cvename>CVE-2024-0225</cvename>
<url>https://github.com/advisories/GHSA-gqr9-4fcc-c9jq</url>
<cvename>CVE-2024-0223</cvename>
<url>https://github.com/advisories/GHSA-w8x8-g534-x4rp</url>
<cvename>CVE-2024-0222</cvename>
<url>https://github.com/advisories/GHSA-c87c-56pw-mwgh</url>
</references>
<dates>
<discovery>2024-01-10</discovery>
<entry>2024-01-12</entry>
</dates>
</vuln>
<vuln vid="4c8c2218-b120-11ee-90ec-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.7.0</ge><lt>16.7.2</lt></range>
<range><ge>16.6.0</ge><lt>16.6.4</lt></range>
<range><ge>8.13.0</ge><lt>16.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/">
<p>Account Takeover via Password Reset without user interactions</p>
<p>Attacker can abuse Slack/Mattermost integrations to execute slash commands as another user</p>
<p>Bypass CODEOWNERS approval removal</p>
<p>Workspaces able to be created under different root namespace</p>
<p>Commit signature validation ignores headers after signature</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-7028</cvename>
<cvename>CVE-2023-5356</cvename>
<cvename>CVE-2023-4812</cvename>
<cvename>CVE-2023-6955</cvename>
<cvename>CVE-2023-2030</cvename>
<url>https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/</url>
</references>
<dates>
<discovery>2024-01-11</discovery>
<entry>2024-01-12</entry>
</dates>
</vuln>
<vuln vid="8337251b-b07b-11ee-b0d7-84a93843eb75">
<topic>OpenSSL -- Vector register corruption on PowerPC</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.12_2,1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.12_2</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.4_2</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.4_2</lt></range>
</package>
<package>
<name>openssl32</name>
<range><lt>3.2.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20240109.txt">
<p>The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on PowerPC CPU based platforms if the CPU provides vector instructions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6129</cvename>
<url>https://www.openssl.org/news/secadv/20240109.txt</url>
</references>
<dates>
<discovery>2024-01-09</discovery>
<entry>2024-01-11</entry>
</dates>
</vuln>
<vuln vid="ec8e4040-afcd-11ee-86bb-a8a1599412c6">
<topic>chromium -- security fix</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.216</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.216</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions. Reported by Malcolm Stagg (@malcolmst) of SODIUM-24, LLC on 2023-12-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0333</cvename>
<url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html</url>
</references>
<dates>
<discovery>2024-01-09</discovery>
<entry>2024-01-10</entry>
</dates>
</vuln>
<vuln vid="e2f981f1-ad9e-11ee-8b55-4ccc6adda413">
<topic>QtNetwork -- potential buffer overflow</topic>
<affects>
<package>
<name>qt5-network</name>
<range><lt>5.15.12p148_1</lt></range>
</package>
<package>
<name>qt6-base</name>
<range><lt>6.6.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Shaw reports:</p>
<blockquote cite="https://www.qt.io/blog/security-advisory-potential-integer-overflow-in-qts-http2-implementation">
<p>A potential integer overflow has been discovered in Qt's HTTP2
implementation. If the HTTP2 implementation receives more than 4GiB
in total headers, or more than 2GiB for any given header pair, then
the internal buffers may overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-51714</cvename>
<url>https://www.qt.io/blog/security-advisory-potential-integer-overflow-in-qts-http2-implementation</url>
</references>
<dates>
<discovery>2023-12-14</discovery>
<entry>2024-01-07</entry>
</dates>
</vuln>
<vuln vid="1f0d0024-ac9c-11ee-8e91-1c697a013f4b">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php74</name>
<name>mantis-php80</name>
<name>mantis-php81</name>
<name>mantis-php82</name>
<name>mantis-php83</name>
<range><lt>2.25.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis 2.25.8 release reports:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?version_id=370">
<p>Security and maintenance release</p>
<ul>
<li>0032432: Update guzzlehttp/psr7 to 1.9.1 (CVE-2023-29197)</li>
<li>0032981: Information Leakage on DokuWiki Integration (CVE-2023-44394)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-29197</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197</url>
<cvename>CVE-2023-44394</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44394</url>
</references>
<dates>
<discovery>2023-10-14</discovery>
<entry>2024-01-06</entry>
</dates>
</vuln>
<vuln vid="3ee577a9-aad4-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.199</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.199</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html">
<p>This update includes 6 security fixes:</p>
<ul>
<li>[1501798] High CVE-2024-0222: Use after free in ANGLE. Reported by Toan (suto) Pham of Qrious Secure on 2023-11-13</li>
<li>[1505009] High CVE-2024-0223: Heap buffer overflow in ANGLE. Reported by Toan (suto) Pham and Tri Dang of Qrious Secure on 2023-11-24</li>
<li>[1505086] High CVE-2024-0224: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2023-11-25</li>
<li>[1506923] High CVE-2024-0225: Use after free in WebGPU. Reported by Anonymous on 2023-12-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-0222</cvename>
<cvename>CVE-2024-0223</cvename>
<cvename>CVE-2024-0224</cvename>
<cvename>CVE-2024-0225</cvename>
<url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2024-01-03</discovery>
<entry>2024-01-04</entry>
</dates>
</vuln>
<vuln vid="d1b20e09-dbdf-432b-83c7-89f0af76324a">
<topic>electron27 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron27</name>
<range><lt>27.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v27.2.1">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6706.</li>
<li>Security: backported fix for CVE-2023-6705.</li>
<li>Security: backported fix for CVE-2023-6703.</li>
<li>Security: backported fix for CVE-2023-6702.</li>
<li>Security: backported fix for CVE-2023-6704.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6706</cvename>
<url>https://github.com/advisories/GHSA-jqrg-rvpw-5fw5</url>
<cvename>CVE-2023-6705</cvename>
<url>https://github.com/advisories/GHSA-h27f-fw5q-c2gh</url>
<cvename>CVE-2023-6703</cvename>
<url>https://github.com/advisories/GHSA-9v72-359m-2vx4</url>
<cvename>CVE-2023-6702</cvename>
<url>https://github.com/advisories/GHSA-7hjc-c62g-4w73</url>
<cvename>CVE-2023-6704</cvename>
<url>https://github.com/advisories/GHSA-587x-fmc5-99p9</url>
</references>
<dates>
<discovery>2024-01-04</discovery>
<entry>2024-01-04</entry>
</dates>
</vuln>
<vuln vid="0cee4f9c-5efb-4770-b917-f4e4569e8bec">
<topic>electron26 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.4">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6704.</li>
<li>Security: backported fix for CVE-2023-6705.</li>
<li>Security: backported fix for CVE-2023-6703.</li>
<li>Security: backported fix for CVE-2023-6702.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6704</cvename>
<url>https://github.com/advisories/GHSA-587x-fmc5-99p9</url>
<cvename>CVE-2023-6705</cvename>
<url>https://github.com/advisories/GHSA-h27f-fw5q-c2gh</url>
<cvename>CVE-2023-6703</cvename>
<url>https://github.com/advisories/GHSA-9v72-359m-2vx4</url>
<cvename>CVE-2023-6702</cvename>
<url>https://github.com/advisories/GHSA-7hjc-c62g-4w73</url>
</references>
<dates>
<discovery>2024-01-04</discovery>
<entry>2024-01-04</entry>
</dates>
</vuln>
<vuln vid="13d83980-9f18-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Prefix Truncation Attack in the SSH protocol</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>14.0</ge><lt>14.0_4</lt></range>
<range><ge>13.2</ge><lt>13.2_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SSH protocol executes an initial handshake between the
server and the client. This protocol handshake includes the
possibility of several extensions allowing different options to be
selected. Validation of the packets in the handshake is done through
sequence numbers.</p>
<h1>Impact:</h1>
<p>A man in the middle attacker can silently manipulate handshake
messages to truncate extension negotiation messages potentially
leading to less secure client authentication algorithms or deactivating
keystroke timing attack countermeasures.</p>
</body>
</description>
<references>
<cvename>CVE-2023-48795</cvename>
<freebsdsa>SA-23:19.openssh</freebsdsa>
</references>
<dates>
<discovery>2023-12-19</discovery>
<entry>2024-01-02</entry>
</dates>
</vuln>
<vuln vid="bd7592a1-cbfd-11ee-a42a-5404a6f3ca32">
<topic>gitea -- Prevent anonymous container access</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.21.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>
Even with RequireSignInView enabled, anonymous users can use docker pull
to fetch public images.
</p>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.21.5/</url>
</references>
<dates>
<discovery>2024-01-24</discovery>
<entry>2024-02-15</entry>
</dates>
</vuln>
<vuln vid="7015ab21-9230-490f-a2fe-f7557e3de25d">
<topic>electron{26,27} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.3</lt></range>
</package>
<package>
<name>electron27</name>
<range><lt>27.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6508.</li>
<li>Security: backported fix for CVE-2023-7024.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6508</cvename>
<url>https://github.com/advisories/GHSA-3pr6-6r34-c98x</url>
<cvename>CVE-2023-7024</cvename>
<url>https://github.com/advisories/GHSA-7c6v-f3h8-2x89</url>
</references>
<dates>
<discovery>2023-12-21</discovery>
<entry>2023-12-22</entry>
</dates>
</vuln>
<vuln vid="b2765c89-a052-11ee-bed2-596753f1a87c">
<topic>gitea -- Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.21.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/28519">
<p>Update golang.org/x/crypto</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.21.3</url>
</references>
<dates>
<discovery>2023-12-19</discovery>
<entry>2023-12-21</entry>
</dates>
</vuln>
<vuln vid="482bb980-99a3-11ee-b5f7-6bd56600d90c">
<topic>gitea -- missing permission checks</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.21.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/28406">
<p>Fix missing check</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/28423">
<p>Do some missing checks</p>
</blockquote>
<p>By crafting an API request, attackers can access the contents of
issues even though the logged-in user does not have access rights to
these issues.</p>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.21.2</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-09-10</entry>
</dates>
</vuln>
<vuln vid="0f7598cc-9fe2-11ee-b47f-901b0e9408dc">
<topic>nebula -- security fix for terrapin vulnerability</topic>
<affects>
<package>
<name>nebula</name>
<range><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://github.com/slackhq/nebula/releases/tag/v1.8.1">
<p>Security fix:</p>
<ul>
<li>Update golang.org/x/crypto, which includes a fix for CVE-2023-48795.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-48795</cvename>
<url>https://www.openssh.com/txt/release-9.6</url>
<url>https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d</url>
<url>https://terrapin-attack.com/</url>
</references>
<dates>
<discovery>2023-10-16</discovery>
<entry>2023-12-19</entry>
</dates>
</vuln>
<vuln vid="1b2a8e8a-9fd5-11ee-86bb-a8a1599412c6">
<topic>chromium -- security fix</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.129</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.129</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-7024</cvename>
<url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2023-12-20</discovery>
<entry>2023-12-21</entry>
</dates>
</vuln>
<vuln vid="91955195-9ebb-11ee-bc14-a703705db3a6">
<topic>putty -- add protocol extension against 'Terrapin attack'</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.80</lt></range>
</package>
<package>
<name>putty-nogtk</name>
<range><lt>0.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html">
<p>PuTTY version 0.80 [contains] one security fix [...] for a newly discovered security issue known as the 'Terrapin'
attack, also numbered CVE-2023-48795. The issue affects widely-used
OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305
cipher system, and 'encrypt-then-MAC' mode.</p>
<p>In order to benefit from the fix, you must be using a fixed version
of PuTTY _and_ a server with the fix, so that they can agree to
adopt a modified version of the protocol. [...]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-48795</cvename>
<url>https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html</url>
<url>https://www.openssh.com/txt/release-9.6</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html</url>
<url>https://terrapin-attack.com/</url>
</references>
<dates>
<discovery>2023-10-16</discovery>
<entry>2023-12-19</entry>
</dates>
</vuln>
<vuln vid="76c2110b-9e97-11ee-ae23-a0f3c100ae18">
<topic>slurm-wlm -- Several security issues</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>23.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Slurm releases notes:</p>
<blockquote cite="https://www.schedmd.com/news.php?id=283#OPT_283">
<h1>Description</h1>
<h5>CVE-2023-49933 through CVE-2023-49938</h5>
<p>Slurm versions 23.11.1, 23.02.7, 22.05.11 are now available
and address a number of recently-discovered security issues.
They've been assigned CVE-2023-49933 through CVE-2023-49938.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-49933</cvename>
<cvename>CVE-2023-49934</cvename>
<cvename>CVE-2023-49935</cvename>
<cvename>CVE-2023-49936</cvename>
<cvename>CVE-2023-49937</cvename>
<cvename>CVE-2023-49938</cvename>
</references>
<dates>
<discovery>2023-11-29</discovery>
<entry>2023-12-19</entry>
</dates>
</vuln>
<vuln vid="fd47fcfe-ec69-4000-b9ce-e5e62102c1c7">
<topic>couchdb -- information sharing via couchjs processes</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>3.3.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nick Vatamane reports:</p>
<blockquote cite="https://docs.couchdb.org/en/stable/cve/2023-26268.html">
<p>Design documents with matching document IDs, from databases on the
same cluster, may share a mutable Javascript environment when using
various design document functions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-26268</cvename>
<url>https://docs.couchdb.org/en/stable/cve/2023-26268.html</url>
</references>
<dates>
<discovery>2023-05-02</discovery>
<entry>2023-12-17</entry>
</dates>
</vuln>
<vuln vid="e2fb85ce-9a3c-11ee-af26-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.6.0</ge><lt>16.6.2</lt></range>
<range><ge>16.5.0</ge><lt>16.5.4</lt></range>
<range><ge>8.17.0</ge><lt>16.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/">
<p>Smartcard authentication allows impersonation of arbitrary user using user's public certificate</p>
<p>When subgroup is allowed to merge or push to protected branches, subgroup members with the Developer role may gain the ability to push or merge</p>
<p>The GitLab web interface does not ensure the integrity of information when downloading the source code from installation packages or tags</p>
<p>Project maintainer can escalate to Project owner using project access token rotate API</p>
<p>Omission of Double Encoding in File Names Facilitates the Creation of Repositories with Malicious Content</p>
<p>Unvalidated timeSpent value leads to unable to load issues on Issue board</p>
<p>Developer can bypass predefined variables via REST API</p>
<p>Auditor users can create merge requests on projects they don't have access to</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6680</cvename>
<cvename>CVE-2023-6564</cvename>
<cvename>CVE-2023-6051</cvename>
<cvename>CVE-2023-3907</cvename>
<cvename>CVE-2023-5512</cvename>
<cvename>CVE-2023-3904</cvename>
<cvename>CVE-2023-5061</cvename>
<cvename>CVE-2023-3511</cvename>
<url>https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/</url>
</references>
<dates>
<discovery>2023-12-13</discovery>
<entry>2023-12-14</entry>
</dates>
</vuln>
<vuln vid="502c9f72-99b3-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.109</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.109</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html">
<p>This update includes 9 security fixes:</p>
<ul>
<li>[1501326] High CVE-2023-6702: Type Confusion in V8. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2023-11-10</li>
<li>[1502102] High CVE-2023-6703: Use after free in Blink. Reported by Cassidy Kim(@cassidy6564) on 2023-11-14</li>
<li>[1504792] High CVE-2023-6704: Use after free in libavif. Reported by Fudan University on 2023-11-23</li>
<li>[1505708] High CVE-2023-6705: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-11-28</li>
<li>[1500921] High CVE-2023-6706: Use after free in FedCM. Reported by anonymous on 2023-11-09</li>
<li>[1504036] Medium CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel on 2023-11-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6702</cvename>
<cvename>CVE-2023-6703</cvename>
<cvename>CVE-2023-6704</cvename>
<cvename>CVE-2023-6705</cvename>
<cvename>CVE-2023-6706</cvename>
<cvename>CVE-2023-6707</cvename>
<url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2023-12-12</discovery>
<entry>2023-12-13</entry>
</dates>
</vuln>
<vuln vid="8eefff69-997f-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- NFS client data corruption and kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.0</ge><lt>14.0_3</lt></range>
<range><ge>13.2</ge><lt>13.2_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In FreeBSD 13.2 and 14.0, the NFS client was optimized to improve
the performance of IO_APPEND writes, that is, writes which add data
to the end of a file and so extend its size. This uncovered an old
bug in some routines which copy userspace data into the kernel.
The bug also affects the NFS client's implementation of direct I/O;
however, this implementation is disabled by default by the
vfs.nfs.nfs_directio_enable sysctl and is only used to handle
synchronous writes.</p>
<h1>Impact:</h1>
<p>When a program running on an affected system appends data to a
file via an NFS client mount, the bug can cause the NFS client to
fail to copy in the data to be written but proceed as though the
copy operation had succeeded. This means that the data to be written
is instead replaced with whatever data had been in the packet buffer
previously. Thus, an unprivileged user with access to an affected
system may abuse the bug to trigger disclosure of sensitive
information. In particular, the leak is limited to data previously
stored in mbufs, which are used for network transmission and
reception, and for certain types of inter-process communication.</p>
<p>The bug can also be triggered unintentionally by system
applications, in which case the data written by the application to an
NFS mount may be corrupted. Corrupted data is written over the
network to the NFS server, and thus also susceptible to being snooped
by other hosts on the network.</p>
<p>Note that the bug exists only in the NFS client; the version and
implementation of the server has no effect on whether a given system
is affected by the problem.</p>
</body>
</description>
<references>
<cvename>CVE-2023-6660</cvename>
<freebsdsa>SA-23:18.nfsclient</freebsdsa>
</references>
<dates>
<discovery>2023-12-12</discovery>
<entry>2023-12-13</entry>
</dates>
</vuln>
<vuln vid="972568d6-3485-40ab-80ff-994a8aaf9683">
<topic>xorg-server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.10,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>21.1.10,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>23.2.3,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.582</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-December/003435.html">
<ul>
<li>CVE-2023-6377/ZDI-CAN-22412/ZDI-CAN-22413: X.Org
server: Out-of-bounds memory write in XKB button actions
<p>A device has XKB button actions for each button on the
device. When a logical device switch happens (e.g. moving
from a touchpad to a mouse), the server re-calculates the
information available on the respective master device
(typically the Virtual Core Pointer). This re-calculation
only allocated enough memory for a single XKB action
rather instead of enough for the newly active physical
device's number of button. As a result, querying or
changing the XKB button actions results in out-of-bounds
memory reads and writes.</p>
<p>This may lead to local privilege escalation if the server is run as root or
remote code execution (e.g. x11 over ssh).</p></li>
<li>CVE-2023-6478/ZDI-CAN-22561: X.Org server:
Out-of-bounds memory read in RRChangeOutputProperty and
RRChangeProviderProperty
<p>This fixes an OOB read and the resulting information disclosure.</p>
<p>Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->nUnits value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.</p>
<p>The server then proceeded with reading at least stuff->nUnits bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->nUnits bytes, i.e. 4GB.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-December/003435.html</url>
<cvename>CVE-2023-6377</cvename>
<cvename>CVE-2023-6478</cvename>
</references>
<dates>
<discovery>2023-12-13</discovery>
<entry>2023-12-13</entry>
</dates>
</vuln>
<vuln vid="4405e9ad-97fe-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>120.0.6099.62</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>120.0.6099.62</lt></range>
</package>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_2</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html">
<p>This update includes 10 security fixes:</p>
<ul>
<li>[1497984] High CVE-2023-6508: Use after free in Media Stream. Reported by Cassidy Kim(@cassidy6564) on 2023-10-31</li>
<li>[1494565] High CVE-2023-6509: Use after free in Side Panel Search. Reported by Khalil Zhani on 2023-10-21</li>
<li>[1480152] Medium CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car] on 2023-09-08</li>
<li>[1478613] Low CVE-2023-6511: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-09-04</li>
<li>[1457702] Low CVE-2023-6512: Inappropriate implementation in Web Browser UI. Reported by Om Apip on 2023-06-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6508</cvename>
<cvename>CVE-2023-6509</cvename>
<cvename>CVE-2023-6510</cvename>
<cvename>CVE-2023-6511</cvename>
<cvename>CVE-2023-6512</cvename>
<url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-12-05</discovery>
<entry>2023-12-11</entry>
</dates>
</vuln>
<vuln vid="2bc376c0-977e-11ee-b4bc-b42e991fc52e">
<topic>apache -- Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication</topic>
<affects>
<package>
<name>zookeeper</name>
<range><lt>3.7.2</lt></range>
<range><ge>3.8.0</ge><lt>3.8.3</lt></range>
<range><ge>3.9.0</ge><lt>3.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@apache.org reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2023/10/11/4">
<p>Authorization Bypass Through User-Controlled Key vulnerability in
Apache ZooKeeper. If SASL Quorum Peer authentication is enabled
in ZooKeeper (quorum.auth.enableSasl=true), the authorization is
done by verifying that the instance part in SASL authentication ID
is listed in zoo.cfg server list. The instance part in SASL auth
ID is optional and if it's missing, like 'eve@EXAMPLE.COM',
the authorization check will be skipped.As a result an arbitrary
endpoint could join the cluster and begin propagating counterfeit
changes to the leader, essentially giving it complete read-write
access to the data tree.Quorum Peer authentication is not enabled
by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2,
which fixes the issue.
Alternately ensure the ensemble election/quorum communication is
protected by a firewall as this will mitigate the issue.
See the documentation for more details on correct cluster administration.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-44981</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-44981</url>
</references>
<dates>
<discovery>2023-10-11</discovery>
<entry>2023-12-10</entry>
</dates>
</vuln>
<vuln vid="e07a7754-12a4-4661-b852-fd221d68955f">
<topic>electron25 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.8">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6350.</li>
<li>Security: backported fix for CVE-2023-6351.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6350</cvename>
<url>https://github.com/advisories/GHSA-wmh6-7xp9-5gh8</url>
<cvename>CVE-2023-6351</cvename>
<url>https://github.com/advisories/GHSA-47vw-3hx2-6877</url>
</references>
<dates>
<discovery>2023-12-06</discovery>
<entry>2023-12-07</entry>
</dates>
</vuln>
<vuln vid="9cbbc506-93c1-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- TCP spoofing vulnerability in pf(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>14.0</ge><lt>14.0_2</lt></range>
<range><ge>13.2</ge><lt>13.2_4</lt></range>
<range><ge>12.4</ge><lt>12.4_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>As part of its stateful TCP connection tracking implementation,
pf performs sequence number validation on inbound packets. This
makes it difficult for a would-be attacker to spoof the sender and
inject packets into a TCP stream, since crafted packets must contain
sequence numbers which match the current connection state to avoid
being rejected by the firewall.</p>
<p>A bug in the implementation of sequence number validation means
that the sequence number is not in fact validated, allowing an
attacker who is able to impersonate the remote host and guess the
connection's port numbers to inject packets into the TCP stream.</p>
<h1>Impact:</h1>
<p>An attacker can, with relatively little effort, inject packets
into a TCP stream destined to a host behind a pf firewall. This
could be used to implement a denial-of-service attack for hosts
behind the firewall, for example by sending TCP RST packets to the
host.</p>
</body>
</description>
<references>
<cvename>CVE-2023-6534</cvename>
<freebsdsa>SA-23:17.pf</freebsdsa>
</references>
<dates>
<discovery>2023-12-05</discovery>
<entry>2023-12-05</entry>
<modified>2023-12-14</modified>
</dates>
</vuln>
<vuln vid="f25a34b1-910d-11ee-a1a2-641c67a117d8">
<topic>varnish -- HTTP/2 Rapid Reset Attack</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.4.2</lt></range>
</package>
<package>
<name>varnish6</name>
<range><lt>6.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00013.html">
<p>A denial of service attack can be performed on Varnish Cache servers
that have the HTTP/2 protocol turned on. An attacker can create a large
volume of streams and immediately reset them without ever reaching the
maximum number of concurrent streams allowed for the session, causing
the Varnish server to consume unnecessary resources processing requests
for which the response will not be delivered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-44487</cvename>
<url>https://varnish-cache.org/security/VSV00013.html</url>
</references>
<dates>
<discovery>2023-11-13</discovery>
<entry>2023-12-02</entry>
</dates>
</vuln>
<vuln vid="3b14b2b4-9014-11ee-98b3-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.6.0</ge><lt>16.6.1</lt></range>
<range><ge>16.5.0</ge><lt>16.5.3</lt></range>
<range><ge>8.13.0</ge><lt>16.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/">
<p>XSS and ReDoS in Markdown via Banzai pipeline of Jira</p>
<p>Members with admin_group_member custom permission can add members with higher role</p>
<p>Release Description visible in public projects despite release set as project members only through atom response</p>
<p>Manipulate the repository content in the UI (CVE-2023-3401 bypass)</p>
<p>External user can abuse policy bot to gain access to internal projects</p>
<p>Client-side DOS via Mermaid Flowchart</p>
<p>Developers can update pipeline schedules to use protected branches even if they don't have permission to merge</p>
<p>Users can install Composer packages from public projects even when Package registry is turned off</p>
<p>Unauthorized member can gain Allowed to push and merge access and affect integrity of protected branches</p>
<p>Guest users can react (emojis) on confidential work items which they cant see in a project</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6033</cvename>
<cvename>CVE-2023-6396</cvename>
<cvename>CVE-2023-3949</cvename>
<cvename>CVE-2023-5226</cvename>
<cvename>CVE-2023-5995</cvename>
<cvename>CVE-2023-4912</cvename>
<cvename>CVE-2023-4317</cvename>
<cvename>CVE-2023-3964</cvename>
<cvename>CVE-2023-4658</cvename>
<cvename>CVE-2023-3443</cvename>
<url>https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/</url>
</references>
<dates>
<discovery>2023-11-30</discovery>
<entry>2023-12-01</entry>
</dates>
</vuln>
<vuln vid="7e1a508f-7167-47b0-b9fc-95f541933a86">
<topic>electron26 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron26</name>
<range><lt>26.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6345.</li>
<li>Security: backported fix for CVE-2023-6346.</li>
<li>Security: backported fix for CVE-2023-6347.</li>
<li>Security: backported fix for CVE-2023-6350.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6345</cvename>
<url>https://github.com/advisories/GHSA-xm5p-7w7v-qqr5</url>
<cvename>CVE-2023-6346</cvename>
<url>https://github.com/advisories/GHSA-w427-5x7p-xj8x</url>
<cvename>CVE-2023-6347</cvename>
<url>https://github.com/advisories/GHSA-6jj9-4hh8-6xpv</url>
<cvename>CVE-2023-6350</cvename>
<url>https://github.com/advisories/GHSA-wmh6-7xp9-5gh8</url>
</references>
<dates>
<discovery>2023-11-30</discovery>
<entry>2023-12-01</entry>
</dates>
</vuln>
<vuln vid="302fc846-860f-482e-a8f6-ee9f254dfacf">
<topic>electron25 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.7">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-6345.</li>
<li>Security: backported fix for CVE-2023-6346.</li>
<li>Security: backported fix for CVE-2023-6347.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6345</cvename>
<url>https://github.com/advisories/GHSA-xm5p-7w7v-qqr5</url>
<cvename>CVE-2023-6346</cvename>
<url>https://github.com/advisories/GHSA-w427-5x7p-xj8x</url>
<cvename>CVE-2023-6347</cvename>
<url>https://github.com/advisories/GHSA-6jj9-4hh8-6xpv</url>
</references>
<dates>
<discovery>2023-12-01</discovery>
<entry>2023-12-01</entry>
</dates>
</vuln>
<vuln vid="8cdd38c7-8ebb-11ee-86bb-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>119.0.6045.199</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>119.0.6045.199</lt></range>
</package>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5_2</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html">
<p>This update includes 7 security fixes:</p>
<ul>
<li>[1491459] High CVE-2023-6348: Type Confusion in Spellcheck. Reported by Mark Brand of Google Project Zero on 2023-10-10</li>
<li>[1494461] High CVE-2023-6347: Use after free in Mojo. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2023-10-21</li>
<li>[1500856] High CVE-2023-6346: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2023-11-09</li>
<li>[1501766] High CVE-2023-6350: Out of bounds memory access in libavif. Reported by Fudan University on 2023-11-13</li>
<li>[1501770] High CVE-2023-6351: Use after free in libavif. Reported by Fudan University on 2023-11-13</li>
<li>[1505053] High CVE-2023-6345: Integer overflow in Skia. Reported by Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group on 2023-11-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-6348</cvename>
<cvename>CVE-2023-6347</cvename>
<cvename>CVE-2023-6346</cvename>
<cvename>CVE-2023-6350</cvename>
<cvename>CVE-2023-6351</cvename>
<cvename>CVE-2023-6345</cvename>
<url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html</url>
</references>
<dates>
<discovery>2023-11-28</discovery>
<entry>2023-11-29</entry>
</dates>
</vuln>
<vuln vid="388e6557-8c80-11ee-9ee3-84a93843eb75">
<topic>MariaDB -- Denial-of-Service vulnerability</topic>
<affects>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.23</lt></range>
</package>
<package>
<name>mariadb106-server</name>
<range><lt>10.6.16</lt></range>
</package>
<package>
<name>mariadb1011-server</name>
<range><lt>10.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/mariadb-10-11-6-release-notes/">
<p>Easily exploitable vulnerability allows high privileged attacker
with network access via multiple protocols to compromise MySQL
Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of MySQL Server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22084</cvename>
<url>https://mariadb.com/kb/en/mariadb-10-11-6-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb-10-6-16-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb-10-5-23-release-notes/</url>
</references>
<dates>
<discovery>2023-11-13</discovery>
<entry>2023-11-26</entry>
</dates>
</vuln>
<vuln vid="a62c0c50-8aa0-11ee-ac0d-00e0670f2660">
<topic>strongSwan -- vulnerability in charon-tkm</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>5.3.0</ge><lt>5.9.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html">
<p>A vulnerability in charon-tkm related to processing
DH public values was discovered in strongSwan
that can result in a buffer overflow and potentially
remote code execution. All versions since
5.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41913</cvename>
<url>https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html</url>
</references>
<dates>
<discovery>2023-11-20</discovery>
<entry>2023-11-24</entry>
</dates>
</vuln>
<vuln vid="147353a3-c33b-46d1-b751-e72c0d7f29df">
<topic>electron{25,26} -- use after free in Garbage Collection</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.6</lt></range>
</package>
<package>
<name>electron26</name>
<range><lt>26.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.6">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-5997.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5997</cvename>
<url>https://github.com/advisories/GHSA-fggx-frxq-cpx8</url>
</references>
<dates>
<discovery>2023-11-22</discovery>
<entry>2023-11-22</entry>
</dates>
</vuln>
<vuln vid="0da4db89-84bf-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>119.0.6045.159</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>119.0.6045.159</lt></range>
</package>
<package>
<name>qt5-webengine</name>
<range><lt>5.15.16.p5</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[1497997] High CVE-2023-5997: Use after free in Garbage Collection. Reported by Anonymous on 2023-10-31</li>
<li>[1499298] High CVE-2023-6112: Use after free in Navigation. Reported by Sergei Glazunov of Google Project Zero on 2023-11-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5997</cvename>
<cvename>CVE-2023-6112</cvename>
<url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2023-11-14</discovery>
<entry>2023-11-16</entry>
</dates>
</vuln>
<vuln vid="a30f1a12-117f-4dac-a1d0-d65eaf084953">
<topic>electron{25,26} -- use after free in WebAudio</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.5</lt></range>
</package>
<package>
<name>electron26</name>
<range><lt>26.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.5">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-5996.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5996</cvename>
<url>https://github.com/advisories/GHSA-q3gq-rg4m-vgrp</url>
</references>
<dates>
<discovery>2023-11-15</discovery>
<entry>2023-11-16</entry>
</dates>
</vuln>
<vuln vid="2fe004f5-83fd-11ee-9f5d-31909fb2f495">
<topic>openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.6.0</ge><lt>2.6.7_1</lt></range>
</package>
<package>
<name>openvpn-devel</name>
<range><lt>g20231109,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenVPN community project team reports:</p>
<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267">
<p>CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore "--fragment" configuration in some circumstances, leading to a division by zero when "--fragment" is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash.
<br/>
Reported by Niccolo Belli and WIPocket (Github #400, #417).
</p>
<p>CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. (found while tracking down CVE-2023-46849 / Github #400, #417)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-46849</cvename>
<cvename>CVE-2023-46850</cvename>
<url>https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267</url>
</references>
<dates>
<discovery>2023-08-29</discovery>
<entry>2023-11-15</entry>
<modified>2023-12-31</modified>
</dates>
</vuln>
<vuln vid="7cc003cb-83b9-11ee-957d-b42e991fc52e">
<topic>typo3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-11</name>
<name>typo3-12</name>
<range><lt>11.5.33</lt></range>
<range><lt>12.4.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019">
<p>Weak Authentication in Session Handling in typo3/cms-core:
In typo3 installations there are always
at least two different sites. Eg. first.example.org and
second.example.com. In affected versions a session cookie
generated for the first site can be reused on the second site
without requiring additional authentication. This
vulnerability has been addressed in versions 8.7.55, 9.5.44,
10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade.
There are no known workarounds for this vulnerability.</p>
<p>Information Disclosure in Install Tool in typo3/cms-install:
In affected versions the login screen of the standalone
install tool discloses the full path of the transient data
directory (e.g. /var/www/html/var/transient/). This applies
to composer-based scenarios only - classic non-composer
installations are not affected. This issue has been addressed
in version 12.4.8. Users are advised to upgrade. There are
no known workarounds for this vulnerability.
</p>
<p>By-passing Cross-Site Scripting Protection in HTML Sanitizer:
In affected versions DOM processing instructions are not
handled correctly. This allows bypassing the cross-site
scripting mechanism of typo3/html-sanitizer. This
vulnerability has been addressed in versions 1.5.3 and 2.1.4.
Users are advised to upgrade. There are no known workarounds
for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-47125</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-47125</url>
<cvename>CVE-2023-47126</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-47126</url>
<cvename>CVE-2023-47127</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-47127</url>
</references>
<dates>
<discovery>2023-11-14</discovery>
<entry>2023-11-15</entry>
</dates>
</vuln>
<vuln vid="31f45d06-7f0e-11ee-94b4-6cc21735f730">
<topic>postgresql-server -- Memory disclosure in aggregate function calls</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>16.1</lt></range>
<range><lt>15.5</lt></range>
<range><lt>14.10</lt></range>
<range><lt>13.13</lt></range>
<range><lt>12.17</lt></range>
<range><lt>11.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5868/">
<p>
Certain aggregate function calls receiving "unknown"-type
arguments could disclose bytes of server memory from the end of
the "unknown"-type value to the next zero byte. One typically
gets an "unknown"-type value via a string literal having no type
designation. We have not confirmed or ruled out viability of
attacks that arrange for presence of notable, confidential
information in disclosed bytes.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5868</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-5868/</url>
</references>
<dates>
<discovery>2023-11-09</discovery>
<entry>2023-11-09</entry>
</dates>
</vuln>
<vuln vid="0f445859-7f0e-11ee-94b4-6cc21735f730">
<topic>postgresql-server -- Buffer overrun from integer overflow in array modification</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>16.1</lt></range>
<range><lt>15.5</lt></range>
<range><lt>14.10</lt></range>
<range><lt>13.13</lt></range>
<range><lt>12.17</lt></range>
<range><lt>11.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5869/">
<p>
While modifying certain SQL array values, missing
overflow checks let authenticated database users write
arbitrary bytes to a memory area that facilitates
arbitrary code execution. Missing overflow checks also
let authenticated database users read a wide area of
server memory. The CVE-2021-32027 fix covered some
attacks of this description, but it missed others.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5869</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-5869/</url>
</references>
<dates>
<discovery>2023-11-09</discovery>
<entry>2023-11-09</entry>
</dates>
</vuln>
<vuln vid="bbb18fcb-7f0d-11ee-94b4-6cc21735f730">
<topic>postgresql-server -- Role pg_cancel_backend can signal certain superuser processes</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>16.1</lt></range>
<range><lt>15.5</lt></range>
<range><lt>14.10</lt></range>
<range><lt>13.13</lt></range>
<range><lt>12.17</lt></range>
<range><lt>11.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5870/">
<p>
Documentation says the pg_cancel_backend role cannot
signal "a backend owned by a superuser". On the
contrary, it can signal background workers, including
the logical replication launcher. It can signal
autovacuum workers and the autovacuum launcher.
Signaling autovacuum workers and those two launchers
provides no meaningful exploit, so exploiting this
vulnerability requires a non-core extension with a
less-resilient background worker. For example, a
non-core background worker that does not auto-restart
would experience a denial of service with respect to
that particular background worker.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5870</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-5870/</url>
</references>
<dates>
<discovery>2023-11-09</discovery>
<entry>2023-11-09</entry>
</dates>
</vuln>
<vuln vid="5558dded-a870-4fbe-8b0a-ba198db47007">
<topic>electron{25,26} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.4</lt></range>
</package>
<package>
<name>electron26</name>
<range><lt>26.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.4">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-5849.</li>
<li>Security: backported fix for CVE-2023-5482.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5849</cvename>
<url>https://github.com/advisories/GHSA-7cjp-92p9-vr97</url>
<cvename>CVE-2023-5482</cvename>
<url>https://github.com/advisories/GHSA-pq78-6h8h-rcf4</url>
</references>
<dates>
<discovery>2023-11-08</discovery>
<entry>2023-11-09</entry>
</dates>
</vuln>
<vuln vid="4ade0c4d-7e83-11ee-9a8c-00155d01f201">
<topic>libsndfile_project -- Integer overflow in dataend calculation</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.2.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/libsndfile/libsndfile/issues/789">
<p>Multiple signed integers overflow in function au_read_header in
src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c
in Libsndfile, allows an attacker to cause Denial of Service or
other unspecified impacts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-33065</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-33065</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-11-08</entry>
</dates>
</vuln>
<vuln vid="77fc311d-7e62-11ee-8290-a8a1599412c6">
<topic>chromium -- security update</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>119.0.6045.123</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>119.0.6045.123</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[1497859] High CVE-2023-5996: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab via Tianfu Cup 2023 on 2023-10-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5996</cvename>
<url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-11-07</discovery>
<entry>2023-11-08</entry>
</dates>
</vuln>
<vuln vid="a5956603-7e4f-11ee-9df6-84a93843eb75">
<topic>OpenSSL -- DoS in DH generation</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.12_1,1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1w_1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.4_1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.12_1</lt></range>
</package>
<package>
<name>openssl31-quictls</name>
<range><lt>3.1.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20231106.txt">
<p>Excessive time spent in DH check / generation with large Q
parameter value (low).
Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5678</cvename>
<url>https://www.openssl.org/news/secadv/20231106.txt</url>
</references>
<dates>
<discovery>2023-11-08</discovery>
<entry>2023-11-08</entry>
</dates>
</vuln>
<vuln vid="f4464e49-7e04-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Incorrect libcap_net limitation list manipulation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Casper services allow limiting operations that a process can
perform. Each service maintains a specific list of permitted
operations. Certain operations can be further restricted, such as
specifying which domain names can be resolved. During the verification
of limits, the service must ensure that the new set of constraints
is a subset of the previous one. In the case of the cap_net service,
the currently limited set of domain names was fetched incorrectly.</p>
<h1>Impact:</h1>
<p>In certain scenarios, if only a list of resolvable domain names
was specified without setting any other limitations, the application
could submit a new list of domains including include entries not
previously in the list.</p>
</body>
</description>
<references>
<cvename>CVE-2023-5978</cvename>
<freebsdsa>SA-23:16.cap_net</freebsdsa>
</references>
<dates>
<discovery>2023-11-08</discovery>
<entry>2023-11-08</entry>
</dates>
</vuln>
<vuln vid="5afcc9a4-7e04-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- libc stdio buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_5</lt></range>
<range><ge>12.4</ge><lt>12.4_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>For line-buffered streams the __sflush() function did not
correctly update the FILE object's write space member when the
write(2) system call returns an error.</p>
<h1>Impact:</h1>
<p>Depending on the nature of an application that calls libc's
stdio functions and the presence of errors returned from the write(2)
system call (or an overridden stdio write routine) a heap buffer
overfly may occur. Such overflows may lead to data corruption or
the execution of arbitrary code at the privilege level of the calling
program.</p>
</body>
</description>
<references>
<cvename>CVE-2023-5941</cvename>
<freebsdsa>SA-23:15.stdio</freebsdsa>
</references>
<dates>
<discovery>2023-11-08</discovery>
<entry>2023-11-08</entry>
</dates>
</vuln>
<vuln vid="a1a1f81c-7c13-11ee-bcf1-f8b156b6dcc8">
<topic>vorbistools -- heap buffer overflow in oggenc</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.4.2_4,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank-Z7 reports:</p>
<blockquote cite="https://github.com/xiph/vorbis-tools/issues/41">
<p>Heap buffer overflow when vorbis-tools/oggenc converts
WAV files to Ogg files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43361</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-43361</url>
</references>
<dates>
<discovery>2023-09-16</discovery>
<entry>2023-11-05</entry>
</dates>
</vuln>
<vuln vid="fe7ac70a-792b-11ee-bf9a-a04a5edf46d9">
<topic>PptiPNG -- Global-buffer-overflow</topic>
<affects>
<package>
<name>optipng</name>
<range><lt>0.7.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank-Z7 reports:</p>
<blockquote cite="https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md">
<p>Running optipng with the "-zm 3 -zc 1 -zw 256 -snip -out"
configuration options enabled raises a global-buffer-overflow bug,
which could allow a remote attacker to conduct a denial-of-service
attack or other unspecified effect on a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43907</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-43907</url>
</references>
<dates>
<discovery>2023-09-30</discovery>
<entry>2023-11-02</entry>
</dates>
</vuln>
<vuln vid="a1e27775-7a61-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>119.0.6045.105</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>119.0.6045.105</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html">
<p>This update includes 15 security fixes:</p>
<ul>
<li>[1492698] High CVE-2023-5480: Inappropriate implementation in Payments. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2023-10-14</li>
<li>[1492381] High CVE-2023-5482: Insufficient data validation in USB. Reported by DarkNavy on 2023-10-13</li>
<li>[1492384] High CVE-2023-5849: Integer overflow in USB. Reported by DarkNavy on 2023-10-13</li>
<li>[1281972] Medium CVE-2023-5850: Incorrect security UI in Downloads. Reported by Mohit Raj (shadow2639) on 2021-12-22</li>
<li>[1473957] Medium CVE-2023-5851: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-08-18</li>
<li>[1480852] Medium CVE-2023-5852: Use after free in Printing. Reported by [pwn2car] on 2023-09-10</li>
<li>[1456876] Medium CVE-2023-5853: Incorrect security UI in Downloads. Reported by Hafiizh on 2023-06-22</li>
<li>[1488267] Medium CVE-2023-5854: Use after free in Profiles. Reported by Dohyun Lee (@l33d0hyun) of SSD-Disclosure Labs & DNSLab, Korea Univ on 2023-10-01</li>
<li>[1492396] Medium CVE-2023-5855: Use after free in Reading Mode. Reported by ChaobinZhang on 2023-10-13</li>
<li>[1493380] Medium CVE-2023-5856: Use after free in Side Panel. Reported by Weipeng Jiang (@Krace) of VRI on 2023-10-17</li>
<li>[1493435] Medium CVE-2023-5857: Inappropriate implementation in Downloads. Reported by Will Dormann on 2023-10-18</li>
<li>[1457704] Low CVE-2023-5858: Inappropriate implementation in WebApp Provider. Reported by Axel Chong on 2023-06-24</li>
<li>[1482045] Low CVE-2023-5859: Incorrect security UI in Picture In Picture. Reported by Junsung Lee on 2023-09-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5480</cvename>
<cvename>CVE-2023-5482</cvename>
<cvename>CVE-2023-5849</cvename>
<cvename>CVE-2023-5850</cvename>
<cvename>CVE-2023-5851</cvename>
<cvename>CVE-2023-5852</cvename>
<cvename>CVE-2023-5853</cvename>
<cvename>CVE-2023-5854</cvename>
<cvename>CVE-2023-5855</cvename>
<cvename>CVE-2023-5856</cvename>
<cvename>CVE-2023-5857</cvename>
<cvename>CVE-2023-5858</cvename>
<cvename>CVE-2023-5859</cvename>
<url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html</url>
</references>
<dates>
<discovery>2023-10-31</discovery>
<entry>2023-11-03</entry>
</dates>
</vuln>
<vuln vid="4f370c80-79ce-11ee-be8e-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq-php80</name>
<name>phpmyfaq-php81</name>
<name>phpmyfaq-php82</name>
<name>phpmyfaq-php83</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-10-27">
<p>XSS</p>
<p>Insufficient session expiration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5863</cvename>
<cvename>CVE-2023-5865</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-5863</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-5865</url>
<url>https://huntr.com/bounties/fbfd4e84-61fb-4063-8f11-15877b8c1f6f/</url>
<url>https://huntr.com/bounties/4c4b7395-d9fd-4ca0-98d7-2e20c1249aff/</url>
</references>
<dates>
<discovery>2023-10-31</discovery>
<entry>2023-11-02</entry>
</dates>
</vuln>
<vuln vid="d2505ec7-78ea-11ee-9131-6f01853956d5">
<topic>open-vm-tools -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>open-vm-tools</name>
<range><lt>12.3.5</lt></range>
</package>
<package>
<name>open-vm-tools-nox11</name>
<range><lt>12.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VMware reports:</p>
<blockquote cite="https://www.vmware.com/security/advisories/VMSA-2023-0024.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>High CVE-2023-34058: SAML token signature bypass vulnerability</li>
<li>High CVE-2023-34059: File descriptor hijack vulnerability in the vmware-user-suid-wrapper</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-34058</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-34058</url>
<cvename>CVE-2023-34059</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-34059</url>
</references>
<dates>
<discovery>2023-10-26</discovery>
<entry>2023-11-01</entry>
</dates>
</vuln>
<vuln vid="a612c25f-788a-11ee-8d57-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.5.0</ge><lt>16.5.1</lt></range>
<range><ge>16.4.0</ge><lt>16.4.2</lt></range>
<range><ge>11.6.0</ge><lt>16.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/">
<p>Disclosure of CI/CD variables using Custom project templates</p>
<p>GitLab omnibus DoS crash via OOM with CI Catalogs</p>
<p>Parsing gitlab-ci.yml with large string via timeout input leads to Denial of Service</p>
<p>DoS - Blocking FIFO files in Tar archives</p>
<p>Titles exposed by service-desk template</p>
<p>Approval on protected environments can be bypassed</p>
<p>Version information disclosure when super_sidebar_logged_out feature flag is enabled</p>
<p>Add abuse detection for search syntax filter pipes</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3399</cvename>
<cvename>CVE-2023-5825</cvename>
<cvename>CVE-2023-3909</cvename>
<cvename>CVE-2023-3246</cvename>
<cvename>CVE-2023-5600</cvename>
<cvename>CVE-2023-4700</cvename>
<cvename>CVE-2023-5831</cvename>
<url>https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/</url>
</references>
<dates>
<discovery>2023-10-31</discovery>
<entry>2023-11-01</entry>
</dates>
</vuln>
<vuln vid="386a14bb-1a21-41c6-a2cf-08d79213379b">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>6.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.2">
<p> A specially-crafted SSL packet could cause Zeek to
leak memory and potentially crash. </p>
<p> A specially-crafted series of FTP packets could cause
Zeek to log entries for requests that have already been
completed, using resources unnecessarily and potentially
causing Zeek to lose other traffic. </p>
<p> A specially-crafted series of SSL packets could cause
Zeek to output a very large number of unnecessary alerts
for the same record. </p>
<p> A specially-crafted series of SSL packets could cause
Zeek to generate very long ssl_history fields in the
ssl.log, potentially using a large amount of memory due
to unbounded state growth </p>
<p> A specially-crafted IEEE802.11 packet could cause
Zeek to overflow memory and potentially crash </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v6.0.2</url>
</references>
<dates>
<discovery>2023-10-27</discovery>
<entry>2023-10-27</entry>
</dates>
</vuln>
<vuln vid="db33e250-74f7-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>118.0.5993.117</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>118.0.5993.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[1491296] High CVE-2023-5472: Use after free in Profiles. Reported by @18楼梦想改造家 on 2023-10-10</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5472</cvename>
<url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2023-10-24</discovery>
<entry>2023-10-27</entry>
</dates>
</vuln>
<vuln vid="9e2fdfc7-e237-4393-9fa5-2d50908c66b3">
<topic>xorg-server -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.9,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>21.1.9,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>23.2.2,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.542</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-October/003430.html">
<ul>
<li>ZDI-CAN-22153/CVE-2023-5367: X.Org server: OOB write
in XIChangeDeviceProperty/RRChangeOutputProperty
<p>When prepending values to an existing property an
invalid offset calculation causes the existing values to
be appended at the wrong offset. The resulting memcpy()
would write into memory outside the heap-allocated
array.</p></li>
<li>ZDI-CAN-21608/CVE-2023-5380: Use-after-free bug in
DestroyWindow
<p>This vulnerability requires a legacy multi-screen setup
with multiple protocol screens ("Zaphod"). If the pointer
is warped from one screen to the root window of the other
screen, the enter/leave code may retain a reference to the
previous pointer window. Destroying this window leaves
that reference in place, other windows may then trigger a
use-after-free bug when they are destroyed. </p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-October/003430.html</url>
<cvename>CVE-2023-5367</cvename>
<cvename>CVE-2023-5380</cvename>
</references>
<dates>
<discovery>2023-10-25</discovery>
<entry>2023-10-25</entry>
</dates>
</vuln>
<vuln vid="a8fb8e3a-730d-11ee-ab61-b42e991fc52e">
<topic>squid -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid-cache project reports:</p>
<blockquote cite="https://github.com/squid-cache/squid/security/advisories?page=1">
<ul>
<li>Denial of Service in FTP</li>
<li>Request/Response smuggling in HTTP/1.1 and ICAP</li>
<li>Denial of Service in HTTP Digest Authentication</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w</url>
<url>https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh</url>
<url>https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g</url>
</references>
<dates>
<discovery>2023-10-21</discovery>
<entry>2023-10-25</entry>
</dates>
</vuln>
<vuln vid="4a4712ae-7299-11ee-85eb-84a93843eb75">
<topic>OpenSSL -- potential loss of confidentiality</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>3.0.12,1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.4</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20231024.txt">
<p>Moderate severity: A bug has been identified in the processing
of key and initialisation vector (IV) lengths. This can lead to
potential truncation or overruns during the initialisation of
some symmetric ciphers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5363</cvename>
<url>https://www.openssl.org/news/secadv/20231024.txt</url>
</references>
<dates>
<discovery>2023-10-24</discovery>
<entry>2023-10-24</entry>
</dates>
</vuln>
<vuln vid="22df5074-71cd-11ee-85eb-84a93843eb75">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-server</name>
<range><lt>5.7.44</lt></range>
</package>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.35</lt></range>
</package>
<package>
<name>mysql-connector-j</name>
<range><lt>8.1.1</lt></range>
</package>
<package>
<name>mysql-connector-odbc</name>
<range><lt>8.1.1</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL">
<p>This Critical Patch Update contains 37 new security patches, plus
additional third party patches noted below, for Oracle MySQL. 9 of
these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42898</cvename>
<cvename>CVE-2023-2650</cvename>
<cvename>CVE-2023-3817</cvename>
<cvename>CVE-2023-22015</cvename>
<cvename>CVE-2023-22026</cvename>
<cvename>CVE-2023-22028</cvename>
<cvename>CVE-2023-22032</cvename>
<cvename>CVE-2023-22059</cvename>
<cvename>CVE-2023-22064</cvename>
<cvename>CVE-2023-22065</cvename>
<cvename>CVE-2023-22066</cvename>
<cvename>CVE-2023-22068</cvename>
<cvename>CVE-2023-22070</cvename>
<cvename>CVE-2023-22078</cvename>
<cvename>CVE-2023-22079</cvename>
<cvename>CVE-2023-22084</cvename>
<cvename>CVE-2023-22092</cvename>
<cvename>CVE-2023-22094</cvename>
<cvename>CVE-2023-22095</cvename>
<cvename>CVE-2023-22097</cvename>
<cvename>CVE-2023-22102</cvename>
<cvename>CVE-2023-22103</cvename>
<cvename>CVE-2023-22104</cvename>
<cvename>CVE-2023-22110</cvename>
<cvename>CVE-2023-22111</cvename>
<cvename>CVE-2023-22112</cvename>
<cvename>CVE-2023-22113</cvename>
<cvename>CVE-2023-22114</cvename>
<cvename>CVE-2023-22115</cvename>
<cvename>CVE-2023-38545</cvename>
<url>https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2023-10-17</discovery>
<entry>2023-10-23</entry>
</dates>
</vuln>
<vuln vid="e14b9870-62a4-11ee-897b-000bab9f87f1">
<topic>Request Tracker -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rt44</name>
<range><lt>4.4.6</lt></range>
</package>
<package>
<name>rt50</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Request Tracker reports:</p>
<p>CVE-2023-41259 SECURITY: RT is vulnerable to unvalidated email headers in incoming email and the mail-gateway REST interface.</p>
<p>CVE-2023-41260 SECURITY: RT is vulnerable to information leakage via response messages returned from requests sent via the mail-gateway REST interface.</p>
<p>CVE-2023-45024 SECURITY: RT 5.0 is vulnerable to information leakage via transaction searches made by authenticated users in the transaction query builder.</p>
</body>
</description>
<references>
<cvename>CVE-2023-41259</cvename>
<cvename>CVE-2023-41260</cvename>
<cvename>CVE-2023-45024</cvename>
<url>https://bestpractical.com/request-tracker/</url>
</references>
<dates>
<discovery>2023-10-18</discovery>
<entry>2023-10-18</entry>
</dates>
</vuln>
<vuln vid="9000591b-483b-45ac-9c87-b3df3a4198ec">
<topic>electron{25,26} -- Use after free in Site Isolation</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.2</lt></range>
</package>
<package>
<name>electron26</name>
<range><lt>26.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.2">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-5218.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5218</cvename>
<url>https://github.com/advisories/GHSA-cvp3-7vpw-ffh6</url>
</references>
<dates>
<discovery>2023-10-18</discovery>
<entry>2023-10-19</entry>
</dates>
</vuln>
<vuln vid="f923205f-6e66-11ee-85eb-84a93843eb75">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.58</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://dlcdn.apache.org/httpd/CHANGES_2.4.58">
<ul>
<li>CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
memory not reclaimed right away on RST</li>
<li>CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
initial windows size 0</li>
<li>CVE-2023-31122: mod_macro buffer over-read</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45802</cvename>
<cvename>CVE-2023-43622</cvename>
<cvename>CVE-2023-31122</cvename>
<url>https://dlcdn.apache.org/httpd/CHANGES_2.4.58</url>
</references>
<dates>
<discovery>2023-10-19</discovery>
<entry>2023-10-19</entry>
</dates>
</vuln>
<vuln vid="f8c2f741-6be1-11ee-b33a-a04a5edf46d9">
<topic>moonlight-embedded -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moonlight-embedded</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The moonlight-embedded project reports:</p>
<blockquote cite="https://github.com/moonlight-stream/moonlight-embedded/releases/tag/v2.6.1">
<p>Moonlight Embedded v2.6.1 fixed CVE-2023-42799, CVE-2023-42800,
and CVE-2023-42801.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42799</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-42799</url>
<cvename>CVE-2022-42800</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-42800</url>
<cvename>CVE-2022-42801</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-42801</url>
</references>
<dates>
<discovery>2022-01-11</discovery>
<entry>2023-10-16</entry>
</dates>
</vuln>
<vuln vid="1ee26d45-6ddb-11ee-9898-00e081b7aa2d">
<topic>jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.428</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.414.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2023-10-18/">
<h1>Description</h1>
<h5>(High) SECURITY-3291 / CVE-2023-36478, CVE-2023-44487</h5>
<p>HTTP/2 denial of service vulnerability in bundled Jetty</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36478</cvename>
<cvename>CVE-2023-44487</cvename>
<url>https://www.jenkins.io/security/advisory/2023-10-18/</url>
</references>
<dates>
<discovery>2023-10-18</discovery>
<entry>2023-10-18</entry>
</dates>
</vuln>
<vuln vid="d2ad7647-6dd9-11ee-85eb-84a93843eb75">
<topic>Roundcube -- XSS vulnerability in SVG</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.6.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="https://roundcube.net/news/2023/10/16/security-update-1.6.4-released">
<p>cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2023/10/16/security-update-1.6.4-released</url>
</references>
<dates>
<discovery>2023-10-16</discovery>
<entry>2023-10-18</entry>
</dates>
</vuln>
<vuln vid="8706e097-6db7-11ee-8744-080027f5fec9">
<topic>redis -- Possible bypassing Unix socket permissions</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.2.2</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.2.2.20231018</lt></range>
</package>
<package>
<name>redis70</name>
<range><lt>7.0.14</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/r81pHa-dcI8">
<p>
The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to
bypass desired Unix socket permissions on startup.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-45145</cvename>
<url>https://groups.google.com/g/redis-db/c/r81pHa-dcI8</url>
</references>
<dates>
<discovery>2023-10-18</discovery>
<entry>2023-10-18</entry>
</dates>
</vuln>
<vuln vid="ae0ee356-6ae1-11ee-bfb6-8c164567ca3c">
<topic>libcue -- out-of-bounds array access</topic>
<affects>
<package>
<name>libcue</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libcue team reports:</p>
<blockquote cite="https://github.com/lipnitsk/libcue/releases/tag/v2.3.0">
<p>There is a vulnerability to out-of-bounds array access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43641</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-43641</url>
</references>
<dates>
<discovery>2023-10-09</discovery>
<entry>2023-10-14</entry>
</dates>
</vuln>
<vuln vid="7a1b2624-6a89-11ee-af06-5404a68ad561">
<topic>traefik -- Resource exhaustion by malicious HTTP/2 client</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik authors report:</p>
<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g">
<p>There is a vulnerability in GO managing HTTP/2 requests, which
impacts Traefik. This vulnerability could be exploited to cause
a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39325</cvename>
<cvename>CVE-2023-44487</cvename>
<url>https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g</url>
</references>
<dates>
<discovery>2023-10-10</discovery>
<entry>2023-10-14</entry>
</dates>
</vuln>
<vuln vid="199cdb4d-690d-11ee-9ed0-001fc69cd6dc">
<topic>x11/libXpm multiple vulnerabilities</topic>
<affects>
<package>
<name>libXpm</name>
<range><lt>3.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg/2023-October/061506.html">
<dl>
<dt>CVE-2023-43788: Out of bounds read in XpmCreateXpmImageFromBuffer</dt>
<dd>An out-of-bounds read is located in ParseComment() when reading from
a memory buffer instead of a file, as it continued to look for the
closing comment marker past the end of the buffer.</dd>
<dt>CVE-2023-43789: Out of bounds read on XPM with corrupted colormap</dt>
<dd>A corrupted colormap section may cause libXpm to read out of bounds.</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43788</cvename>
<cvename>CVE-2023-43789</cvename>
<url>https://lists.x.org/archives/xorg/2023-October/061506.html</url>
</references>
<dates>
<discovery>2023-09-22</discovery>
<entry>2023-10-12</entry>
</dates>
</vuln>
<vuln vid="bd92f1ab-690c-11ee-9ed0-001fc69cd6dc">
<topic>11/libX11 multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg/2023-October/061506.html">
<dl>
<dt>CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()</dt>
<dd>When libX11 is processing the reply from the X server to the XkbGetMap
request, if it detected the number of symbols in the new map was less
than the size of the buffer it had allocated, it always added room for
128 more symbols, instead of the actual size needed. While the
_XkbReadBufferCopyKeySyms() helper function returned an error if asked
to copy more keysyms into the buffer than there was space allocated for,
the caller never checked for an error and assumed the full set of keysyms
was copied into the buffer and could then try to read out of bounds when
accessing the buffer. libX11 1.8.7 has been patched to both fix the size
allocated and check for error returns from _XkbReadBufferCopyKeySyms().</dd>
<dt>CVE-2023-43786: stack exhaustion in XPutImage</dt>
<dd>When splitting a single line of pixels into chunks that fit in a single
request (not using the BIG-REQUESTS extension) to send to the X server,
the code did not take into account the number of bits per pixel, so would
just loop forever finding it needed to send more pixels than fit in the
given request size and not breaking them down into a small enough chunk to
fit. An XPM file was provided that triggered this bug when loaded via
libXpm's XpmReadFileToPixmap() function, which in turn calls XPutImage()
and hit this bug.</dd>
<dt>CVE-2023-43787: integer overflow in XCreateImage() leading to a heap overflow</dt>
<dd>When creating an image, there was no validation that the multiplication
of the caller-provided width by the visual's bits_per_pixel did not
overflow and thus result in the allocation of a buffer too small to hold
the data that would be copied into it. An XPM file was provided that
triggered this bug when loaded via libXpm's XpmReadFileToPixmap() function,
which in turn calls XCreateImage() and hit this bug.i</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43785</cvename>
<cvename>CVE-2023-43786</cvename>
<cvename>CVE-2023-43787</cvename>
<url>https://lists.x.org/archives/xorg/2023-October/061506.html</url>
</references>
<dates>
<discovery>2023-09-22</discovery>
<entry>2023-10-12</entry>
</dates>
</vuln>
<vuln vid="07ee8c14-68f1-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>118.0.5993.70</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>118.0.5993.70</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html">
<p>This update includes 20 security fixes:</p>
<ul>
<li>[1487110] Critical CVE-2023-5218: Use after free in Site Isolation. Reported by @18楼梦想改造家 on 2023-09-27</li>
<li>[1062251] Medium CVE-2023-5487: Inappropriate implementation in Fullscreen. Reported by Anonymous on 2020-03-17</li>
<li>[1414936] Medium CVE-2023-5484: Inappropriate implementation in Navigation. Reported by Thomas Orlita on 2023-02-11</li>
<li>[1476952] Medium CVE-2023-5475: Inappropriate implementation in DevTools. Reported by Axel Chong on 2023-08-30</li>
<li>[1425355] Medium CVE-2023-5483: Inappropriate implementation in Intents. Reported by Axel Chong on 2023-03-17</li>
<li>[1458934] Medium CVE-2023-5481: Inappropriate implementation in Downloads. Reported by Om Apip on 2023-06-28</li>
<li>[1474253] Medium CVE-2023-5476: Use after free in Blink History. Reported by Yunqin Sun on 2023-08-20</li>
<li>[1483194] Medium CVE-2023-5474: Heap buffer overflow in PDF. Reported by [pwn2car] on 2023-09-15</li>
<li>[1471253] Medium CVE-2023-5479: Inappropriate implementation in Extensions API. Reported by Axel Chong on 2023-08-09</li>
<li>[1395164] Low CVE-2023-5485: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2022-12-02</li>
<li>[1472404] Low CVE-2023-5478: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-08-12</li>
<li>[1472558] Low CVE-2023-5477: Inappropriate implementation in Installer. Reported by Bahaa Naamneh of Crosspoint Labs on 2023-08-13</li>
<li>[1357442] Low CVE-2023-5486: Inappropriate implementation in Input. Reported by Hafiizh on 2022-08-29</li>
<li>[1484000] Low CVE-2023-5473: Use after free in Cast. Reported by DarkNavy on 2023-09-18</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5218</cvename>
<cvename>CVE-2023-5487</cvename>
<cvename>CVE-2023-5484</cvename>
<cvename>CVE-2023-5475</cvename>
<cvename>CVE-2023-5483</cvename>
<cvename>CVE-2023-5481</cvename>
<cvename>CVE-2023-5476</cvename>
<cvename>CVE-2023-5474</cvename>
<cvename>CVE-2023-5479</cvename>
<cvename>CVE-2023-5485</cvename>
<cvename>CVE-2023-5478</cvename>
<cvename>CVE-2023-5477</cvename>
<cvename>CVE-2023-5486</cvename>
<cvename>CVE-2023-5473</cvename>
<url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2023-10-10</discovery>
<entry>2023-10-11</entry>
</dates>
</vuln>
<vuln vid="4281b712-ad6b-4c21-8f66-619a9150691f">
<topic>electron25 -- Use after free in extensions vulnerability</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.1">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-5187.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5187</cvename>
<url>https://github.com/advisories/GHSA-hg3r-958g-g8vq</url>
</references>
<dates>
<discovery>2023-10-11</discovery>
<entry>2023-10-12</entry>
</dates>
</vuln>
<vuln vid="d6c19e8c-6806-11ee-9464-b42e991fc52e">
<topic>curl -- SOCKS5 heap buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><gt>7.69.0</gt><lt>8.4.0</lt></range>
</package>
<package>
<name>cmake-core</name>
<range><lt>3.27.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The curl team reports:</p>
<blockquote cite="https://curl.se/docs/CVE-2023-38545.html">
<p>This flaw makes curl overflow a heap based buffer in the
SOCKS5 proxy handshake. When curl is asked to pass along
the hostname to the SOCKS5 proxy to allow that to resolve
the address instead of it getting done by curl itself, the
maximum length that hostname can be is 255 bytes. If the
hostname is detected to be longer than 255 bytes, curl
switches to local name resolving and instead passes on the
resolved address only to the proxy. Due to a bug, the
local variable that means "let the host resolve the name"
could get the wrong value during a slow SOCKS5 handshake,
and contrary to the intention, copy the too long hostname
to the target buffer instead of copying just the resolved
address there.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-38545</cvename>
<url>https://curl.se/docs/CVE-2023-38545.html</url>
</references>
<dates>
<discovery>2023-09-30</discovery>
<entry>2023-10-11</entry>
<modified>2023-10-11</modified>
</dates>
</vuln>
<vuln vid="bf545001-b96d-42e4-9d2e-60fdee204a43">
<topic>h2o -- HTTP/2 Rapid Reset attack vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><le>2.2.6</le></range>
</package>
<package>
<name>h2o-devel</name>
<range><lt>2.3.0.d.20231010</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazuo Okuhu reports:</p>
<blockquote cite="https://github.com/h2o/h2o/issues/3291">
<p>
H2O is vulnerable to the HTTP/2 Rapid Reset attack.
An attacker might be able to consume more than adequate amount of
processing power of h2o and the backend servers by mounting the
attack.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-44487</cvename>
<url>https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf</url>
</references>
<dates>
<discovery>2023-10-10</discovery>
<entry>2023-10-10</entry>
</dates>
</vuln>
<vuln vid="4f254817-6318-11ee-b2ff-080027de9982">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>py39-django41</name>
<name>py310-django41</name>
<name>py311-django41</name>
<range><lt>4.1.12</lt></range>
</package>
<package>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/oct/04/security-releases/">
<p>CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43665</cvename>
<url>https://www.djangoproject.com/weblog/2023/oct/04/security-releases/</url>
</references>
<dates>
<discovery>2023-10-01</discovery>
<entry>2023-10-05</entry>
</dates>
</vuln>
<vuln vid="915855ad-283d-4597-b01e-e0bf611db78b">
<topic>libspf2 -- Integer Underflow Remote Code Execution</topic>
<affects>
<package>
<name>libspf2</name>
<range><lt>1.2.11_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Trendmicro ZDI reports:</p>
<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-23-1472/">
<p>Integer Underflow Remote Code Execution Vulnerability</p>
<p>The specific flaw exists within the parsing of SPF macros.
When parsing SPF macros, the process does not properly
validate user-supplied data, which can result in an integer
underflow before writing to memory. An attacker can leverage
this vulnerability to execute code in the context of the
service account.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-42118</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42118</url>
</references>
<dates>
<discovery>2022-06-06</discovery>
<entry>2023-10-04</entry>
<modified>2025-05-04</modified>
</dates>
</vuln>
<vuln vid="4e45c45b-629e-11ee-8290-a8a1599412c6">
<topic>chromium -- type confusion in v8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>117.0.5938.149</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>117.0.5938.149</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[1485829] High CVE-2023-5346: Type Confusion in V8. Reported by Amit Kumar on 2023-09-22</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5346</cvename>
<url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-10-03</discovery>
<entry>2023-10-04</entry>
</dates>
</vuln>
<vuln vid="162a675b-6251-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- arm64 boot CPUs may lack speculative execution protections</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On CPU 0 the check for the SMCCC workaround is called before
SMCCC support has been initialized.</p>
<h1>Impact:</h1>
<p>No speculative execution workarounds are installed on CPU 0.</p>
</body>
</description>
<references>
<cvename>CVE-2023-5370</cvename>
<freebsdsa>SA-23:14.smccc</freebsdsa>
</references>
<dates>
<discovery>2023-10-03</discovery>
<entry>2023-10-04</entry>
</dates>
</vuln>
<vuln vid="e261e71c-6250-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- copy_file_range insufficient capability rights check</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The syscall checked only for the CAP_READ and CAP_WRITE
capabilities on the input and output file descriptors, respectively.
Using an offset is logically equivalent to seeking, and the syscall
must additionally require the CAP_SEEK capability.</p>
<h1>Impact:</h1>
<p>A sandboxed process with only read or write but no seek capability
on a file descriptor may be able to read data from or write data
to an arbitrary location within the file corresponding to that file
descriptor.</p>
</body>
</description>
<references>
<cvename>CVE-2023-5369</cvename>
<freebsdsa>SA-23:13.capsicum</freebsdsa>
</references>
<dates>
<discovery>2023-10-03</discovery>
<entry>2023-10-04</entry>
</dates>
</vuln>
<vuln vid="fefcd340-624f-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- msdosfs data disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_4</lt></range>
<range><ge>12.4</ge><lt>12.4_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In certain cases using the truncate or ftruncate system call
to extend a file size populates the additional space in the file
with unallocated data from the underlying disk device, rather than
zero bytes.</p>
<h1>Impact:</h1>
<p>A user with write access to files on a msdosfs file system may
be able to read unintended data (for example, from a previously
deleted file).</p>
</body>
</description>
<references>
<cvename>CVE-2023-5368</cvename>
<freebsdsa>SA-23:12.msdosfs</freebsdsa>
</references>
<dates>
<discovery>2023-10-03</discovery>
<entry>2023-10-04</entry>
</dates>
</vuln>
<vuln vid="e59fed96-60da-11ee-9102-000c29de725b">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.13</lt></range>
</package>
<package>
<name>mediawiki139</name>
<range><lt>1.39.5</lt></range>
</package>
<package>
<name>mediawiki140</name>
<range><lt>1.40.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawikwi reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/BRWOWACCHMYRIS7JRTT6XD44X3362MVL/">
<p>(T264765, CVE-2023-PENDING) SECURITY: Users without correct permission
are incorrectly shown MediaWiki:Missing-revision-permission.</p>
<p>(T333050, CVE-2023-PENDING) SECURITY: Fix infinite loop for
self-redirects with variants conversion.</p>
<p>(T340217, CVE-2023-PENDING) SECURITY: Vector 2022: Numerous unescaped
messages leading to potential XSS.</p>
<p>(T340220, CVE-2023-PENDING) SECURITY: Vector 2022: vector-intro-page
message is assumed to yield a valid title.</p>
<p>(T340221, CVE-2023-PENDING) SECURITY: XSS via
'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.</p>
<p>(T341529, CVE-2023-PENDING) SECURITY: diff-multi-sameuser ("X
intermediate revisions by the same user not shown") ignores username
suppression.</p>
<p>(T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML
file to Special:Upload (non-standard configuration).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3550</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/BRWOWACCHMYRIS7JRTT6XD44X3362MVL/</url>
</references>
<dates>
<discovery>2023-09-01</discovery>
<entry>2023-10-02</entry>
</dates>
</vuln>
<vuln vid="33922b84-5f09-11ee-b63d-0897988a1c07">
<topic>Remote Code Execution via web-accessible composer</topic>
<affects>
<package>
<name>php80-composer</name>
<range><lt>1.10.27</lt></range>
<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php81-composer</name>
<range><lt>1.10.27</lt></range>
<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php82-composer</name>
<range><lt>1.10.27</lt></range>
<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php83-composer</name>
<range><lt>1.10.27</lt></range>
<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php80-composer2</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>php81-composer2</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>php82-composer2</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>php83-composer2</name>
<range><lt>2.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Composer project reports:</p>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf">
<p>Description: Users publishing a composer.phar to a
public web-accessible server where the composer.phar can
be executed as a php file may be impacted if PHP also has
register_argc_argv enabled in php.ini.</p>
<p>Workaround: Make sure register_argc_argv is disabled
in php.ini, and avoid publishing composer.phar to the web
as this really should not happen.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43655</cvename>
<url>https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf</url>
</references>
<dates>
<discovery>2023-09-29</discovery>
<entry>2023-09-29</entry>
<modified>2023-09-30</modified>
</dates>
</vuln>
<vuln vid="6d9c6aae-5eb1-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>117.0.5938.132</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>117.0.5938.132</lt></range>
</package>
<package>
<name>qt6-webengine</name>
<range><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html">
<p>This update includes 10 security fixes:</p>
<ul>
<li>[1486441] High CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-09-25</li>
<li>[1478889] High CVE-2023-5186: Use after free in Passwords. Reported by [pwn2car] on 2023-09-05</li>
<li>[1475798] High CVE-2023-5187: Use after free in Extensions. Reported by Thomas Orlita on 2023-08-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5217</cvename>
<cvename>CVE-2023-5186</cvename>
<cvename>CVE-2023-5187</cvename>
<url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-09-29</entry>
</dates>
</vuln>
<vuln vid="2bcd6ba4-d8e2-42e5-9033-b50b722821fb">
<topic>electron{22,24,25} -- Heap buffer overflow in vp8 encoding in libvpx</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.25</lt></range>
</package>
<package>
<name>electron24</name>
<range><lt>24.8.5</lt></range>
</package>
<package>
<name>electron25</name>
<range><lt>25.8.4</lt></range>
</package>
<package>
<name>libvpx</name>
<range><lt>1.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.25">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-5217.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-5217</cvename>
<url>https://github.com/advisories/GHSA-qqvq-6xgj-jw8g</url>
</references>
<dates>
<discovery>2023-09-28</discovery>
<entry>2023-09-29</entry>
<modified>2023-09-30</modified>
</dates>
</vuln>
<vuln vid="6e0ebb4a-5e75-11ee-a365-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.4.0</ge><lt>16.4.1</lt></range>
<range><ge>16.3.0</ge><lt>16.3.5</lt></range>
<range><ge>8.15</ge><lt>16.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Attacker can add other projects policy bot as member to their own project and use that bot to trigger pipelines in victims project</p>
<p>Group import allows impersonation of users in CI pipelines</p>
<p>Developers can bypass code owners approval by changing a MR's base branch</p>
<p>Leaking source code of restricted project through a fork</p>
<p>Third party library Consul requires enable-script-checks to be False to enable patch</p>
<p>Service account not deleted when namespace is deleted allowing access to internal projects</p>
<p>Enforce SSO settings bypassed for public projects for Members without identity</p>
<p>Removed project member can write to protected branches</p>
<p>Unauthorised association of CI jobs for Machine Learning experiments</p>
<p>Force pipelines to not have access to protected variables and will likely fail using tags</p>
<p>Maintainer can create a fork relationship between existing projects</p>
<p>Disclosure of masked CI variables via processing CI/CD configuration of forks</p>
<p>Asset Proxy Bypass using non-ASCII character in asset URI</p>
<p>Unauthorized member can gain Allowed to push and merge access and affect integrity of protected branches</p>
<p>Removed Developer can continue editing the source code of a public project</p>
<p>A project reporter can leak owner's Sentry instance projects</p>
<p>Math rendering in markdown can escape container and hijack clicks</p>
</body>
</description>
<references>
<cvename>CVE-2023-5207</cvename>
<cvename>CVE-2023-5207</cvename>
<cvename>CVE-2023-4379</cvename>
<cvename>CVE-2023-3413</cvename>
<cvename>CVE-2023-3914</cvename>
<cvename>CVE-2023-3115</cvename>
<cvename>CVE-2023-5198</cvename>
<cvename>CVE-2023-4532</cvename>
<cvename>CVE-2023-3917</cvename>
<cvename>CVE-2023-3920</cvename>
<cvename>CVE-2023-0989</cvename>
<cvename>CVE-2023-3906</cvename>
<cvename>CVE-2023-4658</cvename>
<cvename>CVE-2023-3979</cvename>
<cvename>CVE-2023-2233</cvename>
<cvename>CVE-2023-3922</cvename>
<url>https://about.gitlab.com/releases/2023/09/28/security-release-gitlab-16-4-1-released/</url>
</references>
<dates>
<discovery>2023-09-28</discovery>
<entry>2023-09-29</entry>
</dates>
</vuln>
<vuln vid="af065e47-5d62-11ee-bbae-1c61b4739ac9">
<topic>xrdp -- unchecked access to font glyph info</topic>
<affects>
<package>
<name>xrdp</name>
<range><lt>0.9.23.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp team reports:</p>
<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2023-42822">
<p>Access to the font glyphs in xrdp_painter.c is not bounds-checked.
Since some of this data is controllable by the user, this can result
in an out-of-bounds read within the xrdp executable. The vulnerability
allows an out-of-bounds read within a potentially privileged process.
On non-Debian platforms, xrdp tends to run as root. Potentially an
out-of-bounds write can follow the out-of-bounds read. There is no
denial-of-service impact, providing xrdp is running in forking mode. This
issue has been addressed in release 0.9.23.1. Users are advised to upgrade.
There are no known workarounds for this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-42822</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2023-42822</url>
<url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw</url>
</references>
<dates>
<discovery>2023-09-27</discovery>
<entry>2023-09-27</entry>
</dates>
</vuln>
<vuln vid="c9ff1150-5d63-11ee-bbae-1c61b4739ac9">
<topic>xrdp -- Improper handling of session establishment errors allows bypassing OS-level session restrictions</topic>
<affects>
<package>
<name>xrdp</name>
<range><lt>0.9.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp team reports:</p>
<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2023-40184">
<p>In versions prior to 0.9.23 improper handling of session establishment
errors allows bypassing OS-level session restrictions. The `auth_start_session`
function can return non-zero (1) value on, e.g., PAM error which may result
in session restrictions such as max concurrent sessions per user by PAM
(ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't
use restrictions by PAM are not affected. This issue has been addressed in
release version 0.9.23. Users are advised to upgrade. There are no known
workarounds for this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-40184</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2023-40184</url>
<url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-09-27</entry>
</dates>
</vuln>
<vuln vid="ea9d1fd2-5d24-11ee-8507-b42e991fc52e">
<topic>routinator -- Possible path traversal when storing RRDP responses</topic>
<affects>
<package>
<name>routinator</name>
<range><ge>0.9.0</ge><lt>0.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sep@nlnetlabs.nl reports:</p>
<blockquote cite="https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt">
<p>NLnet Labs Routinator 0.9.0 up to and including 0.12.1 contains a
possible path traversal vulnerability in the optional, off-by-default
keep-rrdp-responses feature that allows users to store the content
of responses received for RRDP requests. The location of these
stored responses is constructed from the URL of the request. Due
to insufficient sanitation of the URL, it is possible for an attacker
to craft a URL that results in the response being stored outside
of the directory specified for it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39916</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-39916</url>
</references>
<dates>
<discovery>2023-09-13</discovery>
<entry>2023-09-27</entry>
</dates>
</vuln>
<vuln vid="402fccd0-5b6d-11ee-9898-00e081b7aa2d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.424</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.414.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2023-09-20/">
<h1>Description</h1>
<h5>(Medium) SECURITY-3261 / CVE-2023-43494</h5>
<p>Builds can be filtered by values of sensitive build variables</p>
<h5>(High) SECURITY-3245 / CVE-2023-43495</h5>
<p>Stored XSS vulnerability</p>
<h5>(High) SECURITY-3072 / CVE-2023-43496 </h5>
<p>Temporary plugin file created with insecure permissions</p>
<h5>(Low) SECURITY-3073 / CVE-2023-43497 (Stapler), CVE-2023-43498 (MultipartFormDataParser) </h5>
<p>Temporary uploaded file created with insecure permissions</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-43494</cvename>
<cvename>CVE-2023-43495</cvename>
<cvename>CVE-2023-43496</cvename>
<cvename>CVE-2023-43497</cvename>
<url>https://www.jenkins.io/security/advisory/2023-09-20/</url>
</references>
<dates>
<discovery>2023-09-20</discovery>
<entry>2023-09-25</entry>
</dates>
</vuln>
<vuln vid="732282a5-5a10-11ee-bca0-001999f8d30b">
<topic>Mailpit affected by vulnerability in included go markdown module</topic>
<affects>
<package>
<name>mailpit</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mailpit author reports:</p>
<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.9.1">
<p>Update Go modules to address CVE-2023-42821 (go markdown module DoS).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-42821</cvename>
</references>
<dates>
<discovery>2023-09-23</discovery>
<entry>2023-09-23</entry>
</dates>
</vuln>
<vuln vid="4fd7a2fc-5860-11ee-a1b3-dca632daf43b">
<topic>graphics/webp heap buffer overflow</topic>
<affects>
<package>
<name>webp</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-4863">
<p>Heap buffer overflow in WebP ... allowed a remote attacker to perform an out of bounds memory write ...</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4863</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-4863</url>
</references>
<dates>
<discovery>2023-09-12</discovery>
<entry>2023-09-21</entry>
</dates>
</vuln>
<vuln vid="58a738d4-57af-11ee-8c58-b42e991fc52e">
<topic>libwebp heap buffer overflow</topic>
<affects>
<package>
<name>tor-browser</name>
<range><lt>12.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chrome-cve-admin@google.com reports:</p>
<blockquote cite="https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/">
<p>Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187
allowed a remote attacker to perform an out of bounds memory write
via a crafted HTML page. (Chromium security severity: Critical)
The Tor browser is based on Firefox and GeckoView and uses also
libwep so it is affected by this bug.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4863</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-4863</url>
</references>
<dates>
<discovery>2023-09-12</discovery>
<entry>2023-09-20</entry>
</dates>
</vuln>
<vuln vid="32a4896a-56da-11ee-9186-001b217b3468">
<topic>Gitlab -- vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.3.0</ge><lt>16.3.4</lt></range>
<range><ge>13.12.0</ge><lt>16.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/">
<p>Attacker can abuse scan execution policies to run pipelines as another user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4998</cvename>
<url>https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/</url>
</references>
<dates>
<discovery>2023-09-18</discovery>
<entry>2023-09-19</entry>
</dates>
</vuln>
<vuln vid="11982747-544c-11ee-ac3e-a04a5edf46d9">
<topic>routinator -- multiple vulnerabilities</topic>
<affects>
<package>
<name>routinator</name>
<range><lt>0.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLnet Labs report:</p>
<blockquote cite="https://nlnetlabs.nl/news/2023/Sep/13/routinator-0.12.2-released/">
<p>This release fixes two issues in Routinator that can be exploited
remotely by rogue RPKI CAs and repositories. We therefore advise all
users of Routinator to upgrade to this release at their earliest
convenience.</p>
<p>The first issue, CVE-2022-39915, can lead to Routinator crashing
when trying to decode certain illegal RPKI objects.</p>
<p>The second issue, CVE-2022-39916, only affects users that have the
rrdp-keep-responses option enabled which allows storing all received
RRDP responses on disk. Because the file name for these responses is
derived from the URI and the path wasn't checked properly, a RRDP URI
could be constructed that results in the response stored outside the
directory, possibly overwriting existing files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39915</cvename>
<url>https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt</url>
<cvename>CVE-2022-39916</cvename>
<url>https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt</url>
</references>
<dates>
<discovery>2022-12-08</discovery>
<entry>2023-09-16</entry>
</dates>
</vuln>
<vuln vid="833b469b-5247-11ee-9667-080027f5fec9">
<topic>curl -- HTTP headers eat all memory</topic>
<affects>
<package>
<name>curl</name>
<range><lt>8.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>selmelc on hackerone reports:</p>
<blockquote cite="https://curl.se/docs/CVE-2023-38039.html">
<p>
When curl retrieves an HTTP response, it stores the
incoming headers so that they can be accessed later via
the libcurl headers API.
</p>
<p>
However, curl did not have a limit in how many or how
large headers it would accept in a response, allowing a
malicious server to stream an endless series of headers
and eventually cause curl to run out of heap memory.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-38039</cvename>
<url>https://curl.se/docs/CVE-2023-38039.html HERE</url>
</references>
<dates>
<discovery>2023-09-13</discovery>
<entry>2023-09-13</entry>
</dates>
</vuln>
<vuln vid="b5508c08-547a-11ee-85eb-84a93843eb75">
<topic>Roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.6.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube webmail project reports:</p>
<blockquote cite="https://roundcube.net/news/2023/09/15/security-update-1.6.3-released">
<p>cross-site scripting (XSS) vulnerability in handling of
linkrefs in plain text messages</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2023/09/15/security-update-1.6.3-released</url>
</references>
<dates>
<discovery>2023-09-15</discovery>
<entry>2023-09-16</entry>
</dates>
</vuln>
<vuln vid="773ce35b-eabb-47e0-98ca-669b2b98107a">
<topic>electron{24,25} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron24</name>
<range><lt>24.8.3</lt></range>
</package>
<package>
<name>electron25</name>
<range><lt>25.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v24.8.3">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4763.</li>
<li>Security: backported fix for CVE-2023-4762.</li>
<li>Security: backported fix for CVE-2023-4761.</li>
<li>Security: backported fix for CVE-2023-4863.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4763</cvename>
<url>https://github.com/advisories/GHSA-w5hv-g8p5-vwjr</url>
<cvename>CVE-2023-4762</cvename>
<url>https://github.com/advisories/GHSA-3wjr-p76q-rg8q</url>
<cvename>CVE-2023-4761</cvename>
<url>https://github.com/advisories/GHSA-8cgp-x4c5-vg9g</url>
<cvename>CVE-2023-4863</cvename>
<url>https://github.com/advisories/GHSA-j7hp-h8jx-5ppr</url>
</references>
<dates>
<discovery>2023-09-13</discovery>
<entry>2023-09-13</entry>
</dates>
</vuln>
<vuln vid="3693eca5-f0d3-453c-9558-2353150495bb">
<topic>electron22 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.24">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4572.</li>
<li>Security: backported fix for CVE-2023-4762.</li>
<li>Security: backported fix for CVE-2023-4863.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4572</cvename>
<url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
<cvename>CVE-2023-4762</cvename>
<url>https://github.com/advisories/GHSA-3wjr-p76q-rg8q</url>
<cvename>CVE-2023-4863</cvename>
<url>https://github.com/advisories/GHSA-j7hp-h8jx-5ppr</url>
</references>
<dates>
<discovery>2023-09-13</discovery>
<entry>2023-09-13</entry>
</dates>
</vuln>
<vuln vid="88754d55-521a-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>117.0.5938.62</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>117.0.5938.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html">
<p>This update includes 16 security fixes:</p>
<ul>
<li>[1479274] Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06</li>
<li>[1430867] Medium CVE-2023-4900: Inappropriate implementation in Custom Tabs. Reported by Levit Nudi from Kenya on 2023-04-06</li>
<li>[1459281] Medium CVE-2023-4901: Inappropriate implementation in Prompts. Reported by Kang Ali on 2023-06-29</li>
<li>[1454515] Medium CVE-2023-4902: Inappropriate implementation in Input. Reported by Axel Chong on 2023-06-14</li>
<li>[1446709] Medium CVE-2023-4903: Inappropriate implementation in Custom Mobile Tabs. Reported by Ahmed ElMasry on 2023-05-18</li>
<li>[1453501] Medium CVE-2023-4904: Insufficient policy enforcement in Downloads. Reported by Tudor Enache @tudorhacks on 2023-06-09</li>
<li>[1441228] Medium CVE-2023-4905: Inappropriate implementation in Prompts. Reported by Hafiizh on 2023-04-29</li>
<li>[1449874] Low CVE-2023-4906: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2023-05-30</li>
<li>[1462104] Low CVE-2023-4907: Inappropriate implementation in Intents. Reported by Mohit Raj (shadow2639) on 2023-07-04</li>
<li>[1451543] Low CVE-2023-4908: Inappropriate implementation in Picture in Picture. Reported by Axel Chong on 2023-06-06</li>
<li>[1463293] Low CVE-2023-4909: Inappropriate implementation in Interstitials. Reported by Axel Chong on 2023-07-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4863</cvename>
<cvename>CVE-2023-4900</cvename>
<cvename>CVE-2023-4901</cvename>
<cvename>CVE-2023-4902</cvename>
<cvename>CVE-2023-4903</cvename>
<cvename>CVE-2023-4904</cvename>
<cvename>CVE-2023-4905</cvename>
<cvename>CVE-2023-4906</cvename>
<cvename>CVE-2023-4907</cvename>
<cvename>CVE-2023-4908</cvename>
<cvename>CVE-2023-4909</cvename>
<url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2023-09-12</discovery>
<entry>2023-09-13</entry>
</dates>
</vuln>
<vuln vid="4bc66a81-89d2-4696-a04b-defd2eb77783">
<topic>vscode -- VS Code Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.82.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VSCode developers report:</p>
<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-r6q2-478f-5gmr">
<p>Visual Studio Code Remote Code Execution Vulnerability</p>
<p>A remote code execution vulnerability exists in VS Code 1.82.0 and earlier versions that working in a maliciously crafted package.json can result in executing commands locally. This scenario would require the attacker to get the VS Code user to open the malicious project and have get the user to open and work with malformed entries in the dependencies sections of the package.json file.</p>
<p>VS Code uses the locally installed npm command to fetch information on package dependencies. A package dependency can be named in such a way that the npm tool runs a script instead.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36742</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-36742</url>
<url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742</url>
</references>
<dates>
<discovery>2023-09-12</discovery>
<entry>2023-09-13</entry>
</dates>
</vuln>
<vuln vid="8eefa87f-31f1-496d-bf8e-2b465b6e4e8a">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>6.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.1">
<p> File extraction limits were not correctly enforced
for files containing large amounts of missing bytes. </p>
<p> Sessions are sometimes not cleaned up completely
within Zeek during shutdown, potentially causing a crash
when using the -B dpd flag for debug logging. </p>
<p> A specially-crafted HTTP packet can cause Zeek's
filename extraction code to take a long time to process
the data. </p>
<p> A specially-crafted series of FTP packets made up of
a CWD request followed by a large amount of ERPT requests
may cause Zeek to spend a long time logging the commands.
</p>
<p> A specially-crafted VLAN packet can cause Zeek to
overflow memory and potentially crash. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v6.0.1</url>
</references>
<dates>
<discovery>2023-09-12</discovery>
<entry>2023-09-12</entry>
</dates>
</vuln>
<vuln vid="4061a4b2-4fb1-11ee-acc7-0151f07bc899">
<topic>gitea -- block user account creation from blocked email domains</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.20.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/26812">
<p>check blocklist for emails when adding them to account</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.20.4</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.20.4</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-09-10</entry>
</dates>
</vuln>
<vuln vid="a57472ba-4d84-11ee-bf05-000c29de725b">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.18</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.18</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.13</lt></range>
</package>
<package>
<name>python311</name>
<range><lt>3.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://pythoninsider.blogspot.com/2023/08/python-3115-31013-3918-and-3818-is-now.html">
<p>gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable
to a bypass of the TLS handshake and included protections (like certificate
verification) and treating sent unencrypted data as if it were post-handshake
TLS encrypted data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-40217</cvename>
<url>https://pythoninsider.blogspot.com/2023/08/python-3115-31013-3918-and-3818-is-now.html</url>
</references>
<dates>
<discovery>2023-08-22</discovery>
<entry>2023-09-07</entry>
</dates>
</vuln>
<vuln vid="beb36f39-4d74-11ee-985e-bff341e78d94">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go120</name>
<range><lt>1.20.8</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/62198">
<p>cmd/go: go.mod toolchain directive allows arbitrary
execution</p>
<p>The go.mod toolchain directive, introduced in Go 1.21,
could be leveraged to execute scripts and binaries
relative to the root of the module when the "go" command
was executed within the module. This applies to modules
downloaded using the "go" command from the module proxy,
as well as modules downloaded directly using VCS software.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/62196">
<p>html/template: improper handling of HTML-like comments
within script contexts</p>
<p>The html/template package did not properly handle
HMTL-like "<!--" and "-->"
comment tokens, nor hashbang "#!" comment tokens, in
<script> contexts. This may cause the template
parser to improperly interpret the contents of
<script> contexts, causing actions to be improperly
escaped. This could be leveraged to perform an XSS attack.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/62197">
<p>html/template: improper handling of special tags within
script contexts</p>
<p>The html/template package did not apply the proper rules
for handling occurrences
of "<script", "<!--", and "</script" within JS
literals in <script< contexts. This may cause the
template parser to improperly consider script contexts to
be terminated early, causing actions to be improperly
escaped. This could be leveraged to perform an XSS attack.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/62266">
<p>crypto/tls: panic when processing post-handshake message
on QUIC connections</p>
<p>Processing an incomplete post-handshake message for a QUIC
connection caused a panic.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39320</cvename>
<cvename>CVE-2023-39318</cvename>
<cvename>CVE-2023-39319</cvename>
<cvename>CVE-2023-39321</cvename>
<cvename>CVE-2023-39322</cvename>
<url>https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ?pli=1</url>
</references>
<dates>
<discovery>2023-09-06</discovery>
<entry>2023-09-07</entry>
</dates>
</vuln>
<vuln vid="924cb116-4d35-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Wi-Fi encryption bypass</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_3</lt></range>
<range><ge>12.4</ge><lt>12.4_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The net80211 subsystem would fallback to the multicast key for unicast
traffic in the event the unicast key was removed. This would result in
buffered unicast traffic being exposed to any stations with access to the
multicast key.</p>
<h1>Impact:</h1>
<p>As described in the "Framing Frames: Bypassing Wi-Fi Encryption by
Manipulating Transmit Queues" paper, an attacker can induce an access point
to buffer frames for a client, deauthenticate the client (causing the unicast
key to be removed from the access point), and subsequent flushing of the
buffered frames now encrypted with the multicast key. This would give the
attacker access to the data.</p>
</body>
</description>
<references>
<cvename>CVE-2022-47522</cvename>
<freebsdsa>SA-23:11.wifi</freebsdsa>
</references>
<dates>
<discovery>2023-09-06</discovery>
<entry>2023-09-07</entry>
</dates>
</vuln>
<vuln vid="d35373ae-4d34-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- pf incorrectly handles multiple IPv6 fragment headers</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_3</lt></range>
<range><ge>12.4</ge><lt>12.4_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>With a 'scrub fragment reassemble' rule, a packet containing multiple IPv6
fragment headers would be reassembled, and then immediately processed. That
is, a packet with multiple fragment extension headers would not be recognized
as the correct ultimate payload. Instead a packet with multiple IPv6 fragment
headers would unexpectedly be interpreted as a fragmented packet, rather than
as whatever the real payload is.</p>
<h1>Impact:</h1>
<p>IPv6 fragments may bypass firewall rules written on the assumption all
fragments have been reassembled and, as a result, be forwarded or processed
by the host.</p>
</body>
</description>
<references>
<cvename>CVE-2023-4809</cvename>
<freebsdsa>SA-23:10.pf</freebsdsa>
</references>
<dates>
<discovery>2023-09-06</discovery>
<entry>2023-09-07</entry>
</dates>
</vuln>
<vuln vid="6c72b13f-4d1d-11ee-a7f1-080027f5fec9">
<topic>redis -- Possible bypassing ACL configuration</topic>
<affects>
<package>
<name>redis</name>
<range><ge>7.0.0</ge><lt>7.0.13</lt></range>
<range><ge>7.2.0</ge><lt>7.2.1</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.2.0.20230831</lt></range>
</package>
<package>
<name>redis70</name>
<range><ge>7.0.0</ge><lt>7.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>yangbodong22011 reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc">
<p>
Redis does not correctly identify keys accessed by SORT_RO
and, as a result, may grant users executing this command
access to keys that are not explicitly authorized by the
ACL configuration.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41053</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc</url>
</references>
<dates>
<discovery>2023-09-06</discovery>
<entry>2023-09-07</entry>
</dates>
</vuln>
<vuln vid="df0a2fd1-4c92-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>116.0.5845.179</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>116.0.5845.179</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[1476403] High CVE-2023-4761: Out of bounds memory access in FedCM. Reported by DarkNavy on 2023-08-28</li>
<li>[1473247] High CVE-2023-4762: Type Confusion in V8. Reported by Rong Jian of VRI on 2023-08-16</li>
<li>[1469928] High CVE-2023-4763: Use after free in Networks. Reported by anonymous on 2023-08-03</li>
<li>[1447237] High CVE-2023-4764: Incorrect security UI in BFCache. Reported by Irvan Kurniawan (sourc7) on 2023-05-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4761</cvename>
<cvename>CVE-2023-4762</cvename>
<cvename>CVE-2023-4763</cvename>
<cvename>CVE-2023-4764</cvename>
<url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-09-05</discovery>
<entry>2023-09-06</entry>
</dates>
</vuln>
<vuln vid="8fd4f40a-4b7d-11ee-aa2a-080027de9982">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.21</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<name>py311-django41</name>
<range><lt>4.1.11</lt></range>
</package>
<package>
<name>py38-django42</name>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/sep/04/security-releases/">
<p>CVE-2023-41164: Potential denial of service vulnerability in
django.utils.encoding.uri_to_iri().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-41164</cvename>
<url>https://www.djangoproject.com/weblog/2023/sep/04/security-releases/</url>
</references>
<dates>
<discovery>2023-09-01</discovery>
<entry>2023-09-04</entry>
</dates>
</vuln>
<vuln vid="aaea7b7c-4887-11ee-b164-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.3.0</ge><lt>16.3.1</lt></range>
<range><ge>16.2.0</ge><lt>16.2.5</lt></range>
<range><ge>4.1.0</ge><lt>16.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/">
<p>Privilege escalation of "external user" to internal access through group service account</p>
<p>Maintainer can leak sentry token by changing the configured URL (fix bypass)</p>
<p>Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners</p>
<p>Information disclosure via project import endpoint</p>
<p>Developer can leak DAST scanners "Site Profile" request headers and auth password</p>
<p>Project forking outside current group</p>
<p>User is capable of creating Model experiment and updating existing run's status in public project</p>
<p>ReDoS in bulk import API</p>
<p>Pagination for Branches and Tags can be skipped leading to DoS</p>
<p>Internal Open Redirection Due to Improper handling of "../" characters</p>
<p>Subgroup Member With Reporter Role Can Edit Group Labels</p>
<p>Banned user can delete package registries</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3915</cvename>
<cvename>CVE-2023-4378</cvename>
<cvename>CVE-2023-3950</cvename>
<cvename>CVE-2023-4630</cvename>
<cvename>CVE-2022-4343</cvename>
<cvename>CVE-2023-4638</cvename>
<cvename>CVE-2023-4018</cvename>
<cvename>CVE-2023-3205</cvename>
<cvename>CVE-2023-4647</cvename>
<cvename>CVE-2023-1279</cvename>
<cvename>CVE-2023-0120</cvename>
<cvename>CVE-2023-1555</cvename>
<url>https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/</url>
</references>
<dates>
<discovery>2023-08-31</discovery>
<entry>2023-09-01</entry>
</dates>
</vuln>
<vuln vid="b8a52e5a-483d-11ee-971d-3df00e0f9020">
<topic>Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss.</topic>
<affects>
<package>
<name>py37-borgbackup</name>
<name>py38-borgbackup</name>
<name>py39-borgbackup</name>
<name>py310-borgbackup</name>
<name>py311-borgbackup</name>
<name>py312-borgbackup</name>
<range><lt>1.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Waldmann reports:</p>
<blockquote cite="https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811">
<p>A flaw in the cryptographic authentication scheme in Borg allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository.</p>
<p>The attack requires an attacker to be able to</p>
<ul><li>insert files (with no additional headers) into backups</li>
<li>gain write access to the repository</li></ul>
<p>This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36811</cvename>
<url>https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811</url>
</references>
<dates>
<discovery>2023-06-13</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="970dcbe0-a947-41a4-abe9-7aaba87f41fe">
<topic>electron25 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.8.0">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4427.</li>
<li>Security: backported fix for CVE-2023-4428.</li>
<li>Security: backported fix for CVE-2023-4429.</li>
<li>Security: backported fix for CVE-2023-4430.</li>
<li>Security: backported fix for CVE-2023-4572.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4427</cvename>
<url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
<cvename>CVE-2023-4428</cvename>
<url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
<cvename>CVE-2023-4429</cvename>
<url>https://github.com/advisories/GHSA-r43m-48vw-xgp3</url>
<cvename>CVE-2023-4430</cvename>
<url>https://github.com/advisories/GHSA-h295-rcc5-87jh</url>
<cvename>CVE-2023-4572</cvename>
<url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="29f050e9-3ef4-4c5f-8204-503b41caf181">
<topic>electron24 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron24</name>
<range><lt>24.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v24.8.2">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4427.</li>
<li>Security: backported fix for CVE-2023-4428.</li>
<li>Security: backported fix for CVE-2023-4430.</li>
<li>Security: backported fix for CVE-2023-4572.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4427</cvename>
<url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
<cvename>CVE-2023-4428</cvename>
<url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
<cvename>CVE-2023-4430</cvename>
<url>https://github.com/advisories/GHSA-h295-rcc5-87jh</url>
<cvename>CVE-2023-4572</cvename>
<url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="579c7489-c23d-454a-b0fc-ed9d80ea46e0">
<topic>electron22 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.23">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4427.</li>
<li>Security: backported fix for CVE-2023-4428.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4427</cvename>
<url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
<cvename>CVE-2023-4428</cvename>
<url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
</references>
<dates>
<discovery>2023-08-30</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="1a15b928-5011-4953-8133-d49e24902fe1">
<topic>py-WsgiDAV -- XSS vulnerability</topic>
<affects>
<package>
<name>py37-WsgiDAV</name>
<name>py38-WsgiDAV</name>
<name>py39-WsgiDAV</name>
<name>py310-WsgiDAV</name>
<name>py311-WsgiDAV</name>
<range><lt>4.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-xx6g-jj35-pxjv">
<p>Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41905</cvename>
<url>https://osv.dev/vulnerability/GHSA-xx6g-jj35-pxjv</url>
</references>
<dates>
<discovery>2022-11-11</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="17efbe19-4e72-426a-8016-2b4e001c1378">
<topic>py-wagtail -- stored XSS vulnerability</topic>
<affects>
<package>
<name>py37-wagtail</name>
<name>py38-wagtail</name>
<name>py39-wagtail</name>
<name>py310-wagtail</name>
<name>py311-wagtail</name>
<range><lt>4.1.4</lt></range>
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2">
<p>A stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface.</p>
<p>A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials.</p>
<p>The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled.</p>
<p>For page, the vulnerability is in the "Choose a parent page" ModelAdmin view, available when managing pages via ModelAdmin.</p>
<p>For documents, the vulnerability is in the ModelAdmin Inspect view when displaying document fields.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28836</cvename>
<url>https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2</url>
</references>
<dates>
<discovery>2023-04-03</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="2def7c4b-736f-4754-9f03-236fcb586d91">
<topic>py-wagtail -- DoS vulnerability</topic>
<affects>
<package>
<name>py37-wagtail</name>
<name>py38-wagtail</name>
<name>py39-wagtail</name>
<name>py310-wagtail</name>
<name>py311-wagtail</name>
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-33pv-vcgh-jfg9">
<p>A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents.</p>
<p>For both images and documents, files are loaded into memory during upload for additional processing.</p>
<p>A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.</p>
<p>The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.</p>
<p>It can only be exploited by admin users with permission to upload images or documents.</p>
<p>Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28837</cvename>
<url>https://osv.dev/vulnerability/GHSA-33pv-vcgh-jfg9</url>
</references>
<dates>
<discovery>2023-04-03</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="181f5e49-b71d-4527-9464-d4624d69acc3">
<topic>py-treq -- sensitive information leak vulnerability</topic>
<affects>
<package>
<name>py37-treq</name>
<name>py38-treq</name>
<name>py39-treq</name>
<name>py310-treq</name>
<name>py311-treq</name>
<range><lt>22.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc">
<p>Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary.</p>
<p>Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies").</p>
<p>This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23607</cvename>
<url>https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc</url>
</references>
<dates>
<discovery>2022-02-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="4eb5dccb-923c-4f18-9cd4-b53f9e28d4d7">
<topic>py-Scrapy -- DoS vulnerability</topic>
<affects>
<package>
<name>py37-Scrapy</name>
<name>py38-Scrapy</name>
<name>py39-Scrapy</name>
<name>py310-Scrapy</name>
<name>py311-Scrapy</name>
<range><le>2.8.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kmike and nramirezuy report:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2017-83">
<p>Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14158</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2017-83</url>
<url>https://osv.dev/vulnerability/GHSA-h7wm-ph43-c39p</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="67fe5e5b-549f-4a2a-9834-53f60eaa415e">
<topic>py-Scrapy -- exposure of sensitive information vulnerability</topic>
<affects>
<package>
<name>py37-Scrapy</name>
<name>py38-Scrapy</name>
<name>py39-Scrapy</name>
<name>py310-Scrapy</name>
<name>py311-Scrapy</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ranjit-git reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-159">
<p>Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0577</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-159</url>
<url>https://osv.dev/vulnerability/GHSA-cjvr-mfj7-j4j8</url>
</references>
<dates>
<discovery>2022-03-02</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="a5403af6-225e-48ba-b233-bd95ad26434a">
<topic>py-Scrapy -- cookie injection vulnerability</topic>
<affects>
<package>
<name>py37-Scrapy</name>
<name>py38-Scrapy</name>
<name>py39-Scrapy</name>
<name>py310-Scrapy</name>
<name>py311-Scrapy</name>
<range><lt>1.8.2</lt></range>
<range><ge>2.0.0</ge><lt>2.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96">
<p>Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96</url>
</references>
<dates>
<discovery>2022-03-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="2ad25820-c71a-4e6c-bb99-770c66fe496d">
<topic>py-Scrapy -- credentials leak vulnerability</topic>
<affects>
<package>
<name>py37-Scrapy</name>
<name>py38-Scrapy</name>
<name>py39-Scrapy</name>
<name>py310-Scrapy</name>
<name>py311-Scrapy</name>
<range><lt>1.8.3</lt></range>
<range><ge>2.0.0</ge><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3">
<p>When the built-in HTTP proxy downloader middleware processes a request with `proxy` metadata, and that `proxy` metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the `Proxy-Authentication` header, but only if that header is not already set.</p>
<p>There are third-party proxy-rotation downloader middlewares that set different `proxy` metadata every time they process a request.</p>
<p>Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.</p>
<p>These third-party proxy-rotation downloader middlewares could change the `proxy` metadata of a request to a new value, but fail to remove the `Proxy-Authentication` header from the previous value of the `proxy` metadata, causing the credentials of one proxy to be leaked to a different proxy.</p>
<p>If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under **Workarounds** below.</p>
<p>If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough;</p>
<p>patching that downloader middlware may be necessary as well.</p>
</blockquote>
</body>
</description>
<references>
<url>https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3</url>
</references>
<dates>
<discovery>2022-07-29</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="e831dd5a-7d8e-4818-aa1f-17dd495584ec">
<topic>py-httpx -- input validation vulnerability</topic>
<affects>
<package>
<name>py37-httpx013</name>
<name>py38-httpx013</name>
<name>py39-httpx013</name>
<name>py310-httpx013</name>
<name>py311-httpx013</name>
<range><lt>0.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lebr0nli reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-183">
<p>Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41945</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-183</url>
<url>https://osv.dev/vulnerability/GHSA-h8pj-cxx2-jfg2</url>
</references>
<dates>
<discovery>2022-04-28</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="1e37fa3e-5988-4991-808f-eae98047e2af">
<topic>py-httpie -- exposure of sensitive information vulnerabilities</topic>
<affects>
<package>
<name>py37-httpie</name>
<name>py38-httpie</name>
<name>py39-httpie</name>
<name>py310-httpie</name>
<name>py311-httpie</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Glyph reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-34">
<p>HTTPie is a command-line HTTP client.</p>
<p>HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage.</p>
<p>Before 3.1.0, HTTPie didn't distinguish between cookies and hosts they belonged.</p>
<p>This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website.</p>
<p>Users are advised to upgrade.</p>
<p>There are no known workarounds.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-167">
<p>Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24737</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-34</url>
<url>https://osv.dev/vulnerability/GHSA-9w4w-cpc8-h2fq</url>
<cvename>CVE-2022-0430</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-167</url>
<url>https://osv.dev/vulnerability/GHSA-6pc9-xqrg-wfqw</url>
</references>
<dates>
<discovery>2022-03-07</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="06492bd5-085a-4cc0-9743-e30164bdcb1c">
<topic>py-flask-security -- user redirect to arbitrary URL vulnerability</topic>
<affects>
<package>
<name>py37-flask-security</name>
<name>py38-flask-security</name>
<name>py39-flask-security</name>
<name>py310-flask-security</name>
<name>py311-flask-security</name>
<range><le>3.0.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Snyk reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7">
<p>This affects all versions of package Flask-Security.</p>
<p>When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\evil.com/path`.</p>
<p>This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.</p>
<p>**Note:** Flask-Security is not maintained anymore.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-23385</cvename>
<url>https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7</url>
</references>
<dates>
<discovery>2022-08-02</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="252f40cb-618c-47f4-a2cf-1abf30cffbbe">
<topic>py-Flask-Cors -- directory traversal vulnerability</topic>
<affects>
<package>
<name>py37-Flask-Cors</name>
<name>py38-Flask-Cors</name>
<name>py39-Flask-Cors</name>
<name>py310-Flask-Cors</name>
<name>py311-Flask-Cors</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>praetorian-colby-morgan reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-43">
<p>An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9.</p>
<p>It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-25032</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-43</url>
<url>https://osv.dev/vulnerability/GHSA-xc3p-ff3m-f46v</url>
</references>
<dates>
<discovery>2020-08-31</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="692a5fd5-bb25-4df4-8a0e-eb91581f2531">
<topic>py-flask-caching -- remote code execution or local privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>py37-flask-caching</name>
<name>py38-flask-caching</name>
<name>py39-flask-caching</name>
<name>py310-flask-caching</name>
<name>py311-flask-caching</name>
<range><le>2.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>subnix reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-13">
<p>The Flask-Caching extension through 2.0.2 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation.</p>
<p>If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33026</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-13</url>
<url>https://osv.dev/vulnerability/GHSA-656c-6cxf-hvcv</url>
</references>
<dates>
<discovery>2021-05-13</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="c2c89dea-2859-4231-8f3b-012be0d475ff">
<topic>py-django-photologue -- XSS vulnerability</topic>
<affects>
<package>
<name>py37-django-photologue</name>
<name>py38-django-photologue</name>
<name>py39-django-photologue</name>
<name>py310-django-photologue</name>
<name>py311-django-photologue</name>
<range><le>3.15_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>domiee13 reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-287q-jfcp-9vhv">
<p>A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic.</p>
<p>Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler.</p>
<p>The manipulation of the argument object.caption leads to cross site scripting.</p>
<p>The attack may be launched remotely.</p>
<p>Upgrading to version 3.16 is able to address this issue.</p>
<p>The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7.</p>
<p>It is recommended to apply a patch to fix this issue.</p>
<p>VDB-215906 is the identifier assigned to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4526</cvename>
<url>https://osv.dev/vulnerability/GHSA-287q-jfcp-9vhv</url>
</references>
<dates>
<discovery>2022-12-15</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="cdc685b5-1724-49a1-ad57-2eaab68e9cc0">
<topic>py-pygments -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>py37-pygments</name>
<name>py38-pygments</name>
<name>py39-pygments</name>
<name>py310-pygments</name>
<name>py311-pygments</name>
<range><lt>2.7.4</lt></range>
</package>
<package>
<name>py37-pygments-25</name>
<name>py38-pygments-25</name>
<name>py39-pygments-25</name>
<name>py310-pygments-25</name>
<name>py311-pygments-25</name>
<range><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-140">
<p>An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.</p>
</blockquote>
<p>Ben Caller reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-141">
<p>In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.</p>
<p>Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS.</p>
<p>By crafting malicious input, an attacker can cause a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-20270</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-140</url>
<url>https://osv.dev/vulnerability/GHSA-9w8r-397f-prfh</url>
<cvename>CVE-2021-27291</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-141</url>
<url>https://osv.dev/vulnerability/GHSA-pq64-v7f5-gqh8</url>
</references>
<dates>
<discovery>2021-03-17</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9">
<topic>py-markdown2 -- regular expression denial of service vulnerability</topic>
<affects>
<package>
<name>py37-markdown2</name>
<name>py38-markdown2</name>
<name>py39-markdown2</name>
<name>py310-markdown2</name>
<name>py311-markdown2</name>
<range><lt>2.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Caller reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-20">
<p>markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.</p>
<p>If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26813</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-20</url>
<url>https://osv.dev/vulnerability/GHSA-jr9p-r423-9m2r</url>
</references>
<dates>
<discovery>2021-03-03</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="cf6f3465-e996-4672-9458-ce803f29fdb7">
<topic>py-markdown2 -- XSS vulnerability</topic>
<affects>
<package>
<name>py37-markdown2</name>
<name>py38-markdown2</name>
<name>py39-markdown2</name>
<name>py310-markdown2</name>
<name>py311-markdown2</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TheGrandPew reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-65">
<p>python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds.</p>
<p>For example, an attack might use elementname@ or elementname- with an onclick attribute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-11888</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-65</url>
<url>https://osv.dev/vulnerability/GHSA-fv3h-8x5j-pvgq</url>
</references>
<dates>
<discovery>2020-04-20</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="83b29e3f-886f-439f-b9a8-72e014479ff9">
<topic>py-dparse -- REDoS vulnerability</topic>
<affects>
<package>
<name>py37-dparse</name>
<name>py38-dparse</name>
<name>py39-dparse</name>
<name>py310-dparse</name>
<name>py311-dparse</name>
<range><lt>0.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>yeisonvargasf reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-301">
<p>dparse is a parser for Python dependency files.</p>
<p>dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service.</p>
<p>All the users parsing index server URLs with dparse are impacted by this vulnerability.</p>
<p>Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39280</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-301</url>
<url>https://osv.dev/vulnerability/GHSA-8fg9-p83m-x5pq</url>
</references>
<dates>
<discovery>2022-10-06</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="9b0d9832-47c1-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Network authentication attack via pam_krb5</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_2</lt></range>
<range><ge>13.1</ge><lt>13.1_9</lt></range>
<range><ge>12.4</ge><lt>12.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The problem detailed in FreeBSD-SA-23:04.pam_krb5 persisted following
the patch for that advisory.</p>
<h1>Impact:</h1>
<p>The impact described in FreeBSD-SA-23:04.pam_krb5 persists.</p>
</body>
</description>
<references>
<cvename>CVE-2023-3326</cvename>
<freebsdsa>SA-23:09.pam_krb5</freebsdsa>
</references>
<dates>
<discovery>2023-08-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="291d0953-47c1-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Potential remote code execution via ssh-agent forwarding</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_2</lt></range>
<range><ge>13.1</ge><lt>13.1_9</lt></range>
<range><ge>12.4</ge><lt>12.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The server may cause ssh-agent to load shared libraries other than
those required for PKCS#11 support. These shared libraries may have
side effects that occur on load and unload (dlopen and dlclose).</p>
<h1>Impact:</h1>
<p>An attacker with access to a server that accepts a forwarded
ssh-agent connection may be able to execute code on the machine running
ssh-agent. Note that the attack relies on properties of operating
system-provided libraries. This has been demonstrated on other
operating systems; it is unknown whether this attack is possible using
the libraries provided by a FreeBSD installation.</p>
</body>
</description>
<references>
<cvename>CVE-2023-38408</cvename>
<freebsdsa>SA-23:08.ssh</freebsdsa>
</references>
<dates>
<discovery>2023-08-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="ab437561-47c0-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- bhyve privileged guest escape via fwctl</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_2</lt></range>
<range><ge>13.1</ge><lt>13.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The fwctl driver implements a state machine which is executed when
the guest accesses certain x86 I/O ports. The interface lets the guest
copy a string into a buffer resident in the bhyve process' memory. A
bug in the state machine implementation can result in a buffer
overflowing when copying this string.</p>
<h1>Impact:</h1>
<p>A malicious, privileged software running in a guest VM can exploit
the buffer overflow to achieve code execution on the host in the bhyve
userspace process, which typically runs as root. Note that bhyve runs
in a Capsicum sandbox, so malicious code is constrained by the
capabilities available to the bhyve process.</p>
</body>
</description>
<references>
<cvename>CVE-2023-3494</cvename>
<freebsdsa>SA-23:07.bhyve</freebsdsa>
</references>
<dates>
<discovery>2023-08-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="3dabf5b8-47c0-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Remote denial of service in IPv6 fragment reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.2</ge><lt>13.2_2</lt></range>
<range><ge>13.1</ge><lt>13.1_9</lt></range>
<range><ge>12.4</ge><lt>12.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Each fragment of an IPv6 packet contains a fragment header which
specifies the offset of the fragment relative to the original packet,
and each fragment specifies its length in the IPv6 header. When
reassembling the packet, the kernel calculates the complete IPv6 payload
length. The payload length must fit into a 16-bit field in the IPv6
header.</p>
<p>Due to a bug in the kernel, a set of carefully crafted packets can
trigger an integer overflow in the calculation of the reassembled
packet's payload length field.</p>
<h1>Impact:</h1>
<p>Once an IPv6 packet has been reassembled, the kernel continues
processing its contents. It does so assuming that the fragmentation
layer has validated all fields of the constructed IPv6 header. This bug
violates such assumptions and can be exploited to trigger a remote
kernel panic, resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2023-3107</cvename>
<freebsdsa>SA-23:06.ipv6</freebsdsa>
</references>
<dates>
<discovery>2023-08-01</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="e31a8f8e-47bf-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- ssh-add does not honor per-hop destination constraints</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.4</ge><lt>12.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When using ssh-add(1) to add smartcard keys to ssh-agent(1) with
per-hop destination constraints, a logic error prevented the constraints
from being sent to the agent resulting in keys being added to the agent
without constraints.</p>
<h1>Impact:</h1>
<p>A malicious server could leverage the keys provided by a forwarded
agent that would normally not be allowed due to the logic error.</p>
</body>
</description>
<references>
<cvename>CVE-2023-28531</cvename>
<freebsdsa>SA-23:05.openssh</freebsdsa>
</references>
<dates>
<discovery>2023-06-21</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="41af0277-47bf-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Network authentication attack via pam_krb5</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.2</ge><lt>13.2_1</lt></range>
<range><ge>13.1</ge><lt>13.1_8</lt></range>
<range><ge>12.4</ge><lt>12.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>pam_krb5 authenticates the user by essentially running kinit(1) with
the password, getting a `ticket-granting ticket' (tgt) from the Kerberos
KDC (Key Distribution Center) over the network, as a way to verify the
password.</p>
<p>Normally, the system running the pam_krb5 module will also have a
keytab, a key provisioned by the KDC. The pam_krb5 module will use the
tgt to get a service ticket and validate it against the keytab, ensuring
the tgt is valid and therefore, the password is valid.</p>
<p>However, if a keytab is not provisioned on the system, pam_krb5 has
no way to validate the response from the KDC, and essentially trusts the
tgt provided over the network as being valid.</p>
<h1>Impact:</h1>
<p>In a non-default FreeBSD installation that leverages pam_krb5 for
authentication and does not have a keytab provisioned, an attacker that
is able to control both the password and the KDC responses can return a
valid tgt, allowing authentication to occur for any user on the
system.</p>
</body>
</description>
<references>
<cvename>CVE-2023-3326</cvename>
<freebsdsa>SA-23:04.pam_krb5</freebsdsa>
</references>
<dates>
<discovery>2023-06-21</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="c8eb4c40-47bd-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Multiple vulnerabilities in OpenSSL</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.1</ge><lt>13.1_7</lt></range>
<range><ge>12.4</ge><lt>12.4_2</lt></range>
<range><ge>12.3</ge><lt>12.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2>
<p>There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.</p>
<h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2>
<p>A timing based side channel exists in the OpenSSL RSA Decryption
implementation.</p>
<h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2>
<p>The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support
the SMIME, CMS and PKCS7 streaming capabilities, but may also be called
directly by end user applications.</p>
<p>The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter
BIO onto the front of it to form a BIO chain, and then returns the new head
of the BIO chain to the caller. Under certain conditions, for example if a
CMS recipient public key is invalid, the new filter BIO is freed and the
function returns a NULL result indicating a failure. However, in this case,
the BIO chain is not properly cleaned up and the BIO passed by the caller
still retains internal pointers to the previously freed filter BIO.</p>
<h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2>
<p>The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload
data. If the function succeeds then the "name_out", "header" and "data"
arguments are populated with pointers to buffers containing the relevant
decoded data. The caller is responsible for freeing those buffers. It is
possible to construct a PEM file that results in 0 bytes of payload data. In
this case PEM_read_bio_ex() will return a failure code but will populate the
header argument with a pointer to a buffer that has already been freed.</p>
<h1>Impact:</h1>
<h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2>
<p>When CRL checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass
arbitrary pointers to a memcmp call, enabling them to read memory contents or
enact a denial of service. In most cases, the attack requires the attacker to
provide both the certificate chain and CRL, neither of which need to have a
valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which
is uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for retrieving CRLs
over a network.</p>
<h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2>
<p>A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.</p>
<h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2>
<p>A use-after-free will occur under certain conditions. This will most likely
result in a crash.</p>
<h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2>
<p>A double free may occur. This will most likely lead to a crash. This could be
exploited by an attacker who has the ability to supply malicious PEM files
for parsing to achieve a denial of service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2023-0286</cvename>
<cvename>CVE-2023-0215</cvename>
<cvename>CVE-2022-4450</cvename>
<cvename>CVE-2022-4304</cvename>
<freebsdsa>SA-23:03.openssl</freebsdsa>
</references>
<dates>
<discovery>2023-02-16</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="09b7cd39-47bd-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- OpenSSH pre-authentication double free</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.4</ge><lt>12.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A flaw in the backwards-compatibility key exchange route allows a
pointer to be freed twice.</p>
<h1>Impact:</h1>
<p>A remote, unauthenticated attacker may be able to cause a denial of
service, or possibly remote code execution.</p>
<p>Note that FreeBSD 12.3 and FreeBSD 13.1 include older versions of
OpenSSH, and are not affected. FreeBSD 13.2-BETA1 and later include the
fix.</p>
</body>
</description>
<references>
<cvename>CVE-2023-25136</cvename>
<freebsdsa>SA-23:02.openssh</freebsdsa>
</references>
<dates>
<discovery>2023-02-16</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="3fcab88b-47bc-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- GELI silently omits the keyfile if read from stdin</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.1</ge><lt>13.1_6</lt></range>
<range><ge>12.4</ge><lt>12.4_1</lt></range>
<range><ge>12.3</ge><lt>12.3_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When GELI reads a key file from a standard input, it doesn't store it
anywhere. If the user tries to initialize multiple providers at once,
for the second and subsequent devices the standard input stream will be
already empty. In this case, GELI silently uses a NULL key as the user
key file. If the user used only a key file without a user passphrase,
the master key was encrypted with an empty key file. This might not be
noticed if the devices were also decrypted in a batch operation.</p>
<h1>Impact:</h1>
<p>Some GELI providers might be silently encrypted with a NULL key
file.</p>
</body>
</description>
<references>
<cvename>CVE-2023-0751</cvename>
<freebsdsa>SA-23:01.geli</freebsdsa>
</references>
<dates>
<discovery>2023-02-08</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="a005aea9-47bb-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Stack overflow in ping(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.1</ge><lt>13.1_5</lt></range>
<range><ge>12.3</ge><lt>12.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>ping reads raw IP packets from the network to process responses in
the pr_pack() function. As part of processing a response ping has to
reconstruct the IP header, the ICMP header and if present a "quoted
packet," which represents the packet that generated an ICMP error.
The quoted packet again has an IP header and an ICMP header.</p>
<p>The pr_pack() copies received IP and ICMP headers into stack buffers
for further processing. In so doing, it fails to take into account the
possible presence of IP option headers following the IP header in either
the response or the quoted packet. When IP options are present,
pr_pack() overflows the destination buffer by up to 40 bytes.</p>
<h1>Impact:</h1>
<p>The memory safety bugs described above can be triggered by a remote
host, causing the ping program to crash.</p>
<p>The ping process runs in a capability mode sandbox on all affected
versions of FreeBSD and is thus very constrained in how it can interact
with the rest of the system at the point where the bug can occur.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23093</cvename>
<freebsdsa>SA-22:15.ping</freebsdsa>
</references>
<dates>
<discovery>2022-11-29</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="97c1b0f7-47b9-11ee-8e38-002590c1f29c">
<topic>FreeBSD -- Multiple vulnerabilities in Heimdal</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.1</ge><lt>13.1_4</lt></range>
<range><ge>12.3</ge><lt>12.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple security vulnerabilities have been discovered in the Heimdal
implementation of the Kerberos 5 network authentication
protocols and KDC.</p>
<ul>
<li>CVE-2022-42898 PAC parse integer overflows</li>
<li>CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour</li>
<li>CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors</li>
<li>CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec</li>
<li>CVE-2019-14870 Validate client attributes in protocol-transition</li>
<li>CVE-2019-14870 Apply forwardable policy in protocol-transition</li>
<li>CVE-2019-14870 Always lookup impersonate client in DB</li>
</ul>
<h1>Impact:</h1>
<p>A malicious actor with control of the network between a client and a
service using Kerberos for authentication can impersonate either the
client or the service, enabling a man-in-the-middle (MITM) attack
circumventing mutual authentication.</p>
<p>Note that, while CVE-2022-44640 is a severe vulnerability, possibly
enabling remote code execution on other platforms, the version of
Heimdal included with the FreeBSD base system cannot be exploited in
this way on FreeBSD.</p>
</body>
</description>
<references>
<cvename>CVE-2019-14870</cvename>
<cvename>CVE-2021-44758</cvename>
<cvename>CVE-2022-3437</cvename>
<cvename>CVE-2022-42898</cvename>
<cvename>CVE-2022-44640</cvename>
<freebsdsa>SA-22:14.heimdal</freebsdsa>
</references>
<dates>
<discovery>2022-11-15</discovery>
<entry>2023-08-31</entry>
</dates>
</vuln>
<vuln vid="22fffa69-46fa-11ee-8290-a8a1599412c6">
<topic>chromium -- use after free in MediaStream</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>116.0.5845.140</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>116.0.5845.140</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html">
<p>This update includes 1 security fix:</p>
<ul>
<li>[1472492] High CVE-2023-4572: Use after free in MediaStream. Reported by fwnfwn(@_fwnfwn) on 2023-08-12</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4472</cvename>
<url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2023-08-29</discovery>
<entry>2023-08-30</entry>
</dates>
</vuln>
<vuln vid="36a37c92-44b1-11ee-b091-6162c1274384">
<topic>gitea -- information disclosure</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.20.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/25097">
<p>Fix API leaking Usermail if not logged in</p>
<p>The API should only return the real Mail of a User, if the
caller is logged in. The check do to this don't work. This PR
fixes this. This not really a security issue, but can lead to
Spam.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.20.3</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.20.3</url>
</references>
<dates>
<discovery>2023-06-06</discovery>
<entry>2023-08-27</entry>
</dates>
</vuln>
<vuln vid="5fa332b9-4269-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>116.0.5845.110</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>116.0.5845.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[1469542] High CVE-2023-4430: Use after free in Vulkan. Reported by Cassidy Kim(@cassidy6564) on 2023-08-02</li>
<li>[1469754] High CVE-2023-4429: Use after free in Loader. Reported by Anonymous on 2023-08-03</li>
<li>[1470477] High CVE-2023-4428: Out of bounds memory access in CSS. Reported by Francisco Alonso (@revskills) on 2023-08-06</li>
<li>[1470668] High CVE-2023-4427: Out of bounds memory access in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-08-07</li>
<li>[1469348] Medium CVE-2023-4431: Out of bounds memory access in Fonts. Reported by Microsoft Security Researcher on 2023-08-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4430</cvename>
<cvename>CVE-2023-4429</cvename>
<cvename>CVE-2023-4428</cvename>
<cvename>CVE-2023-4427</cvename>
<cvename>CVE-2023-4431</cvename>
<url>https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html</url>
</references>
<dates>
<discovery>2023-08-22</discovery>
<entry>2023-08-24</entry>
</dates>
</vuln>
<vuln vid="5999fc39-72d0-4b99-851c-ade7ff7125c3">
<topic>electron25 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron25</name>
<range><lt>25.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v25.7.0">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4071.</li>
<li>Security: backported fix for CVE-2023-4070.</li>
<li>Security: backported fix for CVE-2023-4075.</li>
<li>Security: backported fix for CVE-2023-4076.</li>
<li>Security: backported fix for CVE-2023-4074.</li>
<li>Security: backported fix for CVE-2023-4072.</li>
<li>Security: backported fix for CVE-2023-4068.</li>
<li>Security: backported fix for CVE-2023-4073.</li>
<li>Security: backported fix for CVE-2023-4355.</li>
<li>Security: backported fix for CVE-2023-4354.</li>
<li>Security: backported fix for CVE-2023-4353.</li>
<li>Security: backported fix for CVE-2023-4351.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4071</cvename>
<url>https://github.com/advisories/GHSA-qc3g-vp59-7vwh</url>
<cvename>CVE-2023-4070</cvename>
<url>https://github.com/advisories/GHSA-9xxv-mx64-rx27</url>
<cvename>CVE-2023-4075</cvename>
<url>https://github.com/advisories/GHSA-7332-j628-x48x</url>
<cvename>CVE-2023-4076</cvename>
<url>https://github.com/advisories/GHSA-7rfc-cwhj-x2qv</url>
<cvename>CVE-2023-4074</cvename>
<url>https://github.com/advisories/GHSA-6j3m-7hm6-qjrx</url>
<cvename>CVE-2023-4072</cvename>
<url>https://github.com/advisories/GHSA-9j4r-qr47-rcxp</url>
<cvename>CVE-2023-4068</cvename>
<url>https://github.com/advisories/GHSA-wh89-h5f7-hhcr</url>
<cvename>CVE-2023-4073</cvename>
<url>https://github.com/advisories/GHSA-g9wf-6ppg-937x</url>
<cvename>CVE-2023-4355</cvename>
<url>https://github.com/advisories/GHSA-xrw8-8992-37w4</url>
<cvename>CVE-2023-4354</cvename>
<url>https://github.com/advisories/GHSA-rq4v-7hxq-wpm5</url>
<cvename>CVE-2023-4353</cvename>
<url>https://github.com/advisories/GHSA-mjq9-8vf6-qh49</url>
<cvename>CVE-2023-4351</cvename>
<url>https://github.com/advisories/GHSA-mh2g-52mr-mr5v</url>
</references>
<dates>
<discovery>2023-08-23</discovery>
<entry>2023-08-24</entry>
</dates>
</vuln>
<vuln vid="99bc2966-55be-4411-825f-b04017a4c100">
<topic>electron{22,24} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.22</lt></range>
</package>
<package>
<name>electron24</name>
<range><lt>24.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.22">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-4355.</li>
<li>Security: backported fix for CVE-2023-4354.</li>
<li>Security: backported fix for CVE-2023-4353.</li>
<li>Security: backported fix for CVE-2023-4352.</li>
<li>Security: backported fix for CVE-2023-4351.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4355</cvename>
<url>https://github.com/advisories/GHSA-xrw8-8992-37w4</url>
<cvename>CVE-2023-4354</cvename>
<url>https://github.com/advisories/GHSA-rq4v-7hxq-wpm5</url>
<cvename>CVE-2023-4353</cvename>
<url>https://github.com/advisories/GHSA-mjq9-8vf6-qh49</url>
<cvename>CVE-2023-4352</cvename>
<url>https://github.com/advisories/GHSA-vp8r-986v-6qj4</url>
<cvename>CVE-2023-4351</cvename>
<url>https://github.com/advisories/GHSA-mh2g-52mr-mr5v</url>
</references>
<dates>
<discovery>2023-08-23</discovery>
<entry>2023-08-24</entry>
</dates>
</vuln>
<vuln vid="ddd3fcc9-2bdd-11ee-9af4-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq-php80</name>
<name>phpmyfaq-php81</name>
<name>phpmyfaq-php82</name>
<name>phpmyfaq-php83</name>
<range><lt>3.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-07-16">
<p>Cross Site Scripting vulnerability</p>
<p>CSV injection vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/e891dcbc-2092-49d3-9518-23e37187a5ea/</url>
<url>https://huntr.dev/bounties/36149a42-cbd5-445e-a371-e351c899b189/</url>
</references>
<dates>
<discovery>2023-07-16</discovery>
<entry>2023-08-23</entry>
</dates>
</vuln>
<vuln vid="5666688f-803b-4cf0-9cb1-08c088f2225a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>116.0.5845.96</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>116.0.5845.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html">
<p>This update includes 26 security fixes:</p>
<ul>
<li>[1448548] High CVE-2023-2312: Use after free in Offline. Reported by avaue at S.S.L. on 2023-05-24</li>
<li>[1458303] High CVE-2023-4349: Use after free in Device Trust Connectors. Reported by Weipeng Jiang (@Krace) of VRI on 2023-06-27</li>
<li>[1454817] High CVE-2023-4350: Inappropriate implementation in Fullscreen. Reported by Khiem Tran (@duckhiem) on 2023-06-14</li>
<li>[1465833] High CVE-2023-4351: Use after free in Network. Reported by Guang and Weipeng Jiang of VRI on 2023-07-18</li>
<li>[1452076] High CVE-2023-4352: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-06-07</li>
<li>[1458046] High CVE-2023-4353: Heap buffer overflow in ANGLE. Reported by Christoph Diehl / Microsoft Vulnerability Research on 2023-06-27</li>
<li>[1464215] High CVE-2023-4354: Heap buffer overflow in Skia. Reported by Mark Brand of Google Project Zero on 2023-07-12</li>
<li>[1468943] High CVE-2023-4355: Out of bounds memory access in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-07-31</li>
<li>[1449929] Medium CVE-2023-4356: Use after free in Audio. Reported by Zhenghang Xiao (@Kipreyyy) on 2023-05-30</li>
<li>[1458911] Medium CVE-2023-4357: Insufficient validation of untrusted input in XML. Reported by Igor Sak-Sakovskii on 2023-06-28</li>
<li>[1466415] Medium CVE-2023-4358: Use after free in DNS. Reported by Weipeng Jiang (@Krace) of VRI on 2023-07-20</li>
<li>[1443722] Medium CVE-2023-4359: Inappropriate implementation in App Launcher. Reported by @retsew0x01 on 2023-05-09</li>
<li>[1462723] Medium CVE-2023-4360: Inappropriate implementation in Color. Reported by Axel Chong on 2023-07-07</li>
<li>[1465230] Medium CVE-2023-4361: Inappropriate implementation in Autofill. Reported by Thomas Orlita on 2023-07-17</li>
<li>[1316379] Medium CVE-2023-4362: Heap buffer overflow in Mojom IDL. Reported by Zhao Hai of NanJing Cyberpeace TianYu Lab on 2022-04-14</li>
<li>[1367085] Medium CVE-2023-4363: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2022-09-23</li>
<li>[1406922] Medium CVE-2023-4364: Inappropriate implementation in Permission Prompts. Reported by Jasper Rebane on 2023-01-13</li>
<li>[1431043] Medium CVE-2023-4365: Inappropriate implementation in Fullscreen. Reported by Hafiizh on 2023-04-06</li>
<li>[1450784] Medium CVE-2023-4366: Use after free in Extensions. Reported by asnine on 2023-06-02</li>
<li>[1467743] Medium CVE-2023-4367: Insufficient policy enforcement in Extensions API. Reported by Axel Chong on 2023-07-26</li>
<li>[1467751] Medium CVE-2023-4368: Insufficient policy enforcement in Extensions API. Reported by Axel Chong on 2023-07-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2312</cvename>
<cvename>CVE-2023-4349</cvename>
<cvename>CVE-2023-4350</cvename>
<cvename>CVE-2023-4351</cvename>
<cvename>CVE-2023-4352</cvename>
<cvename>CVE-2023-4353</cvename>
<cvename>CVE-2023-4354</cvename>
<cvename>CVE-2023-4355</cvename>
<cvename>CVE-2023-4356</cvename>
<cvename>CVE-2023-4357</cvename>
<cvename>CVE-2023-4358</cvename>
<cvename>CVE-2023-4359</cvename>
<cvename>CVE-2023-4360</cvename>
<cvename>CVE-2023-4361</cvename>
<cvename>CVE-2023-4362</cvename>
<cvename>CVE-2023-4363</cvename>
<cvename>CVE-2023-4364</cvename>
<cvename>CVE-2023-4365</cvename>
<cvename>CVE-2023-4366</cvename>
<cvename>CVE-2023-4367</cvename>
<cvename>CVE-2023-4368</cvename>
<url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2023-08-15</discovery>
<entry>2023-08-17</entry>
</dates>
</vuln>
<vuln vid="759a5599-3ce8-11ee-a0d1-84a93843eb75">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-client57</name>
<range><lt>5.7.43</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.43</lt></range>
</package>
<package>
<name>mysql-client80</name>
<range><lt>8.0.34</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL">
<p>This Critical Patch Update contains 24 new security patches for Oracle
MySQL. 11 of these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without requiring
user credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4899</cvename>
<cvename>CVE-2023-0361</cvename>
<cvename>CVE-2022-4899</cvename>
<cvename>CVE-2022-4899</cvename>
<cvename>CVE-2023-22053</cvename>
<cvename>CVE-2023-22008</cvename>
<cvename>CVE-2023-22046</cvename>
<cvename>CVE-2023-22054</cvename>
<cvename>CVE-2023-22056</cvename>
<cvename>CVE-2023-21950</cvename>
<cvename>CVE-2023-22007</cvename>
<cvename>CVE-2023-22057</cvename>
<cvename>CVE-2023-22033</cvename>
<cvename>CVE-2023-22058</cvename>
<cvename>CVE-2023-22005</cvename>
<cvename>CVE-2023-22048</cvename>
<cvename>CVE-2023-22038</cvename>
<url>https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-08-17</entry>
</dates>
</vuln>
<vuln vid="8e561cfe-3c59-11ee-b32e-080027f5fec9">
<topic>clamav -- Possible denial of service vulnerability in the AutoIt file parser</topic>
<affects>
<package>
<name>clamav-lts</name>
<range><lt>1.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ClamAV project reports:</p>
<blockquote cite="https://blog.clamav.net/2023/07/2023-08-16-releases.html">
<p>
There is a possible denial of service vulnerability in the
AutoIt file parser.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-20212</cvename>
<url>https://blog.clamav.net/2023/07/2023-08-16-releases.html</url>
</references>
<dates>
<discovery>2023-08-15</discovery>
<entry>2023-08-16</entry>
</dates>
</vuln>
<vuln vid="51a59f36-3c58-11ee-b32e-080027f5fec9">
<topic>clamav -- Possible denial of service vulnerability in the HFS+ file parser</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>1.1.1,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><lt>1.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Smith reports:</p>
<blockquote cite="https://blog.clamav.net/2023/07/2023-08-16-releases.html">
<p>
There is a possible denial of service vulnerability in the
HFS+ file parser.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-20197</cvename>
<url>https://blog.clamav.net/2023/07/2023-08-16-releases.html</url>
</references>
<dates>
<discovery>2023-08-15</discovery>
<entry>2023-08-16</entry>
</dates>
</vuln>
<vuln vid="a6986f0f-3ac0-11ee-9a88-206a8a720317">
<topic>krb5 -- Double-free in KDC TGS processing</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.21.1_1</lt></range>
</package>
<package>
<name>krb5-121</name>
<range><lt>1.21.1_1</lt></range>
</package>
<package>
<name>krb5-devel</name>
<range><lt>1.22.2023.08.07</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840">
<p>When issuing a ticket for a TGS renew or validate request, copy
only the server field from the outer part of the header ticket
to the new ticket. Copying the whole structure causes the
enc_part pointer to be aliased to the header ticket until
krb5_encrypt_tkt_part() is called, resulting in a double-free
if handle_authdata() fails..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39975</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39975</url>
</references>
<dates>
<discovery>2023-08-07</discovery>
<entry>2023-08-14</entry>
</dates>
</vuln>
<vuln vid="b1ac663f-3aa9-11ee-b887-b42e991fc52e">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-11-php80</name>
<name>typo3-11-php81</name>
<range><lt>11.5.30</lt></range>
</package>
<package>
<name>typo3-12-php80</name>
<name>typo3-12-php81</name>
<range><lt>12.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 reports:</p>
<blockquote cite="https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published">
<p>TYPO3-CORE-SA-2023-002: By-passing Cross-Site Scripting Protection in HTML Sanitizer</p>
<p>TYPO3-CORE-SA-2023-003: Information Disclosure due to Out-of-scope Site Resolution</p>
<p>TYPO3-CORE-SA-2023-004: Cross-Site Scripting in CKEditor4 WordCount Plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-38500</cvename>
<cvename>CVE-2023-38499</cvename>
<cvename>CVE-2023-37905</cvename>
<url>https://typo3.org/article/typo3-1244-and-11530-security-releases-published</url>
</references>
<dates>
<discovery>2023-07-25</discovery>
<entry>2023-08-14</entry>
</dates>
</vuln>
<vuln vid="59a43a73-3786-11ee-94b4-6cc21735f730">
<topic>postgresql-server -- MERGE fails to enforce UPDATE or SELECT row security policies</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>15.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-39418/">
<p>
PostgreSQL 15 introduced the MERGE command, which fails to test
new rows against row security policies defined for UPDATE and
SELECT. If UPDATE and SELECT policies forbid some row that
INSERT policies do not forbid, a user could store such rows.
Subsequent consequences are application-dependent. This
affects only databases that have used CREATE POLICY to define
a row security policy.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39418</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-39418/</url>
</references>
<dates>
<discovery>2023-08-10</discovery>
<entry>2023-08-10</entry>
</dates>
</vuln>
<vuln vid="cfd2a634-3785-11ee-94b4-6cc21735f730">
<topic>postgresql-server -- Extension script @substitutions@ within quoting allow SQL injection</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>11.21</lt></range>
<range><lt>12.16</lt></range>
<range><lt>13.12</lt></range>
<range><lt>14.9</lt></range>
<range><lt>15.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-39417/">
<p>
An extension script is vulnerable if it uses @extowner@,
@extschema@, or @extschema:...@ inside a quoting construct
(dollar quoting, '', or ""). No bundled extension is
vulnerable. Vulnerable uses do appear in a documentation
example and in non-bundled extensions. Hence, the attack
prerequisite is an administrator having installed files of a
vulnerable, trusted, non-bundled extension. Subject to that
prerequisite, this enables an attacker having database-level
CREATE privilege to execute arbitrary code as the bootstrap
superuser. PostgreSQL will block this attack in the core
server, so there's no need to modify individual extensions.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39417</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-39417/</url>
</references>
<dates>
<discovery>2023-08-10</discovery>
<entry>2023-08-10</entry>
</dates>
</vuln>
<vuln vid="f3a35fb8-2d70-47c9-a516-6aad7eb222b1">
<topic>electron{22,23,24,25} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.20</lt></range>
</package>
<package>
<name>electron23</name>
<range><lt>23.3.12</lt></range>
</package>
<package>
<name>electron24</name>
<range><lt>24.7.0</lt></range>
</package>
<package>
<name>electron25</name>
<range><lt>25.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.12">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3732.</li>
<li>Security: backported fix for CVE-2023-3728.</li>
<li>Security: backported fix for CVE-2023-3730.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3732</cvename>
<url>https://github.com/advisories/GHSA-6f46-9vvr-v3j5</url>
<cvename>CVE-2023-3728</cvename>
<url>https://github.com/advisories/GHSA-fxgf-5cm8-2f8q</url>
<cvename>CVE-2023-3730</cvename>
<url>https://github.com/advisories/GHSA-2gmm-4f9j-mw4p</url>
</references>
<dates>
<discovery>2023-08-02</discovery>
<entry>2023-08-07</entry>
<modified>2023-08-11</modified>
</dates>
</vuln>
<vuln vid="441e1e1a-27a5-11ee-a156-080027f5fec9">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba416</name>
<range><lt>4.16.11</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.17_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.18.5">
<dl>
<dt>CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion DoS Vulnerability</dt>
<dd>
When parsing Spotlight mdssvc RPC packets, one encoded
data structure is a key-value style dictionary where
keys are character strings and values can be any of
the supported types in the mdssvc protocol. Due to a
lack of type checking in callers of the function
dalloc_value_for_key(), which returns the object
associated with a key, a caller may trigger a crash in
talloc_get_size() when talloc detects that the passed in
pointer is not a valid talloc pointer. As RPC worker
processes are shared among multiple client connections,
a malicious client can crash the worker process
affecting all other clients that are also served by this
worker.
</dd>
<dt>CVE-2022-2127: Out-Of-Bounds read in winbind AUTH_CRAP</dt>
<dd>
When doing NTLM authentication, the client sends replies
to cryptographic challenges back to the server. These
replies have variable length. Winbind did not properly
bounds-check the lan manager response length, which
despite the lan manager version no longer being used is
still part of the protocol. If the system is running
Samba's ntlm_auth as authentication backend for services
like Squid (or a very unusual configuration with
FreeRADIUS), the vulnarebility is remotely exploitable.
If not so configured, or to exploit this vulnerability
locally, the user must have access to the privileged
winbindd UNIX domain socket (a subdirectory with name
'winbindd_privileged' under "state directory", as set in
the smb.conf). This access is normally only given so
special system services like Squid or FreeRADIUS, use
this feature.
</dd>
<dt>CVE-2023-34968: Spotlight server-side Share Path Disclosure</dt>
<dd>
As part of the Spotlight protocol, the initial request
returns a path associated with the sharename targeted by
the RPC request. Samba returns the real server-side
share path at this point, as well as returning the
absolute server-side path of results in search queries
by clients. Known server side paths could be used to
mount subsequent more serious security attacks or could
disclose confidential information that is part of the
path. To mitigate the issue, Samba will replace the
real server-side path with a fake path constructed from
the sharename.
</dd>
<dt>CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop DoS Vulnerability</dt>
<dd>
When parsing Spotlight mdssvc RPC packets sent by the
client, the core unmarshalling function sl_unpack_loop()
did not validate a field in the network packet that
contains the count of elements in an array-like
structure. By passing 0 as the count value, the attacked
function will run in an endless loop consuming 100% CPU.
This bug only affects servers where Spotlight is
explicitly enabled globally or on individual shares with
"spotlight = yes".
</dd>
<dt>CVE-2023-3347: SMB2 packet signing not enforced</dt>
<dd>
SMB2 packet signing is not enforced if an admin
configured "server signing = required" or for SMB2
connections to Domain Controllers where SMB2 packet
signing is mandatory. SMB2 packet signing is a
mechanism that ensures the integrity and authenticity of
data exchanged between a client and a server using the
SMB2 protocol. It provides protection against certain
types of attacks, such as man-in-the-middle attacks,
where an attacker intercepts network traffic and
modifies the SMB2 messages. Both client and server of
an SMB2 connection can require that signing is being
used. The server-side setting in Samba to configure
signing to be required is "server signing = required".
Note that on an Samba AD DCs this is also the default
for all SMB2 connections. Unless the client requires
signing which would result in signing being used on the
SMB2 connection, sensitive data might have been modified
by an attacker. Clients connecting to IPC$ on an AD DC
will require signed connections being used, so the
integrity of these connections was not affected.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-34967</cvename>
<cvename>CVE-2022-2127</cvename>
<cvename>CVE-2023-34968</cvename>
<cvename>CVE-2023-34966</cvename>
<cvename>CVE-2023-3347</cvename>
<url>https://www.samba.org/samba/security/CVE-2023-34967.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-2127.html</url>
<url>https://www.samba.org/samba/security/CVE-2023-34968.html</url>
<url>https://www.samba.org/samba/security/CVE-2023-34966.html</url>
<url>https://www.samba.org/samba/security/CVE-2023-3347.html</url>
</references>
<dates>
<discovery>2023-07-19</discovery>
<entry>2023-08-05</entry>
</dates>
</vuln>
<vuln vid="6e4e8e87-9fb8-4e32-9f8e-9b4303f4bfd5">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>115.0.5790.170</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>115.0.5790.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html">
<p>This update includes 17 security fixes:</p>
<ul>
<li>[1466183] High CVE-2023-4068: Type Confusion in V8. Reported by Jerry on 2023-07-20</li>
<li>[1465326] High CVE-2023-4069: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-07-17</li>
<li>[1462951] High CVE-2023-4070: Type Confusion in V8. Reported by Jerry on 2023-07-07</li>
<li>[1458819] High CVE-2023-4071: Heap buffer overflow in Visuals. Reported by Guang and Weipeng Jiang of VRI on 2023-06-28</li>
<li>[1464038] High CVE-2023-4072: Out of bounds read and write in WebGL. Reported by Apple Security Engineering and Architecture (SEAR) on 2023-07-12</li>
<li>[1456243] High CVE-2023-4073: Out of bounds memory access in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-06-20</li>
<li>[1464113] High CVE-2023-4074: Use after free in Blink Task Scheduling. Reported by Anonymous on 2023-07-12</li>
<li>[1457757] High CVE-2023-4075: Use after free in Cast. Reported by Cassidy Kim(@cassidy6564) on 2023-06-25</li>
<li>[1459124] High CVE-2023-4076: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2023-06-29</li>
<li>[1451146] Medium CVE-2023-4077: Insufficient data validation in Extensions. Reported by Anonymous on 2023-06-04</li>
<li>[1461895] Medium CVE-2023-4078: Inappropriate implementation in Extensions. Reported by Anonymous on 2023-07-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-4068</cvename>
<cvename>CVE-2023-4069</cvename>
<cvename>CVE-2023-4070</cvename>
<cvename>CVE-2023-4071</cvename>
<cvename>CVE-2023-4072</cvename>
<cvename>CVE-2023-4073</cvename>
<cvename>CVE-2023-4074</cvename>
<cvename>CVE-2023-4075</cvename>
<cvename>CVE-2023-4076</cvename>
<cvename>CVE-2023-4077</cvename>
<cvename>CVE-2023-4078</cvename>
<url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-08-02</discovery>
<entry>2023-08-04</entry>
</dates>
</vuln>
<vuln vid="78f2e491-312d-11ee-85f2-bd89b893fcb4">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go119</name>
<range><lt>1.19.12</lt></range>
</package>
<package>
<name>go120</name>
<range><lt>1.20.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://groups.google.com/u/1/g/golang-announce/c/X0b6CsSAaYI">
<p>crypto/tls: restrict RSA keys in certificates to <= 8192 bits</p>
<p>Extremely large RSA keys in certificate chains can cause
a client/server to expend significant CPU time verifying
signatures. Limit this by restricting the size of RSA keys
transmitted during handshakes to <= 8192 bits. </p>
</blockquote>
<blockquote cite="https://go.dev/issue/60374">
<p>net/http: insufficient sanitization of Host header</p>
<p>The HTTP/1 client did not fully validate the contents of
the Host header. A maliciously crafted Host header could
inject additional headers or entire requests. The HTTP/1
client now refuses to send requests containing an
invalid Request.Host or Request.URL.Host value.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/60167">
<p>cmd/go: cgo code injection</p>
<p>The go command may generate unexpected code at build
time when using cgo. This may result in unexpected
behavior when running a go program which uses cgo.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/60272">
<p>runtime: unexpected behavior of setuid/setgid binaries</p>
<p>The Go runtime didn't act any differently when a binary
had the setuid/setgid bit set. On Unix platforms, if a
setuid/setgid binary was executed with standard I/O file
descriptors closed, opening any files could result in
unexpected content being read/written with elevated
prilieges. Similarly if a setuid/setgid program was
terminated, either via panic or signal, it could leak the
contents of its registers.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/60305">
<p>cmd/go: improper sanitization of LDFLAGS</p>
<p>The go command may execute arbitrary code at build time
when using cgo. This may occur when running "go get" on a
malicious module, or when running any other command which
builds untrusted code. This is can by triggered by linker
flags, specified via a "#cgo LDFLAGS" directive.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/59720">
<p>html/template: improper sanitization of CSS values</p>
<p>
Angle brackets (<>) were not considered dangerous
characters when inserted into CSS contexts. Templates
containing multiple actions separated by a '/' character
could result in unexpectedly closing the CSS context and
allowing for injection of unexpected HMTL, if executed
with untrusted input.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/59721">
<p>html/template: improper handling of JavaScript whitespace</p>
<p>
Not all valid JavaScript whitespace characters were
considered to be whitespace. Templates containing
whitespace characters outside of the character set
"\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that
also contain actions may not be properly sanitized
during execution.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/59722">
<p>html/template: improper handling of empty HTML attributes</p>
<p>
Templates containing actions in unquoted HTML attributes
(e.g. "attr={{.}}") executed with empty input could
result in output that would have unexpected results when
parsed due to HTML normalization rules. This may allow
injection of arbitrary attributes into tags.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-29406</cvename>
<cvename>CVE-2023-29402</cvename>
<cvename>CVE-2023-29403</cvename>
<cvename>CVE-2023-29404</cvename>
<cvename>CVE-2023-24539</cvename>
<cvename>CVE-2023-24540</cvename>
<cvename>CVE-2023-29400</cvename>
<url>https://groups.google.com/u/1/g/golang-announce/c/X0b6CsSAaYI</url>
<url>https://groups.google.com/u/1/g/golang-announce/c/2q13H6LEEx0</url>
<url>https://groups.google.com/u/1/g/golang-announce/c/q5135a9d924</url>
<url>https://groups.google.com/u/1/g/golang-announce/c/MEb0UyuSMsU</url>
</references>
<dates>
<discovery>2023-04-27</discovery>
<entry>2023-08-02</entry>
</dates>
</vuln>
<vuln vid="fa239535-30f6-11ee-aef9-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.2.0</ge><lt>16.2.2</lt></range>
<range><ge>16.1.0</ge><lt>16.1.3</lt></range>
<range><ge>9.3.0</ge><lt>16.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/">
<p>ReDoS via ProjectReferenceFilter in any Markdown fields</p>
<p>ReDoS via AutolinkFilter in any Markdown fields</p>
<p>Regex DoS in Harbor Registry search</p>
<p>Arbitrary read of files owned by the "git" user via malicious tar.gz file upload using GitLab export functionality</p>
<p>Stored XSS in Web IDE Beta via crafted URL</p>
<p>securityPolicyProjectAssign mutation does not authorize security policy project ID</p>
<p>An attacker can run pipeline jobs as arbitrary user</p>
<p>Possible Pages Unique Domain Overwrite</p>
<p>Access tokens may have been logged when a query was made to an endpoint</p>
<p>Reflected XSS via PlantUML diagram</p>
<p>The main branch of a repository with a specially designed name may allow an attacker to create repositories with malicious code</p>
<p>Invalid 'start_sha' value on merge requests page may lead to Denial of Service</p>
<p>Developers can create pipeline schedules on protected branches even if they don't have access to merge</p>
<p>Potential DOS due to lack of pagination while loading license data</p>
<p>Leaking emails of newly created users</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3994</cvename>
<cvename>CVE-2023-3364</cvename>
<cvename>CVE-2023-0632</cvename>
<cvename>CVE-2023-3385</cvename>
<cvename>CVE-2023-2164</cvename>
<cvename>CVE-2023-4002</cvename>
<cvename>CVE-2023-4008</cvename>
<cvename>CVE-2023-3993</cvename>
<cvename>CVE-2023-3500</cvename>
<cvename>CVE-2023-3401</cvename>
<cvename>CVE-2023-3900</cvename>
<cvename>CVE-2023-2022</cvename>
<cvename>CVE-2023-4011</cvename>
<cvename>CVE-2023-1210</cvename>
<url>https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/</url>
</references>
<dates>
<discovery>2023-08-01</discovery>
<entry>2023-08-02</entry>
</dates>
</vuln>
<vuln vid="bad6588e-2fe0-11ee-a0d1-84a93843eb75">
<topic>OpenSSL -- Excessive time spent checking DH q parameter value</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1u_1,1</lt></range>
</package>
<package>
<name>openssl30</name>
<range><lt>3.0.9_2</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230731.txt">
<p>Checking excessively long DH keys or parameters may be very slow
(severity: Low).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3817</cvename>
<url>https://www.openssl.org/news/secadv/20230731.txt</url>
</references>
<dates>
<discovery>2023-07-31</discovery>
<entry>2023-07-31</entry>
</dates>
</vuln>
<vuln vid="a0321b74-031d-485c-bb76-edd75256a6f0">
<topic>jenkins -- Stored XSS vulnerability</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.416</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.401.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2023-07-26/">
<h1>Description</h1>
<h5>(High) SECURITY-3188 / CVE-2023-39151</h5>
<p>Stored XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-39151</cvename>
<url>https://www.jenkins.io/security/advisory/2023-07-26/</url>
</references>
<dates>
<discovery>2023-07-26</discovery>
<entry>2023-07-26</entry>
</dates>
</vuln>
<vuln vid="ab0bab3c-2927-11ee-8608-07b8d3947721">
<topic>gitea -- Disallow dangerous URL schemes</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/25960">
<p>Disallow javascript, vbscript and data (data uri images still
work) url schemes even if all other schemes are allowed</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.20.1</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.20.1</url>
</references>
<dates>
<discovery>2023-06-18</discovery>
<entry>2023-07-23</entry>
</dates>
</vuln>
<vuln vid="887eb570-27d3-11ee-adba-c80aa9043978">
<topic>OpenSSH -- remote code execution via a forwarded agent socket</topic>
<affects>
<package>
<name>openssh-portable</name>
<name>openssh-portable-hpn</name>
<name>openssh-portable-gssapi</name>
<range><lt>9.3.p2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSH project reports:</p>
<blockquote cite="https://www.openssh.com/txt/release-9.3p2">
<p>Fix CVE-2023-38408 - a condition where specific libaries loaded via
ssh-agent(1)'s PKCS#11 support could be abused to achieve remote
code execution via a forwarded agent socket if the following
conditions are met:
* Exploitation requires the presence of specific libraries on
the victim system.
* Remote exploitation requires that the agent was forwarded
to an attacker-controlled system.
Exploitation can also be prevented by starting ssh-agent(1) with an
empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring
an allowlist that contains only specific provider libraries.
This vulnerability was discovered and demonstrated to be exploitable
by the Qualys Security Advisory team.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-38408</cvename>
<url>https://www.openssh.com/txt/release-9.3p2</url>
</references>
<dates>
<discovery>2023-07-19</discovery>
<entry>2023-07-21</entry>
</dates>
</vuln>
<vuln vid="2f22927f-26ea-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>115.0.5790.98</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>115.0.5790.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html">
<p>This update includes 20 security fixes:</p>
<ul>
<li>[1454086] High CVE-2023-3727: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-06-12</li>
<li>[1457421] High CVE-2023-3728: Use after free in WebRTC. Reported by Zhenghang Xiao (@Kipreyyy) on 2023-06-23</li>
<li>[1453465] High CVE-2023-3730: Use after free in Tab Groups. Reported by @ginggilBesel on 2023-06-09</li>
<li>[1450899] High CVE-2023-3732: Out of bounds memory access in Mojo. Reported by Mark Brand of Google Project Zero on 2023-06-02</li>
<li>[1450203] Medium CVE-2023-3733: Inappropriate implementation in WebApp Installs. Reported by Ahmed ElMasry on 2023-05-31</li>
<li>[1450376] Medium CVE-2023-3734: Inappropriate implementation in Picture In Picture. Reported by Thomas Orlita on 2023-06-01</li>
<li>[1394410] Medium CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts. Reported by Ahmed ElMasry on 2022-11-29</li>
<li>[1434438] Medium CVE-2023-3736: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer (TU Wien) on 2023-04-19</li>
<li>[1446754] Medium CVE-2023-3737: Inappropriate implementation in Notifications. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2023-05-19</li>
<li>[1434330] Medium CVE-2023-3738: Inappropriate implementation in Autofill. Reported by Hafiizh on 2023-04-18</li>
<li>[1405223] Low CVE-2023-3740: Insufficient validation of untrusted input in Themes. Reported by Fardeen Siddiqui on 2023-01-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3727</cvename>
<cvename>CVE-2023-3728</cvename>
<cvename>CVE-2023-3730</cvename>
<cvename>CVE-2023-3732</cvename>
<cvename>CVE-2023-3733</cvename>
<cvename>CVE-2023-3734</cvename>
<cvename>CVE-2023-3735</cvename>
<cvename>CVE-2023-3736</cvename>
<cvename>CVE-2023-3737</cvename>
<cvename>CVE-2023-3738</cvename>
<cvename>CVE-2023-3740</cvename>
<url>https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-07-19</discovery>
<entry>2023-07-20</entry>
</dates>
</vuln>
<vuln vid="f32b1fbd-264d-11ee-a468-80fa5b29d485">
<topic>virtualbox-ose -- multiple vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>6.1.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert_us@oracle.com reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
<p>Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). Supported versions that are
affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable
vulnerability allows high privileged attacker with logon to the
infrastructure where Oracle VM VirtualBox executes to compromise
Oracle VM VirtualBox. Successful attacks require human interaction
from a person other than the attacker. Successful attacks of this
vulnerability can result in unauthorized ability to cause a hang
or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.
CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector:
(CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22016</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-22016</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-07-19</entry>
</dates>
</vuln>
<vuln vid="cf40e8b7-264d-11ee-a468-80fa5b29d485">
<topic>virtualbox-ose -- multiple vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>6.1.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert_us@oracle.com reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
<p>Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). Supported versions that are
affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable
vulnerability allows low privileged attacker with logon to the
infrastructure where Oracle VM VirtualBox executes to compromise
Oracle VM VirtualBox. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox. Note:
This vulnerability applies to Windows VMs only. CVSS 3.1 Base Score
5.5 (Availability impacts). CVSS Vector:
(CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22017</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-22017</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-07-19</entry>
</dates>
</vuln>
<vuln vid="bc90e894-264b-11ee-a468-80fa5b29d485">
<topic>virtualbox-ose -- multiple vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>6.1.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secalert_us@oracle.com reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
<p>Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). Supported versions that are
affected are Prior to 6.1.46 and Prior to 7.0.10. Difficult to
exploit vulnerability allows unauthenticated attacker with network
access via RDP to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in takeover of Oracle VM
VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity
and Availability impacts). CVSS Vector:
(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22018</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-22018</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-07-19</entry>
</dates>
</vuln>
<vuln vid="c70c3dc3-258c-11ee-b37b-901b0e9408dc">
<topic>element-web -- Cross site scripting in Export Chat feature</topic>
<affects>
<package>
<name>element-web</name>
<range><lt>1.11.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix Developers reports:</p>
<blockquote cite="https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65">
<p>The Export Chat feature includes certain attacker-controlled elements in the
generated document without sufficient escaping, leading to stored XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-37259</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-37259</url>
</references>
<dates>
<discovery>2023-07-18</discovery>
<entry>2023-07-18</entry>
</dates>
</vuln>
<vuln vid="b3f77aae-241c-11ee-9684-c11c23f7b0f9">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22759">
<p>Test if container blob is accessible before mounting.</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22175">
<p>Set type="password" on all auth_token fields</p>
<p>Seen when migrating from other hosting platforms.</p>
<p>Prevents exposing the token to screen capture/cameras/eyeballs.</p>
<p>Prevents the browser from saving the value in its autocomplete
dictionary, which often is not secure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.com/release-of-1.20.0</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.20.0</url>
</references>
<dates>
<discovery>2023-06-08</discovery>
<entry>2023-07-05</entry>
</dates>
</vuln>
<vuln vid="41c60e16-2405-11ee-a0d1-84a93843eb75">
<topic>OpenSSL -- AES-SIV implementation ignores empty associated data entries</topic>
<affects>
<package>
<name>openssl30</name>
<range><lt>3.0.9_1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230714.txt">
<p>The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2975</cvename>
<url>https://www.openssl.org/news/secadv/20230714.txt</url>
</references>
<dates>
<discovery>2023-07-14</discovery>
<entry>2023-07-16</entry>
</dates>
</vuln>
<vuln vid="3446e45d-a51b-486f-9b0e-e4402d91fed6">
<topic>electron22 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.17">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3422.</li>
<li>Security: backported fix for CVE-2023-3421.</li>
<li>Security: backported fix for CVE-2023-3420.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3422</cvename>
<url>https://github.com/advisories/GHSA-gqjh-f545-vcx3</url>
<cvename>CVE-2023-3421</cvename>
<url>https://github.com/advisories/GHSA-943x-93ff-jr62</url>
<cvename>CVE-2023-3420</cvename>
<url>https://github.com/advisories/GHSA-4297-fx5c-x987</url>
</references>
<dates>
<discovery>2023-07-12</discovery>
<entry>2023-07-14</entry>
</dates>
</vuln>
<vuln vid="b67d768c-1f53-11ee-82ed-4ccc6adda413">
<topic>librecad -- out-of-bounds read in importshp plugin</topic>
<affects>
<package>
<name>librecad</name>
<range><lt>2.2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albin Eldstål-Ahrens reports:</p>
<blockquote cite="https://github.com/LibreCAD/LibreCAD/issues/1481">
<p>An out-of-bounds read on a heap buffer in the importshp plugin may
allow an attacker to read sensitive data via a crafted DBF file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-30259</cvename>
<url>https://github.com/LibreCAD/LibreCAD/issues/1481</url>
</references>
<dates>
<discovery>2021-12-28</discovery>
<entry>2023-07-10</entry>
</dates>
</vuln>
<vuln vid="6fae2d6c-1f38-11ee-a475-080027f5fec9">
<topic>redis -- heap overflow in COMMAND GETKEYS and ACL evaluation</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.12</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.12.20230710</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/JDjKS0GubsQ">
<p>
Extracting key names from a command and a list of
arguments may, in some cases, trigger a heap overflow and
result in reading random heap memory, heap corruption and
potentially remote code execution. Specifically: using
COMMAND GETKEYS* and validation of key names in ACL rules.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36824</cvename>
<url>https://groups.google.com/g/redis-db/c/JDjKS0GubsQ</url>
<url>https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3</url>
</references>
<dates>
<discovery>2023-07-10</discovery>
<entry>2023-07-10</entry>
</dates>
</vuln>
<vuln vid="0e254b4a-1f37-11ee-a475-080027f5fec9">
<topic>redis -- Heap overflow in the cjson and cmsgpack libraries</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.12</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.12.20230710</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.13</lt></range>
</package>
<package>
<name>redis60</name>
<range><lt>6.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/JDjKS0GubsQ">
<p>
A specially crafted Lua script executing in Redis can
trigger a heap overflow in the cjson and cmsgpack
libraries, and result in heap corruption and potentially
remote code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24834</cvename>
<url>https://groups.google.com/g/redis-db/c/JDjKS0GubsQ</url>
</references>
<dates>
<discovery>2023-07-10</discovery>
<entry>2023-07-10</entry>
</dates>
</vuln>
<vuln vid="8ea24413-1b15-11ee-9331-570525adb7f1">
<topic>gitea -- avoid open HTTP redirects</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.19.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/25143">
<p>If redirect_to parameter has set value starting with
\\example.com redirect will be created with header Location:
/\\example.com that will redirect to example.com domain.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2023/07/gitea-1.19.4-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.19.4</url>
</references>
<dates>
<discovery>2023-06-08</discovery>
<entry>2023-07-05</entry>
</dates>
</vuln>
<vuln vid="d1681df3-421e-4a63-95b4-a3d6e29d395d">
<topic>electron{23,24} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron23</name>
<range><lt>23.3.10</lt></range>
</package>
<package>
<name>electron24</name>
<range><lt>24.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.10">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3422.</li>
<li>Security: backported fix for CVE-2023-3421.</li>
<li>Security: backported fix for CVE-2023-3420.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3422</cvename>
<url>https://github.com/advisories/GHSA-gqjh-f545-vcx3</url>
<cvename>CVE-2023-3421</cvename>
<url>https://github.com/advisories/GHSA-943x-93ff-jr62</url>
<cvename>CVE-2023-3420</cvename>
<url>https://github.com/advisories/GHSA-4297-fx5c-x987</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-07-06</entry>
</dates>
</vuln>
<vuln vid="d8972bcd-1b64-11ee-9cd6-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.1.0</ge><lt>16.1.2</lt></range>
<range><ge>16.0.0</ge><lt>16.0.7</lt></range>
<range><ge>15.11.0</ge><lt>15.11.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/">
<p>A user can change the name and path of some public GitLab groups</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3484</cvename>
<url>https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/</url>
</references>
<dates>
<discovery>2023-07-05</discovery>
<entry>2023-07-05</entry>
</dates>
</vuln>
<vuln vid="01eeea33-1afa-11ee-8a9b-b42e991fc52e">
<topic>phpldapadmin -- XSS vulnerability</topic>
<affects>
<package>
<name>phpldapadmin-php80</name>
<name>phpldapadmin-php81</name>
<range><lt>1.2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474">
<p>An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2
that allows users to store malicious values that may be executed
by other users at a later time via get_request in lib/function.php.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35132</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-35132</url>
</references>
<dates>
<discovery>2020-12-11</discovery>
<entry>2023-07-05</entry>
</dates>
</vuln>
<vuln vid="4ee7fa77-19a6-11ee-8a05-080027eda32c">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.20</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<name>py311-django41</name>
<range><lt>4.1.10</lt></range>
</package>
<package>
<name>py38-django42</name>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/jul/03/security-releases/">
<p>CVE-2023-36053: Potential regular expression denial of service
vulnerability in EmailValidator/URLValidator.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-36053</cvename>
<url>https://www.djangoproject.com/weblog/2023/jul/03/security-releases/</url>
</references>
<dates>
<discovery>2023-07-01</discovery>
<entry>2023-07-03</entry>
</dates>
</vuln>
<vuln vid="95dad123-180e-11ee-86ba-080027eda32c">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.11</lt></range>
</package>
<package>
<name>mediawiki138</name>
<range><lt>1.38.7</lt></range>
</package>
<package>
<name>mediawiki139</name>
<range><lt>1.39.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/">
<p>(T335203, CVE-2023-29197) Upgrade guzzlehttp/psr7 to >= 1.9.1/2.4.5.</p>
<p>(T335612, CVE-2023-36674) Manualthumb bypasses badFile lookup.</p>
<p>(T332889, CVE-2023-36675) XSS in BlockLogFormatter due to unsafe message
use.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-29197</cvename>
<cvename>CVE-2023-36674</cvename>
<cvename>CVE-2023-36675</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/</url>
</references>
<dates>
<discovery>2023-04-21</discovery>
<entry>2023-07-01</entry>
</dates>
</vuln>
<vuln vid="3117e6cd-1772-11ee-9cd6-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.1.0</ge><lt>16.1.1</lt></range>
<range><ge>16.0.0</ge><lt>16.0.6</lt></range>
<range><ge>15.11.0</ge><lt>15.11.10</lt></range>
<range><ge>7.14.0</ge><lt>15.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/">
<p>ReDoS via EpicReferenceFilter in any Markdown fields</p>
<p>New commits to private projects visible in forks created while project was public</p>
<p>New commits to private projects visible in forks created while project was public</p>
<p>Maintainer can leak masked webhook secrets by manipulating URL masking</p>
<p>Information disclosure of project import errors</p>
<p>Sensitive information disclosure via value stream analytics controller</p>
<p>Bypassing Code Owners branch protection rule in GitLab</p>
<p>HTML injection in email address</p>
<p>Webhook token leaked in Sidekiq logs if log format is 'default'</p>
<p>Private email address of service desk issue creator disclosed via issues API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3424</cvename>
<cvename>CVE-2023-2190</cvename>
<cvename>CVE-2023-3444</cvename>
<cvename>CVE-2023-2620</cvename>
<cvename>CVE-2023-3362</cvename>
<cvename>CVE-2023-3102</cvename>
<cvename>CVE-2023-2576</cvename>
<cvename>CVE-2023-2200</cvename>
<cvename>CVE-2023-3363</cvename>
<cvename>CVE-2023-1936</cvename>
<url>https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/</url>
</references>
<dates>
<discovery>2023-06-29</discovery>
<entry>2023-06-30</entry>
</dates>
</vuln>
<vuln vid="d821956f-1753-11ee-ad66-1c61b4739ac9">
<topic>SoftEtherVPN -- multiple vulnerabilities</topic>
<affects>
<package>
<name>softether</name>
<range><lt>4.42.9798</lt></range>
</package>
<package>
<name>softether-devel</name>
<range><lt>4.42.9798</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daiyuu Nobori reports:</p>
<blockquote cite="https://www.softether.org/9-about/News/904-SEVPN202301">
<p>The SoftEther VPN project received a high level code review and technical assistance from Cisco Systems, Inc. of the United States from April to June 2023 to fix several vulnerabilities in the SoftEther VPN code.</p>
<p>The risk of exploitation of any of the fixed vulnerabilities is low under normal usage and environment, and actual attacks are very difficult. However, SoftEther VPN is now an open source VPN software used by 7.4 million unique users worldwide, and is used daily by many users to defend against the risk of blocking attacks by national censorship firewalls and attempts to eavesdrop on communications. Therefore, as long as the slightest attack possibility exists, there is great value in preventing vulnerabilities as much as possible in anticipation of the most sophisticated cyber attackers in the world, such as malicious ISPs and man-in-the-middle attackers on national Internet communication channels. These fixes are important and useful patches for users who use SoftEther VPN and the Internet for secure communications to prevent advanced attacks that can theoretically be triggered by malicious ISPs and man-in-the-middle attackers on national Internet communication pathways.</p>
<p>The fixed vulnerabilities are CVE-2023-27395, CVE-2023-22325, CVE-2023-32275, CVE-2023-27516, CVE-2023-32634, and CVE-2023-31192. All of these were discovered in an outstanding code review of SoftEther VPN by Cisco Systems, Inc.</p>
<ol>
<li>CVE-2023-27395: Heap overflow in SoftEther VPN DDNS client functionality at risk of crashing and theoretically arbitrary code execution caused by a malicious man-in-the-middle attacker such like ISP-level or on national Internet communication channels</li>
<li>CVE-2023-22325: Integer overflow in the SoftEther VPN DDNS client functionality could result in crashing caused by a malicious man-in-the-middle attacker such like ISP-level or on national Internet communication channels</li>
<li>CVE-2023-32275: Vulnerability that allows the administrator himself of a 32-bit version of VPN Client or VPN Server to see the 32-bit value heap address of each of trusted CA's certificates in the VPN process</li>
<li>CVE-2023-27516: If the user forget to set the administrator password of SoftEther VPN Client and enable remote administration with blank password, the administrator password of VPN Client can be changed remotely or VPN client can be used remotely by anonymouse third person</li>
<li>CVE-2023-32634: If an attacker succeeds in launching a TCP relay program on the same port as the VPN Client on a local computer running the SoftEther VPN Client before the VPN Client process is launched, the TCP relay program can conduct a man-in-the-middle attack on communication between the administrator and the VPN Client process</li>
<li>CVE-2023-31192: When SoftEther VPN Client connects to an untrusted VPN Server, an invalid redirection response for the clustering (load balancing) feature causes 20 bytes of uninitialized stack space to be read</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27395</cvename>
<cvename>CVE-2023-22325</cvename>
<cvename>CVE-2023-32275</cvename>
<cvename>CVE-2023-27516</cvename>
<cvename>CVE-2023-32634</cvename>
<cvename>CVE-2023-31192</cvename>
<url>https://www.softether.org/9-about/News/904-SEVPN202301</url>
</references>
<dates>
<discovery>2023-06-30</discovery>
<entry>2023-06-30</entry>
</dates>
</vuln>
<vuln vid="06428d91-152e-11ee-8b14-dbdd62da85fb">
<topic>OpenEXR -- heap buffer overflow in internal_huf_decompress</topic>
<affects>
<package>
<name>openexr</name>
<range><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-fuzz reports:</p>
<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59382">
<p>heap buffer overflow in internal_huf_decompress.</p>
</blockquote>
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.9">
<p>v3.1.9 - Patch release that addresses [...] also OSS-fuzz 59382 Heap-buffer-overflow in internal_huf_decompress</p>
</blockquote>
<p>Kimball Thurston reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/pull/1439">
<p>Fix scenario where malformed dwa file could read past end of buffer - fixes OSS-Fuzz 59382</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59382</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.9</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/commit/e431f7e189d0785bb84a5bfb83391e9e58590c49</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/pull/1439</url>
</references>
<dates>
<discovery>2023-05-28</discovery>
<entry>2023-06-27</entry>
</dates>
</vuln>
<vuln vid="ad05a737-14bd-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>114.0.5735.198</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>114.0.5735.198</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html">
<p>This update includes 4 security fixes:</p>
<ul>
<li>[1452137] High CVE-2023-3420: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-06-07</li>
<li>[1447568] High CVE-2023-3421: Use after free in Media. Reported by Piotr Bania of Cisco Talos on 2023-05-22</li>
<li>[1450397] High CVE-2023-3422: Use after free in Guest View. Reported by asnine on 2023-06-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3420</cvename>
<cvename>CVE-2023-3421</cvename>
<cvename>CVE-2023-3422</cvename>
<url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2023-06-26</discovery>
<entry>2023-06-27</entry>
</dates>
</vuln>
<vuln vid="fdbe9aec-118b-11ee-908a-6c3be5272acd">
<topic>Grafana -- Account takeover / authentication bypass</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>6.7.0</ge><lt>8.5.27</lt></range>
<range><ge>9.0.0</ge><lt>9.2.20</lt></range>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
<range><ge>9.5.0</ge><lt>9.5.5</lt></range>
<range><ge>10.0.0</ge><lt>10.0.1</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.5.27</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.2.20</lt></range>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
<range><ge>9.5.0</ge><lt>9.5.5</lt></range>
</package>
<package>
<name>grafana10</name>
<range><lt>10.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/">
<p>Grafana validates Azure Active Directory accounts based on the email claim.
On Azure AD, the profile email field is not unique across Azure AD tenants.
This can enable a Grafana account takeover and authentication bypass when
Azure AD OAuth is configured with a multi-tenant Azure AD OAuth application.
</p>
<p>The CVSS score for this vulnerability is 9.4 Critical.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3128</cvename>
<url>https://grafana.com/security/security-advisories/cve-2023-3128</url>
</references>
<dates>
<discovery>2023-06-22</discovery>
<entry>2023-06-23</entry>
</dates>
</vuln>
<vuln vid="a03b2d9e-b3f2-428c-8f66-21092ed2ba94">
<topic>electron{23,24} -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron23</name>
<range><lt>23.3.8</lt></range>
</package>
<package>
<name>electron24</name>
<range><lt>24.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.8">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3215.</li>
<li>Security: backported fix for CVE-2023-3216.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3215</cvename>
<url>https://github.com/advisories/GHSA-5rw6-vf4w-p4j3</url>
<cvename>CVE-2023-3216</cvename>
<url>https://github.com/advisories/GHSA-f35r-mcw4-gg3w</url>
</references>
<dates>
<discovery>2023-06-22</discovery>
<entry>2023-06-22</entry>
</dates>
</vuln>
<vuln vid="770d88cc-f6dc-4385-bdfe-497f8080c3fb">
<topic>electron22 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.14">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3215.</li>
<li>Security: backported fix for CVE-2023-3216.</li>
<li>Security: backported fix for CVE-2023-0698.</li>
<li>Security: backported fix for CVE-2023-0932.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3215</cvename>
<url>https://github.com/advisories/GHSA-5rw6-vf4w-p4j3</url>
<cvename>CVE-2023-3216</cvename>
<url>https://github.com/advisories/GHSA-f35r-mcw4-gg3w</url>
<cvename>CVE-2023-0698</cvename>
<url>https://github.com/advisories/GHSA-q6xx-4pmr-m3m4</url>
<cvename>CVE-2023-0932</cvename>
<url>https://github.com/advisories/GHSA-hh2g-39pc-2575</url>
</references>
<dates>
<discovery>2023-06-22</discovery>
<entry>2023-06-22</entry>
</dates>
</vuln>
<vuln vid="734b8f46-773d-4fef-bed3-61114fe8e4c5">
<topic>libX11 -- Sub-object overflows</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.8.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-June/003406.html">
<ul>
<li>Buffer overflows in InitExt.c in libX11 prior to 1.8.6 [CVE-2023-3138]
<p>The functions in src/InitExt.c in libX11 prior to 1.8.6 do not check
that the values provided for the Request, Event, or Error IDs are
within the bounds of the arrays that those functions write to, using
those IDs as array indexes. Instead they trusted that they were called
with values provided by an Xserver that was adhering to the bounds
specified in the X11 protocol, as all X servers provided by X.Org do.</p>
<p>As the protocol only specifies a single byte for these values, an
out-of-bounds value provided by a malicious server (or a malicious
proxy-in-the-middle) can only overwrite other portions of the Display
structure and not write outside the bounds of the Display structure
itself. Testing has found it is possible to at least cause the client
to crash with this memory corruption.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-June/003406.html</url>
<cvename>CVE-2023-3138</cvename>
</references>
<dates>
<discovery>2023-06-15</discovery>
<entry>2023-06-16</entry>
</dates>
</vuln>
<vuln vid="aae2ab45-2d21-4cd5-a53b-07ec933400ac">
<topic>electron24 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron24</name>
<range><lt>24.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v24.5.1">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-3079.</li>
<li>Security: backported fix for CVE-2023-2933.</li>
<li>Security: backported fix for CVE-2023-2932.</li>
<li>Security: backported fix for CVE-2023-2931.</li>
<li>Security: backported fix for CVE-2023-2936.</li>
<li>Security: backported fix for CVE-2023-2935.</li>
<li>Security: backported fix for CVE-2023-2934.</li>
<li>Security: backported fix for CVE-2023-2930.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3079</cvename>
<url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
<cvename>CVE-2023-2933</cvename>
<url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
<cvename>CVE-2023-2932</cvename>
<url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
<cvename>CVE-2023-2931</cvename>
<url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
<cvename>CVE-2023-2936</cvename>
<url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
<cvename>CVE-2023-2935</cvename>
<url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
<cvename>CVE-2023-2934</cvename>
<url>https://github.com/advisories/GHSA-mqff-qm67-cr66</url>
<cvename>CVE-2023-2930</cvename>
<url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
</references>
<dates>
<discovery>2023-06-14</discovery>
<entry>2023-06-16</entry>
</dates>
</vuln>
<vuln vid="3bf6795c-d44c-4033-9b37-ed2e30f34fca">
<topic>electron23 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron23</name>
<range><lt>23.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.7">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-2724.</li>
<li>Security: backported fix for CVE-2023-2725.</li>
<li>Security: backported fix for CVE-2023-2721.</li>
<li>Security: backported fix for CVE-2023-3079.</li>
<li>Security: backported fix for CVE-2023-2933.</li>
<li>Security: backported fix for CVE-2023-2932.</li>
<li>Security: backported fix for CVE-2023-2931.</li>
<li>Security: backported fix for CVE-2023-2936.</li>
<li>Security: backported fix for CVE-2023-2935.</li>
<li>Security: backported fix for CVE-2023-2934.</li>
<li>Security: backported fix for CVE-2023-2930.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2724</cvename>
<url>https://github.com/advisories/GHSA-j5rv-3m5p-q6rc</url>
<cvename>CVE-2023-2725</cvename>
<url>https://github.com/advisories/GHSA-c4fp-wmv9-q4cr</url>
<cvename>CVE-2023-2721</cvename>
<url>https://github.com/advisories/GHSA-5cww-gpqh-ggqj</url>
<cvename>CVE-2023-3079</cvename>
<url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
<cvename>CVE-2023-2933</cvename>
<url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
<cvename>CVE-2023-2932</cvename>
<url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
<cvename>CVE-2023-2931</cvename>
<url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
<cvename>CVE-2023-2936</cvename>
<url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
<cvename>CVE-2023-2935</cvename>
<url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
<cvename>CVE-2023-2934</cvename>
<url>https://github.com/advisories/GHSA-mqff-qm67-cr66</url>
<cvename>CVE-2023-2930</cvename>
<url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
</references>
<dates>
<discovery>2023-06-14</discovery>
<entry>2023-06-16</entry>
</dates>
</vuln>
<vuln vid="3c3d3dcb-bef7-4d20-9580-b4216b5ff6a2">
<topic>electron22 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.13">
<p>This update fixes the following vulnerabilities:</p>
<ul>
<li>Security: backported fix for CVE-2023-2724.</li>
<li>Security: backported fix for CVE-2023-2723.</li>
<li>Security: backported fix for CVE-2023-2725.</li>
<li>Security: backported fix for CVE-2023-2721.</li>
<li>Security: backported fix for CVE-2023-3079.</li>
<li>Security: backported fix for CVE-2023-2933.</li>
<li>Security: backported fix for CVE-2023-2932.</li>
<li>Security: backported fix for CVE-2023-2931.</li>
<li>Security: backported fix for CVE-2023-2936.</li>
<li>Security: backported fix for CVE-2023-2935.</li>
<li>Security: backported fix for CVE-2023-2930.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2724</cvename>
<url>https://github.com/advisories/GHSA-j5rv-3m5p-q6rc</url>
<cvename>CVE-2023-2723</cvename>
<url>https://github.com/advisories/GHSA-7797-6fvm-v8xw</url>
<cvename>CVE-2023-2725</cvename>
<url>https://github.com/advisories/GHSA-c4fp-wmv9-q4cr</url>
<cvename>CVE-2023-2721</cvename>
<url>https://github.com/advisories/GHSA-5cww-gpqh-ggqj</url>
<cvename>CVE-2023-3079</cvename>
<url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
<cvename>CVE-2023-2933</cvename>
<url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
<cvename>CVE-2023-2932</cvename>
<url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
<cvename>CVE-2023-2931</cvename>
<url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
<cvename>CVE-2023-2936</cvename>
<url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
<cvename>CVE-2023-2935</cvename>
<url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
<cvename>CVE-2023-2930</cvename>
<url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
</references>
<dates>
<discovery>2023-06-14</discovery>
<entry>2023-06-16</entry>
</dates>
</vuln>
<vuln vid="b4db7d78-bb62-4f4c-9326-6e9fc2ddd400">
<topic>jenkins -- CSRF protection bypass vulnerability</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.400</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.401.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2023-06-14/">
<h1>Description</h1>
<h5>(High) SECURITY-3135 / CVE-2023-35141</h5>
<p>CSRF protection bypass vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-35141</cvename>
<url>https://www.jenkins.io/security/advisory/2023-06-14/</url>
</references>
<dates>
<discovery>2023-06-14</discovery>
<entry>2023-06-14</entry>
</dates>
</vuln>
<vuln vid="f0250129-fdb8-41ed-aa9e-661ff5026845">
<topic>vscode -- VS Code Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.79.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VSCode developers reports:</p>
<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-j5wm-6crw-xvmr">
<p>VS Code Information Disclosure Vulnerability</p>
<p>A information disclosure vulnerability exists in VS Code 1.79.0 and earlier versions on Windows when file system operations are performed on malicious UNC paths. Examples include reading or resolving metadata of such paths. An authorised attacker must send the user a malicious file and convince the user to open it for the vulnerability to occur. Exploiting this vulnerability could allow the disclosure of NTLM hashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-33144</cvename>
<url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33144</url>
</references>
<dates>
<discovery>2023-06-13</discovery>
<entry>2023-06-13</entry>
</dates>
</vuln>
<vuln vid="1567be8c-0a15-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>114.0.5735.133</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>114.0.5735.133</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html">
<p>This update includes 5 security fixes:</p>
<ul>
<li>[1450568] Critical CVE-2023-3214: Use after free in Autofill payments. Reported by Rong Jian of VRI on 2023-06-01</li>
<li>[1446274] High CVE-2023-3215: Use after free in WebRTC. Reported by asnine on 2023-05-17</li>
<li>[1450114] High CVE-2023-3216: Type Confusion in V8. Reported by 5n1p3r0010 from Topsec ChiXiao Lab on 2023-05-31</li>
<li>[1450601] High CVE-2023-3217: Use after free in WebXR. Reported by Sergei Glazunov of Google Project Zero on 2023-06-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3214</cvename>
<cvename>CVE-2023-3215</cvename>
<cvename>CVE-2023-3216</cvename>
<cvename>CVE-2023-3217</cvename>
<url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2023-06-13</discovery>
<entry>2023-06-13</entry>
</dates>
</vuln>
<vuln vid="f7e9a1cc-0931-11ee-94b4-6cc21735f730">
<topic>xmltooling -- remote resource access</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>3.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20230612.txt">
<p>An updated version of the XMLTooling library that is part of the
OpenSAML and Shibboleth Service Provider software is now available
which corrects a server-side request forgery (SSRF) vulnerability.</p>
<p>Including certain legal but "malicious in intent" content in the
KeyInfo element defined by the XML Signature standard will result
in attempts by the SP's shibd process to dereference untrusted
URLs.</p>
<p>While the content of the URL must be supplied within the message
and does not include any SP internal state or dynamic content,
there is at minimum a risk of denial of service, and the attack
could be combined with others to create more serious vulnerabilities
in the future.</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20230612.txt</url>
</references>
<dates>
<discovery>2023-06-12</discovery>
<entry>2023-06-12</entry>
</dates>
</vuln>
<vuln vid="fdca9418-06f0-11ee-abe2-ecf4bbefc954">
<topic>acme.sh -- closes potential remote vuln</topic>
<affects>
<package>
<name>acme.sh</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Neil Pang reports:</p>
<blockquote cite="https://github.com/acmesh-official/acme.sh/issues/4659">
<p>HiCA was injecting arbitrary code/commands into the certificate obtaining process and acme.sh is running them on the client machine.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/acmesh-official/acme.sh/issues/4665</url>
</references>
<dates>
<discovery>2023-06-08</discovery>
<entry>2023-06-09</entry>
</dates>
</vuln>
<vuln vid="d86becfe-05a4-11ee-9d4a-080027eda32c">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.17</lt></range>
</package>
<package>
<name>python38</name>
<range><lt>3.8.17</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.17</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.12</lt></range>
</package>
<package>
<name>python311</name>
<range><lt>3.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://pythoninsider.blogspot.com/2023/06/python-3114-31012-3917-3817-3717-and.html">
<p>gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded
to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well
as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727).</p>
<p>gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters
following the specification for URLs defined by WHATWG in response to CVE-2023-24329.</p>
<p>gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal
based on the input if no out_file was specified.</p>
<p>gh-104049: Do not expose the local on-disk location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.</p>
<p>gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with
shell=True.</p>
<p>gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open().</p>
<p>gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter
argument that allows limiting tar features than may be surprising or dangerous, such as creating
files outside the destination directory. </p>
<p>gh-102126: Fixed a deadlock at shutdown when clearing thread states if any finalizer tries to
acquire the runtime head lock.</p>
<p>gh-100892: Fixed a crash due to a race while iterating over thread states in clearing
threading.local.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4303</cvename>
<cvename>CVE-2023-2650</cvename>
<cvename>CVE-2023-0286</cvename>
<cvename>CVE-2023-0464</cvename>
<cvename>CVE-2023-0465</cvename>
<cvename>CVE-2023-0466</cvename>
<cvename>CVE-2023-24329</cvename>
<url>https://pythoninsider.blogspot.com/2023/06/python-3114-31012-3917-3817-3717-and.html</url>
</references>
<dates>
<discovery>2022-06-08</discovery>
<entry>2023-06-08</entry>
</dates>
</vuln>
<vuln vid="6c1de144-056f-11ee-8e16-6c3be5272acd">
<topic>Grafana -- Broken access control: viewer can send test alerts</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.5.26</lt></range>
<range><ge>9.0.0</ge><lt>9.2.19</lt></range>
<range><ge>9.3.0</ge><lt>9.3.15</lt></range>
<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.26</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.2.19</lt></range>
<range><ge>9.3.0</ge><lt>9.3.15</lt></range>
<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/06/06/grafana-security-release-new-grafana-versions-with-security-fixes-for-cve-2023-2183-and-cve-2023-2801/">
<p>Grafana can allow an attacker in the <strong>Viewer</strong> role
to send alerts by <strong>API Alert - Test</strong>. This option,
however, is not available in the user panel UI for the Viewer role.
</p>
<p>The CVSS score for this vulnerability is 4.1 Medium
(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2183</cvename>
<url>https://grafana.com/security/security-advisories/cve-2023-2183/</url>
</references>
<dates>
<discovery>2023-06-06</discovery>
<entry>2023-06-07</entry>
</dates>
</vuln>
<vuln vid="652064ef-056f-11ee-8e16-6c3be5272acd">
<topic>Grafana -- Grafana DS proxy race condition</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/06/06/grafana-security-release-new-grafana-versions-with-security-fixes-for-cve-2023-2183-and-cve-2023-2801/">
<p>We have discovered a vulnerability with Grafana’s data source query
endpoints that could end up crashing a Grafana instance.</p>
<p>If you have public dashboards (PD) enabled, we
are scoring this as a CVSS 7.5 High.</p>
<p>If you have disabled PD, this vulnerability is still a risk,
but triggering the issue requires data source read privileges
and access to the Grafana API through a developer script.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2801</cvename>
<url>CVE-2023-2801</url>
</references>
<dates>
<discovery>2023-06-06</discovery>
<entry>2023-06-07</entry>
</dates>
</vuln>
<vuln vid="12741b1f-04f9-11ee-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>114.0.5735.106</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>114.0.5735.106</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[1450481] High CVE-2023-3079: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-06-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-3079</cvename>
<url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-06-05</discovery>
<entry>2023-06-07</entry>
</dates>
</vuln>
<vuln vid="cdb5338d-04ec-11ee-9c88-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>16.0.0</ge><lt>16.0.2</lt></range>
<range><ge>15.11.0</ge><lt>15.11.7</lt></range>
<range><ge>15.10.0</ge><lt>15.10.8</lt></range>
<range><ge>1.2</ge><lt>15.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/">
<p>Stored-XSS with CSP-bypass in Merge requests</p>
<p>ReDoS via FrontMatterFilter in any Markdown fields</p>
<p>ReDoS via InlineDiffFilter in any Markdown fields</p>
<p>ReDoS via DollarMathPostFilter in Markdown fields</p>
<p>DoS via malicious test report artifacts</p>
<p>Restricted IP addresses can clone repositories of public projects</p>
<p>Reflected XSS in Report Abuse Functionality</p>
<p>Privilege escalation from maintainer to owner by importing members from a project</p>
<p>Bypassing tags protection in GitLab</p>
<p>Denial of Service using multiple labels with arbitrarily large descriptions</p>
<p>Ability to use an unverified email for public and commit emails</p>
<p>Open Redirection Through HTTP Response Splitting</p>
<p>Disclosure of issue notes to an unauthorized user when exporting a project</p>
<p>Ambiguous branch name exploitation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2442</cvename>
<cvename>CVE-2023-2199</cvename>
<cvename>CVE-2023-2198</cvename>
<cvename>CVE-2023-2132</cvename>
<cvename>CVE-2023-0121</cvename>
<cvename>CVE-2023-2589</cvename>
<cvename>CVE-2023-2015</cvename>
<cvename>CVE-2023-2485</cvename>
<cvename>CVE-2023-2001</cvename>
<cvename>CVE-2023-0921</cvename>
<cvename>CVE-2023-1204</cvename>
<cvename>CVE-2023-0508</cvename>
<cvename>CVE-2023-1825</cvename>
<cvename>CVE-2023-2013</cvename>
<url>https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/</url>
</references>
<dates>
<discovery>2023-06-05</discovery>
<entry>2023-06-07</entry>
</dates>
</vuln>
<vuln vid="2f38c6a2-04a4-11ee-8cb0-e41f13b9c674">
<topic>qpress -- directory traversal</topic>
<affects>
<package>
<name>qpress</name>
<range><lt>11.3</lt></range>
</package>
<package>
<name>xtrabackup8</name>
<range><lt>8.0.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761">
<p>qpress before PierreLvx/qpress 20220819 and before version 11.3,
as used in Percona XtraBackup and other products, allows directory
traversal via ../ in a .qp file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-45866</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-45866</url>
</references>
<dates>
<discovery>2022-11-23</discovery>
<entry>2023-06-06</entry>
</dates>
</vuln>
<vuln vid="bfca647c-0456-11ee-bafd-b42e991fc52e">
<topic>Kanboard -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php80-kanboard</name>
<range><lt>1.2.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p/>
<p>Kanboard is project management software that focuses on the Kanban
methodology. The last update includes 4 vulnerabilities:</p>
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/kanboard/kanboard/commit/b501ef44bc28ee9cf603a4fa446ee121d66f652f">
<ul>
<li>Missing access control in internal task links feature</li>
<li>Stored Cross site scripting in the Task External Link Functionality in Kanboard</li>
<li>Missing Access Control allows User to move and duplicate tasks in Kanboard</li>
<li>Parameter based Indirect Object Referencing leading to private file exposure in Kanboard</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-33970</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-33970</url>
<cvename>CVE-2023-33969</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-33969</url>
<cvename>CVE-2023-33968</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-33968</url>
<cvename>CVE-2023-33956</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-33956</url>
</references>
<dates>
<discovery>2023-06-05</discovery>
<entry>2023-06-06</entry>
</dates>
</vuln>
<vuln vid="eb9a3c57-ff9e-11ed-a0d1-84a93843eb75">
<topic>OpenSSL -- Possible DoS translating ASN.1 identifiers</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1u,1</lt></range>
</package>
<package>
<name>openssl30</name>
<range><lt>3.0.9</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230530.txt">
<p>Severity: Moderate. Processing some specially crafted ASN.1
object identifiers or data containing them may be very slow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2650</cvename>
<url>https://www.openssl.org/news/secadv/20230530.txt</url>
</references>
<dates>
<discovery>2023-05-30</discovery>
<entry>2023-05-31</entry>
</dates>
</vuln>
<vuln vid="79514fcd-feb4-11ed-92b5-b42e991fc52e">
<topic>Kanboard -- Clipboard based cross-site scripting (blocked with default CSP) in Kanboard</topic>
<affects>
<package>
<name>php80-kanboard</name>
<range><lt>1.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aa2bc7">
<p>Kanboard is project management software that focuses on the Kanban
methodology. Due to improper handling of elements under the
`contentEditable` element, maliciously crafted clipboard content
can inject arbitrary HTML tags into the DOM. A low-privileged
attacker with permission to attach a document on a vulnerable
Kanboard instance can trick the victim into pasting malicious
screenshot data and achieve cross-site scripting if CSP is improperly
configured. This issue has been patched in version 1.2.29.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-32685</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-32685</url>
</references>
<dates>
<discovery>2023-05-30</discovery>
<entry>2023-05-30</entry>
</dates>
</vuln>
<vuln vid="fd87a250-ff78-11ed-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>114.0.5735.90</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>114.0.5735.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html">
<p>This update includes 16 security fixes:</p>
<ul>
<li>[1410191] High CVE-2023-2929: Out of bounds write in Swiftshader. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-01-25</li>
<li>[1443401] High CVE-2023-2930: Use after free in Extensions. Reported by asnine on 2023-05-08</li>
<li>[1444238] High CVE-2023-2931: Use after free in PDF. Reported by Huyna at Viettel Cyber Security on 2023-05-10</li>
<li>[1444581] High CVE-2023-2932: Use after free in PDF. Reported by Huyna at Viettel Cyber Security on 2023-05-11</li>
<li>[1445426] High CVE-2023-2933: Use after free in PDF. Reported by Quang Nguyễn (@quangnh89) of Viettel Cyber Security and Nguyen Phuong on 2023-05-15</li>
<li>[1429720] High CVE-2023-2934: Out of bounds memory access in Mojo. Reported by Mark Brand of Google Project Zero on 2023-04-01</li>
<li>[1440695] High CVE-2023-2935: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-04-27</li>
<li>[1443452] High CVE-2023-2936: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-05-08</li>
<li>[1413813] Medium CVE-2023-2937: Inappropriate implementation in Picture In Picture. Reported by NDevTK on 2023-02-08</li>
<li>[1416350] Medium CVE-2023-2938: Inappropriate implementation in Picture In Picture. Reported by Alesandro Ortiz on 2023-02-15</li>
<li>[1427431] Medium CVE-2023-2939: Insufficient data validation in Installer. Reported by ycdxsb from VARAS@IIE on 2023-03-24</li>
<li>[1426807] Medium CVE-2023-2940: Inappropriate implementation in Downloads. Reported by Axel Chong on 2023-03-22</li>
<li>[1430269] Low CVE-2023-2941: Inappropriate implementation in Extensions API. Reported by Jasper Rebane on 2023-04-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2929</cvename>
<cvename>CVE-2023-2930</cvename>
<cvename>CVE-2023-2931</cvename>
<cvename>CVE-2023-2932</cvename>
<cvename>CVE-2023-2933</cvename>
<cvename>CVE-2023-2934</cvename>
<cvename>CVE-2023-2935</cvename>
<cvename>CVE-2023-2936</cvename>
<cvename>CVE-2023-2937</cvename>
<cvename>CVE-2023-2938</cvename>
<cvename>CVE-2023-2939</cvename>
<cvename>CVE-2023-2940</cvename>
<cvename>CVE-2023-2941</cvename>
<url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2023-05-30</discovery>
<entry>2023-05-31</entry>
</dates>
</vuln>
<vuln vid="5d1b1a0a-fd36-11ed-a0d1-84a93843eb75">
<topic>MariaDB -- Nullpointer dereference</topic>
<affects>
<package>
<name>mariadb1011-server</name>
<range><lt>10.11.3</lt></range>
</package>
<package>
<name>mariadb106-server</name>
<range><lt>10.6.13</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.20</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.29</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/security/">
<p>MariaDB Server is vulnerable to Denial of Service. It is possible for
function spider_db_mbase::print_warnings to dereference a null pointer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-47015</cvename>
<url>https://mariadb.com/kb/en/security/</url>
</references>
<dates>
<discovery>2023-05-10</discovery>
<entry>2023-05-28</entry>
</dates>
</vuln>
<vuln vid="7d6be8d4-f812-11ed-a7ff-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-04-23">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/4d89c7cc-fb4c-4b64-9b67-f0189f70a620/</url>
<url>https://huntr.dev/bounties/8282d78e-f399-4bf4-8403-f39103a31e78/</url>
</references>
<dates>
<discovery>2023-05-17</discovery>
<entry>2023-05-21</entry>
</dates>
</vuln>
<vuln vid="a4f8bb03-f52f-11ed-9859-080027083a05">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>8.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wei Chong Tan, Harry Sintonen, and Hiroki Kurosawa reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<p>This update fixes 4 security vulnerabilities:</p>
<ul>
<li>Medium CVE-2023-28319: UAF in SSH sha256 fingerprint check. Reported by Wei Chong Tan on 2023-03-21</li>
<li>Low CVE-2023-28320: siglongjmp race condition. Reported by Harry Sintonen on 2023-04-02</li>
<li>Low CVE-2023-28321: IDN wildcard match. Reported by Hiroki Kurosawa on 2023-04-17</li>
<li>Low CVE-2023-28322: more POST-after-PUT confusion. Reported by Hiroki Kurosawa on 2023-04-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28319</cvename>
<url>https://curl.se/docs/CVE-2023-28319.html</url>
<cvename>CVE-2023-28320</cvename>
<url>https://curl.se/docs/CVE-2023-28320.html</url>
<cvename>CVE-2023-28321</cvename>
<url>https://curl.se/docs/CVE-2023-28321.html</url>
<cvename>CVE-2023-28322</cvename>
<url>https://curl.se/docs/CVE-2023-28322.html</url>
</references>
<dates>
<discovery>2023-03-21</discovery>
<entry>2023-05-19</entry>
</dates>
</vuln>
<vuln vid="1ab7357f-a3c2-406a-89fb-fd00e49a71b5">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.9">
<p> A specially-crafted series of FTP packets with a CMD
command with a large path followed by a very large number
of replies could cause Zeek to spend a long time processing
the data. </p>
<p> A specially-crafted with a truncated header can cause
Zeek to overflow memory and potentially crash. </p>
<p> A specially-crafted series of SMTP packets can cause
Zeek to generate a very large number of events and take
a long time to process them. </p>
<p> A specially-crafted series of POP3 packets containing
MIME data can cause Zeek to spend a long time dealing
with each individual file ID. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.9</url>
</references>
<dates>
<discovery>2023-05-19</discovery>
<entry>2023-05-19</entry>
</dates>
</vuln>
<vuln vid="b09d77d0-b27c-48ae-b69b-9641bb68b39e">
<topic>electron -- vulnerability</topic>
<affects>
<package>
<name>electron22</name>
<range><lt>22.3.10</lt></range>
</package>
<package>
<name>electron23</name>
<range><lt>23.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Electron developers report:</p>
<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.10">
<p>This update fixes the following vulnerability:</p>
<ul>
<li>Security: backported fix for CVE-2023-29469</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-29469</cvename>
<url>https://github.com/advisories/GHSA-7jv7-hr35-fwjr</url>
</references>
<dates>
<discovery>2023-05-17</discovery>
<entry>2023-05-18</entry>
</dates>
</vuln>
<vuln vid="bea52545-f4a7-11ed-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>113.0.5672.126</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>113.0.5672.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html">
<p>This update includes 12 security fixes:</p>
<ul>
<li>[1444360] Critical CVE-2023-2721: Use after free in Navigation. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2023-05-10</li>
<li>[1400905] High CVE-2023-2722: Use after free in Autofill UI. Reported by Rong Jian of VRI on 2022-12-14</li>
<li>[1435166] High CVE-2023-2723: Use after free in DevTools. Reported by asnine on 2023-04-21</li>
<li>[1433211] High CVE-2023-2724: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-04-14</li>
<li>[1442516] High CVE-2023-2725: Use after free in Guest View. Reported by asnine on 2023-05-04</li>
<li>[1442018] Medium CVE-2023-2726: Inappropriate implementation in WebApp Installs. Reported by Ahmed ElMasry on 2023-05-03</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2721</cvename>
<cvename>CVE-2023-2722</cvename>
<cvename>CVE-2023-2723</cvename>
<cvename>CVE-2023-2724</cvename>
<cvename>CVE-2023-2725</cvename>
<cvename>CVE-2023-2726</cvename>
<url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html</url>
</references>
<dates>
<discovery>2023-05-16</discovery>
<entry>2023-05-17</entry>
</dates>
</vuln>
<vuln vid="4a08a4fb-f152-11ed-9c88-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.11.0</ge><lt>15.11.3</lt></range>
<range><ge>15.10.0</ge><lt>15.10.7</lt></range>
<range><ge>9.0</ge><lt>15.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/">
<p>Smuggling code changes via merge requests with refs/replace</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2181</cvename>
<url>https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/</url>
</references>
<dates>
<discovery>2023-05-10</discovery>
<entry>2023-05-13</entry>
</dates>
</vuln>
<vuln vid="ec63bc8e-f092-11ed-85ca-001517a2e1a4">
<topic>piwigo -- SQL injection</topic>
<affects>
<package>
<name>piwigo</name>
<range><lt>13.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwigo reports:</p>
<blockquote cite="https://www.piwigo.org/release-13.7.0">
<p>Piwigo is affected by multiple SQL injection issues.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.piwigo.org/release-13.7.0</url>
</references>
<dates>
<discovery>2023-03-01</discovery>
<entry>2023-05-12</entry>
</dates>
</vuln>
<vuln vid="4b636f50-f011-11ed-bbae-6cc21735f730">
<topic>postgresql-server -- Row security policies disregard user ID changes after inlining</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>15.3</lt></range>
<range><lt>14.8</lt></range>
<range><lt>13.11</lt></range>
<range><lt>12.15</lt></range>
<range><lt>11.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-2455/">
<p>
While CVE-2016-2193 fixed most interaction between row security and
user ID changes, it missed a scenario involving function
inlining. This leads to potentially incorrect policies being
applied in cases where role-specific policies are used and a
given query is planned under one role and then executed under
other roles. This scenario can happen under security definer
functions or when a common user and query is planned
initially and then re-used across multiple SET ROLEs.
Applying an incorrect policy may permit a user to complete
otherwise-forbidden reads and modifications. This affects
only databases that have used CREATE POLICY to define a row
security policy.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2455</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-2455/</url>
</references>
<dates>
<discovery>2023-05-11</discovery>
<entry>2023-05-11</entry>
</dates>
</vuln>
<vuln vid="fbb5a260-f00f-11ed-bbae-6cc21735f730">
<topic>postgresql-server -- CREATE SCHEMA ... schema elements defeats protective search_path changes</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>15.3</lt></range>
<range><lt>14.8</lt></range>
<range><lt>13.11</lt></range>
<range><lt>12.15</lt></range>
<range><lt>11.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-2454/">
<p>
This enabled an attacker having database-level CREATE
privilege to execute arbitrary code as the bootstrap
superuser. Database owners have that right by default,
and explicit grants may extend it to other users.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2454</cvename>
<url>https://www.postgresql.org/support/security/CVE-2023-2454/</url>
</references>
<dates>
<discovery>2023-05-11</discovery>
<entry>2023-05-11</entry>
</dates>
</vuln>
<vuln vid="7913fe6d-2c6e-40ba-a7d7-35696f3db2b6">
<topic>vscode -- Visual Studio Code Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>vscode</name>
<range><lt>1.78.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secure@microsoft.com reports:</p>
<blockquote cite="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29338">
<p>Visual Studio Code Information Disclosure Vulnerability</p>
<p>A information disclosure vulnerability exists in VS Code 1.78.0 and earlier versions on Windows when file system operations are performed on malicious UNC paths. Examples include reading or resolving metadata of such paths. An authorised attacker must send the user a malicious file and convince the user to open it for the vulnerability to occur. Exploiting this vulnerability could allow the disclosure of NTLM hashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-29338</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-29338</url>
<url>https://github.com/microsoft/vscode/security/advisories/GHSA-mmfh-4pv3-39hr</url>
</references>
<dates>
<discovery>2023-05-09</discovery>
<entry>2023-05-10</entry>
</dates>
</vuln>
<vuln vid="68958e18-ed94-11ed-9688-b42e991fc52e">
<topic>glpi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>10.0.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>glpi Project reports:</p>
<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.7">
<p>Multiple vulnerabilities found and fixed in this version:</p>
<ul>
<li>High CVE-2023-28849: SQL injection and Stored XSS via inventory agent request.</li>
<li>High CVE-2023-28632: Account takeover by authenticated user.</li>
<li>High CVE-2023-28838: SQL injection through dynamic reports.</li>
<li>Moderate CVE-2023-28852: Stored XSS through dashboard administration.</li>
<li>Moderate CVE-2023-28636: Stored XSS on external links.</li>
<li>Moderate CVE-2023-28639: Reflected XSS in search pages.</li>
<li>Moderate CVE-2023-28634: Privilege Escalation from technician to super-admin.</li>
<li>Low CVE-2023-28633: Blind Server-Side Request Forgery (SSRF) in RSS feeds.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28849</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28849</url>
<cvename>CVE-2023-28632</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28632</url>
<cvename>CVE-2023-28838</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28838</url>
<cvename>CVE-2023-28852</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28852</url>
<cvename>CVE-2023-28636</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28636</url>
<cvename>CVE-2023-28639</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28639</url>
<cvename>CVE-2023-28634</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28634</url>
</references>
<dates>
<discovery>2023-03-20</discovery>
<entry>2023-05-08</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="96b2d4db-ddd2-11ed-b6ea-080027f5fec9">
<topic>redis -- HINCRBYFLOAT can be used to crash a redis-server process</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.11</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.12</lt></range>
</package>
<package>
<name>redis6</name>
<range><lt>6.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6">
<p>
Authenticated users can use the HINCRBYFLOAT command to
create an invalid hash field that may later crash Redis on
access.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28856</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6</url>
</references>
<dates>
<discovery>2023-04-17</discovery>
<entry>2023-05-08</entry>
</dates>
</vuln>
<vuln vid="89fdbd85-ebd2-11ed-9c88-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.11.0</ge><lt>15.11.2</lt></range>
<range><ge>15.10.0</ge><lt>15.10.6</lt></range>
<range><ge>9.0</ge><lt>15.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/">
<p>Malicious Runner Attachment via GraphQL</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2478</cvename>
<url>https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/</url>
</references>
<dates>
<discovery>2023-05-05</discovery>
<entry>2023-05-06</entry>
</dates>
</vuln>
<vuln vid="d55e1b4d-eadc-11ed-9cc0-080027de9982">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<name>py311-django32</name>
<range><lt>3.2.19</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<name>py311-django41</name>
<range><lt>4.1.9</lt></range>
</package>
<package>
<name>py38-django42</name>
<name>py39-django42</name>
<name>py310-django42</name>
<name>py311-django42</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/may/03/security-releases/">
<p>CVE-2023-31047: Potential bypass of validation when uploading multiple
files using one form field.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-31047</cvename>
<url>https://www.djangoproject.com/weblog/2023/may/03/security-releases/</url>
</references>
<dates>
<discovery>2023-05-01</discovery>
<entry>2023-05-05</entry>
</dates>
</vuln>
<vuln vid="246174d3-e979-11ed-8290-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>113.0.5672.63</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>113.0.5672.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html">
<p>This update includes 15 security fixes:</p>
<ul>
<li>[1423304] Medium CVE-2023-2459: Inappropriate implementation in Prompts. Reported by Rong Jian of VRI on 2023-03-10</li>
<li>[1419732] Medium CVE-2023-2460: Insufficient validation of untrusted input in Extensions. Reported by Martin Bajanik, Fingerprint[.]com on 2023-02-27</li>
<li>[1350561] Medium CVE-2023-2461: Use after free in OS Inputs. Reported by @ginggilBesel on 2022-08-06</li>
<li>[1375133] Medium CVE-2023-2462: Inappropriate implementation in Prompts. Reported by Alesandro Ortiz on 2022-10-17</li>
<li>[1406120] Medium CVE-2023-2463: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2023-01-10</li>
<li>[1418549] Medium CVE-2023-2464: Inappropriate implementation in PictureInPicture. Reported by Thomas Orlita on 2023-02-23</li>
<li>[1399862] Medium CVE-2023-2465: Inappropriate implementation in CORS. Reported by @kunte_ctf on 2022-12-10</li>
<li>[1385714] Low CVE-2023-2466: Inappropriate implementation in Prompts. Reported by Jasper Rebane (popstonia) on 2022-11-17</li>
<li>[1413586] Low CVE-2023-2467: Inappropriate implementation in Prompts. Reported by Thomas Orlita on 2023-02-07</li>
<li>[1416380] Low CVE-2023-2468: Inappropriate implementation in PictureInPicture. Reported by Alesandro Ortiz on 2023-02-15</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2459</cvename>
<cvename>CVE-2023-2460</cvename>
<cvename>CVE-2023-2461</cvename>
<cvename>CVE-2023-2462</cvename>
<cvename>CVE-2023-2463</cvename>
<cvename>CVE-2023-2464</cvename>
<cvename>CVE-2023-2465</cvename>
<cvename>CVE-2023-2466</cvename>
<cvename>CVE-2023-2467</cvename>
<cvename>CVE-2023-2468</cvename>
<url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-05-03</discovery>
<entry>2023-05-03</entry>
</dates>
</vuln>
<vuln vid="4ffcccae-e924-11ed-9c88-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.11.0</ge><lt>15.11.1</lt></range>
<range><ge>15.10.0</ge><lt>15.10.5</lt></range>
<range><ge>9.0</ge><lt>15.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/">
<p>Privilege escalation for external users when OIDC is enabled under certain conditions</p>
<p>Account takeover through open redirect for Group SAML accounts</p>
<p>Users on banned IP addresses can still commit to projects</p>
<p>User with developer role (group) can modify Protected branches setting on imported project and leak group CI/CD variables</p>
<p>The Gitlab web interface does not guarantee file integrity when downloading source code or installation packages from a tag or from a release.</p>
<p>Banned group member continues to have access to the public projects of a public group with the access level as same as before the ban.</p>
<p>The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.</p>
<p>XSS and content injection and iframe injection when viewing raw files on iOS devices</p>
<p>Authenticated users can find other users by their private email</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2182</cvename>
<cvename>CVE-2023-1965</cvename>
<cvename>CVE-2023-1621</cvename>
<cvename>CVE-2023-2069</cvename>
<cvename>CVE-2023-1178</cvename>
<cvename>CVE-2023-0805</cvename>
<cvename>CVE-2023-0756</cvename>
<cvename>CVE-2023-1836</cvename>
<cvename>CVE-2022-4376</cvename>
<url>https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/</url>
</references>
<dates>
<discovery>2023-05-02</discovery>
<entry>2023-05-02</entry>
</dates>
</vuln>
<vuln vid="02562a78-e6b7-11ed-b0ce-b42e991fc52e">
<topic>cloud-init -- sensitive data exposure in cloud-init logs</topic>
<affects>
<package>
<name>cloud-init</name>
<range><lt>23.1.2</lt></range>
</package>
<package>
<name>cloud-init-devel</name>
<range><lt>23.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@ubuntu.com reports:</p>
<blockquote cite="https://bugs.launchpad.net/cloud-init/+bug/2013967">
<p>Sensitive data could be exposed in logs of cloud-init before version
23.1.2. An attacker could use this information to find hashed
passwords and possibly escalate their privilege.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1786</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-1786</url>
</references>
<dates>
<discovery>2023-04-26</discovery>
<entry>2023-04-29</entry>
</dates>
</vuln>
<vuln vid="4da51989-5a8b-4eb9-b442-46d94ec0802d">
<topic>h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service</topic>
<affects>
<package>
<name>h2o</name>
<range><le>2.2.6</le></range>
</package>
<package>
<name>h2o-devel</name>
<range><lt>2.3.0.d.20230427</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elijah Glover reports:</p>
<blockquote cite="https://github.com/h2o/h2o/issues/3228">
<p>
Malformed HTTP/1.1 requests can crash worker processes.
occasionally locking up child workers and causing denial of
service, and an outage dropping any open connections.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-30847</cvename>
<url>https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx</url>
</references>
<dates>
<discovery>2023-04-27</discovery>
<entry>2023-04-30</entry>
</dates>
</vuln>
<vuln vid="d2c6173f-e43b-11ed-a1d7-002590f2a714">
<topic>git -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.40.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.40.1</lt></range>
</package>
<package>
<name>git-tiny</name>
<range><lt>2.40.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git developers reports:</p>
<blockquote cite="INSERT URL HERE">
<p>This update includes 2 security fixes:</p>
<ul>
<li>CVE-2023-25652: By feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch)</li>
<li>CVE-2023-29007: A specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug that can be used to inject arbitrary configuration into user's git config. This can result in arbitrary execution of code, by inserting values for core.pager, core.editor and so on</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-25652</cvename>
<url>https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx</url>
<cvename>CVE-2023-29007</cvename>
<url>https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844</url>
</references>
<dates>
<discovery>2023-04-25</discovery>
<entry>2023-04-26</entry>
</dates>
</vuln>
<vuln vid="0b85b1cd-e468-11ed-834b-6c3be5272acd">
<topic>Grafana -- Critical vulnerability in golang</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>8.5.24</lt></range>
<range><ge>9.0.0</ge><lt>9.2.17</lt></range>
<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.5.24</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.2.17</lt></range>
<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/04/26/precautionary-patches-for-grafana-released-following-critical-go-vulnerability-cve-2023-24538/">
<p>An issue in how go handles backticks (`) with Javascript can lead to
an injection of arbitrary code into go templates. While Grafana Labs software
contains potentially vulnerable versions of go, we have not identified any
exploitable use cases at this time.</p>
<p>The CVSS score for this vulnerability is 0.0 (adjusted), 9.8 (base).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-24538</cvename>
<url>https://grafana.com/blog/2023/04/26/precautionary-patches-for-grafana-released-following-critical-go-vulnerability-cve-2023-24538/</url>
</references>
<dates>
<discovery>2023-04-19</discovery>
<entry>2023-04-26</entry>
</dates>
</vuln>
<vuln vid="5e257b0d-e466-11ed-834b-6c3be5272acd">
<topic>Grafana -- Exposure of sensitive information to an unauthorized actor</topic>
<affects>
<package>
<name>grafana</name>
<name>grafana9</name>
<range><ge>9.1.0</ge><lt>9.2.17</lt></range>
<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/04/26/grafana-security-release-new-versions-of-grafana-with-security-fixes-for-cve-2023-28119-and-cve-2023-1387/">
<p>When setting up Grafana, there is an option to enable
<a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/jwt/">
JWT authentication</a>. Enabling this will allow users to authenticate towards
the Grafana instance with a special header (default <code>X-JWT-Assertion</code>
).</p>
<p>In Grafana, there is an additional way to authenticate using JWT called
<a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/jwt/#url-login">
URL login</a> where the token is passed as a query parameter.</p>
<p>When using this option, a JWT token is passed to the data source as a header,
which leads to exposure of sensitive information to an unauthorized party.</p>
<p>The CVSS score for this vulnerability is 4.2 Medium</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1387</cvename>
<url>https://grafana.com/security/security-advisories/cve-2023-1387/</url>
</references>
<dates>
<discovery>2023-04-26</discovery>
<entry>2023-04-26</entry>
</dates>
</vuln>
<vuln vid="c676bb1b-e3f8-11ed-b37b-901b0e9408dc">
<topic>element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting</topic>
<affects>
<package>
<name>element-web</name>
<range><lt>1.11.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/advisories/GHSA-xv83-x443-7rmw">
<p>matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP
client into a web page. Prior to version 3.71.0, plain text messages
containing HTML tags are rendered as HTML in the search results.
To exploit this, an attacker needs to trick a user into searching
for a specific message containing an HTML injection payload. No
cross-site scripting attack is possible due to the hardcoded content
security policy. Version 3.71.0 of the SDK patches over the issue.
As a workaround, restarting the client will clear the HTML injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-30609</cvename>
<url>https://github.com/advisories/GHSA-xv83-x443-7rmw</url>
</references>
<dates>
<discovery>2023-04-25</discovery>
<entry>2023-04-26</entry>
</dates>
</vuln>
<vuln vid="4ee322e9-e363-11ed-b934-b42e991fc52e">
<topic>jellyfin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>jellyfin</name>
<range><lt>10.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq">
<p>Jellyfin is a free-software media system. Versions starting with
10.8.0 and prior to 10.8.10 and prior have a directory traversal
vulnerability inside the `ClientLogController`, specifically
`/ClientLog/Document`. When combined with a cross-site scripting
vulnerability (CVE-2023-30627), this can result in file write and
arbitrary code execution. Version 10.8.10 has a patch for this
issue. There are no known workarounds.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-30626</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-30626</url>
<cvename>CVE-2023-30627</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-30627</url>
</references>
<dates>
<discovery>2023-04-24</discovery>
<entry>2023-04-25</entry>
</dates>
</vuln>
<vuln vid="bb528d7c-e2c6-11ed-a3e6-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-04-23">
<p>XSS</p>
<p>email address manipulation</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/20d3a0b3-2693-4bf1-b196-10741201a540/</url>
<url>https://huntr.dev/bounties/89005a6d-d019-4cb7-ae88-486d2d44190d/</url>
<url>https://huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e/</url>
<url>https://huntr.dev/bounties/840c8d91-c97e-4116-a9f8-4ab1a38d239b/</url>
</references>
<dates>
<discovery>2023-04-23</discovery>
<entry>2023-04-24</entry>
</dates>
</vuln>
<vuln vid="f504a8d2-e105-11ed-85f6-84a93843eb75">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-connector-java</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-client57</name>
<range><lt>5.7.42</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.42</lt></range>
</package>
<package>
<name>mysql-client80</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixMSQL">
<p>This Critical Patch Update contains 34 new security patches, plus
additional third party patches noted below, for Oracle MySQL. 11 of
these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without
requiring user credentials.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-37434</cvename>
<cvename>CVE-2023-21912</cvename>
<cvename>CVE-2023-21980</cvename>
<cvename>CVE-2023-21946</cvename>
<cvename>CVE-2023-21929</cvename>
<cvename>CVE-2023-21971</cvename>
<cvename>CVE-2023-21911</cvename>
<cvename>CVE-2023-21962</cvename>
<cvename>CVE-2023-21919</cvename>
<cvename>CVE-2023-21933</cvename>
<cvename>CVE-2023-21972</cvename>
<cvename>CVE-2023-21966</cvename>
<cvename>CVE-2023-21913</cvename>
<cvename>CVE-2023-21917</cvename>
<cvename>CVE-2023-21920</cvename>
<cvename>CVE-2023-21935</cvename>
<cvename>CVE-2023-21945</cvename>
<cvename>CVE-2023-21976</cvename>
<cvename>CVE-2023-21977</cvename>
<cvename>CVE-2023-21982</cvename>
<cvename>CVE-2023-21953</cvename>
<cvename>CVE-2023-21955</cvename>
<cvename>CVE-2023-21940</cvename>
<cvename>CVE-2023-21947</cvename>
<cvename>CVE-2023-21963</cvename>
<url>https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2023-04-19</discovery>
<entry>2023-04-22</entry>
<modified>2023-04-22</modified>
</dates>
</vuln>
<vuln vid="90c48c04-d549-4fc0-a503-4775e32d438e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>112.0.5615.165</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>112.0.5615.165</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html">
<p>This update includes 8 security fixes:</p>
<ul>
<li>[1429197] High CVE-2023-2133: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30</li>
<li>[1429201] High CVE-2023-2134: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30</li>
<li>[1424337] High CVE-2023-2135: Use after free in DevTools. Reported by Cassidy Kim(@cassidy6564) on 2023-03-14</li>
<li>[1432603] High CVE-2023-2136: Integer overflow in Skia. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-04-12</li>
<li>[1430644] Medium CVE-2023-2137: Heap buffer overflow in sqlite. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2023-04-05</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2133</cvename>
<cvename>CVE-2023-2134</cvename>
<cvename>CVE-2023-2135</cvename>
<cvename>CVE-2023-2136</cvename>
<cvename>CVE-2023-2137</cvename>
<url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html</url>
</references>
<dates>
<discovery>2023-04-20</discovery>
<entry>2023-04-20</entry>
</dates>
</vuln>
<vuln vid="0bd7f07b-dc22-11ed-bf28-589cfc0f81b0">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libxml2 project reports:</p>
<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4">
<p>Hashing of empty dict strings isn't deterministic</p>
<p>Fix null deref in xmlSchemaFixupComplexType</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28484</cvename>
<cvename>CVE-2023-29469</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=2185984</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=2185994</url>
</references>
<dates>
<discovery>2023-04-11</discovery>
<entry>2023-04-16</entry>
</dates>
</vuln>
<vuln vid="e8b20517-dbb6-11ed-bf28-589cfc0f81b0">
<topic>mod_gnutls -- Infinite Loop on request read timeout</topic>
<affects>
<package>
<name>ap24-mod_gnutls</name>
<range><lt>0.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mod_gnutls project reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/mod_gnutls-devel/2023-February/000221.html">
<p>Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions
from 0.9.0 to 0.12.0 (including) did not properly fail blocking
read operations on TLS connections when the transport hit timeouts.
Instead it entered an endless loop retrying the read operation,
consuming CPU resources. This could be exploited for denial of
service attacks. If trace level logging was enabled, it would also
produce an excessive amount of log output during the loop, consuming
disk space.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-25824</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-25824</url>
<url>https://mod.gnutls.org/browser/mod_gnutls/CHANGELOG?rev=17b2836dc3e27754159ffb098323a4cd4426192f</url>
</references>
<dates>
<discovery>2023-02-23</discovery>
<entry>2023-04-15</entry>
</dates>
</vuln>
<vuln vid="6f0327d4-9902-4042-9b68-6fc2266944bc">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>112.0.5615.121</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>112.0.5615.121</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html">
<p>This update includes 2 security fixes:</p>
<ul>
<li>[1432210] High CVE-2023-2033: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-04-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-2033</cvename>
<url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2023-04-14</discovery>
<entry>2023-04-15</entry>
</dates>
</vuln>
<vuln vid="25872b25-da2d-11ed-b715-a1e76793953b">
<topic>ghostscript -- exploitable buffer overflow in (T)BCP in PS interpreter</topic>
<affects>
<package><name>ghostscript</name> <range><lt>10.01.1</lt></range></package>
<package><name>ghostscript7-base</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript7-commfont</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript7-jpnfont</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript7-korfont</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript7-x11</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript8-base</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript8-x11</name><range><lt>10.01.1</lt></range></package>
<package><name>ghostscript9-agpl-base</name><range><lt>9.56.1_10</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cve@mitre.org reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2023/04/12/4">
<p>In Artifex Ghostscript through 10.01.0, there is a buffer overflow
leading to potential corruption of data internal to the PostScript
interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode,
TBCPEncode, and TBCPDecode. If the write buffer is filled to one
byte less than full, and one then tries to write an escaped character,
two bytes are written.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28879</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-28879</url>
<url>https://artifex.com/news/critical-security-vulnerability-fixed-in-ghostscript</url>
</references>
<dates>
<discovery>2023-03-23</discovery>
<entry>2023-04-13</entry>
<modified>2023-04-28</modified>
</dates>
</vuln>
<vuln vid="96d6809a-81df-46d4-87ed-2f78c79f06b1">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.8">
<p> Receiving DNS responses from async DNS requests (via
A specially-crafted stream of FTP packets containing a
command reply with many intermediate lines can cause Zeek
to spend a large amount of time processing data. </p>
<p> A specially-crafted set of packets containing extremely
large file offsets cause cause the reassembler code to
allocate large amounts of memory. </p>
<p> The DNS manager does not correctly expire responses
that don't contain any data, such those containing NXDOMAIN
or NODATA status codes. This can lead to Zeek allocating
large amounts of memory for these responses and never
deallocating them. </p>
<p> A specially-crafted stream of RDP packets can cause
Zeek to spend large protocol validation. </p>
<p> A specially-crafted stream of SMTP packets can cause
Zeek to spend large amounts of time processing data. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.8</url>
</references>
<dates>
<discovery>2023-04-12</discovery>
<entry>2023-04-12</entry>
</dates>
</vuln>
<vuln vid="b54abe9d-7024-4d10-98b2-180cf1717766">
<topic>py-beaker -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>py37-beaker</name>
<name>py38-beaker</name>
<name>py39-beaker</name>
<name>py310-beaker</name>
<name>py311-beaker</name>
<range><le>1.12.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>matheusbrat reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-216">
<p>The Beaker library through 1.12.1 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7489</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-216</url>
</references>
<dates>
<discovery>2020-06-26</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="374793ad-2720-4c4a-b86c-fc4a1780deac">
<topic>py-psutil -- double free vulnerability</topic>
<affects>
<package>
<name>py37-psutil121</name>
<name>py38-psutil121</name>
<name>py39-psutil121</name>
<name>py310-psutil121</name>
<name>py311-psutil121</name>
<range><lt>5.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ret2libc reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-41">
<p>psutil (aka python-psutil) through 5.6.5 can have a double free.</p>
<p>This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-18874</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-41</url>
<url>https://osv.dev/vulnerability/GHSA-qfc5-mcwq-26q8</url>
</references>
<dates>
<discovery>2019-11-12</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="e1b77733-a982-442e-8796-a200571bfcf2">
<topic>py-ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-ansible</name>
<name>py38-ansible</name>
<name>py39-ansible</name>
<name>py310-ansible</name>
<name>py311-ansible</name>
<range><le>7.2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>abeluck reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-220">
<p>A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed.</p>
<p>Files would remain in the bucket exposing the data.</p>
<p>This issue affects directly data confidentiality.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-221">
<p>A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers.</p>
<p>Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes.</p>
<p>This issue affects mainly the service availability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-25635</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-220</url>
<cvename>CVE-2020-25636</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-221</url>
</references>
<dates>
<discovery>2020-10-05</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="f418cd50-561a-49a2-a133-965d03ede72a">
<topic>py-ansible -- data leak vulnerability</topic>
<affects>
<package>
<name>py37-ansible</name>
<name>py38-ansible</name>
<name>py39-ansible</name>
<name>py310-ansible</name>
<name>py311-ansible</name>
<range><le>7.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tapas jena reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-125">
<p>A flaw was found in Ansible where the secret information present in async_files are getting disclosed when the user changes the jobdir to a world readable directory.</p>
<p>Any secret information in an async status file will be readable by a malicious user on that system.</p>
<p>This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3532</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-125</url>
</references>
<dates>
<discovery>2021-06-09</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="2acdf364-9f8d-4aaf-8d1b-867fdfd771c6">
<topic>py-kerberos -- DoS and MitM vulnerabilities</topic>
<affects>
<package>
<name>py37-kerberos</name>
<name>py38-kerberos</name>
<name>py39-kerberos</name>
<name>py310-kerberos</name>
<name>py311-kerberos</name>
<range><le>1.3.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>macosforgebot reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2017-49">
<p>The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3206</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2017-49</url>
</references>
<dates>
<discovery>2017-08-25</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="c1a8ed1c-2814-4260-82aa-9e37c83aac93">
<topic>py-cryptography -- includes a vulnerable copy of OpenSSL</topic>
<affects>
<package>
<name>py37-cryptography</name>
<name>py38-cryptography</name>
<name>py39-cryptography</name>
<name>py310-cryptography</name>
<name>py311-cryptography</name>
<range><lt>39.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5">
<p>pyca/cryptography's wheels include a statically linked copy of OpenSSL.</p>
<p>The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue.</p>
<p>More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.</p>
<p>If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL.</p>
<p>Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0286</cvename>
<url>https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5</url>
</references>
<dates>
<discovery>2023-02-08</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="a32ef450-9781-414b-a944-39f2f61677f2">
<topic>py-cryptography -- allows programmers to misuse an API</topic>
<affects>
<package>
<name>py37-cryptography</name>
<name>py38-cryptography</name>
<name>py39-cryptography</name>
<name>py310-cryptography</name>
<name>py311-cryptography</name>
<range><ge>1.8</ge><lt>39.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>alex reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r">
<p>Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers.</p>
<p>This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python.</p>
<p>This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.</p>
<p>This now correctly raises an exception.</p>
<p>This issue has been present since `update_into` was originally introduced in cryptography 1.8.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-23931</cvename>
<url>https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r</url>
</references>
<dates>
<discovery>2023-02-07</discovery>
<entry>2023-04-10</entry>
</dates>
</vuln>
<vuln vid="ae132c6c-d716-11ed-956f-7054d21a9e2a">
<topic>py-tensorflow -- denial of service vulnerability</topic>
<affects>
<package>
<name>py37-tensorflow</name>
<name>py38-tensorflow</name>
<name>py39-tensorflow</name>
<name>py310-tensorflow</name>
<name>py311-tensorflow</name>
<range><lt>2.8.4</lt></range>
<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
<range><ge>2.10.0</ge><lt>2.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kang Hong Jin, Neophytos Christou, 刘力源 and Pattarakrit Rattankul report:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-cqvq-fvhr-v6hc">
<p>Another instance of CVE-2022-35935, where `SobolSample` is vulnerable to a denial of service via assumed scalar inputs, was found and fixed.</p>
</blockquote>
<p>Pattarakrit Rattankul reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-xf83-q765-xm6m">
<p>Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35935</cvename>
<url>https://osv.dev/vulnerability/GHSA-cqvq-fvhr-v6hc</url>
<cvename>CVE-2022-35991</cvename>
<url>https://osv.dev/vulnerability/GHSA-xf83-q765-xm6m</url>
</references>
<dates>
<discovery>2022-11-21</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="52311651-f100-4720-8c62-0887dad6d321">
<topic>py-tensorflow -- unchecked argument causing crash</topic>
<affects>
<package>
<name>py37-tensorflow</name>
<name>py38-tensorflow</name>
<name>py39-tensorflow</name>
<name>py310-tensorflow</name>
<name>py311-tensorflow</name>
<range><lt>2.7.2</lt></range>
<range><ge>2.8.0</ge><lt>2.8.1</lt></range>
<range><ge>2.9.0</ge><lt>2.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jingyi Shi reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-mgmh-g2v6-mqw5">
<p>The 'AvgPoolOp' function takes an argument `ksize` that must be positive but is not checked.</p>
<p>A negative `ksize` can trigger a `CHECK` failure and crash the program.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35941</cvename>
<url>https://osv.dev/vulnerability/GHSA-mgmh-g2v6-mqw5</url>
</references>
<dates>
<discovery>2022-09-16</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="951b513a-9f42-436d-888d-2162615d0fe4">
<topic>py-pymatgen -- regular expression denial of service</topic>
<affects>
<package>
<name>py37-pymatgen</name>
<name>py38-pymatgen</name>
<name>py39-pymatgen</name>
<name>py310-pymatgen</name>
<name>py311-pymatgen</name>
<range><le>2022.9.21</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-5jqp-885w-xj32">
<p>An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42964</cvename>
<url>https://osv.dev/vulnerability/GHSA-5jqp-885w-xj32</url>
</references>
<dates>
<discovery>2022-11-10</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="e87a9326-dd35-49fc-b20b-f57cbebaae87">
<topic>py-nicotine-plus -- Denial of service vulnerability</topic>
<affects>
<package>
<name>py37-nicotine-plus</name>
<name>py38-nicotine-plus</name>
<name>py39-nicotine-plus</name>
<name>py310-nicotine-plus</name>
<name>py311-nicotine-plus</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ztauras reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-p4v2-r99v-wjc2">
<p>Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45848</cvename>
<url>https://osv.dev/vulnerability/GHSA-p4v2-r99v-wjc2</url>
</references>
<dates>
<discovery>2022-03-16</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="93db4f92-9997-4f4f-8614-3963d9e2b0ec">
<topic>py-slixmpp -- incomplete SSL certificate validation</topic>
<affects>
<package>
<name>py37-slixmpp</name>
<name>py38-slixmpp</name>
<name>py39-slixmpp</name>
<name>py310-slixmpp</name>
<name>py311-slixmpp</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://osv.dev/vulnerability/GHSA-q6cq-m9gm-6q2f">
<p>Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-45197</cvename>
<url>https://osv.dev/vulnerability/GHSA-q6cq-m9gm-6q2f</url>
</references>
<dates>
<discovery>2022-12-25</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="b31f7029-817c-4c1f-b7d3-252de5283393">
<topic>py-suds -- vulnerable to symlink attacks</topic>
<affects>
<package>
<name>py37-suds</name>
<name>py38-suds</name>
<name>py39-suds</name>
<name>py310-suds</name>
<name>py311-suds</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUSE reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2013-32">
<p>cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2217</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2013-32</url>
</references>
<dates>
<discovery>2013-09-23</discovery>
<entry>2023-04-09</entry>
<modified>2023-07-08</modified>
</dates>
</vuln>
<vuln vid="b692a49c-9ae7-4958-af21-cbf8f5b819ea">
<topic>py-impacket -- multiple path traversal vulnerabilities</topic>
<affects>
<package>
<name>py37-impacket</name>
<name>py38-impacket</name>
<name>py39-impacket</name>
<name>py310-impacket</name>
<name>py311-impacket</name>
<range><ge>0.9.10</ge><lt>0.9.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>asolino reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-17">
<p>Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31800</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-17</url>
<url>https://osv.dev/vulnerability/GHSA-mj63-64x7-57xf</url>
</references>
<dates>
<discovery>2021-05-05</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="326b2f3e-6fc7-4661-955d-a772760db9cf">
<topic>py-tflite -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>py37-tflite</name>
<name>py38-tflite</name>
<name>py39-tflite</name>
<name>py310-tflite</name>
<name>py311-tflite</name>
<range><lt>2.8.4</lt></range>
<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
<range><ge>2.10.0</ge><lt>2.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thibaut Goetghebuer-Planchon reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-h6q3-vv32-2cq5">
<p>The reference kernel of the CONV_3D_TRANSPOSE TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result.</p>
<p>Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels.</p>
<p>An attacker can craft a model with a specific number of input channels in a way similar to the attached example script.</p>
<p>It is then possible to write specific values through the bias of the layer outside the bounds of the buffer.</p>
<p>This attack only works if the reference kernel resolver is used in the interpreter (i.e. `experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF` is used).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41894</cvename>
<url>https://osv.dev/vulnerability/GHSA-h6q3-vv32-2cq5</url>
</references>
<dates>
<discovery>2022-11-21</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="d82bcd2b-5cd6-421c-8179-b3ff0231029f">
<topic>py-tflite -- denial of service vulnerability</topic>
<affects>
<package>
<name>py37-tflite</name>
<name>py38-tflite</name>
<name>py39-tflite</name>
<name>py310-tflite</name>
<name>py311-tflite</name>
<range><lt>2.3.4</lt></range>
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
<range><ge>2.5.0</ge><lt>2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakun Zhang of Baidu Security reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-wf5p-c75w-w3wh">
<p>An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37689</cvename>
<url>https://osv.dev/vulnerability/GHSA-wf5p-c75w-w3wh</url>
</references>
<dates>
<discovery>2021-08-25</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="a0509648-65ce-4a1b-855e-520a75bd2549">
<topic>py-cinder -- unauthorized data access</topic>
<affects>
<package>
<name>py37-cinder</name>
<name>py38-cinder</name>
<name>py39-cinder</name>
<name>py310-cinder</name>
<name>py311-cinder</name>
<range><lt>19.1.2</lt></range>
<range><ge>20.0.0</ge><lt>20.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Utkarsh Gupta reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-7h75-hwxx-qpgc">
<p>An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0.</p>
<p>By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-47951</cvename>
<url>https://osv.dev/vulnerability/GHSA-7h75-hwxx-qpgc</url>
</references>
<dates>
<discovery>2023-01-27</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="f4a94232-7864-4afb-bbf9-ff2dc8e288d1">
<topic>py-cinder -- data leak</topic>
<affects>
<package>
<name>py37-cinder</name>
<name>py38-cinder</name>
<name>py39-cinder</name>
<name>py310-cinder</name>
<name>py311-cinder</name>
<range><le>12.0.9</le></range>
<range><ge>13.0.0</ge><le>13.0.9</le></range>
<range><ge>14.0.0</ge><le>14.3.1</le></range>
<range><ge>15.0.0</ge><le>15.6.0</le></range>
<range><ge>16.0.0</ge><le>16.4.2</le></range>
<range><ge>17.0.0</ge><le>17.4.0</le></range>
<range><ge>18.0.0</ge><le>18.2.1</le></range>
<range><ge>19.0.0</ge><le>19.2.0</le></range>
<range><ge>20.0.0</ge><le>20.1.0</le></range>
<range><ge>21.0.0</ge><le>21.1.0</le></range>
<range><ge>22.0.0</ge><le>22.0.0.0rc2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Duncan Thomas reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-qhch-g8qr-p497">
<p>The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3641</cvename>
<url>https://osv.dev/vulnerability/GHSA-qhch-g8qr-p497</url>
</references>
<dates>
<discovery>2022-05-17</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="02e51cb3-d7e4-11ed-9f7a-5404a68ad561">
<topic>traefik -- Use of vulnerable Go modules net/http, net/textproto</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.9.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://pkg.go.dev/vuln/GO-2023-1704">
<p>HTTP and MIME header parsing can allocate large amounts
of memory, even when parsing small inputs, potentially
leading to a denial of service. Certain unusual patterns
of input data can cause the common function used to parse
HTTP and MIME headers to allocate substantially more
memory than required to hold the parsed headers. An
attacker can exploit this behavior to cause an HTTP
server to allocate large amounts of memory from a small
request, potentially leading to memory exhaustion and a
denial of service. With fix, header parsing now correctly
allocates only the memory required to hold parsed headers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-24534</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2023-24534</url>
<cvename>CVE-2023-29013</cvename>
<url>https://www.cve.org/CVERecord?id=CVE-2023-29013</url>
</references>
<dates>
<discovery>2023-03-10</discovery>
<entry>2023-04-07</entry>
</dates>
</vuln>
<vuln vid="f767d615-01db-47e9-b4ab-07bb8d3409fd">
<topic>py39-cinder -- insecure-credentials flaw</topic>
<affects>
<package>
<name>py39-cinder</name>
<range><lt>14.1.0</lt></range>
<range><ge>15.0.0</ge><lt>15.2.0</lt></range>
<range><ge>16.0.0</ge><lt>15.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenStack project reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-228">
<p>An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0.</p>
<p>When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element.</p>
<p>This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume.</p>
<p>Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-10755</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2020-228</url>
</references>
<dates>
<discovery>2020-06-10</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="e5d117b3-2153-4129-81ed-42b0221afa78">
<topic>py39-OWSLib -- arbitrary file read vulnerability</topic>
<affects>
<package>
<name>py39-OWSLib</name>
<range><lt>0.28.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jorge Rosillo reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-8h9c-r582-mggc">
<p>OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload.</p>
<p>This affects all XML parsing in the codebase.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27476</cvename>
<url>https://osv.dev/vulnerability/GHSA-8h9c-r582-mggc</url>
</references>
<dates>
<discovery>2023-03-07</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="17083017-d993-43eb-8aaf-7138f4486d1c">
<topic>py39-unicorn -- sandbox escape and arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>py39-unicorn</name>
<range><lt>2.0.0rc1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>jwang-a reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-868">
<p>An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5.</p>
<p>It allows local attackers to escape the sandbox.</p>
<p>An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability.</p>
<p>The specific flaw exists within the virtual memory manager.</p>
<p>The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block.</p>
<p>An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44078</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-868</url>
</references>
<dates>
<discovery>2021-12-26</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="43e9ffd4-d6e0-11ed-956f-7054d21a9e2a">
<topic>py39-pycares -- domain hijacking vulnerability</topic>
<affects>
<package>
<name>py39-pycares</name>
<range><lt>4.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philipp Jeitner and Haya Shulman report:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-c58j-88f5-h53f">
<p>A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking.</p>
<p>The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3672</cvename>
<url>https://osv.dev/vulnerability/GHSA-c58j-88f5-h53f</url>
</references>
<dates>
<discovery>2021-06-11</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="1b38aec4-4149-4c7d-851c-3c4de3a1fbd0">
<topic>py39-setuptools -- denial of service vulnerability</topic>
<affects>
<package>
<name>py39-setuptools</name>
<range><lt>44.1.1_1</lt></range>
<range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
<range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SCH227 reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
<p>Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.</p>
<p>Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.</p>
<p>This has been patched in version 65.5.1. The patch backported to the revision 63.1.0_1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40897</cvename>
<url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
</references>
<dates>
<discovery>2022-12-23</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="187ab98e-2953-4495-b379-4060bd4b75ee">
<topic>py27-setuptools44 -- denial of service vulnerability</topic>
<affects>
<package>
<name>py27-setuptools44</name>
<range><lt>44.1.1_1</lt></range>
<range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
<range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SCH227 reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
<p>Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.</p>
<p>Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.</p>
<p>This has been patched in version 65.5.1. The patch backported to the revision 44.1.1_1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40897</cvename>
<url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
</references>
<dates>
<discovery>2022-12-23</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="24da150a-33e0-4fee-b4ee-2c6b377d3395">
<topic>py39-setuptools58 -- denial of service vulnerability</topic>
<affects>
<package>
<name>py39-setuptools58</name>
<range><lt>44.1.1_1</lt></range>
<range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
<range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SCH227 reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
<p>Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.</p>
<p>Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.</p>
<p>This has been patched in version 65.5.1. The patch backported to the revision 58.5.3_3.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40897</cvename>
<url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
</references>
<dates>
<discovery>2022-12-23</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="15dae5cc-9ee6-4577-a93e-2ab57780e707">
<topic>py39-sentry-sdk -- sensitive cookies leak</topic>
<affects>
<package>
<name>py39-sentry-sdk</name>
<range><lt>1.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tom Wolters reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-29pr-6jr8-q5jm">
<p>When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry.</p>
<p>These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28117</cvename>
<url>https://osv.dev/vulnerability/GHSA-29pr-6jr8-q5jm</url>
</references>
<dates>
<discovery>2023-03-21</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="28a37df6-ba1a-4eed-bb64-623fc8e8dfd0">
<topic>py39-py -- Regular expression Denial of Service vulnerability</topic>
<affects>
<package>
<name>py39-py</name>
<range><le>1.11.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SCH227 reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-42969">
<p>The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42969</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-42969</url>
<url>https://osv.dev/vulnerability/GHSA-w596-4wvx-j9j6</url>
</references>
<dates>
<discovery>2022-11-04</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="845f8430-d0ee-4134-ae35-480a3e139b8a">
<topic>py39-joblib -- arbitrary code execution</topic>
<affects>
<package>
<name>py39-joblib</name>
<range><lt>1.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>jimlinntu reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-288">
<p>The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21797</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2022-288</url>
<url>https://osv.dev/vulnerability/GHSA-6hrg-qmvc-2xh8</url>
</references>
<dates>
<discovery>2022-09-26</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="de970aef-d60e-466b-8e30-1ae945a047f1">
<topic>py39-configobj -- vulnerable to Regular Expression Denial of Service</topic>
<affects>
<package>
<name>py39-configobj</name>
<range><le>5.0.6_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DarkTinia reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-c33w-24p9-8m24">
<p>All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\).</p>
<p>**Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-26112</cvename>
<url>https://osv.dev/vulnerability/GHSA-c33w-24p9-8m24</url>
</references>
<dates>
<discovery>2023-04-03</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="0a38a0d9-757f-4ac3-9561-b439e933dfa9">
<topic>py39-celery -- command injection vulnerability</topic>
<affects>
<package>
<name>py39-celery</name>
<range><lt>5.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Snyk reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-858">
<p>This affects the package celery before 5.2.2.</p>
<p>It by default trusts the messages and metadata stored in backends (result stores).</p>
<p>When reading task metadata from the backend, the data is deserialized.</p>
<p>Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-23727</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-858</url>
<url>https://osv.dev/vulnerability/GHSA-q4xr-rc97-m4xx</url>
</references>
<dates>
<discovery>2021-12-09</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="8aa6340d-e7c6-41e0-b2a3-3c9e9930312a">
<topic>py39-redis -- can send response data to the client of an unrelated request</topic>
<affects>
<package>
<name>py39-redis</name>
<range><ge>4.4.0</ge><lt>4.4.4</lt></range>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>drago-balto reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5">
<p>redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request.</p>
<p>NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28859</cvename>
<url>https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5</url>
</references>
<dates>
<discovery>2023-03-26</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1">
<topic>py39-redis -- can send response data to the client of an unrelated request</topic>
<affects>
<package>
<name>py39-redis</name>
<range><lt>4.3.6</lt></range>
<range><ge>4.4.0</ge><lt>4.4.3</lt></range>
<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>drago-balto reports:</p>
<blockquote cite="https://osv.dev/vulnerability/GHSA-24wv-mv5m-xv4h">
<p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner.</p>
<p>The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665).</p>
<p>CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28858</cvename>
<url>https://osv.dev/vulnerability/GHSA-24wv-mv5m-xv4h</url>
</references>
<dates>
<discovery>2023-03-26</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="d2293e22-4390-42c2-a323-34cca2066000">
<topic>py39-sqlalchemy12 -- multiple SQL Injection vulnerabilities</topic>
<affects>
<package>
<name>py39-sqlalchemy12</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>21k reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
<p>SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.</p>
</blockquote>
<p>nosecurity reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
<p>SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7548</cvename>
<cvename>CVE-2019-7164</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
<url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
<url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
<url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
</references>
<dates>
<discovery>2019-02-06</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="8ccff771-ceca-43a0-85ad-3e595e73b425">
<topic>py39-sqlalchemy11 -- multiple SQL Injection vulnerabilities</topic>
<affects>
<package>
<name>py39-sqlalchemy11</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>21k reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
<p>SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.</p>
</blockquote>
<p>nosecurity reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
<p>SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7164</cvename>
<cvename>CVE-2019-7548</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
<url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
<url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
<url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
</references>
<dates>
<discovery>2019-02-06</discovery>
<entry>2023-04-09</entry>
</dates>
</vuln>
<vuln vid="e4181981-ccf1-11ed-956f-7054d21a9e2a">
<topic>py39-sqlalchemy10 -- multiple SQL Injection vulnerabilities</topic>
<affects>
<package>
<name>py39-sqlalchemy10</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>21k reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
<p>SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.</p>
</blockquote>
<p>nosecurity reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
<p>SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7164</cvename>
<cvename>CVE-2019-7548</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
<url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
<url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
<url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
</references>
<dates>
<discovery>2019-02-06</discovery>
<entry>2023-03-28</entry>
</dates>
</vuln>
<vuln vid="c13a8c17-cbeb-11ed-956f-7054d21a9e2a">
<topic>py39-lmdb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py39-lmdb</name>
<range><lt>0.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TeamSeri0us reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-236">
<p>An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-237">
<p>An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-238">
<p>An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-239">
<p>An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.</p>
</blockquote>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-240">
<p>An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_header obtains a zero value for a certain size field. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16224</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-236</url>
<cvename>CVE-2019-16225</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-237</url>
<cvename>CVE-2019-16226</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-238</url>
<cvename>CVE-2019-16227</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-239</url>
<cvename>CVE-2019-16228</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2019-240</url>
</references>
<dates>
<discovery>2019-09-11</discovery>
<entry>2023-03-26</entry>
</dates>
</vuln>
<vuln vid="2991178f-cbe8-11ed-956f-7054d21a9e2a">
<topic>py39-Elixir -- weak use of cryptography</topic>
<affects>
<package>
<name>py39-Elixir</name>
<range><le>0.8.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat Security Response Team reports:</p>
<blockquote cite="https://osv.dev/vulnerability/PYSEC-2012-13">
<p>Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2146</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2012-13</url>
</references>
<dates>
<discovery>2012-08-26</discovery>
<entry>2023-03-26</entry>
</dates>
</vuln>
<vuln vid="70d0d2ec-cb62-11ed-956f-7054d21a9e2a">
<topic>py39-rencode -- infinite loop that could lead to Denial of Service</topic>
<affects>
<package>
<name>py39-rencode</name>
<range><le>1.0.6_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-40839">
<p>The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-40839</cvename>
<url>https://osv.dev/vulnerability/PYSEC-2021-345</url>
<url>https://osv.dev/vulnerability/GHSA-gh8j-2pgf-x458</url>
</references>
<dates>
<discovery>2021-09-09</discovery>
<entry>2023-03-25</entry>
<modified>2023-03-26</modified>
</dates>
</vuln>
<vuln vid="3d5581ff-d388-11ed-8581-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>112.0.5615.49</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>112.0.5615.49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html">
<p>This update includes 16 security fixes:</p>
<ul>
<li>[1414018] High CVE-2023-1810: Heap buffer overflow in Visuals. Reported by Weipeng Jiang (@Krace) of VRI on 2023-02-08</li>
<li>[1420510] High CVE-2023-1811: Use after free in Frames. Reported by Thomas Orlita on 2023-03-01</li>
<li>[1418224] Medium CVE-2023-1812: Out of bounds memory access in DOM Bindings. Reported by Shijiang Yu on 2023-02-22</li>
<li>[1423258] Medium CVE-2023-1813: Inappropriate implementation in Extensions. Reported by Axel Chong on 2023-03-10</li>
<li>[1417325] Medium CVE-2023-1814: Insufficient validation of untrusted input in Safe Browsing. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2023-02-18</li>
<li>[1278708] Medium CVE-2023-1815: Use after free in Networking APIs. Reported by DDV_UA on 2021-12-10</li>
<li>[1413919] Medium CVE-2023-1816: Incorrect security UI in Picture In Picture. Reported by NDevTK on 2023-02-08</li>
<li>[1418061] Medium CVE-2023-1817: Insufficient policy enforcement in Intents. Reported by Axel Chong on 2023-02-22</li>
<li>[1223346] Medium CVE-2023-1818: Use after free in Vulkan. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research, Eric Lawrence, Microsoft, Patrick Walker (@HomeSen), and Kirtikumar Anandrao Ramchandani on 2021-06-24</li>
<li>[1406588] Medium CVE-2023-1819: Out of bounds read in Accessibility. Reported by Microsoft Edge Team on 2023-01-12</li>
<li>[1408120] Medium CVE-2023-1820: Heap buffer overflow in Browser History. Reported by raven at KunLun lab on 2023-01-17</li>
<li>[1413618] Low CVE-2023-1821: Inappropriate implementation in WebShare. Reported by Axel Chong on 2023-02-07</li>
<li>[1066555] Low CVE-2023-1822: Incorrect security UI in Navigation. Reported by 강우진 on 2020-04-01</li>
<li>[1406900] Low CVE-2023-1823: Inappropriate implementation in FedCM. Reported by Jasper Rebane (popstonia) on 2023-01-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1810</cvename>
<cvename>CVE-2023-1811</cvename>
<cvename>CVE-2023-1812</cvename>
<cvename>CVE-2023-1813</cvename>
<cvename>CVE-2023-1814</cvename>
<cvename>CVE-2023-1815</cvename>
<cvename>CVE-2023-1816</cvename>
<cvename>CVE-2023-1817</cvename>
<cvename>CVE-2023-1818</cvename>
<cvename>CVE-2023-1819</cvename>
<cvename>CVE-2023-1820</cvename>
<cvename>CVE-2023-1821</cvename>
<cvename>CVE-2023-1822</cvename>
<cvename>CVE-2023-1823</cvename>
<url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-04-05</discovery>
<entry>2023-04-05</entry>
</dates>
</vuln>
<vuln vid="348ee234-d541-11ed-ad86-a134a566f1e6">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go119</name>
<range><lt>1.19.8</lt></range>
</package>
<package>
<name>go120</name>
<range><lt>1.20.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/59180">
<p>go/parser: infinite loop in parsing</p>
<p>Calling any of the Parse functions on Go source code
which contains //line directives with very large line
numbers can cause an infinite loop due to integer
overflow.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/59234">
<p>html/template: backticks not treated as string delimiters</p>
<p>Templates did not properly consider backticks (`) as
Javascript string delimiters, and as such did not escape
them as expected. Backticks are used, since ES6, for JS
template literals. If a template contained a Go template
action within a Javascript template literal, the contents
of the action could be used to terminate the literal,
injecting arbitrary Javascript code into the Go template.
As ES6 template literals are rather complex, and
themselves can do string interpolation, we've decided
to simply disallow Go template actions from being used
inside of them (e.g. "var a = {{.}}"), since there is no
obviously safe way to allow this behavior. This takes the
same approach as github.com/google/safehtml.
Template.Parse will now return an Error when it encounters
templates like this, with a currently unexported ErrorCode
with a value of 12. This ErrorCode will be exported in the
next major release.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/58975">
<p>net/http, net/textproto: denial of service from excessive
memory allocation</p>
<p>HTTP and MIME header parsing could allocate large
amounts of memory, even when parsing small inputs.
Certain unusual patterns of input data could cause the
common function used to parse HTTP and MIME headers to
allocate substantially more memory than required to hold
the parsed headers. An attacker can exploit this
behavior to cause an HTTP server to allocate large
amounts of memory from a small request, potentially
leading to memory exhaustion and a denial of service.
Header parsing now correctly allocates only the memory
required to hold parsed headers.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/59153">
<p>net/http, net/textproto, mime/multipart: denial of service
from excessive resource consumption</p>
<p>Multipart form parsing can consume large amounts of CPU
and memory when processing form inputs containing very
large numbers of parts. This stems from several causes:
mime/multipart.Reader.ReadForm limits the total memory a
parsed multipart form can consume. ReadForm could
undercount the amount of memory consumed, leading it to
accept larger inputs than intended. Limiting total
memory does not account for increased pressure on the
garbage collector from large numbers of small
allocations in forms with many parts. ReadForm could
allocate a large number of short-lived buffers, further
increasing pressure on the garbage collector. The
combination of these factors can permit an attacker to
cause an program that parses multipart forms to consume
large amounts of CPU and memory, potentially resulting
in a denial of service. This affects programs that use
mime/multipart.Reader.ReadForm, as well as form parsing
in the net/http package with the Request methods
FormFile, FormValue, ParseMultipartForm, and
PostFormValue. ReadForm now does a better job of
estimating the memory consumption of parsed forms, and
performs many fewer short-lived allocations. In
addition, mime/multipart.Reader now imposes the
following limits on the size of parsed forms: Forms
parsed with ReadForm may contain no more than 1000
parts. This limit may be adjusted with the environment
variable GODEBUG=multipartmaxparts=. Form parts parsed
with NextPart and NextRawPart may contain no more than
10,000 header fields. In addition, forms parsed with
ReadForm may contain no more than 10,000 header fields
across all parts. This limit may be adjusted with the
environment variable GODEBUG=multipartmaxheaders=.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-24537</cvename>
<cvename>CVE-2023-24538</cvename>
<cvename>CVE-2023-24534</cvename>
<cvename>CVE-2023-24536</cvename>
<url>https://groups.google.com/g/golang-dev/c/P-sOFU28bj0/m/QE_cqf22AgAJ</url>
</references>
<dates>
<discovery>2023-04-04</discovery>
<entry>2023-04-07</entry>
</dates>
</vuln>
<vuln vid="e86b8e4d-d551-11ed-8d1e-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba416</name>
<range><lt>4.16.10</lt></range>
</package>
<package>
<name>samba417</name>
<range><lt>4.17.7</lt></range>
</package>
<package>
<name>samba418</name>
<range><lt>4.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0225.html">
<p>An incomplete access check on dnsHostName allows
authenticated but otherwise unprivileged users to
delete this attribute from any object in the directory.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0922.html">
<p>The Samba AD DC administration tool, when operating
against a remote LDAP server, will by default send
new or reset passwords over a signed-only connection. </p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0614.html">
<p>The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for
CVE-2018-10919 Confidential attribute disclosure via
LDAP filters was insufficient and an attacker may be
able to obtain confidential BitLocker recovery keys
from a Samba AD DC.</p>
<p>Installations with such secrets in their Samba AD
should assume they have been obtained and need replacing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0225</cvename>
<url>https://www.samba.org/samba/security/CVE-2023-0225.html</url>
<cvename>CVE-2023-0922</cvename>
<url>https://www.samba.org/samba/security/CVE-2023-0922.html</url>
<cvename>CVE-2023-0614</cvename>
<url>https://www.samba.org/samba/security/CVE-2023-0614.html</url>
</references>
<dates>
<discovery>2023-03-29</discovery>
<entry>2023-04-07</entry>
</dates>
</vuln>
<vuln vid="faf7c1d0-f5bb-47b4-a6a8-ef57317b9766">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><ge>5.1,1</ge><lt>5.1.3,1</lt></range>
<range><ge>5.0,1</ge><lt>5.0.3,1</lt></range>
<range><lt>4.4.4,1</lt></range>
</package>
<package>
<name>ffmpeg4</name>
<range><lt>4.4.4</lt></range>
</package>
<package>
<name>avidemux</name>
<!-- avidemux-2.8.1 has ffmpeg-4.4.2 -->
<range><le>2.9</le></range>
</package>
<package>
<name>emby-server</name>
<name>emby-server-devel</name>
<!-- emby-server-4.7.11.0 has ffmpeg 5.0 fork -->
<!-- emby-server-devel-4.8.0.29 has old ffmpeg unlike upstream -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-1.5.1 has ffmpeg-4.4.1 -->
<range><lt>1.6.0</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-32.0.60 has ffmpeg-4.4.1 fork -->
<range><le>33.0,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3109">
<p>An issue was discovered in the FFmpeg package, where
vp3_decode_frame in libavcodec/vp3.c lacks check of the
return value of av_malloc() and will cause a null pointer
dereference, impacting availability.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3341">
<p>A null pointer dereference issue was discovered in
'FFmpeg' in decode_main_header() function of
libavformat/nutdec.c file. The flaw occurs because the
function lacks check of the return value of
avformat_new_stream() and triggers the null pointer
dereference error, causing an application to crash.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3964">
<p>A vulnerability classified as problematic has been found
in ffmpeg. This affects an unknown part of the file
libavcodec/rpzaenc.c of the component QuickTime RPZA Video
Encoder. The manipulation of the argument y_size leads to
out-of-bounds read. It is possible to initiate the attack
remotely. The name of the patch is
92f9b28ed84a77138105475beba16c146bdaf984. It is recommended
to apply a patch to fix this issue. The associated
identifier of this vulnerability is VDB-213543.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3109</cvename>
<cvename>CVE-2022-3341</cvename>
<cvename>CVE-2022-3964</cvename>
<url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/2cdddcd6ec90c7a248ffe792d85faa4d89eab9f7</url>
<url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/481e81be1271ac9a0124ee615700390c2371bd89</url>
<url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/1eb002596e3761d88de4aeea3158692b82fb6307</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2022-11-12</discovery>
<entry>2023-04-07</entry>
<modified>2023-04-10</modified>
</dates>
</vuln>
<vuln vid="466ba8bd-d033-11ed-addf-080027eda32c">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.10</lt></range>
</package>
<package>
<name>mediawiki138</name>
<range><lt>1.38.6</lt></range>
</package>
<package>
<name>mediawiki139</name>
<range><lt>1.39.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawikwi reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/6UQBHI5FWLATD7QO7DI4YS54U7XSSLAN/">
<p>(T285159, CVE-2023-PENDING) SECURITY: X-Forwarded-For header allows
brute-forcing autoblocked IP addresses.</p>
<p>(T326946, CVE-2020-36649) SECURITY: Bundled PapaParse copy in
VisualEditor has known ReDos.</p>
<p>(T330086, CVE-2023-PENDING) SECURITY: OATHAuth allows replay attacks when
MediaWiki is configured without ObjectCache; Insecure Default Configuration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-36649</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/6UQBHI5FWLATD7QO7DI4YS54U7XSSLAN/</url>
</references>
<dates>
<discovery>2020-04-02</discovery>
<entry>2023-04-01</entry>
</dates>
</vuln>
<vuln vid="54006796-cf7b-11ed-a5d5-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.10.0</ge><lt>15.10.1</lt></range>
<range><ge>15.9.0</ge><lt>15.9.4</lt></range>
<range><ge>8.1</ge><lt>15.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/">
<p>Cross-site scripting in "Maximum page reached" page</p>
<p>Private project guests can read new changes using a fork</p>
<p>Mirror repository error reveals password in Settings UI</p>
<p>DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint</p>
<p>Unauthenticated users can view Environment names from public projects limited to project members only</p>
<p>Copying information to the clipboard could lead to the execution of unexpected commands</p>
<p>Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL</p>
<p>Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release</p>
<p>Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown</p>
<p>MR for security reports are available to everyone</p>
<p>API timeout when searching for group issues</p>
<p>Unauthorised user can add child epics linked to victim's epic in an unrelated group</p>
<p>GitLab search allows to leak internal notes</p>
<p>Ambiguous branch name exploitation in GitLab</p>
<p>Improper permissions checks for moving an issue</p>
<p>Private project branches names can be leaked through a fork</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3513</cvename>
<cvename>CVE-2023-0485</cvename>
<cvename>CVE-2023-1098</cvename>
<cvename>CVE-2023-1733</cvename>
<cvename>CVE-2023-0319</cvename>
<cvename>CVE-2023-1708</cvename>
<cvename>CVE-2023-0838</cvename>
<cvename>CVE-2023-0523</cvename>
<cvename>CVE-2023-0155</cvename>
<cvename>CVE-2023-1167</cvename>
<cvename>CVE-2023-1417</cvename>
<cvename>CVE-2023-1710</cvename>
<cvename>CVE-2023-0450</cvename>
<cvename>CVE-2023-1071</cvename>
<cvename>CVE-2022-3375</cvename>
<url>https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/</url>
</references>
<dates>
<discovery>2023-03-30</discovery>
<entry>2023-03-31</entry>
</dates>
</vuln>
<vuln vid="6bd2773c-cf1a-11ed-bd44-080027f5fec9">
<topic>rubygem-time -- ReDoS vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
</package>
<package>
<name>rubygem-time</name>
<range><lt>0.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ooooooo_q reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/">
<p>
The Time parser mishandles invalid strings that have
specific characters. It causes an increase in execution
time for parsing strings to Time objects.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28756</cvename>
<url>https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/</url>
</references>
<dates>
<discovery>2023-03-30</discovery>
<entry>2023-03-30</entry>
</dates>
</vuln>
<vuln vid="9b60bba1-cf18-11ed-bd44-080027f5fec9">
<topic>rubygem-uri -- ReDoS vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
</package>
<package>
<name>rubygem-uri</name>
<range><lt>0.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dominic Couture reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/">
<p>
A ReDoS issue was discovered in the URI component. The URI
parser mishandles invalid URLs that have specific
characters. It causes an increase in execution time for
parsing strings to URI objects.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28755</cvename>
<url>https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/</url>
</references>
<dates>
<discovery>2023-03-28</discovery>
<entry>2023-03-30</entry>
</dates>
</vuln>
<vuln vid="dc33795f-ced7-11ed-b1fe-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/2023/03/29/security-advisory-2023-02-for-powerdns-recursor-up-to-and-including-4-6-5-4-7-4-and-4-8-3/">
<p>PowerDNS Security Advisory 2023-02: Deterred spoofing attempts
can lead to authoritative servers being marked unavailable</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-26437</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html</url>
</references>
<dates>
<discovery>2023-03-29</discovery>
<entry>2023-03-30</entry>
</dates>
</vuln>
<vuln vid="96d84238-b500-490b-b6aa-2b77090a0410">
<topic>xorg-server -- Overlay Window Use-After-Free</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.8,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>21.1.8,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><ge>23.0.0,1</ge><lt>23.1.1,1</lt></range>
<range><lt>22.1.9,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.439</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-March/003374.html">
<ul>
<li>ZDI-CAN-19866/CVE-2023-1393: X.Org Server Overlay Window Use-After-Free
Local Privilege Escalation Vulnerability
<p>If a client explicitly destroys the compositor overlay window (aka COW),
the Xserver would leave a dangling pointer to that window in the CompScreen
structure, which will trigger a use-after-free later.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-March/003374.html</url>
<cvename>CVE-2023-1393</cvename>
</references>
<dates>
<discovery>2023-03-29</discovery>
<entry>2023-03-29</entry>
</dates>
</vuln>
<vuln vid="425b9538-ce5f-11ed-ade3-d4c9ef517024">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1t,1_2</lt></range>
</package>
<package>
<name>openssl30</name>
<range><lt>3.0.8_2</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.0_2</lt></range>
</package>
<package>
<name>openssl-quic</name>
<range><lt>3.0.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230328.txt">
<p>Severity: low</p>
<p>Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.</p>
<p>The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not
enable the check which allows certificates with invalid or incorrect
policies to pass the certificate verification.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0465</cvename>
<cvename>CVE-2023-0466</cvename>
<url>https://www.openssl.org/news/secadv/20230328.txt</url>
</references>
<dates>
<discovery>2023-03-28</discovery>
<entry>2023-03-29</entry>
</dates>
</vuln>
<vuln vid="955eb3cc-ce0b-11ed-825f-6c3be5272acd">
<topic>Grafana -- Stored XSS in Graphite FunctionDescription tooltip</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>8.5.22</lt></range>
<range><ge>9.0.0</ge><lt>9.2.15</lt></range>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
<range><ge>9.4.0</ge><lt>9.4.7</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.5.22</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.2.15</lt></range>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
<range><ge>9.4.0</ge><lt>9.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/03/22/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-1410/">
<p>When a user adds a Graphite data source, they can then use the data source
in a dashboard. This capability contains a feature to use Functions. Once
a function is selected, a small tooltip appears when hovering over the name
of the function. This tooltip allows you to delete the selected Function
from your query or show the Function Description. However, no sanitization
is done when adding this description to the DOM.</p>
<p>Since it is not uncommon to connect to public data sources, an attacker
could host a Graphite instance with modified Function Descriptions containing
XSS payloads. When the victim uses it in a query and accidentally hovers
over the Function Description, an attacker-controlled XSS payload
will be executed.</p>
<p>The severity of this vulnerability is of CVSSv3.1 5.7 Medium
(CVSS: AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N (5.7)).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1410</cvename>
<url>https://grafana.com/security/security-advisories/cve-2023-1410/</url>
</references>
<dates>
<discovery>2023-03-14</discovery>
<entry>2023-03-29</entry>
</dates>
</vuln>
<vuln vid="5b0ae405-cdc7-11ed-bb39-901b0e9408dc">
<topic>Matrix clients -- Prototype pollution in matrix-js-sdk</topic>
<affects>
<package>
<name>element-web</name>
<range><lt>1.11.26</lt></range>
</package>
<package>
<name>cinny</name>
<range><le>2.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0">
<p>Today we are issuing security releases of matrix-js-sdk and matrix-react-sdk
to patch a pair of High severity vulnerabilities (CVE-2023-28427 /
GHSA-mwq8-fjpf-c2gr for matrix-js-sdk and CVE-2023-28103 / GHSA-6g43-88cp-w5gv
for matrix-react-sdk).</p>
<p>The issues involve prototype pollution via events containing special strings
in key locations, which can temporarily disrupt normal functioning of matrix-js-sdk
and matrix-react-sdk, potentially impacting the consumer's ability to process data
safely.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28103</cvename>
<cvename>CVE-2023-28427</cvename>
<url>https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0</url>
</references>
<dates>
<discovery>2023-03-28</discovery>
<entry>2023-03-29</entry>
</dates>
</vuln>
<vuln vid="6bacd9fd-ca56-11ed-bc52-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-03-20">
<p>XSS</p>
<p>weak passwords</p>
<p>privilege escalation</p>
<p>Captcha bypass</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/e8109aed-d364-4c0c-9545-4de0347b10e1/</url>
<url>https://huntr.dev/bounties/39715aaf-e798-4c60-97c4-45f4f2cd5c61/</url>
<url>https://huntr.dev/bounties/01d6ae23-3a8f-42a8-99f4-10246187d71b/</url>
<url>https://huntr.dev/bounties/dda73cb6-9344-4822-97a1-2e31efb6a73e/</url>
<url>https://huntr.dev/bounties/529f2361-eb2e-476f-b7ef-4e561a712e28/</url>
<url>https://huntr.dev/bounties/1dc7f818-c8ea-4f80-b000-31b48a426334/</url>
<url>https://huntr.dev/bounties/e495b443-b328-42f5-aed5-d68b929b4cb9/</url>
<url>https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e/</url>
<url>https://huntr.dev/bounties/93f981a3-231d-460d-a239-bb960e8c2fdc/</url>
<url>https://huntr.dev/bounties/e4a58835-96b5-412c-a17e-3ceed30231e1/</url>
<url>https://huntr.dev/bounties/b7d244b7-5ac3-4964-81ee-8dbb5bb5e33a/</url>
<url>https://huntr.dev/bounties/24c0a65f-0751-4ff8-af63-4b325ac8879f/</url>
<url>https://huntr.dev/bounties/3c2374cc-7082-44b7-a6a6-ccff7a650a3a/</url>
<url>https://huntr.dev/bounties/0854328e-eb00-41a3-9573-8da8f00e369c/</url>
<url>https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191/</url>
<url>https://huntr.dev/bounties/584a200a-6ff8-4d53-a3c0-e7893edff60c/</url>
<url>https://huntr.dev/bounties/bce84c02-abb2-474f-a67b-1468c9dcabb8/</url>
<url>https://huntr.dev/bounties/882ffa07-5397-4dbb-886f-4626859d711a/</url>
<url>https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957/</url>
<url>https://huntr.dev/bounties/2d0ac48a-490d-4548-8d98-7447042dd1b5/</url>
</references>
<dates>
<discovery>2023-03-20</discovery>
<entry>2023-03-24</entry>
</dates>
</vuln>
<vuln vid="1ba034fb-ca38-11ed-b242-d4c9ef517024">
<topic>OpenSSL -- Excessive Resource Usage Verifying X.509 Policy Constraints</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1t,1_1</lt></range>
</package>
<package>
<name>openssl30</name>
<range><lt>3.0.8_1</lt></range>
</package>
<package>
<name>openssl31</name>
<range><lt>3.1.0_1</lt></range>
</package>
<package>
<name>openssl-quic</name>
<range><lt>3.0.8_1</lt></range>
</package>
<package>
<name>virtualbox-ose</name>
<range><lt>6.1.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230322.txt">
<p>Severity: Low</p>
<p>A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints. Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0464</cvename>
<url>https://www.openssl.org/news/secadv/20230322.txt</url>
</references>
<dates>
<discovery>2023-03-23</discovery>
<entry>2023-03-24</entry>
<modified>2023-07-19</modified>
</dates>
</vuln>
<vuln vid="2fdb053c-ca25-11ed-9d7e-080027f5fec9">
<topic>rack -- possible denial of service vulnerability in header parsing</topic>
<affects>
<package>
<name>rubygem-rack</name>
<range><lt>3.0.6.1,3</lt></range>
</package>
<package>
<name>rubygem-rack22</name>
<range><lt>2.2.6.6,3</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ooooooo_q reports:</p>
<blockquote cite="https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466">
<p>
Carefully crafted input can cause header parsing in Rack
to take an unexpected amount of time, possibly resulting
in a denial of service attack vector. Any applications
that parse headers using Rack (virtually all Rails
applications) are impacted.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27539</cvename>
<url>https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466</url>
</references>
<dates>
<discovery>2023-03-13</discovery>
<entry>2023-03-24</entry>
</dates>
</vuln>
<vuln vid="dec6b8e9-c9fe-11ed-bb39-901b0e9408dc">
<topic>dino -- Insufficient message sender validation in Dino</topic>
<affects>
<package>
<name>dino</name>
<range><lt>0.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dino team reports:</p>
<blockquote cite="https://dino.im/security/cve-2023-28686/">
<p>Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows
attackers to modify the personal bookmark store via a crafted
message. The attacker can change the display of group chats or
force a victim to join a group chat; the victim may then be tricked
into disclosing sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28686</cvename>
<url>https://dino.im/security/cve-2023-28686/</url>
</references>
<dates>
<discovery>2023-03-23</discovery>
<entry>2023-03-24</entry>
</dates>
</vuln>
<vuln vid="38f213b6-8f3d-4067-91ef-bf14de7ba518">
<topic>libXpm -- Issues handling XPM files</topic>
<affects>
<package>
<name>libXpm</name>
<range><lt>3.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.Org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-January/003312.html">
<ol>
<li>CVE-2022-46285: Infinite loop on unclosed comments
<p>When reading XPM images from a file with libXpm 3.5.14 or older, if a
comment in the file is not closed (i.e. a C-style comment starts with
"/*" and is missing the closing "*/"), the ParseComment() function will
loop forever calling getc() to try to read the rest of the comment,
failing to notice that it has returned EOF, which may cause a denial of
service to the calling program.</p>
<p>This issue was found by Marco Ivaldi of the Humanativa Group's HN Security team.</p>
<p>The fix is provided in
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148</p></li>
<li>CVE-2022-44617: Runaway loop on width of 0 and enormous height
<p>When reading XPM images from a file with libXpm 3.5.14 or older, if a
image has a width of 0 and a very large height, the ParsePixels() function
will loop over the entire height calling getc() and ungetc() repeatedly,
or in some circumstances, may loop seemingly forever, which may cause a denial
of service to the calling program when given a small crafted XPM file to parse.</p>
<p>This issue was found by Martin Ettl.</p>
<p>The fix is provided in
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
and
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/c5ab17bcc34914c0b0707d</p></li>
<li>CVE-2022-4883: compression commands depend on $PATH
<p>By default, on all platforms except MinGW, libXpm will detect if a filename
ends in .Z or .gz, and will when reading such a file fork off an uncompress
or gunzip command to read from via a pipe, and when writing such a file will
fork off a compress or gzip command to write to via a pipe.</p>
<p>In libXpm 3.5.14 or older these are run via execlp(), relying on $PATH
to find the commands. If libXpm is called from a program running with
raised privileges, such as via setuid, then a malicious user could set
$PATH to include programs of their choosing to be run with those privileges.</p>
<p>This issue was found by Alan Coopersmith of the Oracle Solaris team.</p></li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-January/003312.html</url>
<cvename>CVE-2022-46285</cvename>
<cvename>CVE-2022-44617</cvename>
<cvename>CVE-2022-4883</cvename>
</references>
<dates>
<discovery>2023-01-17</discovery>
<entry>2023-03-23</entry>
</dates>
</vuln>
<vuln vid="1b15a554-c981-11ed-bb39-901b0e9408dc">
<topic>tailscale -- security vulnerability in Tailscale SSH</topic>
<affects>
<package>
<name>tailscale</name>
<range><lt>1.38.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tailscale team reports:</p>
<blockquote cite="https://tailscale.com/security-bulletins/#ts-2023-003">
<p>A vulnerability identified in the implementation of Tailscale SSH in FreeBSD
allowed commands to be run with a higher privilege group ID than that specified
by Tailscale SSH access rules.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28436</cvename>
<url>https://tailscale.com/security-bulletins/#ts-2023-003</url>
</references>
<dates>
<discovery>2023-03-22</discovery>
<entry>2023-03-23</entry>
</dates>
</vuln>
<vuln vid="c8b334e0-6e83-4575-81d1-f9d5803ceb07">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>111.0.5563.110</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>111.0.5563.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html">
<p>This update includes 8 security fixes:</p>
<ul>
<li>[1421773] High CVE-2023-1528: Use after free in Passwords. Reported by Wan Choi of Seoul National University on 2023-03-07</li>
<li>[1419718] High CVE-2023-1529: Out of bounds memory access in WebHID. Reported by anonymous on 2023-02-27</li>
<li>[1419831] High CVE-2023-1530: Use after free in PDF. Reported by The UK's National Cyber Security Centre (NCSC) on 2023-02-27</li>
<li>[1415330] High CVE-2023-1531: Use after free in ANGLE. Reported by Piotr Bania of Cisco Talos on 2023-02-13</li>
<li>[1421268] High CVE-2023-1532: Out of bounds read in GPU Video. Reported by Mark Brand of Google Project Zero on 2023-03-03</li>
<li>[1422183] High CVE-2023-1533: Use after free in WebProtect. Reported by Weipeng Jiang (@Krace) of VRI on 2023-03-07</li>
<li>[1422594] High CVE-2023-1534: Out of bounds read in ANGLE. Reported by Jann Horn and Mark Brand of Google Project Zero on 2023-03-08</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1528</cvename>
<cvename>CVE-2023-1529</cvename>
<cvename>CVE-2023-1530</cvename>
<cvename>CVE-2023-1531</cvename>
<cvename>CVE-2023-1532</cvename>
<cvename>CVE-2023-1533</cvename>
<cvename>CVE-2023-1534</cvename>
<url>https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2023-03-21</discovery>
<entry>2023-03-22</entry>
</dates>
</vuln>
<vuln vid="a60cc0e4-c7aa-11ed-8a4b-080027f5fec9">
<topic>redis -- specially crafted MSETNX command can lead to denial-of-service</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.10</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.10.20230320</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yupeng Yang reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c">
<p>
Authenticated users can use the MSETNX command to trigger
a runtime assertion and termination of the Redis server
process.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-28425</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c</url>
</references>
<dates>
<discovery>2023-03-20</discovery>
<entry>2023-03-21</entry>
</dates>
</vuln>
<vuln vid="0d7d104c-c6fb-11ed-8a4b-080027f5fec9">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>8.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Harry Sintonen reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<dl>
<dt>CVE-2023-27533</dt>
<dd>
curl supports communicating using the TELNET protocol
and as a part of this it offers users to pass on user
name and "telnet options" for the server
negotiation.
Due to lack of proper input scrubbing and without it
being the documented functionality, curl would pass on
user name and telnet options to the server as
provided. This could allow users to pass in carefully
crafted content that pass on content or do option
negotiation without the application intending to do
so. In particular if an application for example allows
users to provide the data or parts of the data.
</dd>
<dt>CVE-2023-27534</dt>
<dd>
curl supports SFTP transfers. curl's SFTP implementation
offers a special feature in the path component of URLs:
a tilde (~) character as the first path element in the
path to denotes a path relative to the user's home
directory. This is supported because of wording in the
once proposed to-become RFC draft that was to dictate
how SFTP URLs work.
Due to a bug, the handling of the tilde in SFTP path did
however not only replace it when it is used stand-alone
as the first path element but also wrongly when used as
a mere prefix in the first element.
Using a path like /~2/foo when accessing a server using
the user dan (with home directory /home/dan) would then
quite surprisingly access the file /home/dan2/foo.
This can be taken advantage of to circumvent filtering
or worse.
</dd>
<dt>CVE-2023-27535</dt>
<dd>
libcurl would reuse a previously created FTP connection
even when one or more options had been changed that
could have made the effective user a very different one,
thus leading to the doing the second transfer with wrong
credentials.
libcurl keeps previously used connections in a
connection pool for subsequent transfers to reuse if one
of them matches the setup. However, several FTP settings
were left out from the configuration match checks,
making them match too easily. The settings in questions
are CURLOPT_FTP_ACCOUNT,
CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC and
CURLOPT_USE_SSL level.
</dd>
<dt>CVE-2023-27536</dt>
<dd>
ibcurl would reuse a previously created connection even
when the GSS delegation (CURLOPT_GSSAPI_DELEGATION)
option had been changed that could have changed the
user's permissions in a second transfer.
libcurl keeps previously used connections in a
connection pool for subsequent transfers to reuse if one
of them matches the setup. However, this GSS delegation
setting was left out from the configuration match
checks, making them match too easily, affecting
krb5/kerberos/negotiate/GSSAPI transfers.
</dd>
<dt>CVE-2023-27537</dt>
<dd>
libcurl supports sharing HSTS data between separate
"handles". This sharing was introduced without
considerations for do this sharing across separate
threads but there was no indication of this fact in the
documentation.
Due to missing mutexes or thread locks, two threads
sharing the same HSTS data could end up doing a
double-free or use-after-free.
</dd>
<dt>CVE-2023-27538</dt>
<dd>
libcurl would reuse a previously created connection even
when an SSH related option had been changed that should
have prohibited reuse.
libcurl keeps previously used connections in a
connection pool for subsequent transfers to reuse if one
of them matches the setup. However, two SSH settings
were left out from the configuration match checks,
making them match too easily.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27533</cvename>
<cvename>CVE-2023-27534</cvename>
<cvename>CVE-2023-27535</cvename>
<cvename>CVE-2023-27536</cvename>
<cvename>CVE-2023-27537</cvename>
<cvename>CVE-2023-27538</cvename>
<url>https://curl.se/docs/security.html</url>
</references>
<dates>
<discovery>2023-03-20</discovery>
<entry>2023-03-20</entry>
</dates>
</vuln>
<vuln vid="72583cb3-a7f9-11ed-bd9e-589cfc0f81b0">
<topic>phpMyAdmin -- XSS vulnerability in drag-and-drop upload</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php80</name>
<name>phpMyAdmin-php81</name>
<name>phpMyAdmin-php82</name>
<name>phpMyAdmin5</name>
<name>phpMyAdmin5-php80</name>
<name>phpMyAdmin5-php81</name>
<name>phpMyAdmin5-php82</name>
<range><lt>4.9.11</lt></range>
<range><ge>5.0</ge><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/news/2023/2/8/phpmyadmin-4911-and-521-are-released/">
<p>PMASA-2023-1 XSS vulnerability in drag-and-drop upload</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2023-1/</url>
</references>
<dates>
<discovery>2023-02-07</discovery>
<entry>2023-03-16</entry>
</dates>
</vuln>
<vuln vid="8edeb3c1-bfe7-11ed-96f5-3497f65b111b">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.56">
<ul>
<li>CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi
HTTP response splitting (cve.mitre.org).
HTTP Response Smuggling vulnerability in Apache HTTP Server
via mod_proxy_uwsgi. This issue affects Apache HTTP Server:
from 2.4.30 through 2.4.55.
Special characters in the origin response header can
truncate/split the response forwarded to the client.</li>
<li>CVE-2023-25690: HTTP request splitting with mod_rewrite
and mod_proxy (cve.mitre.org).
Some mod_proxy configurations on Apache HTTP Server versions
2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
Configurations are affected when mod_proxy is enabled along
with some form of RewriteRule or ProxyPassMatch in which a
non-specific pattern matches some portion of the user-supplied
request-target (URL) data and is then re-inserted into the
proxied request-target using variable substitution.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-25690</cvename>
<cvename>CVE-2023-27522</cvename>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.56</url>
</references>
<dates>
<discovery>2023-03-08</discovery>
<entry>2023-03-11</entry>
</dates>
</vuln>
<vuln vid="d357f6bb-0af4-4ac9-b096-eeec183ad829">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>111.0.5563.64</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>111.0.5563.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html">
<p>This update includes 40 security fixes:</p>
<ul>
<li>[1411210] High CVE-2023-1213: Use after free in Swiftshader. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-01-30</li>
<li>[1412487] High CVE-2023-1214: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-02-03</li>
<li>[1417176] High CVE-2023-1215: Type Confusion in CSS. Reported by Anonymous on 2023-02-17</li>
<li>[1417649] High CVE-2023-1216: Use after free in DevTools. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2023-02-21</li>
<li>[1412658] High CVE-2023-1217: Stack buffer overflow in Crash reporting. Reported by sunburst of Ant Group Tianqiong Security Lab on 2023-02-03</li>
<li>[1413628] High CVE-2023-1218: Use after free in WebRTC. Reported by Anonymous on 2023-02-07</li>
<li>[1415328] High CVE-2023-1219: Heap buffer overflow in Metrics. Reported by Sergei Glazunov of Google Project Zero on 2023-02-13</li>
<li>[1417185] High CVE-2023-1220: Heap buffer overflow in UMA. Reported by Sergei Glazunov of Google Project Zero on 2023-02-17</li>
<li>[1385343] Medium CVE-2023-1221: Insufficient policy enforcement in Extensions API. Reported by Ahmed ElMasry on 2022-11-16</li>
<li>[1403515] Medium CVE-2023-1222: Heap buffer overflow in Web Audio API. Reported by Cassidy Kim(@cassidy6564) on 2022-12-24</li>
<li>[1398579] Medium CVE-2023-1223: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2022-12-07</li>
<li>[1403539] Medium CVE-2023-1224: Insufficient policy enforcement in Web Payments API. Reported by Thomas Orlita on 2022-12-25</li>
<li>[1408799] Medium CVE-2023-1225: Insufficient policy enforcement in Navigation. Reported by Roberto Ffrench-Davis @Lihaft on 2023-01-20</li>
<li>[1013080] Medium CVE-2023-1226: Insufficient policy enforcement in Web Payments API. Reported by Anonymous on 2019-10-10</li>
<li>[1348791] Medium CVE-2023-1227: Use after free in Core. Reported by @ginggilBesel on 2022-07-31</li>
<li>[1365100] Medium CVE-2023-1228: Insufficient policy enforcement in Intents. Reported by Axel Chong on 2022-09-18</li>
<li>[1160485] Medium CVE-2023-1229: Inappropriate implementation in Permission prompts. Reported by Thomas Orlita on 2020-12-20</li>
<li>[1404230] Medium CVE-2023-1230: Inappropriate implementation in WebApp Installs. Reported by Axel Chong on 2022-12-30</li>
<li>[1274887] Medium CVE-2023-1231: Inappropriate implementation in Autofill. Reported by Yan Zhu, Brave on 2021-11-30</li>
<li>[1346924] Low CVE-2023-1232: Insufficient policy enforcement in Resource Timing. Reported by Sohom Datta on 2022-07-24</li>
<li>[1045681] Low CVE-2023-1233: Insufficient policy enforcement in Resource Timing. Reported by Soroush Karami on 2020-01-25</li>
<li>[1404621] Low CVE-2023-1234: Inappropriate implementation in Intents. Reported by Axel Chong on 2023-01-03</li>
<li>[1404704] Low CVE-2023-1235: Type Confusion in DevTools. Reported by raven at KunLun lab on 2023-01-03</li>
<li>[1374518] Low CVE-2023-1236: Inappropriate implementation in Internals. Reported by Alesandro Ortiz on 2022-10-14</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-1213</cvename>
<cvename>CVE-2023-1214</cvename>
<cvename>CVE-2023-1215</cvename>
<cvename>CVE-2023-1216</cvename>
<cvename>CVE-2023-1217</cvename>
<cvename>CVE-2023-1218</cvename>
<cvename>CVE-2023-1219</cvename>
<cvename>CVE-2023-1220</cvename>
<cvename>CVE-2023-1221</cvename>
<cvename>CVE-2023-1222</cvename>
<cvename>CVE-2023-1223</cvename>
<cvename>CVE-2023-1224</cvename>
<cvename>CVE-2023-1225</cvename>
<cvename>CVE-2023-1226</cvename>
<cvename>CVE-2023-1227</cvename>
<cvename>CVE-2023-1228</cvename>
<cvename>CVE-2023-1229</cvename>
<cvename>CVE-2023-1230</cvename>
<cvename>CVE-2023-1231</cvename>
<cvename>CVE-2023-1232</cvename>
<cvename>CVE-2023-1233</cvename>
<cvename>CVE-2023-1234</cvename>
<cvename>CVE-2023-1235</cvename>
<cvename>CVE-2023-1236</cvename>
<url>https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-03-08</discovery>
<entry>2023-03-09</entry>
</dates>
</vuln>
<vuln vid="f68bb358-be8e-11ed-9215-00e081b7aa2d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.394</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.387.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2023-03-08/">
<h1>Description</h1>
<h5>(High) SECURITY-3037 / CVE-2023-27898</h5>
<p>XSS vulnerability in plugin manager</p>
<h5>(Medium) SECURITY-3030 / CVE-2023-24998 (upstream issue), CVE-2023-27900 (MultipartFormDataParser), CVE-2023-27901 (StaplerRequest)</h5>
<p>DoS vulnerability in bundled Apache Commons FileUpload library</p>
<h5/>
<h5>(Medium) SECURITY-1807 / CVE-2023-27902</h5>
<p>Workspace temporary directories accessible through directory browser</p>
<h5>(Low) SECURITY-3058 / CVE-2023-27903</h5>
<p>Temporary file parameter created with insecure permissions</p>
<h5>(Low) SECURITY-2120 / CVE-2023-27904</h5>
<p>Information disclosure through error stack traces related to agents</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27898</cvename>
<cvename>CVE-2023-24998</cvename>
<cvename>CVE-2023-27900</cvename>
<cvename>CVE-2023-27901</cvename>
<cvename>CVE-2023-27902</cvename>
<cvename>CVE-2023-27903</cvename>
<cvename>CVE-2023-27904</cvename>
<url>https://www.jenkins.io/security/advisory/2023-03-08/</url>
</references>
<dates>
<discovery>2023-03-08</discovery>
<entry>2023-03-09</entry>
</dates>
</vuln>
<vuln vid="742279d6-bdbe-11ed-a179-2b68e9d12706">
<topic>go -- crypto/elliptic: incorrect P-256 ScalarMult and ScalarBaseMult results</topic>
<affects>
<package>
<name>go119</name>
<range><lt>1.19.7</lt></range>
</package>
<package>
<name>go120</name>
<range><lt>1.20.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/58647">
<p>crypto/elliptic: incorrect P-256 ScalarMult and
ScalarBaseMult results</p>
<p>The ScalarMult and ScalarBaseMult methods of the P256
Curve may return an incorrect result if called with some
specific unreduced scalars (a scalar larger than the
order of the curve).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-24532</cvename>
<url>https://groups.google.com/g/golang-dev/c/3wmx8i5WvNY/m/AEOlccrGAwAJ</url>
</references>
<dates>
<discovery>2023-02-22</discovery>
<entry>2023-03-08</entry>
</dates>
</vuln>
<vuln vid="bed545c6-bdb8-11ed-bca8-a33124f1beb1">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php74</name>
<name>mantis-php80</name>
<name>mantis-php81</name>
<name>mantis-php82</name>
<range><lt>2.25.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis 2.25.6 release reports:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.25.6">
<p>Security and maintenance release</p>
<ul>
<li>0031086: Private issue summary disclosure (CVE-2023-22476)</li>
<li>0030772: Update (bundled) moment.js to 2.29.4 (CVE-2022-31129)</li>
<li>0030791: Allow adding relation type noopener/noreferrer to outgoing links</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22476</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-22476</url>
<cvename>CVE-2022-31129</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-31129</url>
</references>
<dates>
<discovery>2023-01-06</discovery>
<entry>2023-03-08</entry>
</dates>
</vuln>
<vuln vid="6678211c-bd47-11ed-beb0-1c1b0d9ea7e6">
<topic>Apache OpenOffice -- master password vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.13</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1678061694,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openoffice project reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-37400">
<p>Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-37401">
<p>Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-37400</cvename>
<cvename>CVE-2022-37401</cvename>
<url>https://cwiki.apache.org/confluence/display/OOOUSERS/AOO+4.1.13+Release+Notes</url>
</references>
<dates>
<discovery>2022-02-25</discovery>
<entry>2023-03-08</entry>
</dates>
</vuln>
<vuln vid="f0798a6a-bbdb-11ed-ba99-080027f5fec9">
<topic>rack -- possible DoS vulnerability in multipart MIME parsing</topic>
<affects>
<package>
<name>rubygem-rack</name>
<range><lt>3.0.4.2,3</lt></range>
</package>
<package>
<name>rubygem-rack22</name>
<range><lt>2.2.6.3,3</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388">
<p>
The Multipart MIME parsing code in Rack limits the number
of file parts, but does not limit the total number of
parts that can be uploaded. Carefully crafted requests can
abuse this and cause multipart parsing to take longer than
expected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-27530</cvename>
<url>https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388</url>
</references>
<dates>
<discovery>2023-03-03</discovery>
<entry>2023-03-06</entry>
</dates>
</vuln>
<vuln vid="be233fc6-bae7-11ed-a4fb-080027f5fec9">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.88.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Harry Sintonen and Patrick Monnerat report:</p>
<blockquote cite="https://curl.se/docs/security.html">
<dl>
<dt>CVE-2023-23914</dt>
<dd>
A cleartext transmission of sensitive information
vulnerability exists in curl < v7.88.0 that could
cause HSTS functionality fail when multiple URLs are
requested serially. Using its HSTS support, curl can be
instructed to use HTTPS instead of using an insecure
clear-text HTTP step even when HTTP is provided in the
URL. This HSTS mechanism would however surprisingly be
ignored by subsequent transfers when done on the same
command line because the state would not be properly
carried on.
</dd>
<dt>CVE-2023-23915</dt>
<dd>
A cleartext transmission of sensitive information
vulnerability exists in curl < v7.88.0 that could
cause HSTS functionality to behave incorrectly when
multiple URLs are requested in parallel. Using its HSTS
support, curl can be instructed to use HTTPS instead of
using an insecure clear-text HTTP step even when HTTP is
provided in the URL. This HSTS mechanism would however
surprisingly fail when multiple transfers are done in
parallel as the HSTS cache file gets overwritten by the
most recently completed transfer. A later HTTP-only
transfer to the earlier host name would then *not* get
upgraded properly to HSTS.
</dd>
<dt>CVE-2023-23916</dt>
<dd>
An allocation of resources without limits or throttling
vulnerability exists in curl < v7.88.0 based on the
"chained" HTTP compression algorithms, meaning
that a server response can be compressed multiple times
and potentially with different algorithms. The number of
acceptable "links" in this "decompression
chain" was capped, but the cap was implemented on a
per-header basis allowing a malicious server to insert a
virtually unlimited number of compression steps simply
by using many headers. The use of such a decompression
chain could result in a "malloc bomb", making
curl end up spending enormous amounts of allocated heap
memory, or trying to and returning out of memory errors.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-23914</cvename>
<cvename>CVE-2023-23915</cvename>
<cvename>CVE-2023-23916</cvename>
<url>https://curl.se/docs/security.html</url>
</references>
<dates>
<discovery>2023-02-15</discovery>
<entry>2023-03-05</entry>
</dates>
</vuln>
<vuln vid="3f9b6943-ba58-11ed-bbbd-00e0670f2660">
<topic>strongSwan -- certificate verification vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>5.9.8</ge><lt>5.9.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html">
<p>A vulnerability related to certificate verification in TLS-based EAP methods
was discovered in strongSwan that results in a denial of service
but possibly even remote code execution. Versions 5.9.8 and 5.9.9
may be affected. </p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-26463</cvename>
<url>https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html</url>
</references>
<dates>
<discovery>2023-03-02</discovery>
<entry>2023-03-04</entry>
</dates>
</vuln>
<vuln vid="f7c5b3a9-b9fb-11ed-99c6-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.9.0</ge><lt>15.9.2</lt></range>
<range><ge>15.8.0</ge><lt>15.8.4</lt></range>
<range><ge>9.0.0</ge><lt>15.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/">
<p>Stored XSS via Kroki diagram</p>
<p>Prometheus integration Google IAP details are not hidden, may leak account details from instance/group/project settings</p>
<p>Improper validation of SSO and SCIM tokens while managing groups</p>
<p>Maintainer can leak Datadog API key by changing Datadog site</p>
<p>Clipboard based XSS in the title field of work items</p>
<p>Improper user right checks for personal snippets</p>
<p>Release Description visible in public projects despite release set as project members only</p>
<p>Group integration settings sensitive information exposed to project maintainers</p>
<p>Improve pagination limits for commits</p>
<p>Gitlab Open Redirect Vulnerability</p>
<p>Maintainer may become an Owner of a project</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0050</cvename>
<cvename>CVE-2022-4289</cvename>
<cvename>CVE-2022-4331</cvename>
<cvename>CVE-2023-0483</cvename>
<cvename>CVE-2022-4007</cvename>
<cvename>CVE-2022-3758</cvename>
<cvename>CVE-2023-0223</cvename>
<cvename>CVE-2022-4462</cvename>
<cvename>CVE-2023-1072</cvename>
<cvename>CVE-2022-3381</cvename>
<cvename>CVE-2023-1084</cvename>
<url>https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/</url>
</references>
<dates>
<discovery>2023-03-02</discovery>
<entry>2023-03-03</entry>
</dates>
</vuln>
<vuln vid="6dccc186-b824-11ed-b695-6c3be5272acd">
<topic>Grafana -- Stored XSS in text panel plugin</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
<p>During an internal audit of Grafana on January 1, a member of the security
team found a stored XSS vulnerability affecting the core text plugin.</p>
<p>The stored XSS vulnerability requires several user interactions in order
to be fully exploited. The vulnerability was possible due to React’s render
cycle that will pass through the unsanitized HTML code, but in the next cycle,
the HTML is cleaned up and saved in Grafana’s database.</p>
<p>The CVSS score for this vulnerability is 6.4 Medium
(CVSS:6.4/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22462</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf</url>
</references>
<dates>
<discovery>2023-01-01</discovery>
<entry>2023-03-01</entry>
</dates>
</vuln>
<vuln vid="e7841611-b808-11ed-b695-6c3be5272acd">
<topic>Grafana -- Stored XSS in TraceView panel</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>8.5.21</lt></range>
<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.5.21</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
<p>During an internal audit of Grafana on January 30, a member
of the engineering team found a stored XSS vulnerability affecting
the <code>TraceView</code> panel.</p>
<p>The stored XSS vulnerability was possible because the value of a span’s
attributes/resources were not properly sanitized, and this will be rendered
when the span’s attributes/resources are expanded.</p>
<p>The CVSS score for this vulnerability is 7.3 High
(CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0594</cvename>
<url>https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/</url>
</references>
<dates>
<discovery>2023-01-30</discovery>
<entry>2023-03-01</entry>
</dates>
</vuln>
<vuln vid="e2a8e2bd-b808-11ed-b695-6c3be5272acd">
<topic>Grafana -- Stored XSS in geomap panel plugin via attribution</topic>
<affects>
<package>
<name>grafana</name>
<range><lt>8.5.21</lt></range>
<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.5.21</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
<p>During an internal audit of Grafana on January 25, a member of the security
team found a stored XSS vulnerability affecting the core geomap plugin.</p>
<p>The stored XSS vulnerability was possible because map attributions weren’t
properly sanitized, allowing arbitrary JavaScript to be executed in the context
of the currently authorized user of the Grafana instance.</p>
<p>The CVSS score for this vulnerability is 7.3 High
(CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0507</cvename>
<url>https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/</url>
</references>
<dates>
<discovery>2023-01-25</discovery>
<entry>2023-03-01</entry>
</dates>
</vuln>
<vuln vid="b17bce48-b7c6-11ed-b304-080027f5fec9">
<topic>redis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.9.20230228</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.11</lt></range>
</package>
<package>
<name>redis6</name>
<range><lt>6.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redis core team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/3hQ1oTO4hMI">
<dl>
<dt>CVE-2023-25155</dt>
<dd>
Specially crafted SRANDMEMBER, ZRANDMEMBER, and
HRANDFIELD commands can trigger an integer overflow,
resulting in a runtime assertion and termination of the
Redis server process.
</dd>
<dt>CVE-2022-36021</dt>
<dd>
String matching commands (like SCAN or KEYS) with a
specially crafted pattern to trigger a denial-of-service
attack on Redis, causing it to hang and consume 100% CPU
time.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-25155</cvename>
<cvename>CVE-2022-36021</cvename>
<url>https://groups.google.com/g/redis-db/c/3hQ1oTO4hMI</url>
</references>
<dates>
<discovery>2023-02-28</discovery>
<entry>2023-03-01</entry>
</dates>
</vuln>
<vuln vid="a75929bd-b6a4-11ed-bad6-080027f5fec9">
<topic>emacs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<range><lt>28.2_3,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<name>emacs-devel-nox</name>
<range><lt>30.0.50.20230101,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xi Lu reports:</p>
<blockquote cite="https://www.debian.org/security/2023/dsa-5360">
<dl>
<dt>CVE-2022-48337</dt>
<dd>
GNU Emacs through 28.2 allows attackers to execute
commands via shell metacharacters in the name of a
source-code file, because lib-src/etags.c uses the
system C library function in its implementation of the
etags program. For example, a victim may use the
"etags -u *" command (suggested in the etags
documentation) in a situation where the current working
directory has contents that depend on untrusted input.
</dd>
<dt>CVE-2022-48338</dt>
<dd>
An issue was discovered in GNU Emacs through 28.2. In
ruby-mode.el, the ruby-find-library-file function has a
local command injection vulnerability. The
ruby-find-library-file function is an interactive
function, and bound to C-c C-f. Inside the function, the
external command gem is called through
shell-command-to-string, but the feature-name parameters
are not escaped. Thus, malicious Ruby source files may
cause commands to be executed.
</dd>
<dt>CVE-2022-48339</dt>
<dd>
An issue was discovered in GNU Emacs through
28.2. htmlfontify.el has a command injection
vulnerability. In the hfy-istext-command function, the
parameter file and parameter srcdir come from external
input, and parameters are not escaped. If a file name or
directory name contains shell metacharacters, code may
be executed.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-48337</cvename>
<cvename>CVE-2022-48338</cvename>
<cvename>CVE-2022-48339</cvename>
<url>https://www.debian.org/security/2023/dsa-5360</url>
</references>
<dates>
<discovery>2022-12-06</discovery>
<entry>2023-02-27</entry>
</dates>
</vuln>
<vuln vid="dd271de6-b444-11ed-9268-b42e991fc52e">
<topic>freerdp -- clients using the `/video` command line switch might read uninitialized data</topic>
<affects>
<package>
<name>freerdp</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39283">
<p>
All FreeRDP based clients when using the `/video`
command line switch might read uninitialized data, decode
it as audio/video and display the result. FreeRDP based
server implementations are not affected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39283</cvename>
<url>https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh</url>
</references>
<dates>
<discovery>2022-10-13</discovery>
<entry>2023-02-24</entry>
</dates>
</vuln>
<vuln vid="c682923d-b444-11ed-9268-b42e991fc52e">
<topic>freerdp -- clients using `/parallel` command line switch might read uninitialized data</topic>
<affects>
<package>
<name>freerdp</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39282">
<p>
FreeRDP based clients on unix systems using
`/parallel` command line switch might read uninitialized
data and send it to the server the client is currently
connected to. FreeRDP based server implementations are not
affected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39282</cvename>
<url>https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq</url>
</references>
<dates>
<discovery>2022-10-13</discovery>
<entry>2023-02-24</entry>
</dates>
</vuln>
<vuln vid="4d6b5ea9-bc64-4e77-a7ee-d62ba68a80dd">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>110.0.5481.177</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>110.0.5481.177</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html">
<p>This update includes 10 security fixes:</p>
<ul>
<li>[1415366] Critical CVE-2023-0941: Use after free in Prompts. Reported by Anonymous on 2023-02-13</li>
<li>[1414738] High CVE-2023-0927: Use after free in Web Payments API. Reported by Rong Jian of VRI on 2023-02-10</li>
<li>[1309035] High CVE-2023-0928: Use after free in SwiftShader. Reported by Anonymous on 2022-03-22</li>
<li>[1399742] High CVE-2023-0929: Use after free in Vulkan. Reported by Cassidy Kim(@cassidy6564) on 2022-12-09</li>
<li>[1410766] High CVE-2023-0930: Heap buffer overflow in Video. Reported by Cassidy Kim(@cassidy6564) on 2023-01-27</li>
<li>[1407701] High CVE-2023-0931: Use after free in Video. Reported by Cassidy Kim(@cassidy6564) on 2023-01-17</li>
<li>[1413005] High CVE-2023-0932: Use after free in WebRTC. Reported by Omri Bushari (Talon Cyber Security) on 2023-02-05</li>
<li>[1404864] Medium CVE-2023-0933: Integer overflow in PDF. Reported by Zhiyi Zhang from Codesafe Team of Legendsec at QI-ANXIN</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0941</cvename>
<cvename>CVE-2023-0927</cvename>
<cvename>CVE-2023-0928</cvename>
<cvename>CVE-2023-0929</cvename>
<cvename>CVE-2023-0930</cvename>
<cvename>CVE-2023-0931</cvename>
<cvename>CVE-2023-0932</cvename>
<cvename>CVE-2023-0933</cvename>
<url>https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html</url>
</references>
<dates>
<discovery>2023-02-22</discovery>
<entry>2023-02-22</entry>
</dates>
</vuln>
<vuln vid="7a425536-74f7-4ce4-9768-0079a9d44d11">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.6">
<p> Receiving DNS responses from async DNS requests (via
the lookup_addr, etc BIF methods) with the TTL set to
zero could cause the DNS manager to eventually stop being
able to make new requests. </p>
<p> Specially-crafted FTP packets with excessively long
usernames, passwords, or other fields could cause log
writes to use large amounts of disk space. </p>
<p> The find_all and find_all_ordered BIF methods could
take extremely large amounts of time to process incoming
data depending on the size of the input. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.7</url>
</references>
<dates>
<discovery>2023-02-21</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="421c0af9-b206-11ed-9fe5-f4a47516fb57">
<topic>libde256 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libde265</name>
<range><lt>1.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Libde265 developer reports:</p>
<blockquote cite="https://github.com/strukturag/libde265/releases/tag/v1.0.10">
<p>This release fixes the known CVEs below. Many of them are actually caused by the same underlying issues that manifest in different ways.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-21594</cvename>
<cvename>CVE-2020-21595</cvename>
<cvename>CVE-2020-21596</cvename>
<cvename>CVE-2020-21597</cvename>
<cvename>CVE-2020-21598</cvename>
<cvename>CVE-2020-21599</cvename>
<cvename>CVE-2020-21600</cvename>
<cvename>CVE-2020-21601</cvename>
<cvename>CVE-2020-21602</cvename>
<cvename>CVE-2020-21603</cvename>
<cvename>CVE-2020-21604</cvename>
<cvename>CVE-2020-21605</cvename>
<cvename>CVE-2020-21606</cvename>
<cvename>CVE-2022-1253</cvename>
<cvename>CVE-2022-43236</cvename>
<cvename>CVE-2022-43237</cvename>
<cvename>CVE-2022-43238</cvename>
<cvename>CVE-2022-43239</cvename>
<cvename>CVE-2022-43240</cvename>
<cvename>CVE-2022-43241</cvename>
<cvename>CVE-2022-43242</cvename>
<cvename>CVE-2022-43243</cvename>
<cvename>CVE-2022-43244</cvename>
<cvename>CVE-2022-43245</cvename>
<cvename>CVE-2022-43248</cvename>
<cvename>CVE-2022-43249</cvename>
<cvename>CVE-2022-43250</cvename>
<cvename>CVE-2022-43252</cvename>
<cvename>CVE-2022-43253</cvename>
<cvename>CVE-2022-47655</cvename>
<url>https://github.com/strukturag/libde265/releases/tag/v1.0.10</url>
</references>
<dates>
<discovery>2023-01-27</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="21f12de8-b1db-11ed-b0f4-002590f2a714">
<topic>git -- "git apply" overwriting paths outside the working tree</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.39.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git team reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh">
<p>By feeding a crafted input to "git apply", a path outside the
working tree can be overwritten as the user who is running "git
apply".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-23946</cvename>
<url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-23946</url>
</references>
<dates>
<discovery>2023-02-14</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="9548d6ed-b1da-11ed-b0f4-002590f2a714">
<topic>git -- Local clone-based data exfiltration with non-local transports</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.39.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git team reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q">
<p>Using a specially-crafted repository, Git can be tricked into using
its local clone optimization even when using a non-local transport.
Though Git will abort local clones whose source $GIT_DIR/objects
directory contains symbolic links (c.f., CVE-2022-39253), the objects
directory itself may still be a symbolic link.</p>
<p>These two may be combined to include arbitrary files based on known
paths on the victim's filesystem within the malicious repository's
working copy, allowing for data exfiltration in a similar manner as
CVE-2022-39253.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22490</cvename>
<url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-22490</url>
</references>
<dates>
<discovery>2023-02-14</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="8fafbef4-b1d9-11ed-b0f4-002590f2a714">
<topic>git -- gitattributes parsing integer overflow</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.39.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git team reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89">
<p>gitattributes are used to define unique attributes corresponding
to paths in your repository. These attributes are defined by
.gitattributes file(s) within your repository.</p>
<p>The parser used to read these files has multiple integer
overflows, which can occur when parsing either a large number
of patterns, a large number of attributes, or attributes with
overly-long names.</p>
<p>These overflows may be triggered via a malicious
.gitattributes file. However, Git automatically splits lines at
2KB when reading .gitattributes from a file, but not when parsing
it from the index. Successfully exploiting this vulnerability
depends on the location of the .gitattributes file in question.</p>
<p>This integer overflow can result in arbitrary heap reads
and writes, which may result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23521</cvename>
<url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-23521</url>
</references>
<dates>
<discovery>2023-01-17</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="2fcca7e4-b1d7-11ed-b0f4-002590f2a714">
<topic>git -- Heap overflow in `git archive`, `git log --format` leading to RCE</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.39.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The git team reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq">
<p>git log has the ability to display commits using an arbitrary
format with its --format specifiers. This functionality is also
exposed to git archive via the export-subst gitattribute.</p>
<p>When processing the padding operators (e.g., %<(, %<|(,
%>(, %>>(, or %><( ), an integer overflow can occur in
pretty.c::format_and_pad_commit() where a size_t is improperly
stored as an int, and then added as an offset to a subsequent
memcpy() call.</p>
<p>This overflow can be triggered directly by a user running a
command which invokes the commit formatting machinery (e.g., git
log --format=...). It may also be triggered indirectly through
git archive via the export-subst mechanism, which expands format
specifiers inside of files within the repository during a git
archive.</p>
<p>This integer overflow can result in arbitrary heap writes, which
may result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41903</cvename>
<url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-41903</url>
</references>
<dates>
<discovery>2023-01-17</discovery>
<entry>2023-02-21</entry>
</dates>
</vuln>
<vuln vid="5048ed45-b0f1-11ed-ab04-9106b1b896dd">
<topic>gitea -- password hash quality</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22942">
<p>This PR refactors and improves the password hashing code within
gitea and makes it possible for server administrators to set the
password hashing parameters.</p>
<p>In addition it takes the opportunity to adjust the settings for
pbkdf2 in order to make the hashing a little stronger.</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22823">
<p>Add command to bulk set must-change-password</p>
<p>As part of administration sometimes it is appropriate to
forcibly tell users to update their passwords.</p>
<p>This PR creates a new command gitea admin user
must-change-password which will set the MustChangePassword flag on
the provided users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2023/02/gitea-1.18.4-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.18.4</url>
</references>
<dates>
<discovery>2022-02-14</discovery>
<entry>2023-02-20</entry>
</dates>
</vuln>
<vuln vid="428922c9-b07e-11ed-8700-5404a68ad561">
<topic>traefik -- Use of vulnerable Go module x/net/http2</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://pkg.go.dev/vuln/GO-2023-1495">
<p>A request smuggling attack is possible when using
MaxBytesHandler. When using MaxBytesHandler, the body of
an HTTP request is not fully consumed. When the server
attempts to read HTTP2 frames from the connection, it
will instead be reading the body of the HTTP request,
which could be attacker-manipulated to represent
arbitrary HTTP2 requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41721</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41721</url>
</references>
<dates>
<discovery>2022-10-22</discovery>
<entry>2023-02-19</entry>
</dates>
</vuln>
<vuln vid="27c822a0-addc-11ed-a9ee-dca632b19f10">
<topic>Rundeck3 -- Log4J RCE vulnerability</topic>
<affects>
<package>
<name>rundeck3</name>
<range><lt>3.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Rundeck project reports:</p>
<blockquote cite="https://docs.rundeck.com/docs/history/3_4_x/version-3.4.10.html">
<p>This release updates both Community and Enterprise with the latest Log4J
to address CVE-2021-44832 by updating it to 2.17.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44832</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832</url>
</references>
<dates>
<discovery>2021-12-11</discovery>
<entry>2023-02-16</entry>
</dates>
</vuln>
<vuln vid="8e20430d-a72b-11ed-a04f-40b034455553">
<topic>MinIO -- unprivileged users can create service accounts for admin users</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2022.04.12.06.55.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MinIO reports:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q">
<p>
A security issue was found where an unprivileged user is
able to create service accounts for root or other admin
users and then is able to assume their access policies
via the generated credentials.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24842</cvename>
<url>https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q</url>
</references>
<dates>
<discovery>2022-04-11</discovery>
<entry>2023-02-13</entry>
</dates>
</vuln>
<vuln vid="fd792048-ad91-11ed-a879-080027f5fec9">
<topic>clamav -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>1.0.1,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><lt>0.103.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Scannell reports:</p>
<blockquote cite="https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html">
<dl>
<dt>CVE-2023-20032</dt>
<dd>
Fixed a possible remote code execution vulnerability in the HFS+ file parser.
</dd>
<dt>CVE-2023-20052</dt>
<dd>
Fixed a possible remote information leak vulnerability in the DMG file parser.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-20032</cvename>
<cvename>CVE-2023-20052</cvename>
<url>https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html</url>
</references>
<dates>
<discovery>2023-02-15</discovery>
<entry>2023-02-16</entry>
</dates>
</vuln>
<vuln vid="3d73e384-ad1f-11ed-983c-83fe35862e3a">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go119</name>
<range><lt>1.19.6</lt></range>
</package>
<package>
<name>go120</name>
<range><lt>1.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/57274">
<p>path/filepath: path traversal in filepath.Clean on Windows</p>
<p>On Windows, the filepath.Clean function could transform
an invalid path such as a/../c:/b into the valid path
c:\b. This transformation of a relative (if invalid)
path into an absolute path could enable a directory
traversal attack. The filepath.Clean function will now
transform this path into the relative (but still
invalid) path .\c:\b.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/58006">
<p>net/http, mime/multipart: denial of service from excessive
resource consumption</p>
<p>Multipart form parsing with
mime/multipart.Reader.ReadForm can consume largely
unlimited amounts of memory and disk files. This also
affects form parsing in the net/http package with the
Request methods FormFile, FormValue, ParseMultipartForm,
and PostFormValue.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/58001">
<p>crypto/tls: large handshake records may cause panics</p>
<p>
Both clients and servers may send large TLS handshake
records which cause servers and clients,
respectively, to panic when attempting to construct responses.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/57855">
<p>net/http: avoid quadratic complexity in HPACK decoding</p>
<p>A maliciously crafted HTTP/2 stream could cause
excessive CPU consumption in the HPACK decoder,
sufficient to cause a denial of service from a small
number of small requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41722</cvename>
<cvename>CVE-2022-41725</cvename>
<cvename>CVE-2022-41724</cvename>
<cvename>CVE-2022-41723</cvename>
<url>https://groups.google.com/g/golang-dev/c/G2APtTxT1HQ/m/6O6aksDaBAAJ</url>
</references>
<dates>
<discovery>2023-02-14</discovery>
<entry>2023-02-15</entry>
</dates>
</vuln>
<vuln vid="9c9ee9a6-ac5e-11ed-9323-080027d3a315">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.18</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.10</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<range><lt>4.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/feb/14/security-releases/">
<p>CVE-2023-24580: Potential denial-of-service vulnerability in file uploads.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-24580</cvename>
<url>https://www.djangoproject.com/weblog/2023/feb/14/security-releases/</url>
</references>
<dates>
<discovery>2023-02-01</discovery>
<entry>2023-02-14</entry>
</dates>
</vuln>
<vuln vid="0a7a5dfb-aba4-11ed-be2c-001cc0382b2f">
<topic>GnuTLS -- timing sidechannel in RSA decryption</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.7.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14">
<p>A vulnerability was found that the response times to malformed RSA
ciphertexts in ClientKeyExchange differ from response times of
ciphertexts with correct PKCS#1 v1.5 padding. Only TLS ciphertext
processing is affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0361</cvename>
<url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14</url>
</references>
<dates>
<discovery>2023-02-10</discovery>
<entry>2023-02-13</entry>
</dates>
</vuln>
<vuln vid="3eccc968-ab17-11ed-bd9e-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
<p>a bypass to flood admin with FAQ proposals</p>
<p>stored XSS in questions</p>
<p>stored HTML injections</p>
<p>weak passwords </p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/14fc4841-0f5d-4e12-bf9e-1b60d2ac6a6c/</url>
<url>https://huntr.dev/bounties/8c74ccab-0d1d-4c6b-a0fa-803aa65de04f/</url>
<url>https://huntr.dev/bounties/87397c71-7b84-4617-a66e-fa6c73be9024/</url>
<url>https://huntr.dev/bounties/808d5452-607c-4af1-812f-26c49faf3e61/</url>
<url>https://huntr.dev/bounties/d9375178-2f23-4f5d-88bd-bba3d6ba7cc5/</url>
<url>https://huntr.dev/bounties/06af150b-b481-4248-9a48-56ded2814156/</url>
<url>https://huntr.dev/bounties/7152b340-c6f3-4ac8-9f62-f764a267488d/</url>
<url>https://huntr.dev/bounties/9e21156b-ab1d-4c60-88ef-8c9f3e2feb7f/</url>
<url>https://huntr.dev/bounties/b3881a1f-2f1e-45cb-86f3-735f66e660e9/</url>
<url>https://huntr.dev/bounties/949975f1-271d-46aa-85e5-1a013cdb5efb/</url>
</references>
<dates>
<discovery>2023-02-12</discovery>
<entry>2023-02-12</entry>
</dates>
</vuln>
<vuln vid="310ca30e-a951-11ed-8314-a8a1599412c6">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>110.0.5481.77</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>110.0.5481.77</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html">
<p>This release contains 15 security fixes, including:</p>
<ul>
<li>[1402270] High CVE-2023-0696: Type Confusion in V8. Reported by Haein Lee at KAIST Hacking Lab on 2022-12-18</li>
<li>[1341541] High CVE-2023-0697: Inappropriate implementation in Full screen mode. Reported by Ahmed ElMasry on 2022-07-03</li>
<li>[1403573] High CVE-2023-0698: Out of bounds read in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2022-12-25</li>
<li>[1371859] Medium CVE-2023-0699: Use after free in GPU. Reported by 7o8v and Cassidy Kim(@cassidy6564) on 2022-10-06</li>
<li>[1393732] Medium CVE-2023-0700: Inappropriate implementation in Download. Reported by Axel Chong on 2022-11-26</li>
<li>[1405123] Medium CVE-2023-0701: Heap buffer overflow in WebUI. Reported by Sumin Hwang of SSD Labs on 2023-01-05</li>
<li>[1316301] Medium CVE-2023-0702: Type Confusion in Data Transfer. Reported by Sri on 2022-04-14</li>
<li>[1405574] Medium CVE-2023-0703: Type Confusion in DevTools. Reported by raven at KunLun lab on 2023-01-07</li>
<li>[1385982] Low CVE-2023-0704: Insufficient policy enforcement in DevTools. Reported by Rhys Elsmore and Zac Sims of the Canva security team on 2022-11-18</li>
<li>[1238642] Low CVE-2023-0705: Integer overflow in Core. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0696</cvename>
<cvename>CVE-2023-0697</cvename>
<cvename>CVE-2023-0698</cvename>
<cvename>CVE-2023-0699</cvename>
<cvename>CVE-2023-0700</cvename>
<cvename>CVE-2023-0701</cvename>
<cvename>CVE-2023-0702</cvename>
<cvename>CVE-2023-0703</cvename>
<cvename>CVE-2023-0704</cvename>
<cvename>CVE-2023-0705</cvename>
<url>https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-02-07</discovery>
<entry>2023-02-10</entry>
</dates>
</vuln>
<vuln vid="7a8b6170-a889-11ed-bbae-6cc21735f730">
<topic>PostgreSQL server -- Client memory disclosure when connecting, with Kerberos, to modified server.</topic>
<affects>
<package>
<name>postgresql15-client</name>
<range><lt>15.2</lt></range>
</package>
<package>
<name>postgresql14-client</name>
<range><lt>14.7</lt></range>
</package>
<package>
<name>postgresql13-client</name>
<range><lt>13.10</lt></range>
</package>
<package>
<name>postgresql12-client</name>
<range><lt>12.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2022-41862/">
<p>
A modified, unauthenticated server can send an
unterminated string during the establishment of Kerberos
transport encryption. When a libpq client application
has a Kerberos credential cache and doesn't explicitly
disable option gssencmode, a server can cause libpq to
over-read and report an error message containing
uninitialized bytes from and following its receive
buffer. If libpq's caller somehow makes that message
accessible to the attacker, this achieves a disclosure
of the over-read bytes. We have not confirmed or ruled
out viability of attacks that arrange for a crash or for
presence of notable, confidential information in
disclosed bytes.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41862</cvename>
<url>https://www.postgresql.org/support/security/CVE-2022-41862/</url>
</references>
<dates>
<discovery>2023-02-09</discovery>
<entry>2023-02-09</entry>
</dates>
</vuln>
<vuln vid="ecffb881-a7a7-11ed-8d6a-6c3be5272acd">
<topic>Grafana -- Stored XSS in ResourcePicker component</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.1.0</ge><lt>8.5.16</lt></range>
<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.1.0</ge><lt>8.5.16</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/">
<p>On 2022-12-16 during an internal audit of Grafana, a member of the security
team found a stored XSS vulnerability affecting the core plugin GeoMap.</p>
<p>The stored XSS vulnerability was possible due to SVG-files weren't properly
sanitized and allowed arbitrary JavaScript to be executed in the context
of the currently authorized user of the Grafana instance.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23552</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv</url>
</references>
<dates>
<discovery>2022-12-16</discovery>
<entry>2023-02-09</entry>
</dates>
</vuln>
<vuln vid="e6281d88-a7a7-11ed-8d6a-6c3be5272acd">
<topic>Grafana -- Spoofing originalUrl of snapshots</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.5.16</lt></range>
<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.16</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/">
<p>A third-party penetration test of Grafana found a vulnerability
in the snapshot functionality. The value of the originalUrl parameter
is automatically generated. The purpose of the presented originalUrl parameter
is to provide a user who views the snapshot with the possibility to click
on the <strong>Local Snapshot</strong> button in the Grafana web UI
and be presented with the dashboard that the snapshot captured. The value
of the originalUrl parameter can be arbitrarily chosen by a malicious user that
creates the snapshot. (Note: This can be done by editing the query thanks
to a web proxy like Burp.)</p>
<p>We have assessed this vulnerability as having a CVSS score of 6.7 MEDIUM
(CVSS:6.7/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39324</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-4724-7jwc-3fpw</url>
</references>
<dates>
<discovery>2023-01-25</discovery>
<entry>2023-02-09</entry>
</dates>
</vuln>
<vuln vid="1dd84344-a7da-11ed-86e9-d4c9ef517024">
<topic>LibreSSL -- Arbitrary memory read</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>3.5.4</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>3.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenBSD project reports:</p>
<blockquote cite="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.4-relnotes.txt">
<p>A malicious certificate revocation list or timestamp response token
would allow an attacker to read arbitrary memory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.4-relnotes.txt</url>
</references>
<dates>
<discovery>2023-02-08</discovery>
<entry>2023-02-08</entry>
</dates>
</vuln>
<vuln vid="6cc63bf5-a727-4155-8ec4-68b626475e68">
<topic>xorg-server -- Security issue in the X server</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.7,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>21.1.7,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>22.1.8,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.386</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-February/003320.html">
<ul>
<li>CVE-2023-0494/ZDI-CAN-19596: X.Org Server DeepCopyPointerClasses
use-after-free
<p>A dangling pointer in DeepCopyPointerClasses can be exploited by
ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read/write into
freed memory.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2023-February/003320.html</url>
<cvename>CVE-2023-0494</cvename>
</references>
<dates>
<discovery>2023-02-07</discovery>
<entry>2023-02-08</entry>
</dates>
</vuln>
<vuln vid="b34c1947-a749-11ed-b24b-1c61b4739ac9">
<topic>TightVNC -- Muliple Vulnerabilities</topic>
<affects>
<package>
<name>tightvnc</name>
<range><le>1.3.10_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8287">
<p>TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15678">
<p>TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15679">
<p>TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15680">
<p>TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-8287</cvename>
<cvename>CVE-2019-15678</cvename>
<cvename>CVE-2019-15679</cvename>
<cvename>CVE-2019-15680</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8287</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15678</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15679</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15680</url>
</references>
<dates>
<discovery>2019-02-12</discovery>
<entry>2023-02-08</entry>
</dates>
</vuln>
<vuln vid="648a432c-a71f-11ed-86e9-d4c9ef517024">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1t,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.8</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20230207.txt">
<p>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High):
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.</p>
<p>Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate):
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.</p>
<p>X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate):
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.</p>
<p>Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate):
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
end user applications.</p>
<p>Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate):
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.</p>
<p>Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.</p>
<p>NULL dereference validating DSA public key (CVE-2023-0217) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely lead
to an application crash. This function can be called on public
keys supplied from untrusted sources which could allow an attacker
to cause a denial of service attack.</p>
<p>NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate):
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0286</cvename>
<cvename>CVE-2022-4304</cvename>
<cvename>CVE-2022-4203</cvename>
<cvename>CVE-2023-0215</cvename>
<cvename>CVE-2022-4450</cvename>
<cvename>CVE-2023-0216</cvename>
<cvename>CVE-2023-0401</cvename>
<url>https://www.openssl.org/news/secadv/20230207.txt</url>
</references>
<dates>
<discovery>2023-02-07</discovery>
<entry>2023-02-07</entry>
</dates>
</vuln>
<vuln vid="c49a880d-a5bb-11ed-aab5-080027de9982">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.17</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.9</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<range><lt>4.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2023/feb/01/security-releases/">
<p>CVE-2023-23969: Potential denial-of-service via Accept-Language headers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-23969</cvename>
<url>https://www.djangoproject.com/weblog/2023/feb/01/security-releases/</url>
</references>
<dates>
<discovery>2023-02-01</discovery>
<entry>2023-02-06</entry>
</dates>
</vuln>
<vuln vid="01823528-a4c1-11ed-b6af-b42e991fc52e">
<topic>kafka -- Denial Of Service vulnerability</topic>
<affects>
<package>
<name>kafka</name>
<range><lt>3.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-36518">
<p>jackson-databind before 2.13.0 allows a Java StackOverflow
exception and denial of service via a large depth of nested
objects.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-36518</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-36518</url>
</references>
<dates>
<discovery>2022-03-11</discovery>
<entry>2023-02-04</entry>
</dates>
</vuln>
<vuln vid="d835c54f-a4bd-11ed-b6af-b42e991fc52e">
<topic>node_exporter -- bypass security with cache poisoning</topic>
<affects>
<package>
<name>node_exporter</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prometheus team reports:</p>
<blockquote cite="https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p">
<p>
Prometheus and its exporters can be secured by a web.yml file that
specifies usernames and hashed passwords for basic authentication.
Passwords are hashed with bcrypt, which means that even if you have
access to the hash, it is very hard to find the original password
back. Passwords are hashed with bcrypt, which means that even if you
have access to the hash, it is very hard to find the original
password back. However, a flaw in the way this mechanism was
implemented in the exporter toolkit makes it possible with people
who know the hashed password to authenticate against Prometheus.
A request can be forged by an attacker to poison the internal cache
used to cache the computation of hashes and make subsequent requests
successful. This cache is used in both happy and unhappy scenarios
in order to limit side channel attacks that could tell an attacker
if a user is present in the file or not.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-46146</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146</url>
</references>
<dates>
<discovery>2021-11-28</discovery>
<entry>2023-02-04</entry>
</dates>
</vuln>
<vuln vid="8dd438ed-a338-11ed-b48b-589cfc0f81b0">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>18.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
<p>AST-2022-007: Remote Crash Vulnerability in H323 channel add on</p>
<p>AST-2022-008: Use after free in res_pjsip_pubsub.c</p>
<p>AST-2022-009: GetConfig AMI Action can read files outside of
Asterisk directory</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-37325</cvename>
<cvename>CVE-2022-42705</cvename>
<cvename>CVE-2022-42706</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2022-007.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2022-008.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2022-009.html</url>
</references>
<dates>
<discovery>2022-12-01</discovery>
<entry>2023-02-02</entry>
</dates>
</vuln>
<vuln vid="c3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18">
<topic>Spotipy -- Path traversal vulnerability</topic>
<affects>
<package>
<name>py37-spotipy</name>
<name>py38-spotipy</name>
<name>py39-spotipy</name>
<name>py310-spotipy</name>
<name>py311-spotipy</name>
<range><le>2.22.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stéphane Bruckert</p>
<blockquote cite="https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v">
<p>If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-23608</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23608</url>
<url>https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v</url>
</references>
<dates>
<discovery>2023-01-16</discovery>
<entry>2023-02-02</entry>
</dates>
</vuln>
<vuln vid="2b5fc9c4-eaca-46e0-83d0-9b10c51c4b1b">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.6">
<p> A missing field in the SMB FSControl script-land record could
cause a heap buffer overflow when receiving packets containing
those header types. </p>
<p> Receiving a series of packets that start with HTTP/1.0
and then switch to HTTP/0.9 could cause Zeek to spend a
large amount of time processing the packets. </p>
<p> Receiving large numbers of FTP commands sequentially
from the network with bad data in them could cause Zeek
to spend a large amount of time processing the packets,
and generate a large amount of events. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.6</url>
</references>
<dates>
<discovery>2023-02-01</discovery>
<entry>2023-02-01</entry>
</dates>
</vuln>
<vuln vid="ee890be3-a1ec-11ed-a81d-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.8.0</ge><lt>15.8.1</lt></range>
<range><ge>15.7.0</ge><lt>15.7.6</lt></range>
<range><ge>12.4.0</ge><lt>15.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/">
<p>Denial of Service via arbitrarily large Issue descriptions</p>
<p>CSRF via file upload allows an attacker to take over a repository</p>
<p>Sidekiq background job DoS by uploading malicious CI job artifact zips</p>
<p>Sidekiq background job DoS by uploading a malicious Helm package</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3411</cvename>
<cvename>CVE-2022-4138</cvename>
<cvename>CVE-2022-3759</cvename>
<cvename>CVE-2023-0518</cvename>
<url>https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/</url>
</references>
<dates>
<discovery>2023-01-31</discovery>
<entry>2023-02-01</entry>
</dates>
</vuln>
<vuln vid="98f78c7a-a08e-11ed-946e-002b67dfc673">
<topic>Plex Media Server -- security vulnerability</topic>
<affects>
<package>
<name>plexmediaserver</name>
<name>plexmediaserver-plexpass</name>
<range><lt>1.25.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plex Security Team reports:</p>
<blockquote cite="https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510">
<p>We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physical access to the computer (just with a different user account on Windows). There are no indications that this exploit could be used from a remote machine.</p>
<p>Plex Media Server versions 1.25.0.5282 and newer are not subject to this vulnerability, and feature additional hardening to prevent similar issues from occurring in the future. Users running older server versions are encouraged to update their Plex Media Server installations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-42835</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42835</url>
</references>
<dates>
<discovery>2021-10-22</discovery>
<entry>2023-01-30</entry>
</dates>
</vuln>
<vuln vid="791a09c5-a086-11ed-954d-b42e991fc52e">
<topic>prometheus2 -- basic authentication bypass</topic>
<affects>
<package>
<name>prometheus</name>
<range><lt>0.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prometheus team reports:</p>
<blockquote cite="https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p">
<p>
Prometheus and its exporters can be secured by a web.yml file that
specifies usernames and hashed passwords for basic authentication.
Passwords are hashed with bcrypt, which means that even if you have
access to the hash, it is very hard to find the original password
back. Passwords are hashed with bcrypt, which means that even if you
have access to the hash, it is very hard to find the original
password back. However, a flaw in the way this mechanism was
implemented in the exporter toolkit makes it possible with people
who know the hashed password to authenticate against Prometheus.
A request can be forged by an attacker to poison the internal cache
used to cache the computation of hashes and make subsequent requests
successful. This cache is used in both happy and unhappy scenarios
in order to limit side channel attacks that could tell an attacker
if a user is present in the file or not.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-46146</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146</url>
</references>
<dates>
<discovery>2022-11-28</discovery>
<entry>2023-01-30</entry>
</dates>
</vuln>
<vuln vid="3d0a3eb0-9ca3-11ed-a925-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>109.0.5414.119</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>109.0.5414.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html">
<p>This release contains 6 security fixes, including:</p>
<ul>
<li>[1376354] High CVE-2023-0471: Use after free in WebTransport. Reported by chichoo Kim(chichoo) and Cassidy Kim(@cassidy6564) on 2022-10-19</li>
<li>[1405256] High CVE-2023-0472: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-01-06</li>
<li>[1404639] Medium CVE-2023-0473: Type Confusion in ServiceWorker API. Reported by raven at KunLun lab on 2023-01-03</li>
<li>[1400841] Medium CVE-2023-0474: Use after free in GuestView. Reported by avaue at S.S.L on 2022-12-14</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0471</cvename>
<cvename>CVE-2023-0472</cvename>
<cvename>CVE-2023-0473</cvename>
<cvename>CVE-2023-0474</cvename>
<url>https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2023-01-24</discovery>
<entry>2023-01-25</entry>
</dates>
</vuln>
<vuln vid="b0e1fa2b-9c86-11ed-9296-002b67dfc673">
<topic>re2c -- uncontrolled recursion</topic>
<affects>
<package>
<name>re2c</name>
<range><lt>2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>re2c reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-pgr8-gpgg-9j5m">
<p>re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-21232</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-21232</url>
</references>
<dates>
<discovery>2022-05-24</discovery>
<entry>2023-01-25</entry>
</dates>
</vuln>
<vuln vid="b8a0fea2-9be9-11ed-8acf-0800277bb8a8">
<topic>gitea -- information disclosure</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22566">
<p>Prevent multiple To recipients: Change the mailer interface to
prevent leaking of possible hidden email addresses when sending
to multiple recipients.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2023/01/gitea-1.18.3-is-released/</url>
</references>
<dates>
<discovery>2022-01-22</discovery>
<entry>2023-01-24</entry>
</dates>
</vuln>
<vuln vid="7844789a-9b1f-11ed-9a3f-b42e991fc52e">
<topic>net/krill -- DoS vulnerability</topic>
<affects>
<package>
<name>krill</name>
<range><lt>0.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0158">
<p>
NLnet Labs Krill supports direct access to the RRDP repository
content through its built-in web server at the "/rrdp" endpoint.
Prior to 0.12.1 a direct query for any existing directory under
"/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml"
as would be expected, causes Krill to crash. If the built-in "/rrdp"
endpoint is exposed directly to the internet, then malicious remote
parties can cause the publication server to crash. The repository
content is not affected by this, but the availability of the server
and repository can cause issues if this attack is persistent and is
not mitigated. .
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0158</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0158</url>
</references>
<dates>
<discovery>2023-01-10</discovery>
<entry>2023-01-23</entry>
</dates>
</vuln>
<vuln vid="bba3f684-9b1d-11ed-9a3f-b42e991fc52e">
<topic>www/awstats -- Partial absolute pathname</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35176">
<p>It seems #90 is not completely fixed in 7.8.
(that is, even after CVE-2017-1000501 and CVE-2020-29600 are fixed).
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a
partial absolute pathname (omitting the initial /etc), even
though it was intended to only read a file in the /etc/awstats/awstats.conf format.
NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35176</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35176</url>
</references>
<dates>
<discovery>2022-12-11</discovery>
<entry>2023-01-23</entry>
</dates>
</vuln>
<vuln vid="b6f7ad7d-9b19-11ed-9a3f-b42e991fc52e">
<topic>net/eternalterminal -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>eternalterminal</name>
<range><lt>6.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48257">
<p>etserver and etclient have predictable logfile names in
/tmp and they are world-readable logfiles</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-48257</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48257</url>
<cvename>CVE-2022-48258</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48258</url>
</references>
<dates>
<discovery>2023-01-13</discovery>
<entry>2023-01-23</entry>
</dates>
</vuln>
<vuln vid="28b69630-9b10-11ed-97a6-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><ge>4.8.0</ge><lt>4.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://blog.powerdns.com/2023/01/20/security-advisory-2023-01-for-powerdns-recursor-4-8-0/">
<p>PowerDNS Security Advisory 2023-01: unbounded recursion results in program termination</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22617</cvename>
<url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-01.html</url>
</references>
<dates>
<discovery>2023-01-20</discovery>
<entry>2023-01-23</entry>
</dates>
</vuln>
<vuln vid="a3b10c9b-99d9-11ed-aa55-d05099fed512">
<topic>shells/fish -- arbitrary code execution via git</topic>
<affects>
<package>
<name>fish</name>
<range><ge>3.1.0</ge><lt>3.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Ammon reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-20001">
<p>
fish is a command line shell. fish version 3.1.0 through
version 3.3.1 is vulnerable to arbitrary code execution.
git repositories can contain per-repository
configuration that change the behavior of git, including
running arbitrary commands. When using the default
configuration of fish, changing to a directory
automatically runs git commands in order to display
information about the current repository in the prompt.
If an attacker can convince a user to change their
current directory into one controlled by the attacker,
such as on a shared file system or extracted archive,
fish will run arbitrary commands under the attacker's
control. This problem has been fixed in fish 3.4.0. Note
that running git in these directories, including using
the git tab completion, remains a potential trigger for
this issue. As a workaround, remove the
fish_git_prompt function from the prompt.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-20001</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001</url>
</references>
<dates>
<discovery>2021-12-26</discovery>
<entry>2023-01-21</entry>
</dates>
</vuln>
<vuln vid="dc49f6dc-99d2-11ed-86e9-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-connector-odbc</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-client57</name>
<range><lt>5.7.42</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.42</lt></range>
</package>
<package>
<name>mysql-client80</name>
<range><lt>8.0.33</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2023.html#AppendixMSQL">
<p>This Critical Patch Update contains 37 new security patches for
Oracle MySQL. 8 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network withouti
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32221</cvename>
<cvename>CVE-2022-24407</cvename>
<cvename>CVE-2022-24407</cvename>
<cvename>CVE-2022-3171</cvename>
<cvename>CVE-2022-1941</cvename>
<cvename>CVE-2023-21868</cvename>
<cvename>CVE-2023-21860</cvename>
<cvename>CVE-2023-21875</cvename>
<cvename>CVE-2023-21869</cvename>
<cvename>CVE-2023-21877</cvename>
<cvename>CVE-2023-21880</cvename>
<cvename>CVE-2023-21872</cvename>
<cvename>CVE-2023-21871</cvename>
<cvename>CVE-2023-21836</cvename>
<cvename>CVE-2023-21887</cvename>
<cvename>CVE-2023-21863</cvename>
<cvename>CVE-2023-21864</cvename>
<cvename>CVE-2023-21865</cvename>
<cvename>CVE-2023-21866</cvename>
<cvename>CVE-2023-21867</cvename>
<cvename>CVE-2023-21870</cvename>
<cvename>CVE-2023-21873</cvename>
<cvename>CVE-2023-21876</cvename>
<cvename>CVE-2023-21878</cvename>
<cvename>CVE-2023-21879</cvename>
<cvename>CVE-2023-21881</cvename>
<cvename>CVE-2023-21883</cvename>
<cvename>CVE-2023-21840</cvename>
<cvename>CVE-2023-21882</cvename>
<cvename>CVE-2023-21874</cvename>
<url>https://www.oracle.com/security-alerts/cpujan2023.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2023-01-20</discovery>
<entry>2023-01-21</entry>
</dates>
</vuln>
<vuln vid="005dfb48-990d-11ed-b9d3-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
<p>phpMyFAQ does not implement sufficient checks to avoid a stored
XSS in "Add new question"</p>
<p>phpMyFAQ does not implement sufficient checks to avoid a stored XSS
in admin user page</p>
<p>phpMyFAQ does not implement sufficient checks to avoid a stored XSS
in FAQ comments</p>
<p>phpMyFAQ does not implement sufficient checks to avoid a blind
stored XSS in admin open question page</p>
<p>phpMyFAQ does not implement sufficient checks to avoid a reflected
XSS in the admin backend login</p>
<p>phpMyFAQ does not implement sufficient checks to avoid stored XSS
on user, category, FAQ, news and configuration admin backend</p>
<p>phpMyFAQ does not implement sufficient checks to avoid weak passwords</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/cbba22f0-89ed-4d01-81ea-744979c8cbde/</url>
<url>https://huntr.dev/bounties/fac01e9f-e3e5-4985-94ad-59a76485f215/</url>
<url>https://huntr.dev/bounties/83cfed62-af8b-4aaa-94f2-5a33dc0c2d69/</url>
<url>https://huntr.dev/bounties/051d5e20-7fab-4769-bd7d-d986b804bb5a/</url>
<url>https://huntr.dev/bounties/c03c5925-43ff-450d-9827-2b65a3307ed6/</url>
<url>https://huntr.dev/bounties/f50ec8d1-cd60-4c2d-9ab8-3711870d83b9/</url>
<url>https://huntr.dev/bounties/82b0b629-c56b-4651-af3f-17f749751857/</url>
<url>https://huntr.dev/bounties/eac0a9d7-9721-4191-bef3-d43b0df59c67/</url>
<url>https://huntr.dev/bounties/bc27e84b-1f91-4e1b-a78c-944edeba8256/</url>
</references>
<dates>
<discovery>2023-01-15</discovery>
<entry>2023-01-20</entry>
</dates>
</vuln>
<vuln vid="95176ba5-9796-11ed-bfbf-080027f5fec9">
<topic>rack -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rack</name>
<range><lt>3.0.4.1,3</lt></range>
</package>
<package>
<name>rubygem-rack22</name>
<range><lt>2.2.6.2,3</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://github.com/rack/rack/blob/v3.0.4.1/CHANGELOG.md">
<dl>
<dt>CVE-2022-44570</dt>
<dd>
Carefully crafted input can cause the Range header
parsing component in Rack to take an unexpected amount
of time, possibly resulting in a denial of service
attack vector. Any applications that deal with Range
requests (such as streaming applications, or
applications that serve files) may be impacted.
</dd>
<dt>CVE-2022-44571</dt>
<dd>
Carefully crafted input can cause Content-Disposition
header parsing in Rack to take an unexpected amount of
time, possibly resulting in a denial of service attack
vector. This header is used typically used in multipart
parsing. Any applications that parse multipart posts
using Rack (virtually all Rails applications) are
impacted.
</dd>
<dt>CVE-2022-44572</dt>
<dd>
Carefully crafted input can cause RFC2183 multipart
boundary parsing in Rack to take an unexpected amount of
time, possibly resulting in a denial of service attack
vector. Any applications that parse multipart posts
using Rack (virtually all Rails applications) are
impacted.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-44570</cvename>
<cvename>CVE-2022-44571</cvename>
<cvename>CVE-2022-44572</cvename>
<url>https://github.com/rack/rack/blob/v3.0.4.1/CHANGELOG.md</url>
<url>https://github.com/advisories/GHSA-65f5-mfpf-vfhj</url>
<url>https://github.com/advisories/GHSA-93pm-5p5f-3ghx</url>
<url>https://github.com/advisories/GHSA-rqv2-275x-2jq5</url>
</references>
<dates>
<discovery>2023-01-17</discovery>
<entry>2023-01-19</entry>
</dates>
</vuln>
<vuln vid="00919005-96a3-11ed-86e9-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.55">
<p>mod_dav out of bounds read, or write of zero byte (CVE-2006-20001)
(moderate)</p>
<p>mod_proxy_ajp Possible request smuggling (CVE-2022-36760) (moderate)</p>
<p>mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response
splitting (CVE-2022-37436) (moderate)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-37436</cvename>
<cvename>CVE-2022-36760</cvename>
<cvename>CVE-2006-20001</cvename>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.55</url>
</references>
<dates>
<discovery>2023-01-17</discovery>
<entry>2023-01-17</entry>
</dates>
</vuln>
<vuln vid="5fa68bd9-95d9-11ed-811a-080027f5fec9">
<topic>redis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redis</name>
<range><lt>7.0.8</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.8.20230116</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.9</lt></range>
</package>
<package>
<name>redis6</name>
<range><lt>6.0.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/releases/tag/7.0.8">
<dl>
<dt>CVE-2022-35977</dt>
<dd>
Integer overflow in the Redis SETRANGE and SORT/SORT_RO
commands can drive Redis to OOM panic.
</dd>
<dt>CVE-2023-22458</dt>
<dd>
Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER
commands can lead to denial-of-service.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35977</cvename>
<cvename>CVE-2023-22458</cvename>
<url>https://github.com/redis/redis/releases/tag/7.0.8</url>
</references>
<dates>
<discovery>2023-01-16</discovery>
<entry>2023-01-16</entry>
</dates>
</vuln>
<vuln vid="9d9e9439-959e-11ed-b464-b42e991fc52e">
<topic>security/keycloak -- Multiple possible DoS attacks</topic>
<affects>
<package>
<name>keycloak</name>
<range><lt>20.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CIRCL reports:</p>
<blockquote cite="https://cve.circl.lu/cve/CVE-2022-41966">
<ul>
<li>CVE-2022-41966: XStream serializes Java objects to XML
and back again.
Versions prior to 1.4.20 may allow a remote attacker
to terminate the application with a stack
overflow error, resulting in a denial of
service only via manipulation the
processed input stream.
</li>
<li>CVE-2022-40151: If the parser is running on user
supplied input, an attacker may supply content that
causes the parser to crash by stackoverflow. This
effect may support a denial of service attack.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40151</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40151</url>
<cvename>CVE-2022-41966</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-41966</url>
</references>
<dates>
<discovery>2022-09-07</discovery>
<entry>2023-01-16</entry>
</dates>
</vuln>
<vuln vid="847f16e5-9406-11ed-a925-3065ec8fd3ec">
<topic>security/tor -- SOCKS4(a) inversion bug</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.4.7.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://gitlab.torproject.org/tpo/core/tor/-/issues/40730">
<p>TROVE-2022-002: The SafeSocks option for SOCKS4(a) is inverted leading to SOCKS4 going through</p>
<p>This is a report from hackerone:<br/>
We have classified this as medium considering that tor was not defending in-depth for dangerous SOCKS request and so any user relying on SafeSocks 1 to make sure they don't link DNS leak and their Tor traffic wasn't safe afterall for SOCKS4(a).
Tor Browser doesn't use SafeSocks 1 and SOCKS4 so at least the likely vast majority of users are not affected.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://hackerone.com/bugs?subject=torproject&report_id=1784589</url>
<url>https://gitlab.torproject.org/tpo/core/tor/-/issues/40730</url>
</references>
<dates>
<discovery>2023-01-12</discovery>
<entry>2023-01-14</entry>
</dates>
</vuln>
<vuln vid="76e2fcce-92d2-11ed-a635-080027f5fec9">
<topic>emacs -- arbitary shell command execution vulnerability of ctags</topic>
<affects>
<package>
<name>emacs</name>
<name>emacs-canna</name>
<name>emacs-nox</name>
<range><lt>28.2_2,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<name>emacs-devel-nox</name>
<range><lt>30.0.50.202211128,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lu4nx reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-45939">
<p>
GNU Emacs through 28.2 allows attackers to execute
commands via shell metacharacters in the name of a
source-code file, because lib-src/etags.c uses the system
C library function in its implementation of the ctags
program. For example, a victim may use the "ctags *"
command (suggested in the ctags documentation) in a
situation where the current working directory has contents
that depend on untrusted input.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-45939</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-45939</url>
</references>
<dates>
<discovery>2022-11-28</discovery>
<entry>2023-01-12</entry>
</dates>
</vuln>
<vuln vid="53caf29b-9180-11ed-acbe-b42e991fc52e">
<topic>cassandra3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cassandra3</name>
<range><lt>3.11.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cassandra tema reports:</p>
<blockquote cite="https://gitbox.apache.org/repos/asf?p=cassandra.git;a=blob_plain;f=CHANGES.txt;hb=refs/tags/cassandra-3.11.14">
<p>This release contains 6 security fixes including</p>
<ul>
<li>CVE-2022-24823: When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory</li>
<li>CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.</li>
<li>CVE-2019-2684: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE</li>
<li>CVE-2022-25857: The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.</li>
<li>CVE-2022-42003: In FasterXML jackson-databind, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.</li>
<li>CVE-2022-42004: In FasterXML jackson-databind, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24823</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24823</url>
<cvename>CVE-2020-7238</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238</url>
<cvename>CVE-2019-2684</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2684</url>
<cvename>CVE-2022-25857</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857</url>
<cvename>CVE-2022-42003</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003</url>
<cvename>CVE-2022-42004</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42004</url>
</references>
<dates>
<discovery>2023-01-11</discovery>
<entry>2023-01-11</entry>
</dates>
</vuln>
<vuln vid="60624f63-9180-11ed-acbe-b42e991fc52e">
<topic>cassandra3 -- arbitrary code execution</topic>
<affects>
<package>
<name>cassandra3</name>
<range><lt>3.11.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marcus Eriksson reports:</p>
<blockquote cite="https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356">
<p>
When running Apache Cassandra with
the following configuration:
enable_user_defined_functions: true
enable_scripted_user_defined_functions: true
enable_user_defined_functions_threads: false
it is possible for an attacker to execute arbitrary code on
the host. The attacker would need to have enough permissions
to create user defined functions in the cluster to be able
to exploit this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44521</cvename>
<url>https://www.cvedetails.com/cve/CVE-2021-44521</url>
</references>
<dates>
<discovery>2022-02-11</discovery>
<entry>2023-01-11</entry>
</dates>
</vuln>
<vuln vid="b3fd12ea-917a-11ed-acbe-b42e991fc52e">
<topic>cassandra3 -- jBCrypt integer overflow</topic>
<affects>
<package>
<name>cassandra3</name>
<range><lt>3.11.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mindrot project reports:</p>
<blockquote cite="http://www.mindrot.org/projects/jBCrypt/news/rel04.html">
<p>There is an integer overflow that
occurs with very large log_rounds values, first reported by
Marcus Rathsfeld.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0886</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0886</url>
</references>
<dates>
<discovery>2015-01-30</discovery>
<entry>2023-01-11</entry>
</dates>
</vuln>
<vuln vid="9fa7b139-c1e9-409e-bed0-006aadcf5845">
<topic>xorg-server -- Multiple security issues in X server extensions</topic>
<affects>
<package>
<name>xorg-server</name>
<name>xephyr</name>
<name>xorg-vfbserver</name>
<range><lt>21.1.5,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>21.1.5,2</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>22.1.6,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><lt>21.0.99.1.319</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2022-December/003302.html">
<ul>
<li>CVE-2022-46340/ZDI-CAN-19265: X.Org Server XTestSwapFakeInput stack
overflow
<p>The swap handler for the XTestFakeInput request of the XTest extension
may corrupt the stack if GenericEvents with lengths larger than 32 bytes
are sent through a the XTestFakeInput request.</p>
<p>This issue does not affect systems where client and server use the same
byte order.</p></li>
<li>CVE-2022-46341/ZDI-CAN-19381: X.Org Server XIPassiveUngrab
out-of-bounds access
<p>The handler for the XIPassiveUngrab request accesses out-of-bounds
memory when invoked with a high keycode or button code.</p></li>
<li>CVE-2022-46342/ZDI-CAN-19400: X.Org Server XvdiSelectVideoNotify
use-after-free
<p>The handler for the XvdiSelectVideoNotify request may write to memory
after it has been freed.</p></li>
<li>CVE-2022-46343/ZDI-CAN-19404: X.Org Server ScreenSaverSetAttributes
use-after-free
<p>The handler for the ScreenSaverSetAttributes request may write to memory
after it has been freed.</p></li>
<li>CVE-2022-46344/ZDI-CAN-19405: X.Org Server XIChangeProperty
out-of-bounds access
<p>The handler for the XIChangeProperty request has a length-validation
issues, resulting in out-of-bounds memory reads and potential
information disclosure.</p></li>
<li>CVE-2022-4283/ZDI-CAN-19530: X.Org Server XkbGetKbdByName use-after-free
<p>The XkbCopyNames function left a dangling pointer to freed memory,
resulting in out-of-bounds memory access on subsequent XkbGetKbdByName
requests.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2022-December/003302.html</url>
<cvename>CVE-2022-46340</cvename>
<cvename>CVE-2022-46341</cvename>
<cvename>CVE-2022-46342</cvename>
<cvename>CVE-2022-46343</cvename>
<cvename>CVE-2022-46344</cvename>
<cvename>CVE-2022-4283</cvename>
</references>
<dates>
<discovery>2022-12-14</discovery>
<entry>2023-01-11</entry>
</dates>
</vuln>
<vuln vid="3a023570-91ab-11ed-8950-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.7.0</ge><lt>15.7.2</lt></range>
<range><ge>15.6.0</ge><lt>15.6.4</lt></range>
<range><ge>6.6.0</ge><lt>15.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/">
<p>Race condition on gitlab.com enables verified email forgery and third-party account hijacking</p>
<p>DOS and high resource consumption of Prometheus server through abuse of Grafana integration proxy endpoint</p>
<p>Maintainer can leak sentry token by changing the configured URL</p>
<p>Maintainer can leak masked webhook secrets by changing target URL of the webhook</p>
<p>Cross-site scripting in wiki changes page affecting self-hosted instances running without strict CSP</p>
<p>Group access tokens continue to work after owner loses ability to revoke them</p>
<p>Users' avatar disclosure by user ID in private GitLab instances</p>
<p>Arbitrary Protocol Redirection in GitLab Pages</p>
<p>Regex DoS due to device-detector parsing user agents</p>
<p>Regex DoS in the Submodule Url Parser</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4037</cvename>
<cvename>CVE-2022-3613</cvename>
<cvename>CVE-2022-4365</cvename>
<cvename>CVE-2022-4342</cvename>
<cvename>CVE-2022-3573</cvename>
<cvename>CVE-2022-4167</cvename>
<cvename>CVE-2022-3870</cvename>
<cvename>CVE-2023-0042</cvename>
<cvename>CVE-2022-4131</cvename>
<cvename>CVE-2022-3514</cvename>
<url>https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/</url>
</references>
<dates>
<discovery>2023-01-09</discovery>
<entry>2023-01-11</entry>
</dates>
</vuln>
<vuln vid="7b929503-911d-11ed-a925-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>109.0.5414.74</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>109.0.5414.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html">
<p>This release contains 17 security fixes, including:</p>
<ul>
<li>[1353208] High CVE-2023-0128: Use after free in Overview Mode. Reported by Khalil Zhani on 2022-08-16</li>
<li>[1382033] High CVE-2023-0129: Heap buffer overflow in Network Service. Reported by asnine on 2022-11-07</li>
<li>[1370028] Medium CVE-2023-0130: Inappropriate implementation in Fullscreen API. Reported by Hafiizh on 2022-09-30</li>
<li>[1357366] Medium CVE-2023-0131: Inappropriate implementation in iframe Sandbox. Reported by NDevTK on 2022-08-28</li>
<li>[1371215] Medium CVE-2023-0132: Inappropriate implementation in Permission prompts. Reported by Jasper Rebane (popstonia) on 2022-10-05</li>
<li>[1375132] Medium CVE-2023-0133: Inappropriate implementation in Permission prompts. Reported by Alesandro Ortiz on 2022-10-17</li>
<li>[1385709] Medium CVE-2023-0134: Use after free in Cart. Reported by Chaoyuan Peng (@ret2happy) on 2022-11-17</li>
<li>[1385831] Medium CVE-2023-0135: Use after free in Cart. Reported by Chaoyuan Peng (@ret2happy) on 2022-11-18</li>
<li>[1356987] Medium CVE-2023-0136: Inappropriate implementation in Fullscreen API. Reported by Axel Chong on 2022-08-26</li>
<li>[1399904] Medium CVE-2023-0137: Heap buffer overflow in Platform Apps. Reported by avaue and Buff3tts at S.S.L. on 2022-12-10</li>
<li>[1346675] Low CVE-2023-0138: Heap buffer overflow in libphonenumber. Reported by Michael Dau on 2022-07-23</li>
<li>[1367632] Low CVE-2023-0139: Insufficient validation of untrusted input in Downloads. Reported by Axel Chong on 2022-09-24</li>
<li>[1326788] Low CVE-2023-0140: Inappropriate implementation in File System API. Reported by harrison.mitchell, cybercx.com.au on 2022-05-18</li>
<li>[1362331] Low CVE-2023-0141: Insufficient policy enforcement in CORS. Reported by scarlet on 2022-09-12</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-0128</cvename>
<cvename>CVE-2023-0129</cvename>
<cvename>CVE-2023-0130</cvename>
<cvename>CVE-2023-0131</cvename>
<cvename>CVE-2023-0132</cvename>
<cvename>CVE-2023-0133</cvename>
<cvename>CVE-2023-0134</cvename>
<cvename>CVE-2023-0135</cvename>
<cvename>CVE-2023-0136</cvename>
<cvename>CVE-2023-0137</cvename>
<cvename>CVE-2023-0138</cvename>
<cvename>CVE-2023-0139</cvename>
<cvename>CVE-2023-0140</cvename>
<cvename>CVE-2023-0141</cvename>
<url>https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2023-01-10</discovery>
<entry>2023-01-10</entry>
</dates>
</vuln>
<vuln vid="59c284f4-8d2e-11ed-9ce0-b42e991fc52e">
<topic>net-mgmt/cacti is vulnerable to remote command injection</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti team reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf">
<p>
A command injection vulnerability allows an
unauthenticated user to execute arbitrary code on a server
running Cacti, if a specific data source was selected for
any monitored device.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-46169</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-46169</url>
</references>
<dates>
<discovery>2022-12-05</discovery>
<entry>2023-01-05</entry>
<modified>2023-01-09</modified>
</dates>
</vuln>
<vuln vid="541696ed-8d12-11ed-af80-ecf4bbc0bda0">
<topic>devel/viewvc-devel is vulnerable to cross-site scripting</topic>
<affects>
<package>
<name>py37-viewvc-devel</name>
<name>py38-viewvc-devel</name>
<name>py39-viewvc-devel</name>
<range><lt>1.3.0.20230104</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>C. Michael Pilato reports:</p>
<blockquote cite="https://github.com/viewvc/viewvc/releases/tag/1.1.30">
<p>security fix: escape revision view copy paths (#311) [CVE-2023-22464]</p>
</blockquote>
<blockquote cite="https://github.com/viewvc/viewvc/releases/tag/1.1.29">
<p>security fix: escape revision view changed paths (#311) [CVE-2023-22456]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-22464</cvename>
<cvename>CVE-2023-22456</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-22464</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-22456</url>
</references>
<dates>
<discovery>2023-01-04</discovery>
<entry>2023-01-05</entry>
</dates>
</vuln>
<vuln vid="5b2eac07-8b4d-11ed-8b23-a0f3c100ae18">
<topic>rxvt-unicode is vulnerable to a remote code execution</topic>
<affects>
<package>
<name>rxvt-unicode</name>
<range><lt>9.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Lehmann reports:</p>
<blockquote cite="http://lists.schmorp.de/pipermail/rxvt-unicode/2023q1/002638.html">
<p>The biggest issue is resolving CVE-2022-4170, which allows command
execution inside urxvt from within the terminal (that means anything that
can output text in the terminal can start commands in the context of the
urxvt process, even remotely).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4170</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-4170</url>
</references>
<dates>
<discovery>2022-12-05</discovery>
<entry>2023-01-03</entry>
</dates>
</vuln>
<vuln vid="86c330fe-bbae-4ca7-85f7-5321e627a4eb">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.18.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/22219">
<p>Remove ReverseProxy authentication from the API</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21139">
<p>Support Go Vulnerability Management</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20935">
<p>Forbid HTML string tooltips</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.18.0</url>
</references>
<dates>
<discovery>2022-08-23</discovery>
<entry>2023-01-02</entry>
</dates>
</vuln>
<vuln vid="140a20e1-8769-11ed-b074-002b67dfc673">
<topic>webtrees -- vulnerability</topic>
<affects>
<package>
<name>webtrees</name>
<range><lt>1.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webtrees reports:</p>
<blockquote cite="https://webtrees.net/blog/2022/06/04/new-webtrees-release-1-7-20.html">
<p>GEDCOM imports containing errors and HTML displayed unescaped.</p>
</blockquote>
</body>
</description>
<references>
<url>https://webtrees.net/blog/2022/06/04/new-webtrees-release-1-7-20.html</url>
</references>
<dates>
<discovery>2022-06-04</discovery>
<entry>2022-12-29</entry>
</dates>
</vuln>
<vuln vid="d379aa14-8729-11ed-b988-080027d3a315">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.9</lt></range>
</package>
<package>
<name>mediawiki138</name>
<range><lt>1.38.5</lt></range>
</package>
<package>
<name>mediawiki139</name>
<range><lt>1.39.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawikwi reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3/">
<p>(T322637, CVE-2022-PENDING) SECURITY: Make sqlite DB files not world readable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3/</url>
</references>
<dates>
<discovery>2022-12-01</discovery>
<entry>2022-12-29</entry>
</dates>
</vuln>
<vuln vid="4b60c3d9-8640-11ed-a762-482ae324f959">
<topic>netdata -- multiple vulnerabilities with streaming</topic>
<affects>
<package>
<name>netdata</name>
<range><lt>1.37.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netdata reports:</p>
<blockquote cite="https://github.com/netdata/netdata/security/advisories">
<p>GHSA-xg38-3vmw-2978: Netdata Streaming Alert Command Injection</p>
<p>GHSA-jx85-39cw-66f2: Netdata Streaming Authentication Bypass</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/netdata/netdata/security/advisories/GHSA-xg38-3vmw-2978</url>
<url>https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2</url>
</references>
<dates>
<discovery>2022-11-30</discovery>
<entry>2022-12-27</entry>
</dates>
</vuln>
<vuln vid="1f0421b1-8398-11ed-973d-002b67dfc673">
<topic>freerdp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freerdp</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FreeRDP reports:</p>
<blockquote cite="https://www.freerdp.com/2022/11/16/2_9_0-release">
<p>GHSA-5w4j-mrrh-jjrm: Out of bound read in zgfx decoder.</p>
<p>GHSA-99cm-4gw7-c8jh: Undefined behaviour in zgfx decoder.</p>
<p>GHSA-387j-8j96-7q35: Division by zero in urbdrc channel.</p>
<p>GHSA-mvxm-wfj2-5fvh: Missing length validation in urbdrc channel.</p>
<p>GHSA-qfq2-82qr-7f4j: Heap buffer overflow in urbdrc channel.</p>
<p>GHSA-c5xq-8v35-pffg: Missing path sanitation with `drive` channel.</p>
<p>GHSA-pmv3-wpw4-pw5h: Missing input length validation in `drive` channel.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39316</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39316</url>
<cvename>CVE-2022-39317</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39317</url>
<cvename>CVE-2022-39318</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39318</url>
<cvename>CVE-2022-39319</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39319</url>
<cvename>CVE-2022-39320</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39320</url>
<cvename>CVE-2022-39347</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-39347</url>
<cvename>CVE-2022-41877</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-41877</url>
</references>
<dates>
<discovery>2022-12-24</discovery>
<entry>2022-12-24</entry>
</dates>
</vuln>
<vuln vid="d0da046a-81e6-11ed-96ca-0800277bb8a8">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.17.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21849">
<p>Do not allow Ghost access to limited visible user/org</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21580">
<p>Fix package access for admins and inactive users</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.17.4</url>
</references>
<dates>
<discovery>2022-10-24</discovery>
<entry>2022-12-22</entry>
</dates>
</vuln>
<vuln vid="d9e154c9-7de9-11ed-adca-080027d3a315">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-11-php81</name>
<range><lt>11.5.20</lt></range>
</package>
<package>
<name>typo3-12-php81</name>
<range><lt>12.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 reports:</p>
<blockquote cite="https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published">
<p>TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling.</p>
<p>TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login.</p>
<p>TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset.</p>
<p>TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework.</p>
<p>TYPO3-CORE-SA-2022-016: Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration.</p>
<p>TYPO3-CORE-SA-2022-017: By-passing Cross-Site Scripting Protection in HTML Sanitizer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23499</cvename>
<cvename>CVE-2022-23500</cvename>
<cvename>CVE-2022-23501</cvename>
<cvename>CVE-2022-23502</cvename>
<cvename>CVE-2022-23503</cvename>
<cvename>CVE-2022-23504</cvename>
<url>https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published</url>
</references>
<dates>
<discovery>2022-12-13</discovery>
<entry>2022-12-17</entry>
</dates>
</vuln>
<vuln vid="83eb9374-7b97-11ed-be8f-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>108.0.5359.124</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>108.0.5359.124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html">
<p>This release contains 8 security fixes, including:</p>
<ul>
<li>[1383991] High CVE-2022-4436: Use after free in Blink Media. Reported by Anonymous on 2022-11-15</li>
<li>[1394692] High CVE-2022-4437: Use after free in Mojo IPC. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-11-30</li>
<li>[1381871] High CVE-2022-4438: Use after free in Blink Frames. Reported by Anonymous on 2022-11-07</li>
<li>[1392661] High CVE-2022-4439: Use after free in Aura. Reported by Anonymous on 2022-11-22</li>
<li>[1382761] Medium CVE-2022-4440: Use after free in Profiles. Reported by Anonymous on 2022-11-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4436</cvename>
<cvename>CVE-2022-4437</cvename>
<cvename>CVE-2022-4438</cvename>
<cvename>CVE-2022-4439</cvename>
<cvename>CVE-2022-4440</cvename>
<url>https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2022-12-13</discovery>
<entry>2022-12-14</entry>
</dates>
</vuln>
<vuln vid="0f99a30c-7b4b-11ed-9168-080027f5fec9">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.86.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Stenberg reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<dl>
<dt>CVE-2022-32221: POST following PUT confusion</dt>
<dd>
When doing HTTP(S) transfers, libcurl might erroneously
use the read callback
(<code>CURLOPT_READFUNCTION</code>) to ask for data to
send, even when the <code>CURLOPT_POSTFIELDS</code>
option has been set, if the same handle previously was
used to issue a <code>PUT</code> request which used that
callback. This flaw may surprise the application and
cause it to misbehave and either send off the wrong data
or use memory after free or similar in the subsequent
<code>POST</code> request. The problem exists in the
logic for a reused handle when it is changed from a PUT
to a POST.
</dd>
<dt>CVE-2022-35260: .netrc parser out-of-bounds access</dt>
<dd>
curl can be told to parse a .netrc file for
credentials. If that file ends in a line with
consecutive non-white space letters and no newline, curl
could read past the end of the stack-based buffer, and
if the read works, write a zero byte possibly beyond its
boundary. This will in most cases cause a segfault or
similar, but circumstances might also cause different
outcomes. If a malicious user can provide a custom netrc
file to an application or otherwise affect its contents,
this flaw could be used as denial-of-service.
</dd>
<dt>CVE-2022-42915: HTTP proxy double-free</dt>
<dd>
f curl is told to use an HTTP proxy for a transfer with
a non-HTTP(S) URL, it sets up the connection to the
remote server by issuing a CONNECT request to the proxy,
and then tunnels the rest of protocol through. An HTTP
proxy might refuse this request (HTTP proxies often only
allow outgoing connections to specific port numbers,
like 443 for HTTPS) and instead return a non-200
response code to the client. Due to flaws in the
error/cleanup handling, this could trigger a double-free
in curl if one of the following schemes were used in the
URL for the transfer: dict, gopher, gophers, ldap,
ldaps, rtmp, rtmps, telnet
</dd>
<dt>CVE-2022-42916: HSTS bypass via IDN</dt>
<dd>
curl's HSTS check could be bypassed to trick it to keep
using HTTP. Using its HSTS support, curl can be
instructed to use HTTPS directly instead of using an
insecure clear-text HTTP step even when HTTP is provided
in the URL. This mechanism could be bypassed if the host
name in the given URL uses IDN characters that get
replaced to ASCII counterparts as part of the IDN
conversion. Like using the character UTF-8 U+3002
(IDEOGRAPHIC FULL STOP) instead of the common ASCII full
stop (U+002E) .. Like this: http://curl。se。
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32221</cvename>
<cvename>CVE-2022-35260</cvename>
<cvename>CVE-2022-42915</cvename>
<cvename>CVE-2022-42916</cvename>
<url>https://curl.se/docs/CVE-2022-32221.html</url>
<url>https://curl.se/docs/CVE-2022-35260.html</url>
<url>https://curl.se/docs/CVE-2022-42915.html</url>
<url>https://curl.se/docs/CVE-2022-42916.html</url>
</references>
<dates>
<discovery>2022-10-26</discovery>
<entry>2022-12-14</entry>
</dates>
</vuln>
<vuln vid="439f3f81-7a49-11ed-97ac-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
<p>an authenticated SQL injection when adding categories in the admin backend</p>
<p>a stored cross-site scripting vulnerability in the category name</p>
<p>a stored cross-site scripting vulnerability in the admin logging</p>
<p>a stored cross-site scripting vulnerability in the FAQ title</p>
<p>a PostgreSQL based SQL injection for the lang parameter </p>
<p>a SQL injection when storing an instance name in the admin backend</p>
<p>a SQL injection when adding attachments in the admin backend</p>
<p>a stored cross-site scripting vulnerability when adding users by admins</p>
<p>a missing "secure" flag for cookies when using TLS</p>
<p>a cross-site request forgery / cross-site scripting vulnerability when saving new questions</p>
<p>a reflected cross-site scripting vulnerability in the admin backend</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/a1649f43-78c9-4927-b313-36911872a84b/</url>
<url>https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea/</url>
<url>https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c/</url>
<url>https://huntr.dev/bounties/5944f154-c0ab-4547-9d9d-3101e86eb975/</url>
<url>https://huntr.dev/bounties/315aa78d-7bd2-4b14-86f2-b5c211e62034/</url>
<url>https://huntr.dev/bounties/eb3a8ea3-daea-4555-a3e6-80b82f533792/</url>
<url>https://huntr.dev/bounties/faac0c92-8d4b-4901-a933-662b661a3f99/</url>
<url>https://huntr.dev/bounties/56499a60-2358-41fe-9b38-8cb23cdfc17c/</url>
<url>https://huntr.dev/bounties/f531bbf2-32c8-4efe-8156-ae9bc6b5d3aa/</url>
<url>https://huntr.dev/bounties/322c12b1-08d5-4ee3-9d94-d4bb40366c7a/</url>
<url>https://huntr.dev/bounties/f2857bc7-8fbc-489a-9a38-30b93300eec5/</url>
</references>
<dates>
<discovery>2022-12-11</discovery>
<entry>2022-12-12</entry>
</dates>
</vuln>
<vuln vid="508da89c-78b9-11ed-854f-5404a68ad561">
<topic>traefik -- multiple vulnerabilities</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>2.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Traefik project reports:</p>
<blockquote cite="https://github.com/traefik/traefik/releases/tag/v2.9.6">
<p>This update is recommended for all traefik users and provides following important security fixes:</p>
<ul>
<li>CVE-2022-23469: Authorization header displayed in the debug logs</li>
<li>CVE-2022-46153: Routes exposed with an empty TLSOption in traefik</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23469</cvename>
<cvename>CVE-2022-46153</cvename>
<url>https://github.com/traefik/traefik/releases/tag/v2.9.6</url>
</references>
<dates>
<discovery>2022-12-08</discovery>
<entry>2022-12-10</entry>
</dates>
</vuln>
<vuln vid="ba94433c-7890-11ed-859e-1c61b4739ac9">
<topic>xrdp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xrdp</name>
<range><lt>0.9.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp project reports:</p>
<blockquote cite="https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.21">
<p>This update is recommended for all xrdp users and provides following important security fixes:</p>
<ul>
<li>CVE-2022-23468</li>
<li>CVE-2022-23477</li>
<li>CVE-2022-23478</li>
<li>CVE-2022-23479</li>
<li>CVE-2022-23480</li>
<li>CVE-2022-23481</li>
<li>CVE-2022-23483</li>
<li>CVE-2022-23482</li>
<li>CVE-2022-23484</li>
<li>CVE-2022-23493</li>
</ul>
<p>These security issues are reported by Team BT5 (BoB 11th). We appreciate their great help with making and reviewing patches.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23468</cvename>
<cvename>CVE-2022-23477</cvename>
<cvename>CVE-2022-23478</cvename>
<cvename>CVE-2022-23479</cvename>
<cvename>CVE-2022-23480</cvename>
<cvename>CVE-2022-23481</cvename>
<cvename>CVE-2022-23483</cvename>
<cvename>CVE-2022-23482</cvename>
<cvename>CVE-2022-23484</cvename>
<cvename>CVE-2022-23493</cvename>
<url>https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.21</url>
</references>
<dates>
<discovery>2022-12-01</discovery>
<entry>2022-12-10</entry>
</dates>
</vuln>
<vuln vid="050eba46-7638-11ed-820d-080027d3a315">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.16</lt></range>
</package>
<package>
<name>python38</name>
<range><lt>3.8.16</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.16</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.9</lt></range>
</package>
<package>
<name>python311</name>
<range><lt>3.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#changelog">
<p>gh-100001: python -m http.server no longer allows terminal control characters sent
within a garbage request to be printed to the stderr server log.
This is done by changing the http.server BaseHTTPRequestHandler .log_message method
to replace control characters with a \xHH hex escape before printing.</p>
<p>gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module.</p>
<p>gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related
name resolution functions no longer involves a quadratic algorithm. This prevents a
potential CPU denial of service if an out-of-spec excessive length hostname involving
bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects
potentially allow for an attacker to supply such a name.</p>
<p>gh-98739: Update bundled libexpat to 2.5.0.</p>
<p>gh-97612: Fix a shell code injection vulnerability in the get-remote-certificate.py example
script. The script no longer uses a shell to run openssl commands. Issue reported and
initial fix by Caleb Shortt. Patch by Victor Stinner.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3/whatsnew/changelog.html#changelog</url>
</references>
<dates>
<discovery>2022-09-28</discovery>
<entry>2022-12-07</entry>
</dates>
</vuln>
<vuln vid="6f5192f5-75a7-11ed-83c0-411d43ce7fe4">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.9</lt></range>
</package>
<package>
<name>go119</name>
<range><lt>1.19.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/56694">
<p>os, net/http: avoid escapes from os.DirFS and http.Dir on Windows</p>
<p>The os.DirFS function and http.Dir type provide access to a
tree of files rooted at a given directory. These functions
permitted access to Windows device files under that root. For
example, os.DirFS("C:/tmp").Open("COM1") would open the COM1 device.
Both os.DirFS and http.Dir only provide read-only filesystem access.</p>
<p>In addition, on Windows, an os.DirFS for the directory \(the root
of the current drive) can permit a maliciously crafted path to escape
from the drive and access any path on the system.</p>
<p>The behavior of os.DirFS("") has changed. Previously, an empty root
was treated equivalently to "/", so os.DirFS("").Open("tmp") would
open the path "/tmp". This now returns an error.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/56350">
<p>net/http: limit canonical header cache by bytes, not entries</p>
<p>An attacker can cause excessive memory growth in a Go server
accepting HTTP/2 requests. HTTP/2 server connections contain a
cache of HTTP header keys sent by the client. While the total number
of entries in this cache is capped, an attacker sending very large
keys can cause the server to allocate approximately 64 MiB per open
connection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41720</cvename>
<cvename>CVE-2022-41717</cvename>
<url>https://groups.google.com/g/golang-dev/c/G9Jj4cO4Gpk/m/kOkLVG6TAgAJ</url>
</references>
<dates>
<discovery>2022-10-20</discovery>
<entry>2022-12-06</entry>
</dates>
</vuln>
<vuln vid="2899da38-7300-11ed-92ce-3065ec8fd3ec">
<topic>chromium -- Type confusion in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>108.0.5359.94</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>108.0.5359.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html">
<p>This release contains 1 security fix:</p>
<ul>
<li>[1394403] High CVE-2022-4262: Type Confusion in V8. Reported by Clement Lecigne of Google's Threat Analysis Group on 2022-11-29</li>
</ul>
<p>Google is aware that an exploit for CVE-2022-4262 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4262</cvename>
<url>https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-12-02</discovery>
<entry>2022-12-03</entry>
</dates>
</vuln>
<vuln vid="0c52abde-717b-11ed-98ca-40b034429ecf">
<topic>rpm4 -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>rpm4</name>
<range><lt>4.18.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rpm project reports:</p>
<blockquote cite="https://rpm.org/wiki/Releases/4.18.0">
<p>Fix intermediate symlinks not verified (CVE-2021-35939).</p>
<p>Fix subkey binding signatures not checked on PGP public keys (CVE-2021-3521).</p>
<p>Refactor file and directory operations to use fd-based APIs throughout (CVE-2021-35938)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-35939</cvename>
<cvename>CVE-2021-3521</cvename>
<cvename>CVE-2021-35938</cvename>
</references>
<dates>
<discovery>2022-08-22</discovery>
<entry>2022-12-01</entry>
</dates>
</vuln>
<vuln vid="3cde510a-7135-11ed-a28b-bff032704f00">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.6.0</ge><lt>15.6.1</lt></range>
<range><ge>15.5.0</ge><lt>15.5.5</lt></range>
<range><ge>9.3.0</ge><lt>15.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/">
<p>DAST API scanner exposes Authorization headers in vulnerabilities</p>
<p>Group IP allow-list not fully respected by the Package Registry</p>
<p>Deploy keys and tokens may bypass External Authorization service if it is enabled</p>
<p>Repository import still allows to import 40 hexadecimal branches</p>
<p>Webhook secret tokens leaked in webhook logs</p>
<p>Maintainer can leak webhook secret token by changing the webhook URL</p>
<p>Cross-site scripting in Jira Integration affecting self-hosted instances without strict CSP</p>
<p>Release names visible in public projects despite release set as project members only</p>
<p>Sidekiq background job DoS by uploading malicious NuGet packages</p>
<p>SSRF in Web Terminal advertise_address</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4206</cvename>
<cvename>CVE-2022-3820</cvename>
<cvename>CVE-2022-3740</cvename>
<cvename>CVE-2022-4205</cvename>
<cvename>CVE-2022-3902</cvename>
<cvename>CVE-2022-4054</cvename>
<cvename>CVE-2022-3572</cvename>
<cvename>CVE-2022-3482</cvename>
<cvename>CVE-2022-3478</cvename>
<cvename>CVE-2022-4201</cvename>
<url>https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/</url>
</references>
<dates>
<discovery>2022-11-30</discovery>
<entry>2022-12-01</entry>
</dates>
</vuln>
<vuln vid="5f7ed6ea-70a7-11ed-92ce-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>108.0.5359.71</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>108.0.5359.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html">
<p>This release contains 28 security fixes, including:</p>
<ul>
<li>[1379054] High CVE-2022-4174: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2022-10-27</li>
<li>[1381401] High CVE-2022-4175: Use after free in Camera Capture. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2022-11-04</li>
<li>[1361066] High CVE-2022-4176: Out of bounds write in Lacros Graphics. Reported by @ginggilBesel on 2022-09-08</li>
<li>[1379242] High CVE-2022-4177: Use after free in Extensions. Reported by Chaoyuan Peng (@ret2happy) on 2022-10-28</li>
<li>[1376099] High CVE-2022-4178: Use after free in Mojo. Reported by Sergei Glazunov of Google Project Zero on 2022-10-18</li>
<li>[1377783] High CVE-2022-4179: Use after free in Audio. Reported by Sergei Glazunov of Google Project Zero on 2022-10-24</li>
<li>[1378564] High CVE-2022-4180: Use after free in Mojo. Reported by Anonymous on 2022-10-26</li>
<li>[1382581] High CVE-2022-4181: Use after free in Forms. Reported by Aviv A. on 2022-11-09</li>
<li>[1368739] Medium CVE-2022-4182: Inappropriate implementation in Fenced Frames. Reported by Peter Nemeth on 2022-09-28</li>
<li>[1251790] Medium CVE-2022-4183: Insufficient policy enforcement in Popup Blocker. Reported by David Sievers on 2021-09-22</li>
<li>[1358647] Medium CVE-2022-4184: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2022-09-01</li>
<li>[1373025] Medium CVE-2022-4185: Inappropriate implementation in Navigation. Reported by James Lee (@Windowsrcer) on 2022-10-10</li>
<li>[1377165] Medium CVE-2022-4186: Insufficient validation of untrusted input in Downloads. Reported by Luan Herrera (@lbherrera_) on 2022-10-21</li>
<li>[1381217] Medium CVE-2022-4187: Insufficient policy enforcement in DevTools. Reported by Axel Chong on 2022-11-04</li>
<li>[1340879] Medium CVE-2022-4188: Insufficient validation of untrusted input in CORS. Reported by Philipp Beer (TU Wien) on 2022-06-30</li>
<li>[1344647] Medium CVE-2022-4189: Insufficient policy enforcement in DevTools. Reported by NDevTK on 2022-07-15</li>
<li>[1378997] Medium CVE-2022-4190: Insufficient data validation in Directory. Reported by Axel Chong on 2022-10-27</li>
<li>[1373941] Medium CVE-2022-4191: Use after free in Sign-In. Reported by Jaehun Jeong(@n3sk) of Theori on 2022-10-12</li>
<li>[1344514] Medium CVE-2022-4192: Use after free in Live Caption. Reported by Samet Bekmezci @sametbekmezci on 2022-07-14</li>
<li>[1354518] Medium CVE-2022-4193: Insufficient policy enforcement in File System API. Reported by Axel Chong on 2022-08-19</li>
<li>[1370562] Medium CVE-2022-4194: Use after free in Accessibility. Reported by Anonymous on 2022-10-03</li>
<li>[1371926] Medium CVE-2022-4195: Insufficient policy enforcement in Safe Browsing. Reported by Eric Lawrence of Microsoft on 2022-10-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4174</cvename>
<cvename>CVE-2022-4175</cvename>
<cvename>CVE-2022-4176</cvename>
<cvename>CVE-2022-4177</cvename>
<cvename>CVE-2022-4178</cvename>
<cvename>CVE-2022-4179</cvename>
<cvename>CVE-2022-4180</cvename>
<cvename>CVE-2022-4181</cvename>
<cvename>CVE-2022-4182</cvename>
<cvename>CVE-2022-4183</cvename>
<cvename>CVE-2022-4184</cvename>
<cvename>CVE-2022-4185</cvename>
<cvename>CVE-2022-4186</cvename>
<cvename>CVE-2022-4187</cvename>
<cvename>CVE-2022-4188</cvename>
<cvename>CVE-2022-4189</cvename>
<cvename>CVE-2022-4190</cvename>
<cvename>CVE-2022-4191</cvename>
<cvename>CVE-2022-4192</cvename>
<cvename>CVE-2022-4193</cvename>
<cvename>CVE-2022-4194</cvename>
<cvename>CVE-2022-4195</cvename>
<url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2022-11-29</discovery>
<entry>2022-11-30</entry>
</dates>
</vuln>
<vuln vid="8d3838b0-6ca8-11ed-92ce-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>107.0.5304.121</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>107.0.5304.121</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html">
<p>This release contains 1 security fix:</p>
<ul>
<li>[1392715] High CVE-2022-4135: Heap buffer overflow in GPU. Reported by Clement Lecigne of Google's Threat Analysis Group on 2022-11-22</li>
</ul>
<p>Google is aware that an exploit for CVE-2022-4135 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4135</cvename>
<url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2022-11-24</discovery>
<entry>2022-11-25</entry>
</dates>
</vuln>
<vuln vid="84ab03b6-6c20-11ed-b519-080027f5fec9">
<topic>rubygem-cgi -- HTTP response splitting vulnerability</topic>
<affects>
<package>
<name>rubygem-cgi</name>
<range><lt>0.3.4</lt></range>
</package>
<package>
<name>ruby</name>
<range><ge>2.7.0,1</ge><lt>2.7.7,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.5,1</lt></range>
<range><ge>3.1.0,1</ge><lt>3.1.3,1</lt></range>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.r1,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.7,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.5,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.3,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.r1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hiroshi Tokumaru reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/">
<p>
If an application that generates HTTP responses using the
cgi gem with untrusted user input, an attacker can exploit
it to inject a malicious HTTP response header and/or body.
</p>
<p>
Also, the contents for a <code>CGI::Cookie</code> object
were not checked properly. If an application creates a
<code>CGI::Cookie</code> object based on user input, an
attacker may exploit it to inject invalid attributes in
<code>Set-Cookie</code> header. We think such applications
are unlikely, but we have included a change to check
arguments for <code>CGI::Cookie#initialize</code>
preventatively.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33621</cvename>
<url>https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/</url>
</references>
<dates>
<discovery>2022-11-22</discovery>
<entry>2022-11-24</entry>
</dates>
</vuln>
<vuln vid="658b9198-8106-4c3d-a2aa-dc4a0a7cc3b6">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.4">
<p> A specially-crafted series of HTTP 0.9 packets can
cause Zeek to spend large amounts of time processing the
packets. </p>
<p> A specially-crafted FTP packet can cause Zeek to spend
large amounts of time processing the command. </p>
<p> A specially-crafted IPv6 packet can cause Zeek to
overflow memory and potentially crash. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.4</url>
</references>
<dates>
<discovery>2022-11-24</discovery>
<entry>2022-11-24</entry>
</dates>
</vuln>
<vuln vid="b6a84729-6bd0-11ed-8d9a-b42e991fc52e">
<topic>advancecomp -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>advancecomp</name>
<range><lt>2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub advisories reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-8xqx-5mpr-g8xj">
<p>Multiple vulnerabilities found in advancecomp including:</p>
<ul>
<li>Three segmentation faults.</li>
<li>Heap buffer overflow via le_uint32_read at /lib/endianrw.h.</li>
<li>Three more heap buffer overflows.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35014</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35014</url>
<cvename>CVE-2022-35015</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35015</url>
<cvename>CVE-2022-35016</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35016</url>
<cvename>CVE-2022-35017</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35017</url>
<cvename>CVE-2022-35018</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35018</url>
<cvename>CVE-2022-35019</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35019</url>
<cvename>CVE-2022-35020</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-35020</url>
</references>
<dates>
<discovery>2022-08-29</discovery>
<entry>2022-11-24</entry>
</dates>
</vuln>
<vuln vid="e0f26ac5-6a17-11ed-93e7-901b0e9408dc">
<topic>tailscale -- Security vulnerability in the client</topic>
<affects>
<package>
<name>tailscale</name>
<range><lt>1.32.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tailscale team reports:</p>
<blockquote cite="https://tailscale.com/security-bulletins/#ts-2022-005">
<p>A vulnerability identified in the Tailscale client allows a
malicious website to access the peer API, which can then be used
to access Tailscale environment variables.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41925</cvename>
<url>https://tailscale.com/security-bulletins/#ts-2022-005</url>
</references>
<dates>
<discovery>2022-11-21</discovery>
<entry>2022-11-22</entry>
</dates>
</vuln>
<vuln vid="556fdf03-6785-11ed-953b-002b67dfc673">
<topic>Tomcat -- Request Smuggling</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>8.5.0</ge><lt>8.5.83</lt></range>
<range><ge>9.0.0-M1</ge><lt>9.0.68</lt></range>
<range><ge>10.0.0-M1</ge><lt>10.0.27</lt></range>
<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
</package>
<package>
<name>tomcat85</name>
<range><ge>8.5.0</ge><lt>8.5.83</lt></range>
</package>
<package>
<name>tomcat9</name>
<range><ge>9.0.0-M1</ge><lt>9.0.68</lt></range>
</package>
<package>
<name>tomcat10</name>
<range><ge>10.0.0-M1</ge><lt>10.0.27</lt></range>
</package>
<package>
<name>tomcat101</name>
<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
</package>
<package>
<name>tomcat-devel</name>
<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Tomcat reports:</p>
<blockquote cite="https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq">
<p>
If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
</p>
<p>The CVSS score for this vulnerability is 7.5 High</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42252</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-42252</url>
</references>
<dates>
<discovery>2022-10-31</discovery>
<entry>2022-11-18</entry>
</dates>
</vuln>
<vuln vid="094e4a5b-6511-11ed-8c5e-206a8a720317">
<topic>krb5 -- Integer overflow vulnerabilities in PAC parsing</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.19.3_1</lt></range>
<range><gt>1.20</gt><lt>1.20_1</lt></range>
</package>
<package>
<name>krb5-120</name>
<range><lt>1.20_1</lt></range>
</package>
<package>
<name>krb5-119</name>
<range><lt>1.19.3_1</lt></range>
</package>
<package>
<name>krb5-devel</name>
<range><lt>1.20.2022.11.03</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITKRB5-SA-2022-001 Vulnerabilities in PAC parsing:</p>
<blockquote cite="https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2022-001.txt">
<p>Due to an integer overflow vulnerabilities in PAC parsing
An authenticated attacker may be able to cause a KDC or kadmind
process to crash by reading beyond the bounds of allocated memory,
creating a denial of service.</p>
<p>On 32-bit platforms an authenticated attacker may be able to
cause heap corruption resulting in an RCE.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-42898</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42898</url>
</references>
<dates>
<discovery>2022-11-05</discovery>
<entry>2022-11-15</entry>
</dates>
</vuln>
<vuln vid="0a80f159-629b-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Username enumeration</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
<p>When using the forget password on the login page, a POST request is made
to the <code>/api/user/password/sent-reset-email</code> URL. When the username
or email does not exist, a JSON response contains a “user not found” message.
</p>
<p>The CVSS score for this vulnerability is 5.3 Moderate</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39307</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5</url>
</references>
<dates>
<discovery>2022-10-24</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="6eb6a442-629a-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Privilege escalation</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
<p>Grafana admins can invite other members to the organization they are
an admin for. When admins add members to the organization, non existing users
get an email invite, existing members are added directly to the organization.
When an invite link is sent, it allows users to sign up with whatever
username/email address the user chooses and become a member of the organization.
</p>
<p>The CVSS score for this vulnerability is 6.4 Moderate</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39306</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84</url>
</references>
<dates>
<discovery>2022-10-24</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="db895ed0-6298-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Privilege escalation</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
<p>Internal security audit identified a race condition in the Grafana codebase,
which allowed an unauthenticated user to query an arbitrary endpoint in Grafana.
A race condition in the <a href="https://github.com/grafana/grafana/blob/main/pkg/web/router.go#L153">
HTTP context</a> creation could make a HTTP request being assigned
the authentication/authorization middlewares of another call. Under heavy load
it is possible that a call protected by a privileged middleware receives instead
the middleware of a public query. As a result, an unauthenticated user can
successfully query protected endpoints.</p>
<p>The CVSS score for this vulnerability is 9.8 Critical</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39328</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch</url>
</references>
<dates>
<discovery>2022-11-08</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="4e60d660-6298-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Plugin signature bypass</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>7.0.0</ge><lt>8.5.14</lt></range>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
<p>On July 4th as a result of an internal security audit we have discovered
a bypass in the plugin signature verification by exploiting a versioning flaw.</p>
<p>We believe that this vulnerability is rated at CVSS 6.1
(CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31123</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8</url>
</references>
<dates>
<discovery>2022-07-04</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="6f6c9420-6297-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>7.0.0</ge><lt>8.5.14</lt></range>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
<p>On June 26 a security researcher contacted Grafana Labs to disclose
a vulnerability with the GitLab data source plugin that could leak the API key
to GitLab. After further analysis the vulnerability impacts data source
and plugin proxy endpoints with authentication tokens but under some conditions.</p>
<p>We believe that this vulnerability is rated at CVSS 4.9
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31130</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc</url>
</references>
<dates>
<discovery>2022-06-26</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="6877e164-6296-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>5.0.0</ge><lt>8.5.14</lt></range>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
<p>On September 7th as a result of an internal security audit we have discovered
that Grafana could leak the authentication cookie of users to plugins. After
further analysis the vulnerability impacts data source and plugin proxy
endpoints under certain conditions.</p>
<p>We believe that this vulnerability is rated at CVSS 6.8
(CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39201</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr</url>
</references>
<dates>
<discovery>2022-09-07</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="909a80ba-6294-11ed-9ca2-6c3be5272acd">
<topic>Grafana -- Improper authentication</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
<p>On September 7, as a result of an internal security audit, we discovered
a security vulnerability in Grafana’s basic authentication related to the usage
of username and email address.</p>
<p>n Grafana, a user’s username and email address are unique fields, which
means no other user can have the same username or email address as another user.
</p>
<p>In addition, a user can have an email address as a username, and the Grafana
login allows users to sign in with either username or email address. This
creates an unusual behavior, where <em>user_1</em> can register with one email
address and <em>user_2</em> can register their username as <em>user_1</em>’s
email address. As a result, <em>user_1</em> would be prevented from signing
in to Grafana, since <em>user_1</em> password won’t match with <em>user_2</em>
email address.</p>
<p>The CVSS score for this vulnerability is 4.3 moderate
(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39229</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r</url>
</references>
<dates>
<discovery>2022-09-07</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="35d1e192-628e-11ed-8c5e-641c67a117d8">
<topic>ipython -- Execution with Unnecessary Privileges</topic>
<affects>
<package>
<name>py37-ipython</name>
<name>py38-ipython</name>
<name>py39-ipython</name>
<name>py310-ipython</name>
<name>py311-ipython</name>
<range><lt>7.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>IPython project reports:</p>
<blockquote cite="https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699">
<p>IPython 8.0.1, 7.31.1 and 5.11 are security releases that change some
default values in order to prevent potential Execution with Unnecessary
Privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21699</cvename>
<url>https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x</url>
<url>https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699</url>
</references>
<dates>
<discovery>2022-01-19</discovery>
<entry>2022-11-12</entry>
</dates>
</vuln>
<vuln vid="f5a48a7a-61d3-11ed-9094-589cfc0f81b0">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
<p>a pre-auth SQL injection in then saving user comments</p>
<p>a reflected cross-site scripting vulnerability in the search</p>
<p>a stored cross-site scripting vulnerability in the meta data administration</p>
<p>a weak password requirement</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/613143a1-8e51-449a-b214-12458308835d/</url>
<url>https://huntr.dev/bounties/d9666520-4ff5-43bb-aacf-50c8e5570983/</url>
<url>https://huntr.dev/bounties/f4711d7f-1368-48ab-9bef-45f32e356c47/</url>
</references>
<dates>
<discovery>2022-10-24</discovery>
<entry>2022-11-11</entry>
</dates>
</vuln>
<vuln vid="5b8d8dee-6088-11ed-8c5e-641c67a117d8">
<topic>varnish -- HTTP/2 Request Forgery Vulnerability</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.2.1</lt></range>
</package>
<package>
<name>varnish6</name>
<range><le>6.6.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00011.html">
<p>A request forgery attack can be performed on Varnish Cache servers that
have the HTTP/2 protocol turned on. An attacker may introduce
characters through the HTTP/2 pseudo-headers that are invalid in the
context of an HTTP/1 request line, causing the Varnish server to
produce invalid HTTP/1 requests to the backend. This may in turn be
used to successfully exploit vulnerabilities in a server behind the
Varnish server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00011.html</url>
</references>
<dates>
<discovery>2022-11-08</discovery>
<entry>2022-11-09</entry>
</dates>
</vuln>
<vuln vid="b10d1afa-6087-11ed-8c5e-641c67a117d8">
<topic>varnish -- Request Smuggling Vulnerability</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00010.html">
<p>A request smuggling attack can be performed on Varnish Cache servers by
requesting that certain headers are made hop-by-hop, preventing the
Varnish Cache servers from forwarding critical headers to the backend.
Among the headers that can be filtered this way are both Content-Length
and Host, making it possible for an attacker to both break the HTTP/1
protocol framing, and bypass request to host routing in VCL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00010.html</url>
</references>
<dates>
<discovery>2022-11-08</discovery>
<entry>2022-11-09</entry>
</dates>
</vuln>
<vuln vid="6b04476f-601c-11ed-92ce-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>107.0.5304.110</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>107.0.5304.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html">
<p>This release contains 10 security fixes, including:</p>
<ul>
<li>[1377816] High CVE-2022-3885: Use after free in V8. Reported by gzobqq@ on 2022-10-24</li>
<li>[1372999] High CVE-2022-3886: Use after free in Speech Recognition. Reported by anonymous on 2022-10-10</li>
<li>[1372695] High CVE-2022-3887: Use after free in Web Workers. Reported by anonymous on 2022-10-08</li>
<li>[1375059] High CVE-2022-3888: Use after free in WebCodecs. Reported by Peter Nemeth on 2022-10-16</li>
<li>[1380063] High CVE-2022-3889: Type Confusion in V8. Reported by anonymous on 2022-11-01</li>
<li>[1380083] High CVE-2022-3890: Heap buffer overflow in Crashpad. Reported by anonymous on 2022-11-01</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3885</cvename>
<cvename>CVE-2022-3886</cvename>
<cvename>CVE-2022-3887</cvename>
<cvename>CVE-2022-3888</cvename>
<cvename>CVE-2022-3889</cvename>
<cvename>CVE-2022-3890</cvename>
<url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-11-08</discovery>
<entry>2022-11-09</entry>
</dates>
</vuln>
<vuln vid="60d4d31a-a573-41bd-8c1e-5af7513c1ee9">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.3">
<p> Fix an issue where a specially-crafted FTP packet can
cause Zeek to spend large amounts of time attempting to
search for valid commands in the data stream. </p>
<p> Fix a possible overflow in the Zeek dictionary code
that may lead to a memory leak. </p>
<p> Fix an issue where a specially-crafted packet can
cause Zeek to spend large amounts of time reporting
analyzer violations. </p>
<p> Fix a possible assert and crash in the HTTP analyzer
when receiving a specially crafted packet. </p>
<p> Fix an issue where a specially-crafted HTTP or SMTP
packet can cause Zeek to spend a large amount of time
attempting to search for filenames within the packet data.
</p>
<p> Fix two separate possible crashes when converting
processed IP headers for logging via the raw_packet event
handlers. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.3</url>
</references>
<dates>
<discovery>2022-11-09</discovery>
<entry>2022-11-09</entry>
</dates>
</vuln>
<vuln vid="9c399521-5f80-11ed-8ac4-b42e991fc52e">
<topic>darkhttpd -- DOS vulnerability</topic>
<affects>
<package>
<name>darkhttpd</name>
<range><lt>1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25691">
<p>
flaw was found in darkhttpd. Invalid error handling allows
remote attackers to cause denial-of-service by accessing a
file with a large modification date. The highest threat
from this vulnerability is to system availability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-25691</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25691</url>
</references>
<dates>
<discovery>2020-11-02</discovery>
<entry>2022-11-08</entry>
</dates>
</vuln>
<vuln vid="3310014a-5ef9-11ed-812b-206a8a720317">
<topic>sudo -- Potential out-of-bounds write for small passwords</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.8.0</ge><lt>1.9.12p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="INSERT URL HERE">
<p>Sudo 1.8.0 through 1.9.12, with the crypt() password backend,
contains a plugins/sudoers/auth/passwd.c array-out-of-bounds
error that can result in a heap-based buffer over-read. This
can be triggered by arbitrary local users with access to sudo
by entering a password of seven characters or fewer. The impact
could vary depending on the system libraries, compiler,
and processor architecture.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-43995</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43995</url>
</references>
<dates>
<discovery>2022-11-07</discovery>
<entry>2022-11-07</entry>
</dates>
</vuln>
<vuln vid="16f7ec68-5cce-11ed-9be7-454b1dd82c64">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.5.0</ge><lt>15.5.2</lt></range>
<range><ge>15.4.0</ge><lt>15.4.4</lt></range>
<range><ge>9.3.0</ge><lt>15.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/">
<p>DAST analyzer sends custom request headers with every request</p>
<p>Stored-XSS with CSP-bypass via scoped labels' color</p>
<p>Maintainer can leak Datadog API key by changing integration URL</p>
<p>Uncontrolled resource consumption when parsing URLs</p>
<p>Issue HTTP requests when users view an OpenAPI document and click buttons</p>
<p>Command injection in CI jobs via branch name in CI pipelines</p>
<p>Open redirection</p>
<p>Prefill variables do not check permission of the project in external CI config</p>
<p>Disclosure of audit events to insufficiently permissioned group and project members</p>
<p>Arbitrary GFM references rendered in Jira issue description leak private/confidential resources</p>
<p>Award emojis API for an internal note is accessible to users without access to the note</p>
<p>Open redirect in pipeline artifacts when generating HTML documents</p>
<p>Retrying a job in a downstream pipeline allows the retrying user to take ownership of the retried jobs in upstream pipelines</p>
<p>Project-level Secure Files can be written out of the target directory</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3767</cvename>
<cvename>CVE-2022-3265</cvename>
<cvename>CVE-2022-3483</cvename>
<cvename>CVE-2022-3818</cvename>
<cvename>CVE-2022-3726</cvename>
<cvename>CVE-2022-2251</cvename>
<cvename>CVE-2022-3486</cvename>
<cvename>CVE-2022-3793</cvename>
<cvename>CVE-2022-3413</cvename>
<cvename>CVE-2022-2761</cvename>
<cvename>CVE-2022-3819</cvename>
<cvename>CVE-2022-3280</cvename>
<cvename>CVE-2022-3706</cvename>
<url>https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/</url>
</references>
<dates>
<discovery>2022-11-02</discovery>
<entry>2022-11-05</entry>
</dates>
</vuln>
<vuln vid="b278783f-5c1d-11ed-a21f-001fc69cd6dc">
<topic>pixman -- heap overflow</topic>
<affects>
<package>
<name>pixman</name>
<range><lt>0.42.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pixman reports: for release 0.42.2</p>
<blockquote cite="https://lists.freedesktop.org/archives/pixman/2022-November/004994.html">
<p>Avoid integer overflow leading to out-of-bounds write</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-44638</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-44638</url>
</references>
<dates>
<discovery>2022-11-02</discovery>
<entry>2022-11-03</entry>
</dates>
</vuln>
<vuln vid="26b1100a-5a27-11ed-abfe-29ac76ec31b5">
<topic>go -- syscall, os/exec: unsanitized NUL in environment variables</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.8</lt></range>
</package>
<package>
<name>go119</name>
<range><lt>1.19.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/56284">
<p>syscall, os/exec: unsanitized NUL in environment
variables</p>
<p>On Windows, syscall.StartProcess and os/exec.Cmd did not
properly check for invalid environment variable values. A
malicious environment variable value could exploit this
behavior to set a value for a different environment
variable. For example, the environment variable string
"A=B\x00C=D" set the variables "A=B" and "C=D".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41716</cvename>
<url>https://groups.google.com/g/golang-dev/c/83nKqv2W1Dk/m/gEJdD5vjDwAJ</url>
</references>
<dates>
<discovery>2022-10-17</discovery>
<entry>2022-11-01</entry>
</dates>
</vuln>
<vuln vid="0844671c-5a09-11ed-856e-d4c9ef517024">
<topic>OpenSSL -- Buffer overflows in Email verification</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20221101.txt">
<p>X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602) (High):
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking.</p>
<p>X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
(High): A buffer overrun can be triggered in X.509 certificate
verification, specifically in name constraint checking.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3602</cvename>
<cvename>CVE-2022-3786</cvename>
<url>https://www.openssl.org/news/secadv/20221101.txt</url>
</references>
<dates>
<discovery>2022-11-01</discovery>
<entry>2022-11-01</entry>
</dates>
</vuln>
<vuln vid="4b9c1c17-587c-11ed-856e-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.31</lt></range>
</package>
<package>
<name>mysql-connector-odbc</name>
<range><lt>8.0.31</lt></range>
</package>
<package>
<name>mysql-client57</name>
<range><lt>5.7.40</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.40</lt></range>
</package>
<package>
<name>mysql-client80</name>
<range><lt>8.0.31</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixMSQL">
<p>This Critical Patch Update contains 37 new security patches for
Oracle MySQL. 11 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without requiring user credentials</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21600</cvename>
<cvename>CVE-2022-21635</cvename>
<cvename>CVE-2022-39408</cvename>
<cvename>CVE-2022-39410</cvename>
<cvename>CVE-2022-2097</cvename>
<cvename>CVE-2022-21604</cvename>
<cvename>CVE-2022-21637</cvename>
<cvename>CVE-2022-21617</cvename>
<cvename>CVE-2022-21605</cvename>
<cvename>CVE-2022-21594</cvename>
<cvename>CVE-2022-21607</cvename>
<cvename>CVE-2022-21608</cvename>
<cvename>CVE-2022-21638</cvename>
<cvename>CVE-2022-21640</cvename>
<cvename>CVE-2022-21641</cvename>
<cvename>CVE-2022-39400</cvename>
<cvename>CVE-2022-21633</cvename>
<cvename>CVE-2022-21632</cvename>
<cvename>CVE-2022-21599</cvename>
<cvename>CVE-2022-21595</cvename>
<cvename>CVE-2022-21625</cvename>
<cvename>CVE-2022-21592</cvename>
<cvename>CVE-2022-21589</cvename>
<cvename>CVE-2022-39402</cvename>
<cvename>CVE-2022-39404</cvename>
<cvename>CVE-2022-21611</cvename>
<cvename>CVE-2022-39403</cvename>
<url>https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2022-10-18</discovery>
<entry>2022-10-30</entry>
</dates>
</vuln>
<vuln vid="1225c888-56ea-11ed-b5c3-3065ec8fd3ec">
<topic>chromium -- Type confusion in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>107.0.5304.87</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>107.0.5304.87</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html">
<p>This release contains 1 security fix:</p>
<ul>
<li>[1378239] High CVE-2022-3723: Type Confusion in V8. Reported by Jan Vojtešek, Milánek, and Przemek Gmerek of Avast on 2022-10-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3723</cvename>
<url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2022-10-27</discovery>
<entry>2022-10-28</entry>
</dates>
</vuln>
<vuln vid="1c5f3fd7-54bf-11ed-8d1e-005056a311d1">
<topic>samba -- buffer overflow in Heimdal unwrap_des3()</topic>
<affects>
<package>
<name>samba412</name>
<range><lt>4.12.16</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.17_4</lt></range>
</package>
<package>
<name>samba416</name>
<range><lt>4.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2022-3437.html">
<p>The DES (for Samba 4.11 and earlier) and Triple-DES decryption
routines in the Heimdal GSSAPI library allow a length-limited write
buffer overflow on malloc() allocated memory when presented with a
maliciously small packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3437</cvename>
<url>https://www.samba.org/samba/security/CVE-2022-3437.html</url>
</references>
<dates>
<discovery>2022-08-02</discovery>
<entry>2022-10-25</entry>
</dates>
</vuln>
<vuln vid="b4ef02f4-549f-11ed-8ad9-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>107.0.5304.68</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>107.0.5304.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html">
<p>This release contains 14 security fixes, including:</p>
<ul>
<li>[1369871] High CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L Team on 2022-09-30</li>
<li>[1354271] High CVE-2022-3653: Heap buffer overflow in Vulkan. Reported by SeongHwan Park (SeHwa) on 2022-08-19</li>
<li>[1365330] High CVE-2022-3654: Use after free in Layout. Reported by Sergei Glazunov of Google Project Zero on 2022-09-19</li>
<li>[1343384] Medium CVE-2022-3655: Heap buffer overflow in Media Galleries. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11</li>
<li>[1345275] Medium CVE-2022-3656: Insufficient data validation in File System. Reported by Ron Masas, Imperva on 2022-07-18</li>
<li>[1351177] Medium CVE-2022-3657: Use after free in Extensions. Reported by Omri Bushari, Talon Cyber Security on 2022-08-09</li>
<li>[1352817] Medium CVE-2022-3658: Use after free in Feedback service on Chrome OS. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-14</li>
<li>[1355560] Medium CVE-2022-3659: Use after free in Accessibility. Reported by @ginggilBesel on 2022-08-23</li>
<li>[1327505] Medium CVE-2022-3660: Inappropriate implementation in Full screen mode. Reported by Irvan Kurniawan (sourc7) on 2022-05-20</li>
<li>[1350111] Low CVE-2022-3661: Insufficient data validation in Extensions. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2022-08-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3652</cvename>
<cvename>CVE-2022-3653</cvename>
<cvename>CVE-2022-3654</cvename>
<cvename>CVE-2022-3655</cvename>
<cvename>CVE-2022-3656</cvename>
<cvename>CVE-2022-3657</cvename>
<cvename>CVE-2022-3658</cvename>
<cvename>CVE-2022-3659</cvename>
<cvename>CVE-2022-3660</cvename>
<cvename>CVE-2022-3661</cvename>
<url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html</url>
</references>
<dates>
<discovery>2022-10-25</discovery>
<entry>2022-10-25</entry>
</dates>
</vuln>
<vuln vid="68fcee9b-5259-11ed-89c9-0800276af896">
<topic>Cleartext leak in libudisks</topic>
<affects>
<package>
<name>libudisks</name>
<range><lt>2.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From libudisks 2.9.4 NEWS:</p>
<blockquote cite="https://github.com/storaged-project/udisks/blob/udisks-2.9.4/NEWS">
<p>udiskslinuxblock: Fix leaking cleartext block interface</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/storaged-project/udisks/blob/udisks-2.9.4/NEWS</url>
</references>
<dates>
<discovery>2021-09-29</discovery>
<entry>2022-10-22</entry>
</dates>
</vuln>
<vuln vid="c253c4aa-5126-11ed-8a21-589cfc0f81b0">
<topic>phpmyfaq -- CSRF vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>3.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-02">
<p> phpMyFAQ does not implement sufficient checks to avoid
CSRF when logging out an user.</p>
</blockquote>
</body>
</description>
<references>
<url>https://huntr.dev/bounties/76095ac1-da12-449b-9564-4a086be96592/</url>
</references>
<dates>
<discovery>2022-10-02</discovery>
<entry>2022-10-21</entry>
</dates>
</vuln>
<vuln vid="d6d088c9-5064-11ed-bade-080027881239">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.15</lt></range>
</package>
<package>
<name>python38</name>
<range><lt>3.8.15</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.15</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/release/3.9.15/whatsnew/changelog.html">
<p>gh-97616: Fix multiplying a list by an integer (list *= int): detect
the integer overflow when the new allocated length is close to the
maximum size. Issue reported by Jordan Limor. Patch by Victor Stinner.</p>
<p>gh-97612: Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses
a shell to run openssl commands. Issue reported and initial fix by
Caleb Shortt. Patch by Victor Stinner.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/release/3.9.15/whatsnew/changelog.html</url>
</references>
<dates>
<discovery>2022-09-29</discovery>
<entry>2022-10-20</entry>
</dates>
</vuln>
<vuln vid="676d4f16-4fb3-11ed-a374-8c164567ca3c">
<topic>nginx -- Two vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.0.7</ge><lt>1.22.1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.1.3</ge><lt>1.23.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Development Team reports:</p>
<blockquote cite="https://mailman.nginx.org/archives/list/nginx@nginx.org/thread/F7TMIHDNNU3M52GYS23UWDWW2R2BLVVH/">
<p>Two security issues were identified in the ngx_http_mp4_module,
which might allow an attacker to cause a worker process crash
or worker process memory disclosure by using a specially crafted
mp4 file, or might have potential other impact (CVE-2022-41741,
CVE-2022-41742).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41741</cvename>
<cvename>CVE-2022-41742</cvename>
<url>https://mailman.nginx.org/archives/list/nginx@nginx.org/thread/F7TMIHDNNU3M52GYS23UWDWW2R2BLVVH/</url>
</references>
<dates>
<discovery>2022-10-19</discovery>
<entry>2022-10-19</entry>
</dates>
</vuln>
<vuln vid="2523bc76-4f01-11ed-929b-002590f2a714">
<topic>git -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.38.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.38.1</lt></range>
</package>
<package>
<name>git-tiny</name>
<range><lt>2.38.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p/>
<blockquote cite="https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u">
<h1>This release contains 2 security fixes:</h1>
<h2>CVE-2022-39253</h2>
<p>
When relying on the `--local` clone optimization, Git dereferences
symbolic links in the source repository before creating hardlinks
(or copies) of the dereferenced link in the destination repository.
This can lead to surprising behavior where arbitrary files are
present in a repository's `$GIT_DIR` when cloning from a malicious
repository.
Git will no longer dereference symbolic links via the `--local`
clone mechanism, and will instead refuse to clone repositories that
have symbolic links present in the `$GIT_DIR/objects` directory.
Additionally, the value of `protocol.file.allow` is changed to be
"user" by default.
</p>
<h2>CVE-2022-39260</h2>
<p>
An overly-long command string given to `git shell` can result in
overflow in `split_cmdline()`, leading to arbitrary heap writes and
remote code execution when `git shell` is exposed and the directory
`$HOME/git-shell-commands` exists.
`git shell` is taught to refuse interactive commands that are
longer than 4MiB in size. `split_cmdline()` is hardened to reject
inputs larger than 2GiB.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39253</cvename>
<cvename>CVE-2022-39260</cvename>
<url>https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u</url>
</references>
<dates>
<discovery>2022-06-09</discovery>
<entry>2022-10-18</entry>
</dates>
</vuln>
<vuln vid="7392e1e3-4eb9-11ed-856e-d4c9ef517024">
<topic>OpenSSL -- Potential NULL encryption in NID_undef with Custom Cipher</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="://www.openssl.org/news/secadv/20221011.txt">
<p>Using a Custom Cipher with NID_undef may lead to NULL encryption (low)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3358</cvename>
<url>https://www.openssl.org/news/secadv/20221011.txt</url>
</references>
<dates>
<discovery>2022-10-11</discovery>
<entry>2022-10-18</entry>
</dates>
</vuln>
<vuln vid="d713d709-4cc9-11ed-a621-0800277bb8a8">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21463">
<p>Sanitize and Escape refs in git backend</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21412">
<p>Bump golang.org/x/text</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21281">
<p>Update bluemonday</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.17.3</url>
</references>
<dates>
<discovery>2022-09-27</discovery>
<entry>2022-10-15</entry>
</dates>
</vuln>
<vuln vid="127674c6-4a27-11ed-9f93-002b67dfc673">
<topic>roundcube-thunderbird_labels -- RCE with custom label titles</topic>
<affects>
<package>
<name>roundcube-thunderbird_labels</name>
<range><le>1.4.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="https://roundcube.net/news/2021/12/30/security-update-1.4.13-released">
<h1>Description:</h1>
<p>Remote code execution vulnerability in
roundcube-thunderbird_labels when tb_label_modify_labels is enabled.</p>
<h1>Workaround:</h1>
<p>If you cannot upgrade to roundcube-thunderbird_labels-1.4.13 disable the
tb_label_modify_labels config option.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mike-kfed/roundcube-thunderbird_labels/security/advisories/GHSA-wp6h-wgxq-v949</url>
</references>
<dates>
<discovery>2022-10-10</discovery>
<entry>2022-10-12</entry>
</dates>
</vuln>
<vuln vid="7cb12ee0-4a13-11ed-8ad9-3065ec8fd3ec">
<topic>chromium -- mulitple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>106.0.5249.119</lt></range>
</package>
<package>
<name>ungoogled-chromium</name>
<range><lt>106.0.5249.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html">
<p>This release contains 6 security fixes:</p>
<ul>
<li>[1364604] High CVE-2022-3445: Use after free in Skia. Reported by Nan Wang (@eternalsakura13) and Yong Liu of 360 Vulnerability Research Institute on 2022-09-16</li>
<li>[1368076] High CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by Kaijie Xu (@kaijieguigui) on 2022-09-26</li>
<li>[1366582] High CVE-2022-3447: Inappropriate implementation in Custom Tabs. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2022-09-22</li>
<li>[1363040] High CVE-2022-3448: Use after free in Permissions API. Reported by raven at KunLun lab on 2022-09-13</li>
<li>[1364662] High CVE-2022-3449: Use after free in Safe Browsing. Reported by asnine on 2022-09-17</li>
<li>[1369882] High CVE-2022-3450: Use after free in Peer Connection. Reported by Anonymous on 2022-09-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3445</cvename>
<cvename>CVE-2022-3446</cvename>
<cvename>CVE-2022-3447</cvename>
<cvename>CVE-2022-3448</cvename>
<cvename>CVE-2022-3449</cvename>
<cvename>CVE-2022-3450</cvename>
<url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html</url>
</references>
<dates>
<discovery>2022-10-11</discovery>
<entry>2022-10-12</entry>
</dates>
</vuln>
<vuln vid="f9140ad4-4920-11ed-a07e-080027f5fec9">
<topic>samba -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>samba412</name>
<range><lt>4.12.16</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.17_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://lists.samba.org/archive/samba-announce/2022/000609.html">
<dl>
<dt>CVE-2022-2031</dt>
<dd>
The KDC and the kpasswd service share a single account
and set of keys, allowing them to decrypt each other's
tickets. A user who has been requested to change their
password can exploit this to obtain and use tickets to
other services.
</dd>
<dt>CVE-2022-32744</dt>
<dd>
The KDC accepts kpasswd requests encrypted with any key
known to it. By encrypting forged kpasswd requests with
its own key, a user can change the passwords of other
users, enabling full domain takeover.
</dd>
<dt>CVE-2022-32745</dt>
<dd>
Samba AD users can cause the server to access
uninitialised data with an LDAP add or modify request,
usually resulting in a segmentation fault.
</dd>
<dt>CVE-2022-32746</dt>
<dd>
The AD DC database audit logging module can be made to
access LDAP message values that have been freed by a
preceding database module, resulting in a
use-after-free. This is only possible when modifying
certain privileged attributes, such as
userAccountControl.
</dd>
<dt>CVE-2022-32742</dt>
<dd>
SMB1 Client with write access to a share can cause
server memory contents to be written into a file or
printer.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2031</cvename>
<cvename>CVE-2022-32744</cvename>
<cvename>CVE-2022-32745</cvename>
<cvename>CVE-2022-32746</cvename>
<cvename>CVE-2022-32742</cvename>
<url>https://lists.samba.org/archive/samba-announce/2022/000609.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-2031.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-32744.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-32745.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-32746.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-32742.html</url>
</references>
<dates>
<discovery>2022-07-27</discovery>
<entry>2022-10-11</entry>
</dates>
</vuln>
<vuln vid="0ae56f3e-488c-11ed-bb31-b42e99a1b9c3">
<topic>strongswan -- DOS attack vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lahav Schlesinger reported a bug related to online
certificate revocation checking that can lead to a
denial-of-service attack</p>
<blockquote cite="https://www.strongswan.org/blog/2022/10/03/strongswan-vulnerability-(cve-2022-40617).html">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40617</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-40617</url>
</references>
<dates>
<discovery>2022-10-03</discovery>
<entry>2022-10-10</entry>
</dates>
</vuln>
<vuln vid="e4133d8b-ab33-451a-bc68-3719de73d54a">
<topic>routinator -- potential DOS attack</topic>
<affects>
<package>
<name>routinator</name>
<range><ge>0.9.0</ge><lt>0.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>
Due to a mistake in error handling, data in RRDP snapshot and delta files
that isn’t correctly base 64 encoded is treated as a fatal error and causes
Routinator to exit.
Worst case impact of this vulnerability is denial of service for the RPKI
data that Routinator provides to routers. This may stop your network from
validating route origins based on RPKI data. This vulnerability does not
allow an attacker to manipulate RPKI data. We are not aware of exploitation
of this vulnerability at this point in time.
Starting with release 0.11.3, Routinator handles encoding errors by rejecting
the snapshot or delta file and continuing with validation. In case of an
invalid delta file, it will try using the snapshot instead. If a snapshot file
is invalid, the update of the repository will fail and an update through rsync
is attempted.
</p>
<blockquote cite="https://www.cvedetails.com/cve/CVE-2022-3029/">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3029</cvename>
<url>https://nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt</url>
</references>
<dates>
<discovery>2022-10-06</discovery>
<entry>2022-10-07</entry>
</dates>
</vuln>
<vuln vid="f4f15051-4574-11ed-81a1-080027881239">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.8</lt></range>
</package>
<package>
<name>py38-django41</name>
<name>py39-django41</name>
<name>py310-django41</name>
<range><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2022/oct/04/security-releases/">
<p>CVE-2022-41323: Potential denial-of-service vulnerability in
internationalized URLs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41323</cvename>
<url>https://www.djangoproject.com/weblog/2022/oct/04/security-releases/</url>
</references>
<dates>
<discovery>2022-09-23</discovery>
<entry>2022-10-06</entry>
</dates>
</vuln>
<vuln vid="c2a89e8f-44e9-11ed-9215-00e081b7aa2d">
<topic>jenkins -- XSS vulnerability</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.370</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2022-09-21/">
<h1>Description</h1>
<h5>(High) SECURITY-2886 / CVE-2022-41224</h5>
<p>Jenkins 2.367 through 2.369 (both inclusive) does not escape
tooltips of the l:helpIcon UI component used for some help icons on
the Jenkins web UI.</p>
<p>This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to control tooltips for this
component.</p>
<p>Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41224</cvename>
<url>https://www.jenkins.io/security/advisory/2022-09-21/</url>
</references>
<dates>
<discovery>2022-09-21</discovery>
<entry>2022-10-05</entry>
<modified>2022-10-07</modified>
</dates>
</vuln>
<vuln vid="854c2afb-4424-11ed-af97-adcabf310f9b">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.7</lt></range>
</package>
<package>
<name>go119</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/54853">
<p>archive/tar: unbounded memory consumption when reading
headers</p>
<p>Reader.Read did not set a limit on the maximum size of
file headers. A maliciously crafted archive could cause
Read to allocate unbounded amounts of memory, potentially
causing resource exhaustion or panics. Reader.Read now
limits the maximum size of header blocks to 1 MiB.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/54663">
<p>net/http/httputil: ReverseProxy should not forward
unparseable query parameters</p>
<p>Requests forwarded by ReverseProxy included the raw
query parameters from the inbound request, including
unparseable parameters rejected by net/http. This could
permit query parameter smuggling when a Go proxy
forwards a parameter with an unparseable value.</p>
<p>ReverseProxy will now sanitize the query parameters in
the forwarded query when the outbound request's Form
field is set after the ReverseProxy.Director function
returns, indicating that the proxy has parsed the query
parameters. Proxies which do not parse query parameters
continue to forward the original query parameters
unchanged.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/55949">
<p>regexp/syntax: limit memory used by parsing regexps</p>
<p>The parsed regexp representation is linear in the size
of the input, but in some cases the constant factor can be
as high as 40,000, making relatively small regexps consume
much larger amounts of memory.</p>
<p>Each regexp being parsed is now limited to a 256 MB
memory footprint. Regular expressions whose
representation would use more space than that are now
rejected. Normal use of regular expressions is
unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2879</cvename>
<cvename>CVE-2022-2880</cvename>
<cvename>CVE-2022-41715</cvename>
<url>https://groups.google.com/g/golang-announce/c/xtuG5faxtaU/m/jEhlI_5WBgAJ</url>
</references>
<dates>
<discovery>2022-10-04</discovery>
<entry>2022-10-04</entry>
</dates>
</vuln>
<vuln vid="d487d4fc-43a8-11ed-8b01-b42e991fc52e">
<topic>zydis -- heap buffer overflow</topic>
<affects>
<package>
<name>zydis</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zyantific reports:</p>
<blockquote cite="https://github.com/zyantific/zydis/security/advisories/GHSA-q42v-hv86-3m4g">
<p>
Zydis users of versions v3.2.0 and older
that use the string functions provided in zycore in order to
append untrusted user data to the formatter buffer within
their custom formatter hooks can run into heap buffer
overflows. Older versions of Zydis failed to properly
initialize the string object within the formatter buffer,
forgetting to initialize a few fields, leaving their value
to chance. This could then in turn cause zycore functions
like ZyanStringAppend to make incorrect calculations for the
new target size, resulting in heap memory corruption.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41253</cvename>
<url>https://www.cvedetails.com/cve/CVE-2021-41253</url>
</references>
<dates>
<discovery>2021-11-08</discovery>
<entry>2022-10-04</entry>
</dates>
</vuln>
<vuln vid="67057b48-41f4-11ed-86c3-080027881239">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.8</lt></range>
</package>
<package>
<name>mediawiki137</name>
<range><lt>1.37.6</lt></range>
</package>
<package>
<name>mediawiki138</name>
<range><lt>1.38.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/SPYFDCGZE7KJNO73ET7QVSUXMHXVRFTE/">
<p>(T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
in an IP range check on Special:Contributions..</p>
<p>(T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
of hidden users.</p>
<p> (T307278, CVE-2022-41766) SECURITY: On action=rollback the message
"alreadyrolled" can leak revision deleted user name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41765</cvename>
<cvename>CVE-2022-41766</cvename>
<cvename>CVE-2022-41767</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/SPYFDCGZE7KJNO73ET7QVSUXMHXVRFTE/</url>
</references>
<dates>
<discovery>2022-09-29</discovery>
<entry>2022-10-02</entry>
</dates>
</vuln>
<vuln vid="d459c914-4100-11ed-9bc7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>106.0.5249.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html">
<p>This release contains 3 security fixes, including:</p>
<ul>
<li>[1366813] High CVE-2022-3370: Use after free in Custom Elements. Reported by Aviv A. on 2022-09-22</li>
<li>[1366399] High CVE-2022-3373: Out of bounds write in V8. Reported by Tibor Klajnscek on 2022-09-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3370</cvename>
<cvename>CVE-2022-3373</cvename>
<url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2022-09-30</discovery>
<entry>2022-09-30</entry>
</dates>
</vuln>
<vuln vid="04422df1-40d8-11ed-9be7-454b1dd82c64">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.4.0</ge><lt>15.4.1</lt></range>
<range><ge>15.3.0</ge><lt>15.3.4</lt></range>
<range><ge>9.3.0</ge><lt>15.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/">
<p>Denial of Service via cloning an issue</p>
<p>Arbitrary PUT request as victim user through Sentry error list</p>
<p>Content injection via External Status Checks</p>
<p>Project maintainers can access Datadog API Key from logs</p>
<p>Unsafe serialization of Json data could lead to sensitive data leakage</p>
<p>Import bug allows importing of private local git repos</p>
<p>Maintainer can leak Github access tokens by changing integration URL (even after 15.2.1 patch)</p>
<p>Unauthorized users able to create issues in any project</p>
<p>Bypass group IP restriction on Dependency Proxy</p>
<p>Healthcheck endpoint allow list can be bypassed when accessed over HTTP in an HTTPS enabled system</p>
<p>Disclosure of Todo details to guest users</p>
<p>A user's primary email may be disclosed through group member events webhooks</p>
<p>Content manipulation due to branch/tag name confusion with the default branch name</p>
<p>Leakage of email addresses in WebHook logs</p>
<p>Specially crafted output makes job logs inaccessible</p>
<p>Enforce editing approval rules on project level</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3283</cvename>
<cvename>CVE-2022-3060</cvename>
<cvename>CVE-2022-2904</cvename>
<cvename>CVE-2022-3018</cvename>
<cvename>CVE-2022-3291</cvename>
<cvename>CVE-2022-3067</cvename>
<cvename>CVE-2022-2882</cvename>
<cvename>CVE-2022-3066</cvename>
<cvename>CVE-2022-3286</cvename>
<cvename>CVE-2022-3285</cvename>
<cvename>CVE-2022-3330</cvename>
<cvename>CVE-2022-3351</cvename>
<cvename>CVE-2022-3288</cvename>
<cvename>CVE-2022-3293</cvename>
<cvename>CVE-2022-3279</cvename>
<cvename>CVE-2022-3325</cvename>
<url>https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/</url>
</references>
<dates>
<discovery>2022-09-29</discovery>
<entry>2022-09-30</entry>
</dates>
</vuln>
<vuln vid="5a1c2e06-3fb7-11ed-a402-b42e991fc52e">
<topic>unbound -- Non-Responsive Delegation Attack</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>
A vulnerability named 'Non-Responsive Delegation Attack'
(NRDelegation Attack) has been discovered in various DNS
resolving software. The NRDelegation Attack works by having
a malicious delegation with a considerable number of non
responsive nameservers. The attack starts by querying a
resolver for a record that relies on those unresponsive
nameservers. The attack can cause a resolver to spend a lot
of time/resources resolving records under a malicious
delegation point where a considerable number of unresponsive
NS records reside. It can trigger high CPU usage in some
resolver implementations that continually look in the cache
for resolved NS records in that delegation.
</p>
<blockquote cite="https://www.cvedetails.com/cve/CVE-2022-3204">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3204</cvename>
<url>https://nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt</url>
</references>
<dates>
<discovery>2022-09-26</discovery>
<entry>2022-09-29</entry>
</dates>
</vuln>
<vuln vid="cb902a77-3f43-11ed-9402-901b0e9408dc">
<topic>Matrix clients -- several vulnerabilities</topic>
<affects>
<package>
<name>cinny</name>
<range><lt>2.2.1</lt></range>
</package>
<package>
<name>element-web</name>
<range><lt>1.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients">
<p>Two critical severity vulnerabilities in end-to-end encryption were
found in the SDKs which power Element, Beeper, Cinny, SchildiChat,
Circuli, Synod.im and any other clients based on matrix-js-sdk,
matrix-ios-sdk or matrix-android-sdk2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-39249</cvename>
<cvename>CVE-2022-39250</cvename>
<cvename>CVE-2022-39251</cvename>
<cvename>CVE-2022-39236</cvename>
<url>https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients</url>
</references>
<dates>
<discovery>2022-09-23</discovery>
<entry>2022-09-28</entry>
</dates>
</vuln>
<vuln vid="18529cb0-3e9c-11ed-9bc7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>106.0.5249.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html">
<p>This release contains 20 security fixes, including:</p>
<ul>
<li>[1358907] High CVE-2022-3304: Use after free in CSS. Reported by Anonymous on 2022-09-01</li>
<li>[1343104] High CVE-2022-3201: Insufficient validation of untrusted input in Developer Tools. Reported by NDevTK on 2022-07-09</li>
<li>[1319229] High CVE-2022-3305: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-24</li>
<li>[1320139] High CVE-2022-3306: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-27</li>
<li>[1323488] High CVE-2022-3307: Use after free in Media. Reported by Anonymous Telecommunications Corp. Ltd. on 2022-05-08</li>
<li>[1342722] Medium CVE-2022-3308: Insufficient policy enforcement in Developer Tools. Reported by Andrea Cappa (zi0Black) @ Shielder on 2022-07-08</li>
<li>[1348415] Medium CVE-2022-3309: Use after free in Assistant. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2022-07-29</li>
<li>[1240065] Medium CVE-2022-3310: Insufficient policy enforcement in Custom Tabs. Reported by Ashwin Agrawal from Optus, Sydney on 2021-08-16</li>
<li>[1302813] Medium CVE-2022-3311: Use after free in Import. Reported by Samet Bekmezci @sametbekmezci on 2022-03-04</li>
<li>[1303306] Medium CVE-2022-3312: Insufficient validation of untrusted input in VPN. Reported by Andr.Ess on 2022-03-06</li>
<li>[1317904] Medium CVE-2022-3313: Incorrect security UI in Full Screen. Reported by Irvan Kurniawan (sourc7) on 2022-04-20</li>
<li>[1328708] Medium CVE-2022-3314: Use after free in Logging. Reported by Anonymous on 2022-05-24</li>
<li>[1322812] Medium CVE-2022-3315: Type confusion in Blink. Reported by Anonymous on 2022-05-05</li>
<li>[1333623] Low CVE-2022-3316: Insufficient validation of untrusted input in Safe Browsing. Reported by Sven Dysthe (@svn_dy) on 2022-06-07</li>
<li>[1300539] Low CVE-2022-3317: Insufficient validation of untrusted input in Intents. Reported by Hafiizh on 2022-02-24</li>
<li>[1318791] Low CVE-2022-3318: Use after free in ChromeOS Notifications. Reported by GraVity0 on 2022-04-22</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3201</cvename>
<cvename>CVE-2022-3304</cvename>
<cvename>CVE-2022-3305</cvename>
<cvename>CVE-2022-3306</cvename>
<cvename>CVE-2022-3307</cvename>
<cvename>CVE-2022-3308</cvename>
<cvename>CVE-2022-3309</cvename>
<cvename>CVE-2022-3310</cvename>
<cvename>CVE-2022-3311</cvename>
<cvename>CVE-2022-3312</cvename>
<cvename>CVE-2022-3313</cvename>
<cvename>CVE-2022-3314</cvename>
<cvename>CVE-2022-3315</cvename>
<cvename>CVE-2022-3316</cvename>
<cvename>CVE-2022-3317</cvename>
<cvename>CVE-2022-3318</cvename>
<url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2022-09-27</discovery>
<entry>2022-09-27</entry>
</dates>
</vuln>
<vuln vid="0a0670a1-3e1a-11ed-b48b-e0d55e2a8bf9">
<topic>expat -- Heap use-after-free vulnerability</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="https://www.debian.org/security/2022/dsa-5236">
<p>Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-40674</cvename>
<url>https://www.debian.org/security/2022/dsa-5236</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-40674</url>
</references>
<dates>
<discovery>2022-09-14</discovery>
<entry>2022-09-27</entry>
</dates>
</vuln>
<vuln vid="f9ada0b5-3d80-11ed-9330-080027f5fec9">
<topic>squid -- Exposure of sensitive information in cache manager</topic>
<affects>
<package>
<name>squid</name>
<range><lt>5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mikhail Evdokimov (aka konata) reports:</p>
<blockquote cite="https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq">
<p>
Due to inconsistent handling of internal URIs Squid is
vulnerable to Exposure of Sensitive Information about
clients using the proxy. This problem allows a trusted
client to directly access cache manager information
bypassing the manager ACL protection. The available cache
manager information contains records of internal network
structure, client credentials, client identity and client
traffic behaviour.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-41317</cvename>
<url>https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq</url>
</references>
<dates>
<discovery>2022-04-17</discovery>
<entry>2022-09-26</entry>
</dates>
</vuln>
<vuln vid="f1f637d1-39eb-11ed-ab44-080027f5fec9">
<topic>redis -- Potential remote code execution vulnerability</topic>
<affects>
<package>
<name>redis</name>
<range><ge>7.0.0</ge><lt>7.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redis core team reports:</p>
<blockquote cite="https://github.com/redis/redis/releases/tag/7.0.5">
<p>
Executing a XAUTOCLAIM command on a stream key in a
specific state, with a specially crafted COUNT argument,
may cause an integer overflow, a subsequent heap overflow,
and potentially lead to remote code execution. The problem
affects Redis versions 7.0.0 or newer.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35951</cvename>
<url>https://github.com/redis/redis/releases/tag/7.0.5</url>
</references>
<dates>
<discovery>2022-09-21</discovery>
<entry>2022-09-21</entry>
</dates>
</vuln>
<vuln vid="95e6e6ca-3986-11ed-8e0c-6c3be5272acd">
<topic>Grafana -- Privilege escalation</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>2.1.0</ge><lt>8.5.13</lt></range>
<range><ge>9.0.0</ge><lt>9.0.9</lt></range>
<range><ge>9.1.0</ge><lt>9.1.6</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.5.13</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.0.9</lt></range>
<range><ge>9.1.0</ge><lt>9.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/09/20/grafana-security-releases-new-versions-with-moderate-severity-security-fixes-for-cve-2022-35957-and-cve-2022-36062/">
<p>On August 9 an internal security review identified a vulnerability
in the Grafana which allows an escalation from Admin privileges
to Server Admin when Auth proxy authentication is used.</p>
<p><a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication">
Auth proxy</a> allows to authenticate a user by only providing the username
(or email) in a <code>X-WEBAUTH-USER</code> HTTP header: the trust assumption
is that a front proxy will take care of authentication and that Grafana server
is publicly reachable only with this front proxy.</p>
<p><a href="https://grafana.com/docs/grafana/latest/developers/http_api/data_source/#data-source-proxy-calls">
Datasource proxy</a> breaks this assumption:</p>
<ul>
<li>it is possible to configure a fake datasource pointing to a localhost
Grafana install with a <code>X-WEBAUTH-USER</code> HTTP header containing
admin username.</li>
<li>This fake datasource can be called publicly via this proxying feature.</li>
</ul>
<p>The CVSS score for this vulnerability is 6.6 Moderate
(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35957</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q</url>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-09-21</entry>
</dates>
</vuln>
<vuln vid="656b0152-faa9-4755-b08d-aee4a774bd04">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.2">
<p> Fix a possible overflow and crash in the ICMP analyzer
when receiving a specially crafted packet. </p>
<p> Fix a possible overflow and crash in the IRC analyzer
when receiving a specially crafted packet. </p>
<p> Fix a possible overflow and crash in the SMB analyzer
when receiving a specially crafted packet. </p>
<p> Fix two possible crashes when converting IP headers for
output via the raw_packet event. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.2</url>
</references>
<dates>
<discovery>2022-09-19</discovery>
<entry>2022-09-19</entry>
</dates>
</vuln>
<vuln vid="aeb4c85b-3600-11ed-b52d-589cfc007716">
<topic>puppetdb -- Potential SQL injection</topic>
<affects>
<package>
<name>puppetdb6</name>
<range><lt>6.22.1</lt></range>
</package>
<package>
<name>puppetdb7</name>
<range><lt>7.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/docs/puppetdb/7/release_notes.html#puppetdb-7111">
<p>The org.postgresql/postgresql driver has been updated to version 42.4.1 to address CVE-2022-31197, which is an SQL injection risk that according to the CVE report, can only be exploited if an attacker controls the database to the extent that they can adjust relevant tables to have "malicious" column names.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31197</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-31197</url>
<url>https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2</url>
</references>
<dates>
<discovery>2022-08-03</discovery>
<entry>2022-09-16</entry>
</dates>
</vuln>
<vuln vid="b59847e0-346d-11ed-8fe9-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>105.0.5195.125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html">
<p>This release includes 11 security fixes, including:</p>
<ul>
<li>[1358381] High CVE-2022-3195: Out of bounds write in Storage. Reported by Ziling Chen and Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute on 2022-08-31</li>
<li>[1358090] High CVE-2022-3196: Use after free in PDF. Reported by triplepwns on 2022-08-30</li>
<li>[1358075] High CVE-2022-3197: Use after free in PDF. Reported by triplepwns on 2022-08-30</li>
<li>[1355682] High CVE-2022-3198: Use after free in PDF. Reported by MerdroidSG on 2022-08-23</li>
<li>[1355237] High CVE-2022-3199: Use after free in Frames. Reported by Anonymous on 2022-08-22</li>
<li>[1355103] High CVE-2022-3200: Heap buffer overflow in Internals. Reported by Richard Lorenz, SAP on 2022-08-22</li>
<li>[1343104] High CVE-2022-3201: Insufficient validation of untrusted input in DevTools. Reported by NDevTK on 2022-07-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3195</cvename>
<cvename>CVE-2022-3196</cvename>
<cvename>CVE-2022-3197</cvename>
<cvename>CVE-2022-3198</cvename>
<cvename>CVE-2022-3199</cvename>
<cvename>CVE-2022-3200</cvename>
<cvename>CVE-2022-3201</cvename>
<url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2022-09-14</discovery>
<entry>2022-09-14</entry>
</dates>
</vuln>
<vuln vid="4ebaa983-3299-11ed-95f8-901b0e9408dc">
<topic>dendrite -- Signature checks not applied to some retrieved missing events</topic>
<affects>
<package>
<name>dendrite</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dendrite team reports:</p>
<blockquote cite="https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c">
<p>Events retrieved from a remote homeserver using /get_missing_events did
not have their signatures verified correctly. This could potentially allow
a remote homeserver to provide invalid/modified events to Dendrite via this
endpoint.</p>
<p>Note that this does not apply to events retrieved through other endpoints
(e.g. /event, /state) as they have been correctly verified.</p>
<p>Homeservers that have federation disabled are not vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c</url>
</references>
<dates>
<discovery>2022-09-12</discovery>
<entry>2022-09-12</entry>
</dates>
</vuln>
<vuln vid="f75722ce-31b0-11ed-8b56-0800277bb8a8">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.17.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20869">
<p>Double check CloneURL is acceptable</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/21011">
<p>Add more checks in migration code</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2022/09/gitea-1.17.2-is-released/</url>
</references>
<dates>
<discovery>2022-08-19</discovery>
<entry>2022-09-11</entry>
</dates>
</vuln>
<vuln vid="80e057e7-2f0a-11ed-978f-fcaa147e860e">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.14</lt></range>
</package>
<package>
<name>python38</name>
<range><lt>3.8.14</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.14</lt></range>
</package>
<package>
<name>python310</name>
<range><lt>3.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/release/3.7.14/whatsnew/changelog.html#changelog">
<p>gh-95778: Converting between int and str in bases other than 2 (binary), 4, 8 (octal),
16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number
of digits in string form is above a limit to avoid potential denial of service attacks
due to the algorithmic complexity.</p>
<p>gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when
an URI path starts with //. Vulnerability discovered, and initial fix proposed, by
Hamza Avvan.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-10735</cvename>
<url>https://docs.python.org/release/3.7.14/whatsnew/changelog.html#changelog</url>
</references>
<dates>
<discovery>2020-03-20</discovery>
<entry>2022-09-08</entry>
</dates>
</vuln>
<vuln vid="6fea7103-2ea4-11ed-b403-3dae8ac60d3e">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.6</lt></range>
</package>
<package>
<name>go119</name>
<range><lt>1.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/54658">
<p>net/http: handle server errors after sending GOAWAY</p>
<p>A closing HTTP/2 server connection could hang forever
waiting for a clean shutdown that was preempted by a
subsequent fatal error. This failure mode could be
exploited to cause a denial of service.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/54385">
<p>net/url: JoinPath does not strip relative path components
in all circumstances</p>
<p>JoinPath and URL.JoinPath would not remove ../ path
components appended to a relative path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-27664</cvename>
<cvename>CVE-2022-32190</cvename>
<url>https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ</url>
</references>
<dates>
<discovery>2022-09-06</discovery>
<entry>2022-09-07</entry>
</dates>
</vuln>
<vuln vid="f38d25ac-2b7a-11ed-a1ef-3065ec8fd3ec">
<topic>chromium -- insufficient data validation in Mojo</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>105.0.5195.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html">
<p>This release contains 1 security fix:</p>
<ul>
<li>[1358134] High CVE-2022-3075: Insufficient data validation in Mojo. Reported by Anonymous on 2022-08-30</li>
</ul>
<p>Google is aware that an exploit of CVE-2022-3075 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3075</cvename>
<url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-09-02</discovery>
<entry>2022-09-03</entry>
</dates>
</vuln>
<vuln vid="5418b360-29cc-11ed-a6d4-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.7.2</lt></range>
<range><lt>4.6.3</lt></range>
<range><lt>4.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://www.powerdns.com/news.html#20220823">
<p>PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-37428</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html</url>
</references>
<dates>
<discovery>2022-08-23</discovery>
<entry>2022-09-01</entry>
</dates>
</vuln>
<vuln vid="827b95ff-290e-11ed-a2e7-6c3be5272acd">
<topic>Grafana -- Unauthorized file disclosure</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>5.2.0</ge><lt>8.3.11</lt></range>
<range><ge>8.4.0</ge><lt>8.4.11</lt></range>
<range><ge>8.5.0</ge><lt>8.5.11</lt></range>
<range><ge>9.0.0</ge><lt>9.0.8</lt></range>
<range><ge>9.1.0</ge><lt>9.1.2</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.3.0</ge><lt>8.3.11</lt></range>
<range><ge>8.4.0</ge><lt>8.4.11</lt></range>
<range><ge>8.5.0</ge><lt>8.5.11</lt></range>
</package>
<package>
<name>grafana9</name>
<range><ge>9.0.0</ge><lt>9.0.8</lt></range>
<range><ge>9.1.0</ge><lt>9.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/08/30/security-release-new-versions-of-grafana-and-grafana-image-renderer-with-a-high-severity-security-fix-for-cve-2022-31176/">
<p>On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the <a href="https://grafana.com/grafana/plugins/grafana-image-renderer/">Grafana Image Renderer plugin</a> when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files in a PNG file. This makes it possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake data source (this applies if the user has admin permissions in Grafana).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31176</cvename>
<url>https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5</url>
</references>
<dates>
<discovery>2022-07-21</discovery>
<entry>2022-09-01</entry>
</dates>
</vuln>
<vuln vid="e4d93d07-297a-11ed-95f8-901b0e9408dc">
<topic>Matrix clients -- several vulnerabilities</topic>
<affects>
<package>
<name>cinny</name>
<range><lt>2.1.3</lt></range>
</package>
<package>
<name>element-web</name>
<range><lt>1.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2022/08/31/security-releases-matrix-js-sdk-19-4-0-and-matrix-react-sdk-3-53-0">
<p>The vulnerabilities give an adversary who you share a
room with the ability to carry out a denial-of-service
attack against the affected clients, making it not show all
of a user's rooms or spaces and/or causing minor temporary
corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-36059</cvename>
<cvename>CVE-2022-36060</cvename>
<url>https://matrix.org/blog/2022/08/31/security-releases-matrix-js-sdk-19-4-0-and-matrix-react-sdk-3-53-0</url>
</references>
<dates>
<discovery>2022-08-31</discovery>
<entry>2022-08-31</entry>
</dates>
</vuln>
<vuln vid="f2043ff6-2916-11ed-a1ef-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>105.0.5195.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html">
<p>This release contains 24 security fixes, including:</p>
<ul>
<li>[1340253] Critical CVE-2022-3038: Use after free in Network Service. Reported by Sergei Glazunov of Google Project Zero on 2022-06-28</li>
<li>[1343348] High CVE-2022-3039: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11</li>
<li>[1341539] High CVE-2022-3040: Use after free in Layout. Reported by Anonymous on 2022-07-03</li>
<li>[1345947] High CVE-2022-3041: Use after free in WebSQL. Reported by Ziling Chen and Nan Wang(@eternalsakura13) of 360 Vulnerability Research Institute on 2022-07-20</li>
<li>[1338553] High CVE-2022-3042: Use after free in PhoneHub. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22</li>
<li>[1336979] High CVE-2022-3043: Heap buffer overflow in Screen Capture. Reported by @ginggilBesel on 2022-06-16</li>
<li>[1051198] High CVE-2022-3044: Inappropriate implementation in Site Isolation. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability Research on 2020-02-12</li>
<li>[1339648] High CVE-2022-3045: Insufficient validation of untrusted input in V8. Reported by Ben Noordhuis <info@bnoordhuis.nl> on 2022-06-26</li>
<li>[1346245] High CVE-2022-3046: Use after free in Browser Tag. Reported by Rong Jian of VRI on 2022-07-21</li>
<li>[1342586] Medium CVE-2022-3047: Insufficient policy enforcement in Extensions API. Reported by Maurice Dauer on 2022-07-07</li>
<li>[1303308] Medium CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen. Reported by Andr.Ess on 2022-03-06</li>
<li>[1316892] Medium CVE-2022-3049: Use after free in SplitScreen. Reported by @ginggilBesel on 2022-04-17</li>
<li>[1337132] Medium CVE-2022-3050: Heap buffer overflow in WebUI. Reported by Zhihua Yao of KunLun Lab on 2022-06-17</li>
<li>[1345245] Medium CVE-2022-3051: Heap buffer overflow in Exosphere. Reported by @ginggilBesel on 2022-07-18</li>
<li>[1346154] Medium CVE-2022-3052: Heap buffer overflow in Window Manager. Reported by Khalil Zhani on 2022-07-21</li>
<li>[1267867] Medium CVE-2022-3053: Inappropriate implementation in Pointer Lock. Reported by Jesper van den Ende (Pelican Party Studios) on 2021-11-08</li>
<li>[1290236] Medium CVE-2022-3054: Insufficient policy enforcement in DevTools. Reported by Kuilin Li on 2022-01-24</li>
<li>[1351969] Medium CVE-2022-3055: Use after free in Passwords. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-11</li>
<li>[1329460] Low CVE-2022-3056: Insufficient policy enforcement in Content Security Policy. Reported by Anonymous on 2022-05-26</li>
<li>[1336904] Low CVE-2022-3057: Inappropriate implementation in iframe Sandbox. Reported by Gareth Heyes on 2022-06-16</li>
<li>[1337676] Low CVE-2022-3058: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-06-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-3038</cvename>
<cvename>CVE-2022-3039</cvename>
<cvename>CVE-2022-3040</cvename>
<cvename>CVE-2022-3041</cvename>
<cvename>CVE-2022-3042</cvename>
<cvename>CVE-2022-3043</cvename>
<cvename>CVE-2022-3044</cvename>
<cvename>CVE-2022-3045</cvename>
<cvename>CVE-2022-3046</cvename>
<cvename>CVE-2022-3047</cvename>
<cvename>CVE-2022-3048</cvename>
<cvename>CVE-2022-3049</cvename>
<cvename>CVE-2022-3050</cvename>
<cvename>CVE-2022-3051</cvename>
<cvename>CVE-2022-3052</cvename>
<cvename>CVE-2022-3053</cvename>
<cvename>CVE-2022-3054</cvename>
<cvename>CVE-2022-3055</cvename>
<cvename>CVE-2022-3056</cvename>
<cvename>CVE-2022-3057</cvename>
<cvename>CVE-2022-3058</cvename>
<url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2022-08-30</discovery>
<entry>2022-08-31</entry>
</dates>
</vuln>
<vuln vid="a1323a76-28f1-11ed-a72a-002590c1f29c">
<topic>FreeBSD -- zlib heap buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.1</ge><lt>13.1_2</lt></range>
<range><ge>13.0</ge><lt>13.0_13</lt></range>
<range><ge>12.3</ge><lt>12.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>zlib through 1.2.12 has a heap-based buffer over-read or buffer
overflow in inflate in inflate.c via a large gzip header extra
field.</p>
<h1>Impact:</h1>
<p>Applications that call inflateGetHeader may be vulnerable to a
buffer overflow. Note that inflateGetHeader is not used by anything
in the FreeBSD base system, but may be used by third party
software.</p>
</body>
</description>
<references>
<cvename>CVE-2022-37434</cvename>
<freebsdsa>SA-22:13.zlib</freebsdsa>
</references>
<dates>
<discovery>2022-08-30</discovery>
<entry>2022-08-31</entry>
</dates>
</vuln>
<vuln vid="e6b994e2-2891-11ed-9be7-454b1dd82c64">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.3.0</ge><lt>15.3.2</lt></range>
<range><ge>15.2.0</ge><lt>15.2.4</lt></range>
<range><ge>10.0.0</ge><lt>15.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/">
<p>Remote Command Execution via GitHub import</p>
<p>Stored XSS via labels color</p>
<p>Content injection via Incidents Timeline description</p>
<p>Lack of length validation in Snippets leads to Denial of Service</p>
<p>Group IP allow-list not fully respected by the Package Registry</p>
<p>Abusing Gitaly.GetTreeEntries calls leads to denial of service</p>
<p>Arbitrary HTTP Requests Possible in .ipynb Notebook with Malicious Form Tags</p>
<p>Regular Expression Denial of Service via special crafted input</p>
<p>Information Disclosure via Arbitrary GFM references rendered in Incident Timeline Events</p>
<p>Regex backtracking through the Commit message field</p>
<p>Read repository content via LivePreview feature</p>
<p>Denial of Service via the Create branch API</p>
<p>Denial of Service via Issue preview</p>
<p>IDOR in Zentao integration leaked issue details</p>
<p>Brute force attack may guess a password even when 2FA is enabled</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2992</cvename>
<cvename>CVE-2022-2865</cvename>
<cvename>CVE-2022-2527</cvename>
<cvename>CVE-2022-2592</cvename>
<cvename>CVE-2022-2533</cvename>
<cvename>CVE-2022-2455</cvename>
<cvename>CVE-2022-2428</cvename>
<cvename>CVE-2022-2908</cvename>
<cvename>CVE-2022-2630</cvename>
<cvename>CVE-2022-2931</cvename>
<cvename>CVE-2022-2907</cvename>
<cvename>CVE-2022-3031</cvename>
<url>https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/</url>
</references>
<dates>
<discovery>2022-08-30</discovery>
<entry>2022-08-30</entry>
</dates>
</vuln>
<vuln vid="3110b29e-c82d-4287-9f6c-db82bb883b1e">
<topic>zeek -- potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.1">
<p> Fix a possible overflow and crash in the ARP analyzer
when receiving a specially crafted packet. Due to the
possibility of this happening with packets received from
the network, this is a potential DoS vulnerability. </p>
<p> Fix a possible overflow and crash in the Modbus analyzer
when receiving a specially crafted packet. Due to the
possibility of this happening with packets received from
the network, this is a potential DoS vulnerability. </p>
<p> Fix two possible crashes when converting IP headers for
output via the raw_packet event. Due to the possibility of
this happening with packets received from the network, this
is a potential DoS vulnerability. Note that the raw_packet
event is not enabled by default so these are likely
low-severity issues. </p>
<p> Fix an abort related to an error related to the ordering
of record fields when processing DNS EDNS headers via events.
Due to the possibility of this happening with packets
received from the network, this is a potential DoS
vulnerability. Note that the dns_EDNS events are not
implemented by default so this is likely a low-severity
issue. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v5.0.1</url>
</references>
<dates>
<discovery>2022-08-23</discovery>
<entry>2022-08-26</entry>
</dates>
</vuln>
<vuln vid="36d10af7-248d-11ed-856e-d4c9ef517024">
<topic>MariaDB -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.36</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.26</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.17</lt></range>
</package>
<package>
<name>mariadb106-server</name>
<range><lt>10.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/cve/">
<p>Multiple vulnerabilities, mostly segfaults, in
the server component</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32082</cvename>
<cvename>CVE-2022-32089</cvename>
<cvename>CVE-2022-32081</cvename>
<cvename>CVE-2018-25032</cvename>
<cvename>CVE-2022-32091</cvename>
<cvename>CVE-2022-32084</cvename>
<url>https://mariadb.com/kb/en/cve/</url>
</references>
<dates>
<discovery>2022-08-22</discovery>
<entry>2022-08-25</entry>
</dates>
</vuln>
<vuln vid="8a0cd618-22a0-11ed-b1e7-001b217b3468">
<topic>Gitlab -- Remote Code Execution</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.3.0</ge><lt>15.3.1</lt></range>
<range><ge>15.2.0</ge><lt>15.2.3</lt></range>
<range><ge>11.3.4</ge><lt>15.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/">
<p>Remote Command Execution via Github import</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2884</cvename>
<url>https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/</url>
</references>
<dates>
<discovery>2022-08-22</discovery>
<entry>2022-08-23</entry>
</dates>
</vuln>
<vuln vid="03bb8373-2026-11ed-9d70-080027240888">
<topic>drupal9 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal9</name>
<range><lt>9.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal reports:</p>
<blockquote cite="https://www.drupal.org/project/drupal/releases/9.4.5">
<p>CVE-2022-31175: Cross-site scripting (XSS) caused by the editor
instance destroying process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31175</cvename>
<url>https://www.drupal.org/project/drupal/releases/9.4.5</url>
</references>
<dates>
<discovery>2022-08-01</discovery>
<entry>2022-08-20</entry>
</dates>
</vuln>
<vuln vid="f12368a8-1e05-11ed-a1ef-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>104.0.5112.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html">
<p>This release contains 11 security fixes, including:</p>
<ul>
<li>[1349322] Critical CVE-2022-2852: Use after free in FedCM. Reported by Sergei Glazunov of Google Project Zero on 2022-08-02</li>
<li>[1337538] High CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2022-06-18</li>
<li>[1345042] High CVE-2022-2855: Use after free in ANGLE. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2022-07-16</li>
<li>[1338135] High CVE-2022-2857: Use after free in Blink. Reported by Anonymous on 2022-06-21</li>
<li>[1341918] High CVE-2022-2858: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05</li>
<li>[1350097] High CVE-2022-2853: Heap buffer overflow in Downloads. Reported by Sergei Glazunov of Google Project Zero on 2022-08-04</li>
<li>[1345630] High CVE-2022-2856: Insufficient validation of untrusted input in Intents. Reported by Ashley Shen and Christian Resell of Google Threat Analysis Group on 2022-07-19</li>
<li>[1338412] Medium CVE-2022-2859: Use after free in Chrome OS Shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-22</li>
<li>[1345193] Medium CVE-2022-2860: Insufficient policy enforcement in Cookies. Reported by Axel Chong on 2022-07-18</li>
<li>[1346236] Medium CVE-2022-2861: Inappropriate implementation in Extensions API. Reported by Rong Jian of VRI on 2022-07-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2852</cvename>
<cvename>CVE-2022-2853</cvename>
<cvename>CVE-2022-2854</cvename>
<cvename>CVE-2022-2855</cvename>
<cvename>CVE-2022-2856</cvename>
<cvename>CVE-2022-2857</cvename>
<cvename>CVE-2022-2858</cvename>
<cvename>CVE-2022-2859</cvename>
<cvename>CVE-2022-2860</cvename>
<cvename>CVE-2022-2861</cvename>
<url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html</url>
</references>
<dates>
<discovery>2022-08-16</discovery>
<entry>2022-08-17</entry>
</dates>
</vuln>
<vuln vid="d658042c-1c98-11ed-95f8-901b0e9408dc">
<topic>dendrite -- Incorrect parsing of the event default power level in event auth</topic>
<affects>
<package>
<name>dendrite</name>
<range><lt>0.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dendrite team reports:</p>
<blockquote cite="https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c">
<p>The power level parsing within gomatrixserverlib was failing to parse the "events_default"
key of the m.room.power_levels event, defaulting the event default power level to zero in all cases.</p>
<p> In rooms where the "events_default" power level had been changed, this could result in
events either being incorrectly authorised or rejected by Dendrite servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-36009</cvename>
<url>https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c</url>
</references>
<dates>
<discovery>2022-08-15</discovery>
<entry>2022-08-15</entry>
<modified>2022-08-25</modified>
</dates>
</vuln>
<vuln vid="e2e7faf9-1b51-11ed-ae46-002b67dfc673">
<topic>Tomcat -- XSS in examples web application</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>8.5.50</ge><lt>8.5.81</lt></range>
<range><ge>9.0.30</ge><lt>9.0.64</lt></range>
<range><ge>10.0.0-M1</ge><lt>10.0.22</lt></range>
<range><ge>10.1.0-M1</ge><lt>10.1.0-M16</lt></range>
</package>
<package>
<name>tomcat85</name>
<range><ge>8.5.50</ge><lt>8.5.81</lt></range>
</package>
<package>
<name>tomcat9</name>
<range><ge>9.0.30</ge><lt>9.0.64</lt></range>
</package>
<package>
<name>tomcat10</name>
<range><ge>10.0.0-M1</ge><lt>10.0.22</lt></range>
</package>
<package>
<name>tomcat-devel</name>
<range><ge>10.1.0-M1</ge><lt>10.1.0-M16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Tomcat reports:</p>
<blockquote cite="https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k">
<p>The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-34305</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305</url>
</references>
<dates>
<discovery>2022-06-22</discovery>
<entry>2022-08-14</entry>
</dates>
</vuln>
<vuln vid="75c073cc-1a1d-11ed-bea0-48ee0c739857">
<topic>XFCE tumbler -- Vulnerability in the GStreamer plugin</topic>
<affects>
<package>
<name>xfce4-tumbler</name>
<range><lt>4.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The XFCE project reports:</p>
<blockquote cite="https://mail.xfce.org/pipermail/xfce-announce/2022-August/001133.html">
<p>Added mime type check to the gst-thumbnailer plugin
to fix an undisclosed vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.xfce.org/pipermail/xfce-announce/2022-August/001133.html</url>
<url>https://gitlab.xfce.org/xfce/tumbler/-/commit/a0fc191e8ab41fe579f3333085d649fdacb2daa5</url>
</references>
<dates>
<discovery>2022-08-02</discovery>
<entry>2022-08-12</entry>
</dates>
</vuln>
<vuln vid="c3610f39-18f1-11ed-9854-641c67a117d8">
<topic>varnish -- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>varnish7</name>
<range><lt>7.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00009.html">
<p>A denial of service attack can be performed against Varnish Cache
servers by specially formatting the reason phrase of the backend response
status line. In order to execute an attack, the attacker would have to
be able to influence the HTTP/1 responses that the Varnish Server
receives from its configured backends. A successful attack would cause
the Varnish Server to assert and automatically restart.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00009.html</url>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-08-10</entry>
</dates>
</vuln>
<vuln vid="8eaaf135-1893-11ed-9b22-002590c1f29c">
<topic>FreeBSD -- Missing bounds check in 9p message handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.1</ge><lt>13.1_1</lt></range>
<range><ge>13.0</ge><lt>13.0_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of lib9p's handling of RWALK messages was
missing a bounds check needed when unpacking the message contents.
The missing check means that the receipt of a specially crafted
message will cause lib9p to overwrite unrelated memory.</p>
<h1>Impact:</h1>
<p>The bug can be triggered by a malicious bhyve guest kernel to
overwrite memory in the bhyve(8) process. This could potentially lead
to user-mode code execution on the host, subject to bhyve's Capsicum
sandbox.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23092</cvename>
<freebsdsa>SA-22:12.lib9p</freebsdsa>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-08-10</entry>
</dates>
</vuln>
<vuln vid="02fb9764-1893-11ed-9b22-002590c1f29c">
<topic>FreeBSD -- Memory disclosure by stale virtual memory mapping</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.1</ge><lt>13.1_1</lt></range>
<range><ge>13.0</ge><lt>13.0_12</lt></range>
<range><ge>12.3</ge><lt>12.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A particular case of memory sharing is mishandled in the virtual
memory system. This is very similar to SA-21:08.vm, but with a
different root cause.</p>
<h1>Impact:</h1>
<p>An unprivileged local user process can maintain a mapping of a page
after it is freed, allowing that process to read private data
belonging to other processes or the kernel.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23091</cvename>
<freebsdsa>SA-22:11.vm</freebsdsa>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-08-10</entry>
</dates>
</vuln>
<vuln vid="5ddbe47b-1891-11ed-9b22-002590c1f29c">
<topic>FreeBSD -- AIO credential reference count leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_12</lt></range>
<range><ge>12.3</ge><lt>12.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The aio_aqueue function, used by the lio_listio system call, fails
to release a reference to a credential in an error case.</p>
<h1>Impact:</h1>
<p>An attacker may cause the reference count to overflow, leading to a
use after free (UAF).</p>
</body>
</description>
<references>
<cvename>CVE-2022-23090</cvename>
<freebsdsa>SA-22:10.aio</freebsdsa>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-08-10</entry>
<modified>2022-08-10</modified>
</dates>
</vuln>
<vuln vid="5028c1ae-1890-11ed-9b22-002590c1f29c">
<topic>FreeBSD -- Out of bound read in elf_note_prpsinfo()</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.1</ge><lt>13.1_1</lt></range>
<range><ge>13.0</ge><lt>13.0_12</lt></range>
<range><ge>12.3</ge><lt>12.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When dumping core and saving process information, proc_getargv()
might return an sbuf which have a sbuf_len() of 0 or -1, which is not
properly handled.</p>
<h1>Impact:</h1>
<p>An out-of-bound read can happen when user constructs a specially
crafted ps_string, which in turn can cause the kernel to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23089</cvename>
<freebsdsa>SA-22:09.elf</freebsdsa>
</references>
<dates>
<discovery>2022-08-09</discovery>
<entry>2022-08-10</entry>
</dates>
</vuln>
<vuln vid="21f43976-1887-11ed-9911-40b034429ecf">
<topic>rsync -- client-side arbitrary file write vulnerability</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>3.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall oss-security reports:</p>
<blockquote cite="https://www.openwall.com/lists/oss-security/2022/08/02/1">
<p>We have discovered a critical arbitrary file write vulnerability
in the rsync utility that allows malicious remote servers to write
arbitrary files inside the directories of connecting peers.
The server chooses which files/directories are sent to the client.
Due to the insufficient controls inside the do_server_recv function
a malicious rysnc server (or Man-in-The-Middle attacker) can
overwrite arbitrary files in the rsync client target directory and
subdirectories.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-29154</cvename>
<url>https://www.openwall.com/lists/oss-security/2022/08/02/1</url>
</references>
<dates>
<discovery>2022-08-02</discovery>
<entry>2022-08-10</entry>
</dates>
</vuln>
<vuln vid="1cd0c17a-17c0-11ed-91a5-080027f5fec9">
<topic>gnutls -- double free vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><ge>3.6.0</ge><lt>3.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-07-07">
<p>
When gnutls_pkcs7_verify cannot verify signature against
given trust list, it starts creating a chain of
certificates starting from identified signer up to known
root. During the creation of this chain the signer
certificate gets freed which results in double free when
the same signer certificate is freed at the end of the
algorithm.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2509</cvename>
<url>https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-07-07</url>
</references>
<dates>
<discovery>2022-07-07</discovery>
<entry>2022-08-09</entry>
</dates>
</vuln>
<vuln vid="9b9a5f6e-1755-11ed-adef-589cfc01894a">
<topic>wolfssl -- multiple issues</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>5.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wolfSSL blog reports:</p>
<blockquote cite="https://www.wolfssl.com/wolfssl-5-4-0-release/">
<p>In release 5.4.0 there were 3 vulnerabilities listed as
fixed in wolfSSL. Two relatively new reports, one dealing with a DTLS
1.0/1.2 denial of service attack and the other a ciphertext attack on
ECC/DH operations. The last vulnerability listed was a public
disclosure of a previous attack on AMD devices fixed since wolfSSL
version 5.1.0. Coordination of the disclosure of the attack was done
responsibly, in cooperation with the researchers, waiting for the
public release of the attack details since it affects multiple
security libraries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-34293</cvename>
<cvename>CVE-2020-12966</cvename>
<cvename>CVE-2021-46744</cvename>
<url>https://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable</url>
<url>https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1013</url>
<url>https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033</url>
</references>
<dates>
<discovery>2022-07-11</discovery>
<entry>2022-08-08</entry>
</dates>
</vuln>
<vuln vid="8bec3994-104d-11ed-a7ac-0800273f11ea">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.17.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20114">
<p>Use git.HOME_PATH for Git HOME directory</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20332">
<p>Add write check for creating Commit status</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/18697">
<p>Remove deprecated SSH ciphers from default</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.17.0</url>
</references>
<dates>
<discovery>2022-07-12</discovery>
<entry>2022-08-05</entry>
</dates>
</vuln>
<vuln vid="bc43a578-14ec-11ed-856e-d4c9ef517024">
<topic>Unbound -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLnet Labs reports:</p>
<blockquote cite="https://www.nlnetlabs.nl/projects/unbound/security-advisories/">
<p>novel type of the "ghost domain names" attack. The vulnerability
works by targeting an Unbound instance. Unbound is queried for a
rogue domain name when the cached delegation information is about to
expire. The rogue nameserver delays the response so that the cached
delegation information is expired. Upon receiving the delayed answer
containing the delegation information, Unbound overwrites the now
expired entries. This action can be repeated when the delegation
information is about to expire making the rogue delegation
information ever-updating.</p>
<p>novel type of the "ghost domain names" attack. The vulnerability
works by targeting an Unbound instance. Unbound is queried for a
subdomain of a rogue domain name. The rogue nameserver returns
delegation information for the subdomain that updates Unbound's
delegation cache. This action can be repeated before expiry of the
delegation information by querying Unbound for a second level
subdomain which the rogue nameserver provides new delegation
information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-30699</cvename>
<cvename>CVE-2022-30698</cvename>
<url>https://www.nlnetlabs.nl/projects/unbound/security-advisories/</url>
</references>
<dates>
<discovery>2022-08-01</discovery>
<entry>2022-08-05</entry>
</dates>
</vuln>
<vuln vid="df29c391-1046-11ed-a7ac-0800273f11ea">
<topic>gitea -- multiple issues</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.16.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20334">
<p>Add write check for creating Commit status</p>
</blockquote>
<blockquote cite="https://github.com/go-gitea/gitea/pull/20196">
<p>Check for permission when fetching user controlled issues</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.16.9</url>
</references>
<dates>
<discovery>2022-07-12</discovery>
<entry>2022-08-05</entry>
</dates>
</vuln>
<vuln vid="3b47104f-1461-11ed-a0c5-080027240888">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.15</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2022/aug/03/security-releases/">
<p>CVE-2022-36359: Potential reflected file download vulnerability in FileResponse.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-36359</cvename>
<url>https://www.djangoproject.com/weblog/2022/aug/03/security-releases/</url>
</references>
<dates>
<discovery>2022-08-01</discovery>
<entry>2022-08-05</entry>
</dates>
</vuln>
<vuln vid="96a41723-133a-11ed-be3b-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>104.0.5112.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html">
<p>This release contains 27 security fixes, including:</p>
<ul>
<li>[1325699] High CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous on 2022-05-16</li>
<li>[1335316] High CVE-2022-2604: Use after free in Safe Browsing. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-10</li>
<li>[1338470] High CVE-2022-2605: Out of bounds read in Dawn. Reported by Looben Yang on 2022-06-22</li>
<li>[1330489] High CVE-2022-2606: Use after free in Managed devices API. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-31</li>
<li>[1286203] High CVE-2022-2607: Use after free in Tab Strip. Reported by @ginggilBesel on 2022-01-11</li>
<li>[1330775] High CVE-2022-2608: Use after free in Overview Mode. Reported by Khalil Zhani on 2022-06-01</li>
<li>[1338560] High CVE-2022-2609: Use after free in Nearby Share. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22</li>
<li>[1278255] Medium CVE-2022-2610: Insufficient policy enforcement in Background Fetch. Reported by Maurice Dauer on 2021-12-09</li>
<li>[1320538] Medium CVE-2022-2611: Inappropriate implementation in Fullscreen API. Reported by Irvan Kurniawan (sourc7) on 2022-04-28</li>
<li>[1321350] Medium CVE-2022-2612: Side-channel information leakage in Keyboard input. Reported by Erik Kraft (erik.kraft5@gmx.at), Martin Schwarzl (martin.schwarzl@iaik.tugraz.at) on 2022-04-30</li>
<li>[1325256] Medium CVE-2022-2613: Use after free in Input. Reported by Piotr Tworek (Vewd) on 2022-05-13</li>
<li>[1341907] Medium CVE-2022-2614: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05</li>
<li>[1268580] Medium CVE-2022-2615: Insufficient policy enforcement in Cookies. Reported by Maurice Dauer on 2021-11-10</li>
<li>[1302159] Medium CVE-2022-2616: Inappropriate implementation in Extensions API. Reported by Alesandro Ortiz on 2022-03-02</li>
<li>[1292451] Medium CVE-2022-2617: Use after free in Extensions API. Reported by @ginggilBesel on 2022-01-31</li>
<li>[1308422] Medium CVE-2022-2618: Insufficient validation of untrusted input in Internals. Reported by asnine on 2022-03-21</li>
<li>[1332881] Medium CVE-2022-2619: Insufficient validation of untrusted input in Settings. Reported by Oliver Dunk on 2022-06-04</li>
<li>[1337304] Medium CVE-2022-2620: Use after free in WebUI. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-17</li>
<li>[1323449] Medium CVE-2022-2621: Use after free in Extensions. Reported by Huyna at Viettel Cyber Security on 2022-05-07</li>
<li>[1332392] Medium CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean on 2022-06-03</li>
<li>[1337798] Medium CVE-2022-2623: Use after free in Offline. Reported by raven at KunLun lab on 2022-06-20</li>
<li>[1339745] Medium CVE-2022-2624: Heap buffer overflow in PDF. Reported by YU-CHANG CHEN and CHIH-YEN CHANG, working with DEVCORE Internship Program on 2022-06-27</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2603</cvename>
<cvename>CVE-2022-2604</cvename>
<cvename>CVE-2022-2605</cvename>
<cvename>CVE-2022-2606</cvename>
<cvename>CVE-2022-2607</cvename>
<cvename>CVE-2022-2608</cvename>
<cvename>CVE-2022-2609</cvename>
<cvename>CVE-2022-2610</cvename>
<cvename>CVE-2022-2611</cvename>
<cvename>CVE-2022-2612</cvename>
<cvename>CVE-2022-2613</cvename>
<cvename>CVE-2022-2614</cvename>
<cvename>CVE-2022-2615</cvename>
<cvename>CVE-2022-2616</cvename>
<cvename>CVE-2022-2617</cvename>
<cvename>CVE-2022-2618</cvename>
<cvename>CVE-2022-2619</cvename>
<cvename>CVE-2022-2620</cvename>
<cvename>CVE-2022-2621</cvename>
<cvename>CVE-2022-2622</cvename>
<cvename>CVE-2022-2623</cvename>
<cvename>CVE-2022-2624</cvename>
<url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-08-02</discovery>
<entry>2022-08-03</entry>
</dates>
</vuln>
<vuln vid="7f8d5435-125a-11ed-9a69-10c37b4ac2ea">
<topic>go -- decoding big.Float and big.Rat can panic</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.5</lt></range>
</package>
<package>
<name>go117</name>
<range><lt>1.17.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/53871">
<p>encoding/gob & math/big: decoding big.Float and
big.Rat can panic</p>
<p>Decoding big.Float and big.Rat types can panic if the
encoded message is too short.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32189</cvename>
<url>https://groups.google.com/g/golang-announce/c/YqYYG87xB10</url>
</references>
<dates>
<discovery>2022-07-14</discovery>
<entry>2022-08-02</entry>
</dates>
</vuln>
<vuln vid="4c26f668-0fd2-11ed-a83d-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.2.0</ge><lt>15.2.1</lt></range>
<range><ge>15.1.0</ge><lt>15.1.4</lt></range>
<range><ge>0</ge><lt>15.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/">
<p>Revoke access to confidential notes todos</p>
<p>Pipeline subscriptions trigger new pipelines with the wrong author</p>
<p>Ability to gain access to private project through an email invite by using other user's email address as an unverified secondary email</p>
<p>Import via git protocol allows to bypass checks on repository</p>
<p>Unauthenticated IP allowlist bypass when accessing job artifacts through GitLab Pages</p>
<p>Maintainer can leak Packagist and other integration access tokens by changing integration URL</p>
<p>Unauthenticated access to victims Grafana datasources through path traversal</p>
<p>Unauthorized users can filter issues by contact and organization</p>
<p>Malicious Maintainer may change the visibility of project or a group</p>
<p>Stored XSS in job error messages</p>
<p>Enforced group MFA can be bypassed when using Resource Owner Password Credentials grant</p>
<p>Non project members can view public project's Deploy Keys</p>
<p>IDOR in project with Jira integration leaks project owner's other projects Jira issues</p>
<p>Group Bot Users and Tokens not deleted after group deletion</p>
<p>Email invited members can join projects even after the member lock has been enabled</p>
<p>Datadog integration returns user emails</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2512</cvename>
<cvename>CVE-2022-2498</cvename>
<cvename>CVE-2022-2326</cvename>
<cvename>CVE-2022-2417</cvename>
<cvename>CVE-2022-2501</cvename>
<cvename>CVE-2022-2497</cvename>
<cvename>CVE-2022-2531</cvename>
<cvename>CVE-2022-2539</cvename>
<cvename>CVE-2022-2456</cvename>
<cvename>CVE-2022-2500</cvename>
<cvename>CVE-2022-2303</cvename>
<cvename>CVE-2022-2095</cvename>
<cvename>CVE-2022-2499</cvename>
<cvename>CVE-2022-2307</cvename>
<cvename>CVE-2022-2459</cvename>
<cvename>CVE-2022-2534</cvename>
<url>https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/</url>
</references>
<dates>
<discovery>2022-07-28</discovery>
<entry>2022-07-30</entry>
</dates>
</vuln>
<vuln vid="e1387e95-08d0-11ed-be26-001999f8d30b">
<topic>VirtualBox -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>6.1.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2022.html">
<p> Easily exploitable vulnerability allows high privileged
attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox.
Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21554</cvename>
<cvename>CVE-2022-21571</cvename>
<url>https://www.oracle.com/security-alerts/cpujul2022.html</url>
</references>
<dates>
<discovery>2022-07-20</discovery>
<entry>2022-07-21</entry>
</dates>
</vuln>
<vuln vid="8e150606-08c9-11ed-856e-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-server56</name>
<range><lt>5.6.52</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.39</lt></range>
</package>
<package>
<name>mysql-client80</name>
<range><lt>8.0.30</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL">
<p>This Critical Patch Update contains 34 new security patches plus
additional third party patches noted below for Oracle MySQL. 10 of
these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1292</cvename>
<cvename>CVE-2022-21824</cvename>
<cvename>CVE-2022-27778</cvename>
<cvename>CVE-2018-25032</cvename>
<cvename>CVE-2022-21556</cvename>
<cvename>CVE-2022-21569</cvename>
<cvename>CVE-2022-21550</cvename>
<cvename>CVE-2022-21519</cvename>
<cvename>CVE-2022-21527</cvename>
<cvename>CVE-2022-21528</cvename>
<cvename>CVE-2022-21509</cvename>
<cvename>CVE-2022-21539</cvename>
<cvename>CVE-2022-21517</cvename>
<cvename>CVE-2022-21537</cvename>
<cvename>CVE-2022-21547</cvename>
<cvename>CVE-2022-21525</cvename>
<cvename>CVE-2022-21526</cvename>
<cvename>CVE-2022-21529</cvename>
<cvename>CVE-2022-21530</cvename>
<cvename>CVE-2022-21531</cvename>
<cvename>CVE-2022-21553</cvename>
<cvename>CVE-2022-21515</cvename>
<cvename>CVE-2022-21455</cvename>
<cvename>CVE-2022-21534</cvename>
<cvename>CVE-2022-21522</cvename>
<cvename>CVE-2022-21538</cvename>
<cvename>CVE-2022-21535</cvename>
<url>https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2022-07-19</discovery>
<entry>2022-07-21</entry>
</dates>
</vuln>
<vuln vid="27cc4258-0805-11ed-8ac1-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>103.0.5060.134</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html">
<p>This release contains 11 security fixes, including:</p>
<ul>
<li>[1336266] High CVE-2022-2477: Use after free in Guest View. Reported by anonymous on 2022-06-14</li>
<li>[1335861] High CVE-2022-2478: Use after free in PDF. Reported by triplepwns on 2022-06-13</li>
<li>[1329987] High CVE-2022-2479: Insufficient validation of untrusted input in File. Reported by anonymous on 2022-05-28</li>
<li>[1339844] High CVE-2022-2480: Use after free in Service Worker API. Reported by Sergei Glazunov of Google Project Zero on 2022-06-27</li>
<li>[1341603] High CVE-2022-2481: Use after free in Views. Reported by YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University on 2022-07-04</li>
<li>[1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2163</cvename>
<cvename>CVE-2022-2477</cvename>
<cvename>CVE-2022-2478</cvename>
<cvename>CVE-2022-2479</cvename>
<cvename>CVE-2022-2480</cvename>
<cvename>CVE-2022-2481</cvename>
<url>https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2022-07-19</discovery>
<entry>2022-07-20</entry>
</dates>
</vuln>
<vuln vid="871d93f9-06aa-11ed-8d5f-080027f5fec9">
<topic>redis -- Potential remote code execution vulnerability</topic>
<affects>
<package>
<name>redis</name>
<range><ge>7.0.0</ge><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redis core team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/FWngtg3WpfA">
<p>
A specially crafted XAUTOCLAIM command on a stream key in
a specific state may result with heap overflow, and
potentially remote code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31144</cvename>
<url>https://groups.google.com/g/redis-db/c/FWngtg3WpfA</url>
</references>
<dates>
<discovery>2022-07-18</discovery>
<entry>2022-07-18</entry>
</dates>
</vuln>
<vuln vid="0c367e98-0415-11ed-a53b-6c3be5272acd">
<topic>Grafana -- Stored XSS</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
<range><ge>9.0.0</ge><lt>9.0.3</lt></range>
<range><ge>9.1.0</ge><lt>9.2.7</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.0.3</lt></range>
<range><ge>9.1.0</ge><lt>9.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/07/14/grafana-v9-0-3-8-5-9-8-4-10-and-8-3-10-released-with-high-severity-security-fix/">
<p>An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. (Note: Grafana Alerting is activated by default in Grafana 9.0.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31097</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f</url>
</references>
<dates>
<discovery>2022-06-19</discovery>
<entry>2022-07-15</entry>
</dates>
</vuln>
<vuln vid="0859e6d5-0415-11ed-a53b-6c3be5272acd">
<topic>Grafana -- OAuth Account Takeover</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>5.3.0</ge><lt>8.3.10</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
<range><ge>9.0.0</ge><lt>9.0.3</lt></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0</ge></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
</package>
<package>
<name>grafana9</name>
<range><lt>9.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/07/14/grafana-v9-0-3-8-5-9-8-4-10-and-8-3-10-released-with-high-severity-security-fix/">
<p>It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31107</cvename>
<url>https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2</url>
</references>
<dates>
<discovery>2022-06-27</discovery>
<entry>2022-07-15</entry>
</dates>
</vuln>
<vuln vid="a4f2416c-02a0-11ed-b817-10c37b4ac2ea">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.4</lt></range>
</package>
<package>
<name>go117</name>
<range><lt>1.17.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/53188">
<p>net/http: improper sanitization of Transfer-Encoding
header</p>
<p>The HTTP/1 client accepted some invalid
Transfer-Encoding headers as indicating a "chunked"
encoding. This could potentially allow for request
smuggling, but only if combined with an intermediate
server that also improperly failed to reject the header
as invalid.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53423">
<p>When httputil.ReverseProxy.ServeHTTP was called with a
Request.Header map containing a nil value for the
X-Forwarded-For header, ReverseProxy would set the client
IP as the value of the X-Forwarded-For header, contrary to
its documentation. In the more usual case where a Director
function set the X-Forwarded-For header value to nil,
ReverseProxy would leave the header unmodified as
expected.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53168">
<p>compress/gzip: stack exhaustion in Reader.Read</p>
<p>Calling Reader.Read on an archive containing a large
number of concatenated 0-length compressed files can
cause a panic due to stack exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53611">
<p>encoding/xml: stack exhaustion in Unmarshal</p>
<p>Calling Unmarshal on a XML document into a Go struct
which has a nested field that uses the any field tag can
cause a panic due to stack exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53614">
<p>encoding/xml: stack exhaustion in Decoder.Skip</p>
<p>Calling Decoder.Skip when parsing a deeply nested XML
document can cause a panic due to stack exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53615">
<p>encoding/gob: stack exhaustion in Decoder.Decode</p>
<p>Calling Decoder.Decode on a message which contains
deeply nested structures can cause a panic due to stack
exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53416">
<p>path/filepath: stack exhaustion in Glob</p>
<p>Calling Glob on a path which contains a large number of
path separators can cause a panic due to stack
exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53415">
<p>io/fs: stack exhaustion in Glob</p>
<p>Calling Glob on a path which contains a large number of
path separators can cause a panic due to stack
exhaustion.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/53616">
<p>go/parser: stack exhaustion in all Parse* functions</p>
<p>Calling any of the Parse functions on Go source code
which contains deeply nested types or declarations can
cause a panic due to stack exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1705</cvename>
<cvename>CVE-2022-32148</cvename>
<cvename>CVE-2022-30631</cvename>
<cvename>CVE-2022-30633</cvename>
<cvename>CVE-2022-28131</cvename>
<cvename>CVE-2022-30635</cvename>
<cvename>CVE-2022-30632</cvename>
<cvename>CVE-2022-30630</cvename>
<cvename>CVE-2022-1962</cvename>
<url>https://groups.google.com/g/golang-dev/c/frczlF8OFQ0</url>
</references>
<dates>
<discovery>2022-07-12</discovery>
<entry>2022-07-13</entry>
</dates>
</vuln>
<vuln vid="b99f99f6-021e-11ed-8c6f-000c29ffbb6c">
<topic>git -- privilege escalation</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.37.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The git project reports:</p>
<blockquote cite="https://lkml.org/lkml/2022/7/12/1137">
<p>Git is vulnerable to privilege escalation in all platforms.
An unsuspecting user could still be affected by the issue
reported in CVE-2022-24765, for example when navigating as
root into a shared tmp directory that is owned by them, but
where an attacker could create a git repository.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-29187</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29187</url>
</references>
<dates>
<discovery>2022-07-12</discovery>
<entry>2022-07-12</entry>
</dates>
</vuln>
<vuln vid="830855f3-ffcc-11ec-9d41-d05099c8b5a7">
<topic>mat2 -- directory traversal/arbitrary file read during ZIP file processing</topic>
<affects>
<package>
<name>mat2</name>
<range><lt>0.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35410">
<p>
mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../
directory traversal during the ZIP archive cleaning process. This
primarily affects mat2 web instances, in which clients could obtain
sensitive information via a crafted archive.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-35410</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35410</url>
</references>
<dates>
<discovery>2022-07-08</discovery>
<entry>2022-07-10</entry>
</dates>
</vuln>
<vuln vid="d1b35142-ff4a-11ec-8be3-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.1.0</ge><lt>15.1.1</lt></range>
<range><ge>15.0.0</ge><lt>15.0.4</lt></range>
<range><ge>0</ge><lt>14.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/">
<p>Remote Command Execution via Project Imports</p>
<p>XSS in ZenTao integration affecting self hosted instances without strict CSP</p>
<p>XSS in project settings page</p>
<p>Unallowed users can read unprotected CI variables</p>
<p>IP allow-list bypass to access Container Registries</p>
<p>2FA status is disclosed to unauthenticated users</p>
<p>CI variables provided to runners outside of a group's restricted IP range</p>
<p>IDOR in sentry issues</p>
<p>Reporters can manage issues in error tracking</p>
<p>Regular Expression Denial of Service via malicious web server responses</p>
<p>Unauthorized read for conan repository</p>
<p>Open redirect vulnerability</p>
<p>Group labels are editable through subproject</p>
<p>Release titles visible for any users if group milestones are associated with any project releases</p>
<p>Restrict membership by email domain bypass</p>
<p>Job information is leaked to users who previously were maintainers via the Runner Jobs API endpoint</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2185</cvename>
<cvename>CVE-2022-2235</cvename>
<cvename>CVE-2022-2230</cvename>
<cvename>CVE-2022-2229</cvename>
<cvename>CVE-2022-1983</cvename>
<cvename>CVE-2022-1963</cvename>
<cvename>CVE-2022-2228</cvename>
<cvename>CVE-2022-2243</cvename>
<cvename>CVE-2022-2244</cvename>
<cvename>CVE-2022-1954</cvename>
<cvename>CVE-2022-2270</cvename>
<cvename>CVE-2022-2250</cvename>
<cvename>CVE-2022-1999</cvename>
<cvename>CVE-2022-2281</cvename>
<cvename>CVE-2022-1981</cvename>
<cvename>CVE-2022-2227</cvename>
<url>https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/</url>
</references>
<dates>
<discovery>2022-06-30</discovery>
<entry>2022-07-09</entry>
</dates>
</vuln>
<vuln vid="b9210706-feb0-11ec-81fa-1c697a616631">
<topic>Node.js -- July 7th 2022 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><ge>14.0.0</ge><lt>14.20.0</lt></range>
<range><ge>16.0.0</ge><lt>16.16.0</lt></range>
<range><ge>18.0.0</ge><lt>18.5.0</lt></range>
</package>
<package>
<name>node16</name>
<range><lt>16.16.0</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/">
<h1>HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding
(Medium)(CVE-2022-32213)</h1>
<p>The llhttp parser in the http module does not correctly parse and
validate Transfer-Encoding headers. This can lead to HTTP Request
Smuggling (HRS).</p>
<h1>HTTP Request Smuggling - Improper Delimiting of Header Fields
(Medium)(CVE-2022-32214)</h1>
<p>The llhttp parser in the http module does not strictly use the CRLF
sequence to delimit HTTP requests. This can lead to HTTP Request
Smuggling (HRS).</p>
<h1>HTTP Request Smuggling - Incorrect Parsing of Multi-line
Transfer-Encoding (Medium)(CVE-2022-32215)</h1>
<p>The llhttp parser in the http module does not correctly handle
multi-line Transfer-Encoding headers. This can lead to HTTP Request
Smuggling (HRS).</p>
<h1>DNS rebinding in --inspect via invalid IP addresses
(High)(CVE-2022-32212)</h1>
<p>The IsAllowedHost check can easily be bypassed because IsIPAddress
does not properly check if an IP address is invalid or not. When an
invalid IPv4 address is provided (for instance 10.0.2.555 is
provided), browsers (such as Firefox) will make DNS requests to the
DNS server, providing a vector for an attacker-controlled DNS server
or a MITM who can spoof DNS responses to perform a rebinding attack
and hence connect to the WebSocket debugger, allowing for arbitrary
code execution. This is a bypass of CVE-2021-22884.</p>
<h1>Attempt to read openssl.cnf from /home/iojs/build/ upon startup
(Medium)(CVE-2022-32222)</h1>
<p>When Node.js starts on linux based systems, it attempts to read
/home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf,
which ordinarily doesn't exist. On some shared systems an attacker may
be able create this file and therefore affect the default OpenSSL
configuration for other users.</p>
<h1>OpenSSL - AES OCB fails to encrypt some bytes
(Medium)(CVE-2022-2097)</h1>
<p>AES OCB mode for 32-bit x86 platforms using the AES-NI assembly
optimised implementation will not encrypt the entirety of the data
under some circumstances. This could reveal sixteen bytes of data that
was preexisting in the memory that wasn't written. In the special case
of "in place" encryption, sixteen bytes of the plaintext would be
revealed. Since OpenSSL does not support OCB based cipher suites for
TLS and DTLS, they are both unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32212</cvename>
<cvename>CVE-2022-32213</cvename>
<cvename>CVE-2022-32214</cvename>
<cvename>CVE-2022-32215</cvename>
<cvename>CVE-2022-32222</cvename>
<cvename>CVE-2022-2097</cvename>
<url>https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/</url>
</references>
<dates>
<discovery>2022-07-05</discovery>
<entry>2022-07-08</entry>
<modified>2022-07-08</modified>
</dates>
</vuln>
<vuln vid="744ec9d7-fe0f-11ec-bcd2-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>103.0.5060.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html">
<p>This release contains 4 security fixes, including:</p>
<ul>
<li>[1341043] High CVE-2022-2294: Heap buffer overflow in WebRTC. Reported by Jan Vojtesek from the Avast Threat Intelligence team on 2022-07-01</li>
<li>[1336869] High CVE-2022-2295: Type Confusion in V8. Reported by avaue and Buff3tts at S.S.L. on 2022-06-16</li>
<li>[1327087] High CVE-2022-2296: Use after free in Chrome OS Shell. Reported by Khalil Zhani on 2022-05-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2294</cvename>
<cvename>CVE-2022-2295</cvename>
<cvename>CVE-2022-2296</cvename>
<url>https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-07-04</discovery>
<entry>2022-07-07</entry>
</dates>
</vuln>
<vuln vid="a28e8b7e-fc70-11ec-856e-d4c9ef517024">
<topic>OpenSSL -- AES OCB fails to encrypt some bytes</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1q,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20220705.txt">
<p>AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances. This could reveal sixteen bytes of data that was
preexisting in the memory that wasn't written. In the special case of
"in place" encryption, sixteen bytes of the plaintext would be revealed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2097</cvename>
<url>https://www.openssl.org/news/secadv/20220705.txt</url>
</references>
<dates>
<discovery>2022-07-05</discovery>
<entry>2022-07-05</entry>
</dates>
</vuln>
<vuln vid="5be19b0d-fb85-11ec-95cd-080027b24e86">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.14</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2022/jul/04/security-releases/">
<p>CVE-2022-34265: Potential SQL injection via Trunc(kind) and
Extract(lookup_name) arguments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-34265</cvename>
<url>https://www.djangoproject.com/weblog/2022/jul/04/security-releases/</url>
</references>
<dates>
<discovery>2022-06-21</discovery>
<entry>2022-07-04</entry>
</dates>
</vuln>
<vuln vid="f0e45968-faff-11ec-856e-d4c9ef517024">
<topic>OpenSSL -- Heap memory corruption with RSA private key operation</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><ge>3.0.4</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html">
<p>The OpenSSL 3.0.4 release introduced a serious bug in the RSA
implementation for X86_64 CPUs supporting the AVX512IFMA instructions.
This issue makes the RSA implementation with 2048 bit private keys
incorrect on such machines and memory corruption will happen during
the computation. As a consequence of the memory corruption an attacker
may be able to trigger a remote code execution on the machine performing
the computation.</p>
<p>SSL/TLS servers or other servers using 2048 bit RSA private keys running
on machines supporting AVX512IFMA instructions of the X86_64 architecture
are affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2274</cvename>
<url>https://www.openssl.org/news/secadv/20220705.txt</url>
</references>
<dates>
<discovery>2022-07-01</discovery>
<entry>2022-07-03</entry>
<modified>2022-07-05</modified>
</dates>
</vuln>
<vuln vid="5ab54ea0-fa94-11ec-996c-080027b24e86">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.7</lt></range>
</package>
<package>
<name>mediawiki137</name>
<range><lt>1.37.3</lt></range>
</package>
<package>
<name>mediawiki138</name>
<range><lt>1.38.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/PIPYDRSHXOYW5DB7X755QDNUV5EZWPWB/">
<p>(T308471) Username is not escaped in the "welcomeuser" message.</p>
<p>(T308473) Username not escaped in the contributions-title message.</p>
<p>(T309377, CVE-2022-29248) Update "guzzlehttp/guzzle" to version 6.5.6.</p>
<p>(T311384, CVE-2022-27776) Update "guzzlehttp/guzzle" to 6.5.8/7.4.5.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-29248</cvename>
<cvename>CVE-2022-27776</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/PIPYDRSHXOYW5DB7X755QDNUV5EZWPWB/</url>
</references>
<dates>
<discovery>2022-05-16</discovery>
<entry>2022-07-03</entry>
</dates>
</vuln>
<vuln vid="07c0d782-f758-11ec-acaa-901b0e9408dc">
<topic>py-matrix-synapse -- unbounded recursion in urlpreview</topic>
<affects>
<package>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<name>py311-matrix-synapse</name>
<range><lt>1.61.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1">
<p>This release fixes a vulnerability with Synapse's URL preview feature. URL previews
of some web pages can lead to unbounded recursion, causing the request to either fail,
or in some cases crash the running Synapse process.</p>
<p>Note that:</p>
<ul>
<li>Homeservers with the url_preview_enabled configuration option set to false
(the default value) are unaffected.</li>
<li>Instances with the enable_media_repo configuration option set to false are
also unaffected, as this also disables the URL preview functionality.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31052</cvename>
<url>https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1</url>
</references>
<dates>
<discovery>2022-06-28</discovery>
<entry>2022-06-29</entry>
</dates>
</vuln>
<vuln vid="ae5722a6-f5f0-11ec-856e-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.16.4</ge><lt>7.84.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<ul>
<li>CVE-2022-32205: Set-Cookie denial of service</li>
<li>CVE-2022-32206: HTTP compression denial of service</li>
<li>CVE-2022-32207: Unpreserved file permissions</li>
<li>CVE-2022-32208: FTP-KRB bad message verification</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32205</cvename>
<cvename>CVE-2022-32206</cvename>
<cvename>CVE-2022-32207</cvename>
<cvename>CVE-2022-32208</cvename>
<url>https://curl.se/docs/security.html</url>
</references>
<dates>
<discovery>2022-06-27</discovery>
<entry>2022-06-27</entry>
</dates>
</vuln>
<vuln vid="25be46f0-f25d-11ec-b62a-00e081b7aa2d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.356</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.346.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2022-06-22/">
<h1>Description</h1>
<h5>(High) SECURITY-2781 / CVE-2022-34170 (SECURITY-2779), CVE-2022-34171 (SECURITY-2761), CVE-2022-34172 (SECURITY-2776), CVE-2022-34173 (SECURITY-2780)</h5>
<p>Multiple XSS vulnerabilities</p>
<h5>(Medium) SECURITY-2566 / CVE-2022-34174</h5>
<p>Observable timing discrepancy allows determining username validity</p>
<h5>(Medium) Unauthorized view fragment access</h5>
<p>SECURITY-2777 / CVE-2022-34175</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-34170</cvename>
<cvename>CVE-2022-34171</cvename>
<cvename>CVE-2022-34172</cvename>
<cvename>CVE-2022-34173</cvename>
<cvename>CVE-2022-34174</cvename>
<cvename>CVE-2022-34175</cvename>
<url>https://www.jenkins.io/security/advisory/2022-06-22/</url>
</references>
<dates>
<discovery>2022-06-22</discovery>
<entry>2022-06-22</entry>
</dates>
</vuln>
<vuln vid="4eeb93bf-f204-11ec-8fbd-d4c9ef517024">
<topic>OpenSSL -- Command injection vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1p,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.4</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20220621.txt">
<p>Circumstances where the c_rehash script does not properly
sanitise shell metacharacters to prevent command injection were
found by code review.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2068</cvename>
<url>https://www.openssl.org/news/secadv/20220621.txt</url>
</references>
<dates>
<discovery>2022-06-21</discovery>
<entry>2022-06-22</entry>
</dates>
</vuln>
<vuln vid="b2a4c5f1-f1fe-11ec-bcd2-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>103.0.5060.53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html">
<p>This release contains 14 security fixes, including:</p>
<ul>
<li>[1335458] Critical CVE-2022-2156: Use after free in Base. Reported by Mark Brand of Google Project Zero on 2022-06-11</li>
<li>[1327312] High CVE-2022-2157: Use after free in Interest groups. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-19</li>
<li>[1321078] High CVE-2022-2158: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-04-29</li>
<li>[1116450] Medium CVE-2022-2160: Insufficient policy enforcement in DevTools. Reported by David Erceg on 2020-08-14</li>
<li>[1330289] Medium CVE-2022-2161: Use after free in WebApp Provider. Reported by Zhihua Yao of KunLun Lab on 2022-05-30</li>
<li>[1307930] Medium CVE-2022-2162: Insufficient policy enforcement in File System API. Reported by Abdelhamid Naceri (halov) on 2022-03-19</li>
<li>[1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21</li>
<li>[1268445] Low CVE-2022-2164: Inappropriate implementation in Extensions API. Reported by José Miguel Moreno Computer Security Lab (COSEC) at UC3M on 2021-11-10</li>
<li>[1250993] Low CVE-2022-2165: Insufficient data validation in URL formatting. Reported by Rayyan Bijoora on 2021-09-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2156</cvename>
<cvename>CVE-2022-2157</cvename>
<cvename>CVE-2022-2158</cvename>
<cvename>CVE-2022-2160</cvename>
<cvename>CVE-2022-2161</cvename>
<cvename>CVE-2022-2162</cvename>
<cvename>CVE-2022-2163</cvename>
<cvename>CVE-2022-2164</cvename>
<cvename>CVE-2022-2165</cvename>
<url>https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2022-06-21</discovery>
<entry>2022-06-22</entry>
</dates>
</vuln>
<vuln vid="482456fb-e9af-11ec-93b6-318d1419ea39">
<topic>Security Vulnerability found in ExifTool leading to RCE</topic>
<affects>
<package>
<name>p5-Image-ExifTool</name>
<range><lt>12.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security tracker reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2022-23935">
<p>ExifTool.pm in ExifTool before 12.38 mishandles a file special characters check, leading to command injection</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23935</cvename>
<url>https://www.cvedetails.com/cve/CVE-2022-23935</url>
</references>
<dates>
<discovery>2022-01-25</discovery>
<entry>2022-06-11</entry>
</dates>
</vuln>
<vuln vid="ad37a349-ebb7-11ec-b9f7-21427354249d">
<topic>mitmproxy -- Insufficient Protection against HTTP Request Smuggling</topic>
<affects>
<package>
<name>mitmproxy</name>
<range><lt>8.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zeyu Zhang reports:</p>
<blockquote cite="https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b">
<p>
In mitmproxy 7.0.4 and below, a malicious client or server is able to
perform HTTP request smuggling attacks through mitmproxy. This means
that a malicious client/server could smuggle a request/response through
mitmproxy as part of another request/response's HTTP message body. While
mitmproxy would only see one request, the target server would see
multiple requests. A smuggled request is still captured as part of
another request's body, but it does not appear in the request list and
does not go through the usual mitmproxy event hooks, where users may
have implemented custom access control checks or input sanitization.
</p>
<p>
Unless you use mitmproxy to protect an HTTP/1 service, no action is required.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24766</cvename>
<url>https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b</url>
</references>
<dates>
<discovery>2022-03-21</discovery>
<entry>2022-06-20</entry>
</dates>
</vuln>
<vuln vid="5d1e4f6a-ee4f-11ec-86c2-485b3931c969">
<topic>Tor - Unspecified high severity vulnerability</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.4.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tor organization reports:</p>
<blockquote cite="https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE">
<p>TROVE-2022-001</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE</url>
</references>
<dates>
<discovery>2022-06-14</discovery>
<entry>2022-06-17</entry>
</dates>
</vuln>
<vuln vid="55cff5d2-e95c-11ec-ae20-001999f8d30b">
<topic>XFCE -- Allows executing malicious .desktop files pointing to remote code</topic>
<affects>
<package>
<name>libexo</name>
<range><lt>4.16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>XFCE Project reports:</p>
<blockquote cite="https://gitlab.xfce.org/xfce/exo/-/commit/cc047717c3b5efded2cc7bd419c41a3d1f1e48b6">
<p>Prevent executing possibly malicious .desktop files
from online sources (ftp://, http:// etc.).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-32278</cvename>
<url>https://gitlab.xfce.org/xfce/exo/-/commit/cc047717c3b5efded2cc7bd419c41a3d1f1e48b6</url>
</references>
<dates>
<discovery>2022-06-11</discovery>
<entry>2022-06-11</entry>
</dates>
</vuln>
<vuln vid="b51cfaea-e919-11ec-9fba-080027240888">
<topic>py-numpy -- Missing return-value validation of the function PyArray_DescrNew</topic>
<affects>
<package>
<name>py38-numpy</name>
<name>py39-numpy</name>
<name>py310-numpy</name>
<range><lt>1.22.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Numpy reports:</p>
<blockquote cite="https://github.com/numpy/numpy/pull/20960">
<p>At most call-sites for PyArray_DescrNew, there are no validations of its return,
but an invalid address may be returned.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41495</cvename>
<url>https://github.com/numpy/numpy/pull/20960</url>
</references>
<dates>
<discovery>2021-05-19</discovery>
<entry>2022-06-11</entry>
</dates>
</vuln>
<vuln vid="c80ce2dd-e831-11ec-bcd2-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>102.0.5005.115</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html">
<p>This release contains 7 security fixes, including:</p>
<ul>
<li>[1326210] High CVE-2022-2007: Use after free in WebGPU. Reported by David Manouchehri on 2022-05-17</li>
<li>[1317673] High CVE-2022-2008: Out of bounds memory access in WebGL. Reported by khangkito - Tran Van Khang (VinCSS) on 2022-04-19</li>
<li>[1325298] High CVE-2022-2010: Out of bounds read in compositing. Reported by Mark Brand of Google Project Zero on 2022-05-13</li>
<li>[1330379] High CVE-2022-2011: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-05-31</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-2007</cvename>
<cvename>CVE-2022-2008</cvename>
<cvename>CVE-2022-2010</cvename>
<cvename>CVE-2022-2011</cvename>
<url>https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-06-09</discovery>
<entry>2022-06-09</entry>
</dates>
</vuln>
<vuln vid="49adfbe5-e7d1-11ec-8fbd-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.54</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://downloads.apache.org/httpd/CHANGES_2.4.54">
<ul>
<li>CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop
mechanism. Apache HTTP Server 2.4.53 and earlier may not send the
X-Forwarded-* headers to the origin server based on client side
Connection header hop-by-hop mechanism. This may be used to bypass
IP based authentication on the origin server/application.</li>
<li>CVE-2022-30556: Information Disclosure in mod_lua with websockets.
Apache HTTP Server 2.4.53 and earlier may return lengths to
applications calling r:wsread() that point past the end of the
storage allocated for the buffer.</li>
<li>CVE-2022-30522: mod_sed denial of service. If Apache HTTP Server
2.4.53 is configured to do transformations with mod_sed in contexts
where the input to mod_sed may be very large, mod_sed may make
excessively large memory allocations and trigger an abort.</li>
<li>CVE-2022-29404: Denial of service in mod_lua r:parsebody. In Apache
HTTP Server 2.4.53 and earlier, a malicious request to a lua script
that calls r:parsebody(0) may cause a denial of service due to no
default limit on possible input size.</li>
<li>CVE-2022-28615: Read beyond bounds in ap_strcmp_match(). Apache
HTTP Server 2.4.53 and earlier may crash or disclose information due
to a read beyond bounds in ap_strcmp_match() when provided with an
extremely large input buffer. While no code distributed with the
server can be coerced into such a call, third-party modules or lua
scripts that use ap_strcmp_match() may hypothetically be affected.
</li>
<li>CVE-2022-28614: read beyond bounds via ap_rwrite(). The ap_rwrite()
function in Apache HTTP Server 2.4.53 and earlier may read unintended
memory if an attacker can cause the server to reflect very large
input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts()
function.</li>
<li>CVE-2022-28330: read beyond bounds in mod_isapi. Apache HTTP Server
2.4.53 and earlier on Windows may read beyond bounds when configured
to process requests with the mod_isapi module.</li>
<li>CVE-2022-26377: mod_proxy_ajp: Possible request smuggling.
Inconsistent Interpretation of HTTP Requests ('HTTP Request
Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
allows an attacker to smuggle requests to the AJP server it forwards
requests to.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31813</cvename>
<cvename>CVE-2022-30556</cvename>
<cvename>CVE-2022-30522</cvename>
<cvename>CVE-2022-29404</cvename>
<cvename>CVE-2022-28615</cvename>
<cvename>CVE-2022-28614</cvename>
<cvename>CVE-2022-28330</cvename>
<cvename>CVE-2022-26377</cvename>
<url>http://downloads.apache.org/httpd/CHANGES_2.4.54</url>
</references>
<dates>
<discovery>2022-06-08</discovery>
<entry>2022-06-09</entry>
<modified>2022-06-10</modified>
</dates>
</vuln>
<vuln vid="15888c7e-e659-11ec-b7fe-10c37b4ac2ea">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go118</name>
<range><lt>1.18.3</lt></range>
</package>
<package>
<name>go117</name>
<range><lt>1.17.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/52561">
<p>crypto/rand: rand.Read hangs with extremely large buffers</p>
<p>On Windows, rand.Read will hang indefinitely if passed a
buffer larger than 1 << 32 - 1 bytes.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/52814">
<p>crypto/tls: session tickets lack random ticket_age_add</p>
<p>Session tickets generated by crypto/tls did not contain
a randomly generated ticket_age_add. This allows an
attacker that can observe TLS handshakes to correlate
successive connections by comparing ticket ages during
session resumption.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/52574">
<p>os/exec: empty Cmd.Path can result in running unintended
binary on Windows</p>
<p>If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or
cmd.CombinedOutput are executed when Cmd.Path is unset
and, in the working directory, there are binaries named
either "..com" or "..exe", they will be executed.</p>
</blockquote>
<blockquote cite="https://go.dev/issue/52476">
<p>path/filepath: Clean(`.\c:`) returns `c:` on Windows</p>
<p>On Windows, the filepath.Clean function could convert an
invalid path to a valid, absolute path. For example,
Clean(`.\c:`) returned `c:`.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/g/golang-dev/c/DidEMYAH_n0</url>
<cvename>CVE-2022-30634</cvename>
<url>https://go.dev/issue/52561</url>
<cvename>CVE-2022-30629</cvename>
<url>https://go.dev/issue/52814</url>
<cvename>CVE-2022-30580</cvename>
<url>https://go.dev/issue/52574</url>
<cvename>CVE-2022-29804</cvename>
<url>https://go.dev/issue/52476</url>
</references>
<dates>
<discovery>2022-06-01</discovery>
<entry>2022-06-07</entry>
</dates>
</vuln>
<vuln vid="a58f3fde-e4e0-11ec-8340-2d623369b8b5">
<topic>e2fsprogs -- out-of-bounds read/write vulnerability</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.46.5_1</lt></range>
</package>
<package>
<name>e2fsprogs-nobootfsck</name>
<range><lt>1.46.5_1</lt></range>
</package>
<package>
<name>e2fsprogs-roothardlinks</name>
<range><lt>1.46.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nils Bars reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2068113">
<p>
During the processing of [a specially fuzzed disk image], an
out-of-bounds write is triggered and causes a segmentation fault
(SIGSEGV).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1304</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=2068113</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=2069726</url>
<url>https://lore.kernel.org/linux-ext4/20220421173148.20193-1-lczerner@redhat.com/T/#u</url>
</references>
<dates>
<discovery>2022-03-24</discovery>
<entry>2022-06-05</entry>
</dates>
</vuln>
<vuln vid="f414d69f-e43d-11ec-9ea4-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>15.0.0</ge><lt>15.0.1</lt></range>
<range><ge>14.10.0</ge><lt>14.10.4</lt></range>
<range><ge>11.10.0</ge><lt>14.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/">
<p>Account take over via SCIM email change</p>
<p>Stored XSS in Jira integration</p>
<p>Quick action commands susceptible to XSS</p>
<p>IP allowlist bypass when using Trigger tokens</p>
<p>IP allowlist bypass when using Project Deploy Tokens</p>
<p>Improper authorization in the Interactive Web Terminal</p>
<p>Subgroup member can list members of parent group</p>
<p>Group member lock bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1680</cvename>
<cvename>CVE-2022-1940</cvename>
<cvename>CVE-2022-1948</cvename>
<cvename>CVE-2022-1935</cvename>
<cvename>CVE-2022-1936</cvename>
<cvename>CVE-2022-1944</cvename>
<cvename>CVE-2022-1821</cvename>
<cvename>CVE-2022-1783</cvename>
<url>https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/</url>
</references>
<dates>
<discovery>2022-06-01</discovery>
<entry>2022-06-04</entry>
</dates>
</vuln>
<vuln vid="204f1a7a-43df-412f-ad25-7dbe88f54fa4">
<topic>zeek -- potential DoS vulnerabilty</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.7">
<p> Fix potential hang in the DNS analyzer when receiving
a specially-crafted packet. Due to the possibility of
this happening with packets received from the network,
this is a potential DoS vulnerability. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.7</url>
</references>
<dates>
<discovery>2022-06-01</discovery>
<entry>2022-06-03</entry>
</dates>
</vuln>
<vuln vid="40e2c35e-db99-11ec-b0cf-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>102.0.5005.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html">
<p>This release contains 32 security fixes, including:</p>
<ul>
<li>[1324864] Critical CVE-2022-1853: Use after free in Indexed DB. Reported by Anonymous on 2022-05-12</li>
<li>[1320024] High CVE-2022-1854: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-04-27</li>
<li>[1228661] High CVE-2022-1855: Use after free in Messaging. Reported by Anonymous on 2021-07-13</li>
<li>[1323239] High CVE-2022-1856: Use after free in User Education. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06</li>
<li>[1227995] High CVE-2022-1857: Insufficient policy enforcement in File System API. Reported by Daniel Rhea on 2021-07-11</li>
<li>[1314310] High CVE-2022-1858: Out of bounds read in DevTools. Reported by EllisVlad on 2022-04-07</li>
<li>[1322744] High CVE-2022-1859: Use after free in Performance Manager. Reported by Guannan Wang (@Keenan7310) of Tencent Security Xuanwu Lab on 2022-05-05</li>
<li>[1297209] High CVE-2022-1860: Use after free in UI Foundations. Reported by @ginggilBesel on 2022-02-15</li>
<li>[1316846] High CVE-2022-1861: Use after free in Sharing. Reported by Khalil Zhani on 2022-04-16</li>
<li>[1236325] Medium CVE-2022-1862: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2021-08-04</li>
<li>[1292870] Medium CVE-2022-1863: Use after free in Tab Groups. Reported by David Erceg on 2022-02-01</li>
<li>[1320624] Medium CVE-2022-1864: Use after free in WebApp Installs. Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab on 2022-04-28</li>
<li>[1289192] Medium CVE-2022-1865: Use after free in Bookmarks. Reported by Rong Jian of VRI on 2022-01-20</li>
<li>[1292264] Medium CVE-2022-1866: Use after free in Tablet Mode. Reported by @ginggilBesel on 2022-01-29</li>
<li>[1315563] Medium CVE-2022-1867: Insufficient validation of untrusted input in Data Transfer. Reported by Michal Bentkowski of Securitum on 2022-04-12</li>
<li>[1301203] Medium CVE-2022-1868: Inappropriate implementation in Extensions API. Reported by Alesandro Ortiz on 2022-02-28</li>
<li>[1309467] Medium CVE-2022-1869: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2022-03-23</li>
<li>[1323236] Medium CVE-2022-1870: Use after free in App Service. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06</li>
<li>[1308199] Low CVE-2022-1871: Insufficient policy enforcement in File System API. Reported by Thomas Orlita on 2022-03-21</li>
<li>[1310461] Low CVE-2022-1872: Insufficient policy enforcement in Extensions API. Reported by ChaobinZhang on 2022-03-26</li>
<li>[1305394] Low CVE-2022-1873: Insufficient policy enforcement in COOP. Reported by NDevTK on 2022-03-11</li>
<li>[1251588] Low CVE-2022-1874: Insufficient policy enforcement in Safe Browsing. Reported by hjy79425575 on 2021-09-21</li>
<li>[1306443] Low CVE-2022-1875: Inappropriate implementation in PDF. Reported by NDevTK on 2022-03-15</li>
<li>[1313600] Low CVE-2022-1876: Heap buffer overflow in DevTools. Reported by @ginggilBesel on 2022-04-06</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1853</cvename>
<cvename>CVE-2022-1854</cvename>
<cvename>CVE-2022-1855</cvename>
<cvename>CVE-2022-1856</cvename>
<cvename>CVE-2022-1857</cvename>
<cvename>CVE-2022-1858</cvename>
<cvename>CVE-2022-1859</cvename>
<cvename>CVE-2022-1860</cvename>
<cvename>CVE-2022-1861</cvename>
<cvename>CVE-2022-1862</cvename>
<cvename>CVE-2022-1863</cvename>
<cvename>CVE-2022-1864</cvename>
<cvename>CVE-2022-1865</cvename>
<cvename>CVE-2022-1866</cvename>
<cvename>CVE-2022-1867</cvename>
<cvename>CVE-2022-1868</cvename>
<cvename>CVE-2022-1869</cvename>
<cvename>CVE-2022-1870</cvename>
<cvename>CVE-2022-1871</cvename>
<cvename>CVE-2022-1872</cvename>
<cvename>CVE-2022-1873</cvename>
<cvename>CVE-2022-1874</cvename>
<cvename>CVE-2022-1875</cvename>
<cvename>CVE-2022-1876</cvename>
<url>https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2022-05-24</discovery>
<entry>2022-05-24</entry>
</dates>
</vuln>
<vuln vid="04fecc47-dad2-11ec-8fbd-d4c9ef517024">
<topic>MariaDB -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-client</name>
<range><lt>10.3.35</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.35</lt></range>
</package>
<package>
<name>mariadb104-client</name>
<range><lt>10.4.25</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.25</lt></range>
</package>
<package>
<name>mariadb105-client</name>
<range><lt>10.5.16</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.16</lt></range>
</package>
<package>
<name>mariadb106-client</name>
<range><lt>10.6.8</lt></range>
</package>
<package>
<name>mariadb106-server</name>
<range><lt>10.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/security/#full-list-of-cves-fixed-in-mariadb">
<p>MariaDB fixed 23 vulnerabilities across all supported versions</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-46669</cvename>
<cvename>CVE-2022-27376</cvename>
<cvename>CVE-2022-27377</cvename>
<cvename>CVE-2022-27378</cvename>
<cvename>CVE-2022-27379</cvename>
<cvename>CVE-2022-27380</cvename>
<cvename>CVE-2022-27381</cvename>
<cvename>CVE-2022-27382</cvename>
<cvename>CVE-2022-27383</cvename>
<cvename>CVE-2022-27384</cvename>
<cvename>CVE-2022-27386</cvename>
<cvename>CVE-2022-27387</cvename>
<cvename>CVE-2022-27444</cvename>
<cvename>CVE-2022-27445</cvename>
<cvename>CVE-2022-27446</cvename>
<cvename>CVE-2022-27447</cvename>
<cvename>CVE-2022-27448</cvename>
<cvename>CVE-2022-27449</cvename>
<cvename>CVE-2022-27451</cvename>
<cvename>CVE-2022-27452</cvename>
<cvename>CVE-2022-27455</cvename>
<cvename>CVE-2022-27456</cvename>
<cvename>CVE-2022-27457</cvename>
<cvename>CVE-2022-27458</cvename>
<url>https://mariadb.com/kb/en/security/#full-list-of-cves-fixed-in-mariadb</url>
</references>
<dates>
<discovery>2022-05-20</discovery>
<entry>2022-05-23</entry>
</dates>
</vuln>
<vuln vid="b2407db1-d79f-11ec-a15f-589cfc0f81b0">
<topic>clamav -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.104.3,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><lt>0.103.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ClamAV project reports:</p>
<blockquote cite="https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html">
<p>Fixed a possible double-free vulnerability in the OLE2 file
parser. Issue affects versions 0.104.0 through 0.104.2. Issue
identified by OSS-Fuzz.</p>
<p>Fixed a possible infinite loop vulnerability in the CHM file
parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
version 0.103.5 and prior versions. Thank you to Michał Dardas
for reporting this issue.</p>
<p>Fixed a possible NULL-pointer dereference crash in the scan
verdict cache check. Issue affects versions 0.103.4, 0.103.5,
0.104.1, and 0.104.2. Thank you to Alexander Patrakov and
Antoine Gatineau for reporting this issue.</p>
<p>Fixed a possible infinite loop vulnerability in the TIFF file
parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
version 0.103.5 and prior versions. The issue only occurs if the
"--alert-broken-media" ClamScan option is enabled. For ClamD,
the affected option is "AlertBrokenMedia yes", and for libclamav
it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. Thank
you to Michał Dardas for reporting this issue.</p>
<p>Fixed a possible memory leak in the HTML file parser /
Javascript normalizer. Issue affects versions 0.104.0 through
0.104.2 and LTS version 0.103.5 and prior versions. Thank you to
Michał Dardas for reporting this issue.</p>
<p>Fixed a possible multi-byte heap buffer overflow write
vulnerability in the signature database load module. The fix was
to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version
0.103.5 and prior versions. Thank you to Michał Dardas for
reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-20803</cvename>
<cvename>CVE-2022-20770</cvename>
<cvename>CVE-2022-20796</cvename>
<cvename>CVE-2022-20771</cvename>
<cvename>CVE-2022-20785</cvename>
<cvename>CVE-2022-20792</cvename>
<url>https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html#more</url>
</references>
<dates>
<discovery>2022-05-04</discovery>
<entry>2022-05-19</entry>
</dates>
</vuln>
<vuln vid="a1360138-d446-11ec-8ea1-10c37b4ac2ea">
<topic>go -- syscall.Faccessat checks wrong group on Linux</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.18.2,1</lt></range>
</package>
<package>
<name>go117</name>
<range><lt>1.17.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/52313">
<p>When called with a non-zero flags parameter, the
syscall.Faccessat function could incorrectly report that a
file is accessible. This bug only occurs on Linux systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-29526</cvename>
<url>https://github.com/golang/go/issues/52313</url>
<url>https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-05-15</entry>
</dates>
</vuln>
<vuln vid="11e36890-d28c-11ec-a06f-d4c9ef517024">
<topic>curl -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.83.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The curl project reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<p>CVE-2022-27778: curl removes wrong file on error</p>
<p>CVE-2022-27779: cookie for trailing dot TLD</p>
<p>CVE-2022-27780: percent-encoded path separator in URL host</p>
<p>CVE-2022-27781: CERTINFO never-ending busy-loop</p>
<p>CVE-2022-27782: TLS and SSH connection too eager reuse</p>
<p>CVE-2022-30115: HSTS bypass via trailing dot</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-27778</cvename>
<cvename>CVE-2022-27779</cvename>
<cvename>CVE-2022-27780</cvename>
<cvename>CVE-2022-27781</cvename>
<cvename>CVE-2022-27782</cvename>
<cvename>CVE-2022-30115</cvename>
<url>https://curl.se/docs/security.html</url>
</references>
<dates>
<discovery>2022-05-11</discovery>
<entry>2022-05-13</entry>
</dates>
</vuln>
<vuln vid="157ce083-d145-11ec-ab9b-6cc21735f730">
<topic>PostgreSQL Server -- execute arbitrary SQL code as DBA user</topic>
<affects>
<package>
<name>postgresql14-server</name>
<range><lt>14.3</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.7</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.16</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote>
<p>
Confine additional operations within "security restricted
operation" sandboxes.
</p>
<p>
Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW,
and pg_amcheck activated the "security restricted operation" protection
mechanism too late, or even not at all in some code paths.
A user having permission to create non-temporary objects within a
database could define an object that would execute arbitrary SQL
code with superuser permissions the next time that autovacuum
processed the object, or that some superuser ran one of the affected
commands against it.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1552</cvename>
</references>
<dates>
<discovery>2022-05-11</discovery>
<entry>2022-05-11</entry>
</dates>
</vuln>
<vuln vid="ac91cf5e-d098-11ec-bead-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>101.0.4951.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html">
<p>This release contains 13 security fixes, including:</p>
<ul>
<li>[1316990] High CVE-2022-1633: Use after free in Sharesheet. Reported by Khalil Zhani on 2022-04-18</li>
<li>[1314908] High CVE-2022-1634: Use after free in Browser UI. Reported by Khalil Zhani on 2022-04-09</li>
<li>[1319797] High CVE-2022-1635: Use after free in Permission Prompts. Reported by Anonymous on 2022-04-26</li>
<li>[1297283] High CVE-2022-1636: Use after free in Performance APIs. Reported by Seth Brenith, Microsoft on 2022-02-15</li>
<li>[1311820] High CVE-2022-1637: Inappropriate implementation in Web Contents. Reported by Alesandro Ortiz on 2022-03-31</li>
<li>[1316946] High CVE-2022-1638: Heap buffer overflow in V8 Internationalization. Reported by DoHyun Lee (@l33d0hyun) of DNSLab, Korea University on 2022-04-17</li>
<li>[1317650] High CVE-2022-1639: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-04-19</li>
<li>[1320592] High CVE-2022-1640: Use after free in Sharing. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-28</li>
<li>[1305068] Medium CVE-2022-1641: Use after free in Web UI Diagnostics. Reported by Rong Jian of VRI on 2022-03-10</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1633</cvename>
<cvename>CVE-2022-1634</cvename>
<cvename>CVE-2022-1635</cvename>
<cvename>CVE-2022-1636</cvename>
<cvename>CVE-2022-1637</cvename>
<cvename>CVE-2022-1638</cvename>
<cvename>CVE-2022-1639</cvename>
<cvename>CVE-2022-1640</cvename>
<cvename>CVE-2022-1641</cvename>
<url>https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html</url>
</references>
<dates>
<discovery>2022-05-10</discovery>
<entry>2022-05-10</entry>
</dates>
</vuln>
<vuln vid="b9837fa1-cd72-11ec-98f1-6805ca0b3d42">
<topic>rsyslog8 -- heap buffer overflow on receiving TCP syslog</topic>
<affects>
<package>
<name>rsyslog</name>
<range><lt>8.2204.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rainer Gerhards reports:</p>
<blockquote cite="https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8">
<p>Modules for TCP syslog reception have a heap buffer
overflow when octet-counted framing is used. The attacker
can corrupt heap values, leading to data integrity issues
and availability impact. Remote code execution is unlikely
to happen but not impossible..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24903</cvename>
<url>https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8</url>
</references>
<dates>
<discovery>2022-05-05</discovery>
<entry>2022-05-06</entry>
</dates>
</vuln>
<vuln vid="647ac600-cc70-11ec-9cfc-10c37b4ac2ea">
<topic>gogs -- XSS in issue attachments</topic>
<affects>
<package>
<name>gogs</name>
<range><lt>0.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The gogs project reports:</p>
<blockquote cite="https://github.com/gogs/gogs/issues/6919">
<p>Repository issues page allows HTML attachments with arbitrary
JS code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1464</cvename>
<url>https://github.com/gogs/gogs/issues/6919</url>
<url>https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-05-05</entry>
</dates>
</vuln>
<vuln vid="95ee401d-cc6a-11ec-9cfc-10c37b4ac2ea">
<topic>gitea -- Escape git fetch remote</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.16.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/pull/19487">
<p>Escape git fetch remote in
services/migrations/gitea_uploader.go</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/19487</url>
</references>
<dates>
<discovery>2022-04-25</discovery>
<entry>2022-05-05</entry>
</dates>
</vuln>
<vuln vid="fceb2b08-cb76-11ec-a06f-d4c9ef517024">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1o,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.3</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20220503.txt">
<ul>
<li>The c_rehash script allows command injection (CVE-2022-1292)
(Moderate) <br/>The c_rehash script does not properly sanitise shell
metacharacters to prevent command injection. This script is distributed
by some operating systems in a manner where it is automatically
executed. On such operating systems, an attacker could execute arbitrary
commands with the privileges of the script.</li>
<li>OCSP_basic_verify may incorrectly verify the response signing
certificate (CVE-2022-1343) (Moderate)<br/>The function
`OCSP_basic_verify` verifies the signer certificate on an OCSP response.
In the case where the (non-default) flag OCSP_NOCHECKS is used then the
response will be positive (meaning a successful verification) even in
the case where the response signing certificate fails to verify.</li>
<li>Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
(Low)<br/>The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly uses the AAD data as the MAC key. This makes the MAC key
trivially predictable.</li>
<li>Resource leakage when decoding certificates and keys (CVE-2022-1473)
(Low)<br/>The OPENSSL_LH_flush() function, which empties a hash table,
containsa bug that breaks reuse of the memory occuppied by the removed
hash table entries.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1292</cvename>
<cvename>CVE-2022-1343</cvename>
<cvename>CVE-2022-1434</cvename>
<cvename>CVE-2022-1473</cvename>
<url>https://www.openssl.org/news/secadv/20220503.txt</url>
</references>
<dates>
<discovery>2022-05-03</discovery>
<entry>2022-05-04</entry>
<modified>2022-05-05</modified>
</dates>
</vuln>
<vuln vid="a8118db0-cac2-11ec-9288-0800270512f4">
<topic>rainloop -- cross-site-scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>rainloop-php74</name>
<name>rainloop-php80</name>
<name>rainloop-php81</name>
<name>rainloop-community-php74</name>
<name>rainloop-community-php80</name>
<name>rainloop-community-php81</name>
<range><lt>1.16.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Scannell reports:</p>
<blockquote cite="https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw">
<p>
The code vulnerability can be easily exploited by an
attacker by sending a malicious email to a victim that
uses RainLoop as a mail client. When the email is viewed
by the victim, the attacker gains full control over the
session of the victim and can steal any of their emails,
including those that contain highly sensitive information
such as passwords, documents, and password reset links.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-29360</cvename>
<url>https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw</url>
<url>https://github.com/RainLoop/rainloop-webmail/issues/2142</url>
</references>
<dates>
<discovery>2022-04-19</discovery>
<entry>2022-05-03</entry>
</dates>
</vuln>
<vuln vid="61bce714-ca0c-11ec-9cfc-10c37b4ac2ea">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.18.1,1</lt></range>
</package>
<package>
<name>go117</name>
<range><lt>1.17.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/51853">
<p>encoding/pem: fix stack overflow in Decode.</p>
<p>A large (more than 5 MB) PEM input can cause a stack
overflow in Decode, leading the program to crash.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/52075">
<p>crypto/elliptic: tolerate all oversized scalars in generic
P-256.</p>
<p>A crafted scalar input longer than 32 bytes can
cause P256().ScalarMult or P256().ScalarBaseMult to panic.
Indirect uses through crypto/ecdsa and crypto/tls are
unaffected. amd64, arm64, ppc64le, and s390x are
unaffected.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/51759">
<p>crypto/x509: non-compliant certificates can cause a panic
in Verify on macOS in Go 1.18.</p>
<p>Verifying certificate chains containing certificates
which are not compliant with RFC 5280 causes
Certificate.Verify to panic on macOS. These chains can be
delivered through TLS and can cause a crypto/tls or
net/http client to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24675</cvename>
<url>https://github.com/golang/go/issues/51853</url>
<cvename>CVE-2022-28327</cvename>
<url>https://github.com/golang/go/issues/52075</url>
<cvename>CVE-2022-27536</cvename>
<url>https://github.com/golang/go/issues/51759</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-05-02</entry>
</dates>
</vuln>
<vuln vid="9db93f3d-c725-11ec-9618-000d3ac47524">
<topic>Rails -- XSS vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack52</name>
<range><lt>5.2.7.1</lt></range>
</package>
<package>
<name>rubygem-actionpack60</name>
<range><lt>6.0.4.8</lt></range>
</package>
<package>
<name>rubygem-actionpack61</name>
<range><lt>6.1.5.1</lt></range>
</package>
<package>
<name>rubygem-actionpack70</name>
<range><lt>7.0.2.4</lt></range>
</package>
<package>
<name>rubygem-actionview52</name>
<range><lt>5.2.7.1</lt></range>
</package>
<package>
<name>rubygem-actionview60</name>
<range><lt>6.0.4.8</lt></range>
</package>
<package>
<name>rubygem-actionview61</name>
<range><lt>6.1.5.1</lt></range>
</package>
<package>
<name>rubygem-actionview70</name>
<range><lt>7.0.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released">
<p>This is an announcement to let you know that Rails 7.0.2.4, 6.1.5.1,
6.0.4.8, and 5.2.7.1 have been released!</p>
<p>These are security releases so please update as soon as you can. Once
again we've made these releases based on the last release tag, so
hopefully upgrading will go smoothly.</p>
<p>The releases address two vulnerabilities, CVE-2022-22577, and
CVS-2022-27777. They are both XSS vulnerabilities, so please take a look
at the forum posts to see how (or if) they might possibly impact your
application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-22577</cvename>
<cvename>CVE-2022-27777</cvename>
<url>https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released</url>
</references>
<dates>
<discovery>2022-04-26</discovery>
<entry>2022-04-30</entry>
</dates>
</vuln>
<vuln vid="2220827b-c732-11ec-b272-901b0e934d69">
<topic>hiredis -- integer/buffer overflow</topic>
<affects>
<package>
<name>hiredis</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>hiredis maintainers report:</p>
<blockquote cite="https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2">
<p>
Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data.
When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32765</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32765</url>
<url>https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2</url>
</references>
<dates>
<discovery>2021-10-04</discovery>
<entry>2022-04-29</entry>
</dates>
</vuln>
<vuln vid="92a4d881-c6cf-11ec-a06f-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.83.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.se/docs/vuln-7.82.0.html">
<ul>
<li>OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)</li>
<li>Credential leak on redirect (CVE-2022-27774)</li>
<li>Bad local IPv6 connection reuse (CVE-2022-27775)</li>
<li>Auth/cookie leak on redirect (CVE-2022-27776)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-22576</cvename>
<cvename>CVE-2022-27774</cvename>
<cvename>CVE-2022-27775</cvename>
<cvename>CVE-2022-27776</cvename>
<url>https://curl.se/docs/vuln-7.82.0.html</url>
</references>
<dates>
<discovery>2022-04-27</discovery>
<entry>2022-04-28</entry>
</dates>
</vuln>
<vuln vid="26f2123b-c6c6-11ec-b66f-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>101.0.4951.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html">
<p>This release contains 30 security fixes, including:</p>
<ul>
<li>[1313905] High CVE-2022-1477: Use after free in Vulkan. Reported by SeongHwan Park (SeHwa) on 2022-04-06</li>
<li>[1299261] High CVE-2022-1478: Use after free in SwiftShader. Reported by SeongHwan Park (SeHwa) on 2022-02-20</li>
<li>[1305190] High CVE-2022-1479: Use after free in ANGLE. Reported by Jeonghoon Shin of Theori on 2022-03-10</li>
<li>[1307223] High CVE-2022-1480: Use after free in Device API. Reported by @uwu7586 on 2022-03-17</li>
<li>[1302949] High CVE-2022-1481: Use after free in Sharing. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-03-04</li>
<li>[1304987] High CVE-2022-1482: Inappropriate implementation in WebGL. Reported by Christoph Diehl, Microsoft on 2022-03-10</li>
<li>[1314754] High CVE-2022-1483: Heap buffer overflow in WebGPU. Reported by Mark Brand of Google Project Zero on 2022-04-08</li>
<li>[1297429] Medium CVE-2022-1484: Heap buffer overflow in Web UI Settings. Reported by Chaoyuan Peng (@ret2happy) on 2022-02-15</li>
<li>[1299743] Medium CVE-2022-1485: Use after free in File System API. Reported by Anonymous on 2022-02-22</li>
<li>[1314616] Medium CVE-2022-1486: Type Confusion in V8. Reported by Brendon Tiszka on 2022-04-08</li>
<li>[1304368] Medium CVE-2022-1487: Use after free in Ozone. Reported by Sri on 2022-03-09</li>
<li>[1302959] Medium CVE-2022-1488: Inappropriate implementation in Extensions API. Reported by Thomas Beverley from Wavebox.io on 2022-03-04</li>
<li>[1300561] Medium CVE-2022-1489: Out of bounds memory access in UI Shelf. Reported by Khalil Zhani on 2022-02-25</li>
<li>[1301840] Medium CVE-2022-1490: Use after free in Browser Switcher. Reported by raven at KunLun lab on 2022-03-01</li>
<li>[1305706] Medium CVE-2022-1491: Use after free in Bookmarks. Reported by raven at KunLun lab on 2022-03-12</li>
<li>[1315040] Medium CVE-2022-1492: Insufficient data validation in Blink Editing. Reported by Michal Bentkowski of Securitum on 2022-04-11</li>
<li>[1275414] Medium CVE-2022-1493: Use after free in Dev Tools. Reported by Zhihua Yao of KunLun Lab on 2021-12-01</li>
<li>[1298122] Medium CVE-2022-1494: Insufficient data validation in Trusted Types. Reported by Masato Kinugawa on 2022-02-17</li>
<li>[1301180] Medium CVE-2022-1495: Incorrect security UI in Downloads. Reported by Umar Farooq on 2022-02-28</li>
<li>[1306391] Medium CVE-2022-1496: Use after free in File Manager. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2022-03-15</li>
<li>[1264543] Medium CVE-2022-1497: Inappropriate implementation in Input. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-10-29</li>
<li>[1297138] Low CVE-2022-1498: Inappropriate implementation in HTML Parser. Reported by SeungJu Oh (@real_as3617) on 2022-02-14</li>
<li>[1000408] Low CVE-2022-1499: Inappropriate implementation in WebAuthentication. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-09-04</li>
<li>[1223475] Low CVE-2022-1500: Insufficient data validation in Dev Tools. Reported by Hoang Nguyen on 2021-06-25</li>
<li>[1293191] Low CVE-2022-1501: Inappropriate implementation in iframe. Reported by Oriol Brufau on 2022-02-02</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1477</cvename>
<cvename>CVE-2022-1478</cvename>
<cvename>CVE-2022-1479</cvename>
<cvename>CVE-2022-1480</cvename>
<cvename>CVE-2022-1481</cvename>
<cvename>CVE-2022-1482</cvename>
<cvename>CVE-2022-1483</cvename>
<cvename>CVE-2022-1484</cvename>
<cvename>CVE-2022-1485</cvename>
<cvename>CVE-2022-1486</cvename>
<cvename>CVE-2022-1487</cvename>
<cvename>CVE-2022-1488</cvename>
<cvename>CVE-2022-1489</cvename>
<cvename>CVE-2022-1490</cvename>
<cvename>CVE-2022-1491</cvename>
<cvename>CVE-2022-1492</cvename>
<cvename>CVE-2022-1493</cvename>
<cvename>CVE-2022-1494</cvename>
<cvename>CVE-2022-1495</cvename>
<cvename>CVE-2022-1496</cvename>
<cvename>CVE-2022-1497</cvename>
<cvename>CVE-2022-1498</cvename>
<cvename>CVE-2022-1499</cvename>
<cvename>CVE-2022-1500</cvename>
<cvename>CVE-2022-1501</cvename>
<url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2022-04-26</discovery>
<entry>2022-04-28</entry>
</dates>
</vuln>
<vuln vid="cc42db1c-c65f-11ec-ad96-0800270512f4">
<topic>redis -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>redis</name>
<range><lt>6.2.7</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>7.0.0.20220428</lt></range>
</package>
<package>
<name>redis62</name>
<range><lt>6.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aviv Yahav reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/7iWUlwtoDqU">
<dl>
<dt>CVE-2022-24735</dt>
<dd>
By exploiting weaknesses in the Lua script execution
environment, an attacker with access to Redis can inject
Lua code that will execute with the (potentially higher)
privileges of another Redis user.
</dd>
<dt>CVE-2022-24736</dt>
<dd>
An attacker attempting to load a specially crafted Lua
script can cause NULL pointer dereference which will
result with a crash of the redis-server process.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24735</cvename>
<cvename>CVE-2022-24736</cvename>
<url>https://groups.google.com/g/redis-db/c/7iWUlwtoDqU</url>
</references>
<dates>
<discovery>2022-04-27</discovery>
<entry>2022-04-27</entry>
</dates>
</vuln>
<vuln vid="17a30a24-c579-11ec-bbbd-0800270512f4">
<topic>eb -- Potential buffer overrun vulnerability</topic>
<affects>
<package>
<name>ja-eb</name>
<range><lt>4.4.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazuhiro Ito reports:</p>
<blockquote cite="mailto:edict@ring.gr.jp">
<p>Potential buffer overrun vulnerability is found in eb/multiplex.c.</p>
</blockquote>
</body>
</description>
<references>
<url>mailto:edict@ring.gr.jp</url>
</references>
<dates>
<discovery>2022-04-25</discovery>
<entry>2022-04-26</entry>
</dates>
</vuln>
<vuln vid="a00c76d9-0c05-4d99-bef7-ae4521cb2a4d">
<topic>zeek -- potential DoS vulnerabilty</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.6">
<p> Fix potential unbounded state growth in the FTP
analyzer when receiving a specially-crafted stream of
commands. This may lead to a buffer overflow and cause
Zeek to crash. Due to the possibility of this happening
with packets received from the network, this is a potential
DoS vulnerabilty. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.6</url>
</references>
<dates>
<discovery>2022-04-21</discovery>
<entry>2022-04-21</entry>
</dates>
</vuln>
<vuln vid="b019585a-bfea-11ec-b46c-b42e991fc52e">
<topic>zgrep -- arbitrary file write</topic>
<affects>
<package>
<name>gzip</name>
<range><lt>1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/cve-2022-1271">
<p>An arbitrary file write vulnerability was found in GNU
gzip's zgrep utility. When zgrep is applied on the
attacker's chosen file name (for example, a crafted
file name), this can overwrite an attacker's content
to an arbitrary attacker-selected file. This flaw
occurs due to insufficient validation when processing
filenames with two or more newlines where selected
content and the target file names are embedded in
crafted multi-line file names. This flaw allows a
remote, low privileged attacker to force zgrep to
write arbitrary files on the system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1271</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=2073310</url>
</references>
<dates>
<discovery>2022-04-07</discovery>
<entry>2022-04-19</entry>
</dates>
</vuln>
<vuln vid="2a314635-be46-11ec-a06f-d4c9ef517024">
<topic>Nextcloud Calendar -- SMTP Command Injection</topic>
<affects>
<package>
<name>nextcloud-calendar</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf">
<p>SMTP Command Injection in Appointment Emails via Newlines: as newlines
and special characters are not sanitized in the email value in the JSON
request, a malicious attacker can inject newlines to break out of the
`RCPT TO:<BOOKING USER'S EMAIL>` SMTP command and begin injecting
arbitrary SMTP commands.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24838</cvename>
<url>https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf</url>
</references>
<dates>
<discovery>2022-04-11</discovery>
<entry>2022-04-17</entry>
</dates>
</vuln>
<vuln vid="add683be-bd76-11ec-a06f-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-server</name>
<range><lt>5.7.38</lt></range>
</package>
<package>
<name>mysql80-client</name>
<range><lt>8.0.29</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2022.html">
<p>The 2022 April Critical Patch Update contains 43 new security
patches for Oracle MySQL. 11 of these vulnerabilities may be
remotely exploitable without authentication, i.e., may be
exploited over a network without requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuapr2022.html</url>
<cvename>CVE-2022-0778</cvename>
<cvename>CVE-2021-22570</cvename>
<cvename>CVE-2022-0778</cvename>
<cvename>CVE-2022-21454</cvename>
<cvename>CVE-2022-21482</cvename>
<cvename>CVE-2022-21483</cvename>
<cvename>CVE-2022-21489</cvename>
<cvename>CVE-2022-21490</cvename>
<cvename>CVE-2022-21457</cvename>
<cvename>CVE-2022-21425</cvename>
<cvename>CVE-2022-21440</cvename>
<cvename>CVE-2022-21459</cvename>
<cvename>CVE-2022-21478</cvename>
<cvename>CVE-2022-21479</cvename>
<cvename>CVE-2022-21418</cvename>
<cvename>CVE-2022-21417</cvename>
<cvename>CVE-2022-21413</cvename>
<cvename>CVE-2022-21427</cvename>
<cvename>CVE-2022-21412</cvename>
<cvename>CVE-2022-21414</cvename>
<cvename>CVE-2022-21435</cvename>
<cvename>CVE-2022-21436</cvename>
<cvename>CVE-2022-21437</cvename>
<cvename>CVE-2022-21438</cvename>
<cvename>CVE-2022-21452</cvename>
<cvename>CVE-2022-21462</cvename>
<cvename>CVE-2022-21415</cvename>
<cvename>CVE-2022-21451</cvename>
<cvename>CVE-2022-21444</cvename>
<cvename>CVE-2022-21460</cvename>
<cvename>CVE-2022-21484</cvename>
<cvename>CVE-2022-21485</cvename>
<cvename>CVE-2022-21486</cvename>
<cvename>CVE-2022-21423</cvename>
</references>
<dates>
<discovery>2022-04-16</discovery>
<entry>2022-04-16</entry>
<modified>2022-05-23</modified>
</dates>
</vuln>
<vuln vid="a25ea27b-bced-11ec-87b5-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>100.0.4896.127</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html">
<p>This release contains 2 security fixes, including:</p>
<ul>
<li>[1315901] High CVE-2022-1364: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2022-0-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1364</cvename>
<url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2022-04-14</discovery>
<entry>2022-04-15</entry>
</dates>
</vuln>
<vuln vid="a5de43ed-bc49-11ec-b516-0897988a1c07">
<topic>Asterisk -- func_odbc: Possible SQL Injection</topic>
<affects>
<package>
<name>asterisk16</name>
<range><lt>16.25.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
<p>Some databases can use backslashes to escape certain
characters, such as backticks. If input is provided to
func_odbc which includes backslashes it is possible for
func_odbc to construct a broken SQL query and the SQL
query to fail.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-26651</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2022-003.html</url>
</references>
<dates>
<discovery>2022-04-14</discovery>
<entry>2022-04-14</entry>
</dates>
</vuln>
<vuln vid="8838abf0-bc47-11ec-b516-0897988a1c07">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>16.15.0</gt><lt>16.25.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
<p>AST-2022-001 - When using STIR/SHAKEN, its possible
to download files that are not certificates. These files
could be much larger than what you would expect to
download.</p>
<p>AST-2022-002 - When using STIR/SHAKEN, its possible
to send arbitrary requests like GET to interfaces such
as localhost using the Identity header.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-26498</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2022-001.html</url>
<cvename>CVE-2022-26499</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2022-002.html</url>
</references>
<dates>
<discovery>2022-04-14</discovery>
<entry>2022-04-14</entry>
</dates>
</vuln>
<vuln vid="24a9bd2b-bb43-11ec-af81-0897988a1c07">
<topic>Composer -- Command injection vulnerability</topic>
<affects>
<package>
<name>php74-composer</name>
<name>php80-composer</name>
<name>php81-composer</name>
<range><lt>1.10.26</lt></range>
</package>
<package>
<name>php74-composer2</name>
<name>php80-composer2</name>
<name>php81-composer2</name>
<range><ge>2.0.0</ge><lt>2.2.12</lt></range>
<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Composer developers reports:</p>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6">
<p>The Composer method VcsDriver::getFileContent() with
user-controlled $file or $identifier arguments is susceptible
to an argument injection vulnerability. It can be leveraged
to gain arbitrary command execution if the Mercurial or
the Git driver are used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24828</cvename>
<url>https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6</url>
</references>
<dates>
<discovery>2022-04-13</discovery>
<entry>2022-04-13</entry>
</dates>
</vuln>
<vuln vid="3a1dc8c8-bb27-11ec-98d1-d43d7eed0ce2">
<topic>Subversion -- Multiple vulnerabilities in server code</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
<range><ge>1.11.0</ge><lt>1.14.2</lt></range>
</package>
<package>
<name>mod_dav_svn</name>
<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
<range><ge>1.11.0</ge><lt>1.14.2</lt></range>
</package>
<package>
<name>subversion-lts</name>
<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
</package>
<package>
<name>mod_dav_svn-lts</name>
<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="https://subversion.apache.org/security/CVE-2021-28544-advisory.txt">
<p>
Subversion servers reveal 'copyfrom' paths that should be hidden according
to configured path-based authorization (authz) rules. When a node has been
copied from a protected location, users with access to the copy can see the
'copyfrom' path of the original. This also reveals the fact that the node
was copied. Only the 'copyfrom' path is revealed; not its contents. Both
httpd and svnserve servers are vulnerable.
</p>
</blockquote>
<blockquote cite="https://subversion.apache.org/security/CVE-2022-24070-advisory.txt">
<p>
While looking up path-based authorization rules, mod_dav_svn servers
may attempt to use memory which has already been freed.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-28544</cvename>
<cvename>CVE-2022-24070</cvename>
<url>https://subversion.apache.org/security/CVE-2021-28544-advisory.txt</url>
<url>https://subversion.apache.org/security/CVE-2022-24070-advisory.txt</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-04-13</entry>
</dates>
</vuln>
<vuln vid="06ed6a49-bad4-11ec-9cfe-0800270512f4">
<topic>Ruby -- Buffer overrun in String-to-Float conversion</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.7.0,1</ge><lt>2.7.6,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.6,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>piao reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/">
<p>
Due to a bug in an internal function that converts a String
to a Float, some convertion methods like <code>Kernel#Float</code>
and <code>String#to_f</code> could cause buffer over-read.
A typical consequence is a process termination due to
segmentation fault, but in a limited circumstances, it may
be exploitable for illegal memory read.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-28739</cvename>
<url>https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-04-13</entry>
</dates>
</vuln>
<vuln vid="f22144d7-bad1-11ec-9cfe-0800270512f4">
<topic>Ruby -- Double free in Regexp compilation</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
</package>
<package>
<name>ruby31</name>
<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
</package>
<package>
<name>ruby32</name>
<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>piao reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/">
<p>
Due to a bug in the Regexp compilation process, creating
a Regexp object with a crafted source string could cause
the same memory to be freed twice. This is known as a
"double free" vulnerability. Note that, in general, it
is considered unsafe to create and use a Regexp object
generated from untrusted input. In this case, however,
following a comprehensive assessment, we treat this issue
as a vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-28738</cvename>
<url>https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/</url>
</references>
<dates>
<discovery>2022-04-12</discovery>
<entry>2022-04-13</entry>
</dates>
</vuln>
<vuln vid="6eb9cf14-bab0-11ec-8f59-4437e6ad11c4">
<topic>mutt -- mutt_decode_uuencoded() can read past the of the input line</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy reports:</p>
<blockquote cite="https://gitlab.com/muttmua/mutt/-/issues/404">
<p>mutt_decode_uuencoded(), the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in message parts, for example fragments of other messages, passphrases or keys in replys</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1328</cvename>
<url>https://gitlab.com/muttmua/mutt/-/issues/404</url>
</references>
<dates>
<discovery>2022-04-04</discovery>
<entry>2022-04-12</entry>
</dates>
</vuln>
<vuln vid="b582a85a-ba4a-11ec-8d1e-3065ec8fd3ec">
<topic>Chromium -- mulitple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>100.0.4896.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html">
<p>This release contains 11 security fixes, including:</p>
<ul>
<li>[1285234] High CVE-2022-1305: Use after free in storage. Reported by Anonymous on 2022-01-07</li>
<li>[1299287] High CVE-2022-1306: Inappropriate implementation in compositing. Reported by Sven Dysthe on 2022-02-21</li>
<li>[1301873] High CVE-2022-1307: Inappropriate implementation in full screen. Reported by Irvan Kurniawan (sourc7) on 2022-03-01</li>
<li>[1283050] High CVE-2022-1308: Use after free in BFCache. Reported by Samet Bekmezci (@sametbekmezci) on 2021-12-28</li>
<li>[1106456] High CVE-2022-1309: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-07-17</li>
<li>[1307610] High CVE-2022-1310: Use after free in regular expressions. Reported by Brendon Tiszka on 2022-03-18</li>
<li>[1310717] High CVE-2022-1311: Use after free in Chrome OS shell. Reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-03-28</li>
<li>[1311701] High CVE-2022-1312: Use after free in storage. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2022-03-30</li>
<li>[1270539] Medium CVE-2022-1313: Use after free in tab groups. Reported by Thomas Orlita on 2021-11-16</li>
<li>[1304658] Medium CVE-2022-1314: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-03-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1305</cvename>
<cvename>CVE-2022-1306</cvename>
<cvename>CVE-2022-1307</cvename>
<cvename>CVE-2022-1308</cvename>
<cvename>CVE-2022-1309</cvename>
<cvename>CVE-2022-1310</cvename>
<cvename>CVE-2022-1311</cvename>
<cvename>CVE-2022-1312</cvename>
<cvename>CVE-2022-1313</cvename>
<cvename>CVE-2022-1314</cvename>
<url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html</url>
</references>
<dates>
<discovery>2022-04-11</discovery>
<entry>2022-04-12</entry>
</dates>
</vuln>
<vuln vid="0db46f84-b9fa-11ec-89df-080027240888">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django22</name>
<name>py38-django22</name>
<name>py39-django22</name>
<name>py310-django22</name>
<range><lt>2.2.28</lt></range>
</package>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<name>py310-django32</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>py38-django40</name>
<name>py39-django40</name>
<name>py310-django40</name>
<range><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2022/apr/11/security-releases/">
<p>CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra().</p>
<p>CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-28346</cvename>
<cvename>CVE-2022-28347</cvename>
<url>https://www.djangoproject.com/weblog/2022/apr/11/security-releases/</url>
</references>
<dates>
<discovery>2022-04-02</discovery>
<entry>2022-04-12</entry>
</dates>
</vuln>
<vuln vid="38f2e3a0-b61e-11ec-9ebc-1c697aa5a594">
<topic>FreeBSD -- zlib compression out-of-bounds write</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_11</lt></range>
<range><ge>12.3</ge><lt>12.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Certain inputs can cause zlib's compression routine to overwrite an
internal buffer with compressed data. This issue may require the use
of uncommon or non-default compression parameters.</p>
<h1>Impact:</h1>
<p>The out-of-bounds write may result in memory corruption and an
application crash or kernel panic.</p>
</body>
</description>
<references>
<cvename>CVE-2018-25032</cvename>
<freebsdsa>SA-22:08.zlib</freebsdsa>
</references>
<dates>
<discovery>2022-04-06</discovery>
<entry>2022-04-07</entry>
</dates>
</vuln>
<vuln vid="d4cc994f-b61d-11ec-9ebc-1c697aa5a594">
<topic>FreeBSD -- 802.11 heap buffer overflow</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_11</lt></range>
<range><ge>12.3</ge><lt>12.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The 802.11 beacon handling routine failed to validate the length of
an IEEE 802.11s Mesh ID before copying it to a heap-allocated
buffer.</p>
<h1>Impact:</h1>
<p>While a FreeBSD Wi-Fi client is in scanning mode (i.e., not
associated with a SSID) a malicious beacon frame may overwrite kernel
memory, leading to remote code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23088</cvename>
<freebsdsa>SA-22:07.wifi_meshid</freebsdsa>
</references>
<dates>
<discovery>2022-04-06</discovery>
<entry>2022-04-07</entry>
</dates>
</vuln>
<vuln vid="703c4761-b61d-11ec-9ebc-1c697aa5a594">
<topic>FreeBSD -- mpr/mps/mpt driver ioctl heap out-of-bounds write</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_11</lt></range>
<range><ge>12.3</ge><lt>12.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and
mpt drivers allocated a buffer of a caller-specified size, but
copied to it a fixed size header. Other heap content would be
overwritten if the specified size was too small.</p>
<h1>Impact:</h1>
<p>Users with access to the mpr, mps or mpt device node may overwrite
heap data, potentially resulting in privilege escalation. Note that
the device node is only accessible to root and members of the operator
group.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23086</cvename>
<freebsdsa>SA-22:06.ioctl</freebsdsa>
</references>
<dates>
<discovery>2022-04-06</discovery>
<entry>2022-04-07</entry>
</dates>
</vuln>
<vuln vid="ba796b98-b61c-11ec-9ebc-1c697aa5a594">
<topic>FreeBSD -- Bhyve e82545 device emulation out-of-bounds write</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_11</lt></range>
<range><ge>12.3</ge><lt>12.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The e1000 network adapters permit a variety of modifications to an
Ethernet packet when it is being transmitted. These include the
insertion of IP and TCP checksums, insertion of an Ethernet VLAN
header, and TCP segmentation offload ("TSO"). The e1000 device model
uses an on-stack buffer to generate the modified packet header when
simulating these modifications on transmitted packets.</p>
<p>When checksum offload is requested for a transmitted packet, the
e1000 device model used a guest-provided value to specify the checksum
offset in the on-stack buffer. The offset was not validated for
certain packet types.</p>
<h1>Impact:</h1>
<p>A misbehaving bhyve guest could overwrite memory in the bhyve
process on the host, possibly leading to code execution in the host
context.</p>
<p>The bhyve process runs in a Capsicum sandbox, which (depending on
the FreeBSD version and bhyve configuration) limits the impact of
exploiting this issue.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23087</cvename>
<freebsdsa>SA-22:05.bhyve</freebsdsa>
</references>
<dates>
<discovery>2022-04-06</discovery>
<entry>2022-04-07</entry>
</dates>
</vuln>
<vuln vid="27d39055-b61b-11ec-9ebc-1c697aa5a594">
<topic>FreeBSD -- Potential jail escape vulnerabilities in netmap</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_11</lt></range>
<range><ge>12.3</ge><lt>12.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The total size of the user-provided nmreq to nmreq_copyin() was
first computed and then trusted during the copyin. This
time-of-check to time-of-use bug could lead to kernel memory
corruption. [CVE-2022-23084]</p>
<p>A user-provided integer option was passed to nmreq_copyin() without
checking if it would overflow. This insufficient bounds checking
could lead to kernel memory corruption. [CVE-2022-23085]</p>
<h1>Impact:</h1>
<p>On systems configured to include netmap in their devfs_ruleset, a
privileged process running in a jail can affect the host
environment.</p>
</body>
</description>
<references>
<cvename>CVE-2022-23084</cvename>
<cvename>CVE-2022-23085</cvename>
<freebsdsa>SA-22:04.netmap</freebsdsa>
</references>
<dates>
<discovery>2022-04-06</discovery>
<entry>2022-04-07</entry>
</dates>
</vuln>
<vuln vid="fe15f30a-b4c9-11ec-94a3-3065ec8fd3ec">
<topic>chromium -- Type confusion in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>100.0.4896.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html">
<p>This release includes one security fix:</p>
<ul>
<li>[1311641] High CVE-2022-1232: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2022-03-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1232</cvename>
<url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-04-04</discovery>
<entry>2022-04-05</entry>
</dates>
</vuln>
<vuln vid="8657eedd-b423-11ec-9559-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.9.0</ge><lt>14.9.2</lt></range>
<range><ge>14.8.0</ge><lt>14.8.5</lt></range>
<range><ge>0</ge><lt>14.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/">
<p>Static passwords inadvertently set during OmniAuth-based registration</p>
<p>Stored XSS in notes</p>
<p>Stored XSS on Multi-word milestone reference</p>
<p>Denial of service caused by a specially crafted RDoc file</p>
<p>GitLab Pages access tokens can be reused on multiple domains</p>
<p>GitLab Pages uses default (disabled) server Timeouts and a weak TCP Keep-Alive timeout</p>
<p>Incorrect include in pipeline definition exposes masked CI variables in UI</p>
<p>Regular expression denial of service in release asset link</p>
<p>Latest Commit details from private projects leaked to guest users via Merge Requests</p>
<p>CI/CD analytics are available even when public pipelines are disabled</p>
<p>Absence of limit for the number of tags that can be added to a runner can cause performance issues</p>
<p>Client DoS through rendering crafted comments</p>
<p>Blind SSRF Through Repository Mirroring</p>
<p>Bypass of branch restriction in Asana integration</p>
<p>Readable approval rules by Guest user</p>
<p>Redact InvalidURIError error messages</p>
<p>Project import maps members' created_by_id users based on source user ID</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1162</cvename>
<cvename>CVE-2022-1175</cvename>
<cvename>CVE-2022-1190</cvename>
<cvename>CVE-2022-1185</cvename>
<cvename>CVE-2022-1148</cvename>
<cvename>CVE-2022-1121</cvename>
<cvename>CVE-2022-1120</cvename>
<cvename>CVE-2022-1100</cvename>
<cvename>CVE-2022-1193</cvename>
<cvename>CVE-2022-1105</cvename>
<cvename>CVE-2022-1099</cvename>
<cvename>CVE-2022-1174</cvename>
<cvename>CVE-2022-1188</cvename>
<cvename>CVE-2022-0740</cvename>
<cvename>CVE-2022-1189</cvename>
<cvename>CVE-2022-1157</cvename>
<cvename>CVE-2022-1111</cvename>
<url>https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/</url>
</references>
<dates>
<discovery>2022-03-31</discovery>
<entry>2022-04-04</entry>
</dates>
</vuln>
<vuln vid="79ea6066-b40e-11ec-8b93-080027b24e86">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.6</lt></range>
</package>
<package>
<name>mediawiki136</name>
<range><lt>1.36.4</lt></range>
</package>
<package>
<name>mediawiki137</name>
<range><lt>1.37.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/">
<p>(T297543, CVE-2022-28202) Messages widthheight/widthheightpage/nbytes not
escaped when used in galleries or Special:RevisionDelete.</p>
<p>(T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite
recursion loop if it points to a local interwiki.</p>
<p>(T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many
file uploads with actor as a condition can result in a DoS.</p>
<p>(T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when
a page is used on a extremely large number of other pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-28201</cvename>
<cvename>CVE-2022-28202</cvename>
<cvename>CVE-2022-28203</cvename>
<cvename>CVE-2022-28204</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/</url>
</references>
<dates>
<discovery>2021-12-12</discovery>
<entry>2022-04-04</entry>
</dates>
</vuln>
<vuln vid="3f321a5a-b33b-11ec-80c2-1bb2c6a00592">
<topic>dnsmasq -- heap use-after-free in dhcp6_no_relay</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.86_4,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.86_4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Menšík reports:</p>
<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html">
<p>Possible vulnerability [...] found in latest dnsmasq. It [was] found
with help of oss-fuzz Google project by me and short after that
independently also by Richard Johnson of Trellix Threat Labs.</p>
<p>It is affected only by DHCPv6 requests, which could be crafted to
modify already freed memory. [...] We think it might be triggered
remotely, but we do not think it could be used to execute remote
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0934</cvename>
<url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html</url>
</references>
<dates>
<discovery>2022-03-31</discovery>
<entry>2022-04-03</entry>
</dates>
</vuln>
<vuln vid="83466f76-aefe-11ec-b4b6-d05099c0c059">
<topic>gitea -- Open Redirect on login</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.16.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andrew Thornton reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1058">
<p>
When a location containing backslashes is presented, the existing
protections against open redirect are bypassed, because browsers
will convert adjacent forward and backslashes within the location
to double forward slashes.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1058</cvename>
<url>https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d/</url>
</references>
<dates>
<discovery>2022-03-23</discovery>
<entry>2022-03-29</entry>
</dates>
</vuln>
<vuln vid="0ff80f41-aefe-11ec-b4b6-d05099c0c059">
<topic>gitea -- Improper/incorrect authorization</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Youssef Rebahi-Gilbert reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0905">
<p>
When Gitea is built and configured for PAM authentication
it skips checking authorization completely. Therefore expired
accounts and accounts with expired passwords can still login.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0905</cvename>
<url>https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb</url>
</references>
<dates>
<discovery>2022-03-06</discovery>
<entry>2022-03-29</entry>
</dates>
</vuln>
<vuln vid="ab2d7f62-af9d-11ec-a0b8-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>100.0.4896.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html">
<p>This release contains 28 security fixes, including:</p>
<ul>
<li>[1292261] High CVE-2022-1125: Use after free in Portals.
Reported by Khalil Zhani on 2022-01-29</li>
<li>[1291891] High CVE-2022-1127: Use after free in QR Code
Generator. Reported by anonymous on 2022-01-28</li>
<li>[1301920] High CVE-2022-1128: Inappropriate implementation in
Web Share API. Reported by Abdel Adim (@smaury92) Oisfi of
Shielder on 2022-03-01</li>
<li>[1300253] High CVE-2022-1129: Inappropriate implementation in
Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on
2022-02-24</li>
<li>[1142269] High CVE-2022-1130: Insufficient validation of
untrusted input in WebOTP. Reported by Sergey Toshin of
Oversecurity Inc. on 2020-10-25</li>
<li>[1297404] High CVE-2022-1131: Use after free in Cast UI.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2022-02-15</li>
<li>[1303410] High CVE-2022-1132: Inappropriate implementation in
Virtual Keyboard. Reported by Andr.Ess on 2022-03-07</li>
<li>[1305776] High CVE-2022-1133: Use after free in WebRTC.
Reported by Anonymous on 2022-03-13</li>
<li>[1308360] High CVE-2022-1134: Type Confusion in V8. Reported by
Man Yue Mo of GitHub Security Lab on 2022-03-21</li>
<li>[1285601] Medium CVE-2022-1135: Use after free in Shopping Cart.
Reported by Wei Yuan of MoyunSec VLab on 2022-01-09</li>
<li>[1280205] Medium CVE-2022-1136: Use after free in Tab Strip.
Reported by Krace on 2021-12-15</li>
<li>[1289846] Medium CVE-2022-1137: Inappropriate implementation in
Extensions. Reported by Thomas Orlita on 2022-01-22</li>
<li>[1246188] Medium CVE-2022-1138: Inappropriate implementation in
Web Cursor. Reported by Alesandro Ortiz on 2021-09-03</li>
<li>[1268541] Medium CVE-2022-1139: Inappropriate implementation in
Background Fetch API. Reported by Maurice Dauer on 2021-11-10</li>
<li>[1303253] Medium CVE-2022-1141: Use after free in File Manager.
Reported by raven at KunLun lab on 2022-03-05</li>
<li>[1303613] Medium CVE-2022-1142: Heap buffer overflow in WebUI.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2022-03-07</li>
<li>[1303615] Medium CVE-2022-1143: Heap buffer overflow in WebUI.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2022-03-07</li>
<li>[1304145] Medium CVE-2022-1144: Use after free in WebUI.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2022-03-08</li>
<li>[1304545] Medium CVE-2022-1145: Use after free in Extensions.
Reported by Yakun Zhang of Baidu Security on 2022-03-09</li>
<li>[1290150] Low CVE-2022-1146: Inappropriate implementation in
Resource Timing. Reported by Sohom Datta on 2022-01-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1125</cvename>
<cvename>CVE-2022-1127</cvename>
<cvename>CVE-2022-1128</cvename>
<cvename>CVE-2022-1129</cvename>
<cvename>CVE-2022-1130</cvename>
<cvename>CVE-2022-1131</cvename>
<cvename>CVE-2022-1132</cvename>
<cvename>CVE-2022-1133</cvename>
<cvename>CVE-2022-1134</cvename>
<cvename>CVE-2022-1135</cvename>
<cvename>CVE-2022-1136</cvename>
<cvename>CVE-2022-1137</cvename>
<cvename>CVE-2022-1138</cvename>
<cvename>CVE-2022-1139</cvename>
<cvename>CVE-2022-1141</cvename>
<cvename>CVE-2022-1142</cvename>
<cvename>CVE-2022-1143</cvename>
<cvename>CVE-2022-1144</cvename>
<cvename>CVE-2022-1145</cvename>
<cvename>CVE-2022-1146</cvename>
<url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2022-03-29</discovery>
<entry>2022-03-29</entry>
</dates>
</vuln>
<vuln vid="cb84b940-add5-11ec-9bc8-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><eq>4.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://www.powerdns.com/news.html#20220325">
<p>PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-27227</cvename>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html</url>
</references>
<dates>
<discovery>2022-03-25</discovery>
<entry>2022-03-27</entry>
</dates>
</vuln>
<vuln vid="2cda5c88-add4-11ec-9bc8-6805ca2fa271">
<topic>powerdns -- denial of service</topic>
<affects>
<package>
<name>powerdns</name>
<range><eq>4.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://www.powerdns.com/news.html#20220325">
<p>PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-27227</cvename>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html</url>
</references>
<dates>
<discovery>2022-03-25</discovery>
<entry>2022-03-27</entry>
</dates>
</vuln>
<vuln vid="323f900d-ac6d-11ec-a0b8-3065ec8fd3ec">
<topic>chromium -- V8 type confusion</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>99.0.4844.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html">
<p>This release contains 1 security fix:</p>
<ul>
<li>[1309225] High CVE-2022-1096: Type Confusion in V8. Reported by
anonymous on 2022-03-23</li>
</ul>
<p>Google is aware that an exploit for CVE-2022-1096 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-1096</cvename>
<url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html</url>
</references>
<dates>
<discovery>2022-03-25</discovery>
<entry>2022-03-25</entry>
</dates>
</vuln>
<vuln vid="955f377e-7bc3-11ec-a51c-7533f219d428">
<topic>Security Vulnerability found in ExifTool</topic>
<affects>
<package>
<name>p5-Image-ExifTool</name>
<range><ge>7.44</ge><lt>12.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="https://www.debian.org/security/2021/dsa-4910">
<p>A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22204</cvename>
<url>https://www.cvedetails.com/cve/CVE-2021-22204/</url>
</references>
<dates>
<discovery>2021-01-04</discovery>
<entry>2022-03-25</entry>
</dates>
</vuln>
<vuln vid="61f416ff-aa00-11ec-b439-000d3a450398">
<topic>tcpslice -- heap-based use-after-free in extract_slice()</topic>
<affects>
<package>
<name>tcpslice</name>
<range><lt>1.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tcpdump Group reports:</p>
<blockquote cite="https://github.com/the-tcpdump-group/tcpslice/commit/030859fce9c77417de657b9bb29c0f78c2d68f4a">
<p>heap-based use-after-free in extract_slice()</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41043</cvename>
<url>https://github.com/the-tcpdump-group/tcpslice/issues/11</url>
</references>
<dates>
<discovery>2021-09-13</discovery>
<entry>2022-03-22</entry>
</dates>
</vuln>
<vuln vid="e2af876f-a7c8-11ec-9a2a-002324b2fba8">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/51112">
<p>regexp: stack exhaustion compiling deeply nested expressions</p>
<p>On 64-bit platforms, an extremely deeply nested expression can
cause regexp.Compile to cause goroutine stack exhaustion, forcing
the program to exit. Note this applies to very large expressions, on
the order of 2MB.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24921</cvename>
<url>https://github.com/golang/go/issues/51112</url>
</references>
<dates>
<discovery>2022-02-09</discovery>
<entry>2022-03-19</entry>
</dates>
</vuln>
<vuln vid="45a72180-a640-11ec-a08b-85298243e224">
<topic>openvpn -- Potential authentication by-pass with multiple deferred authentication plug-ins</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.5.6</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Sommerseth reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2022-0547">
<p>OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. This issue is resolved in OpenVPN 2.4.12 and v2.5.6.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0547</cvename>
<url>https://community.openvpn.net/openvpn/wiki/CVE-2022-0547</url>
<url>https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-256</url>
</references>
<dates>
<discovery>2022-03-10</discovery>
<entry>2022-03-17</entry>
</dates>
</vuln>
<vuln vid="5df757ef-a564-11ec-85fa-a0369f7f7be0">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.9.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>th_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/">
<p>This security and maintenance release features 1 bug fix in addition to 3 security fixes.
Because this is a security release, it is recommended that you update your sites immediately.
All versions since WordPress 3.7 have also been updated.
The security team would like to thank the following people for responsively reporting
vulnerabilities, allowing them to be fixed in this release:
-Melar Dev, for finding a Prototype Pollution Vulnerability in a jQuery dependency
-Ben Bidner of the WordPress security team, for finding a Stored Cross Site Scripting Vulnerability
-Researchers from Johns Hopkins University, for finding a Prototype Pollution Vulnerability in the block editor</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/</url>
</references>
<dates>
<discovery>2022-03-11</discovery>
<entry>2022-03-16</entry>
</dates>
</vuln>
<vuln vid="3ba1ca94-a563-11ec-8be6-d4c9ef517024">
<topic>Weechat -- Possible man-in-the-middle attack in TLS connection to servers</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Weechat project reports:</p>
<blockquote cite="https://weechat.org/doc/security/WSA-2022-1/">
<p>After changing the options weechat.network.gnutls_ca_system or
weechat.network.gnutls_ca_user, the TLS verification function is lost.
Consequently, any connection to a server with TLS is made without
verifying the certificate, which could lead to a man-in-the-middle
attack. Connection to IRC servers with TLS is affected, as well as any
connection a server made by a plugin or a script using the function
hook_connect.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/doc/security/WSA-2022-1/</url>
</references>
<dates>
<discovery>2022-03-13</discovery>
<entry>2022-03-16</entry>
</dates>
</vuln>
<vuln vid="ea05c456-a4fd-11ec-90de-1c697aa5a594">
<topic>OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1n,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.2</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.2</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>3.4.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_8</lt></range>
<range><ge>12.3</ge><lt>12.3_3</lt></range>
<range><ge>12.2</ge><lt>12.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20220315.txt">
<p>Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(High)</p>
<p>The BN_mod_sqrt() function, which computes a modular square root,
contains a bug that can cause it to loop forever for non-prime
moduli.</p>
<p>Internally this function is used when parsing certificates that
contain elliptic curve public keys in compressed form or explicit
elliptic curve parameters with a base point encoded in compressed
form.</p>
<p>It is possible to trigger the infinite loop by crafting a
certificate that has invalid explicit curve parameters.</p>
<p>Since certificate parsing happens prior to verification of the
certificate signature, any process that parses an externally
supplied certificate may thus be subject to a denial of service
attack. The infinite loop can also be reached when parsing crafted
private keys as they can contain explicit elliptic curve
parameters.</p>
<p>Thus vulnerable situations include:</p>
<ul>
<li>TLS clients consuming server certificates</li>
<li>TLS servers consuming client certificates</li>
<li>Hosting providers taking certificates or private keys from
customers</li>
<li>Certificate authorities parsing certification requests from
subscribers</li>
<li>Anything else which parses ASN.1 elliptic curve parameters</li>
</ul>
<p>Also any other applications that use the BN_mod_sqrt() where the
attacker can control the parameter values are vulnerable to this DoS
issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0778</cvename>
<url>https://www.openssl.org/news/secadv/20220315.txt</url>
<freebsdsa>SA-22:03.openssl</freebsdsa>
</references>
<dates>
<discovery>2022-03-15</discovery>
<entry>2022-03-16</entry>
<modified>2022-03-16</modified>
</dates>
</vuln>
<vuln vid="8d20bd48-a4f3-11ec-90de-1c697aa5a594">
<topic>FreeBSD-kernel -- Multiple WiFi issues</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_8</lt></range>
<range><ge>12.3</ge><lt>12.3_3</lt></range>
<range><ge>12.2</ge><lt>12.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The paper "Fragment and Forge: Breaking Wi-Fi Through Frame
Aggregation and Fragmentation" reported a number of security
vulnerabilities in the 802.11 specification related to frame
aggregation and fragmentation.</p>
<p>Additionally, FreeBSD 12.x missed length validation of SSIDs and
Information Elements (IEs).</p>
<h1>Impact:</h1>
<p>As reported on the FragAttacks website, the "design flaws are hard
to abuse because doing so requires user interaction or is only
possible when using uncommon network settings." Under suitable
conditions an attacker may be able to extract sensitive data or inject
data.</p>
</body>
</description>
<references>
<cvename>CVE-2020-26147</cvename>
<cvename>CVE-2020-24588</cvename>
<cvename>CVE-2020-26144</cvename>
<freebsdsa>SA-22:02.wifi</freebsdsa>
</references>
<dates>
<discovery>2022-03-15</discovery>
<entry>2022-03-16</entry>
</dates>
</vuln>
<vuln vid="857be71a-a4b0-11ec-95fc-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>98.0.4844.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html">
<p>This release contains 11 security fixes, including:</p>
<ul>
<li>[1299422] Critical CVE-2022-0971: Use after free in Blink
Layout. Reported by Sergei Glazunov of Google Project Zero on
2022-02-21</li>
<li>[1301320] High CVE-2022-0972: Use after free in Extensions.
Reported by Sergei Glazunov of Google Project Zero on
2022-02-28</li>
<li>[1297498] High CVE-2022-0973: Use after free in Safe Browsing.
Reported by avaue and Buff3tts at S.S.L. on 2022-02-15</li>
<li>[1291986] High CVE-2022-0974: Use after free in Splitscreen.
Reported by @ginggilBesel on 2022-01-28</li>
<li>[1295411] High CVE-2022-0975: Use after free in ANGLE. Reported
by SeongHwan Park (SeHwa) on 2022-02-09</li>
<li>[1296866] High CVE-2022-0976: Heap buffer overflow in GPU.
Reported by Omair on 2022-02-13</li>
<li>[1299225] High CVE-2022-0977: Use after free in Browser UI.
Reported by Khalil Zhani on 2022-02-20</li>
<li>[1299264] High CVE-2022-0978: Use after free in ANGLE. Reported
by Cassidy Kim of Amber Security Lab, OPPO Mobile
Telecommunications Corp. Ltd. on 2022-02-20</li>
<li>[1302644] High CVE-2022-0979: Use after free in Safe Browsing.
Reported by anonymous on 2022-03-03</li>
<li>[1302157] Medium CVE-2022-0980: Use after free in New Tab Page.
Reported by Krace on 2022-03-02</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0971</cvename>
<cvename>CVE-2022-0972</cvename>
<cvename>CVE-2022-0973</cvename>
<cvename>CVE-2022-0974</cvename>
<cvename>CVE-2022-0975</cvename>
<cvename>CVE-2022-0976</cvename>
<cvename>CVE-2022-0977</cvename>
<cvename>CVE-2022-0978</cvename>
<cvename>CVE-2022-0979</cvename>
<cvename>CVE-2022-0980</cvename>
<url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2022-03-15</discovery>
<entry>2022-03-15</entry>
</dates>
</vuln>
<vuln vid="6601c08d-a46c-11ec-8be6-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li><p>mod_lua: Use of uninitialized value of in r:parsebody (moderate)
(CVE-2022-22719)</p><p>A carefully crafted request body can cause a
read to a random memory area which could cause the process to crash.
</p></li>
<li><p>HTTP request smuggling vulnerability (important) (CVE-2022-22720)
</p><p>httpd fails to close inbound connection when errors are
encountered discarding the request body, exposing the server to HTTP
Request Smuggling</p></li>
<li><p>core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody (low) (CVE-2022-22721)</p><p>If LimitXMLRequestBody
is set to allow request bodies larger than 350MB (defaults to 1M) on 32
bit systems an integer overflow happens which later causes out of
bounds writes.</p></li>
<li><p>mod_sed: Read/write beyond bounds (important) (CVE-2022-23924)</p>
<p>Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server
allows an attacker to overwrite heap memory with possibly attacker
provided data.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-22719</cvename>
<cvename>CVE-2022-22720</cvename>
<cvename>CVE-2022-22721</cvename>
<cvename>CVE-2022-23943</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2022-03-14</discovery>
<entry>2022-03-15</entry>
</dates>
</vuln>
<vuln vid="5aaf534c-a069-11ec-acdc-14dae9d5a9d2">
<topic>Teeworlds -- Buffer Overflow</topic>
<affects>
<package>
<name>teeworlds</name>
<range><lt>0.7.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-43518">
<p>Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate m_Channels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43518</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-43518</url>
</references>
<dates>
<discovery>2021-10-23</discovery>
<entry>2022-03-10</entry>
</dates>
</vuln>
<vuln vid="2823048d-9f8f-11ec-8c9c-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.8.0</ge><lt>14.8.2</lt></range>
<range><ge>14.7.0</ge><lt>14.7.4</lt></range>
<range><ge>0</ge><lt>14.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/">
<p>Runner registration token disclosure through Quick Actions</p>
<p>Unprivileged users can add other users to groups through an API endpoint</p>
<p>Inaccurate display of Snippet contents can be potentially misleading to users</p>
<p>Environment variables can be leaked via the sendmail delivery method</p>
<p>Unauthenticated user enumeration on GraphQL API</p>
<p>Adding a mirror with SSH credentials can leak password</p>
<p>Denial of Service via user comments</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0735</cvename>
<cvename>CVE-2022-0549</cvename>
<cvename>CVE-2022-0751</cvename>
<cvename>CVE-2022-0741</cvename>
<cvename>CVE-2021-4191</cvename>
<cvename>CVE-2022-0738</cvename>
<cvename>CVE-2022-0489</cvename>
<url>https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/</url>
</references>
<dates>
<discovery>2022-02-25</discovery>
<entry>2022-03-09</entry>
</dates>
</vuln>
<vuln vid="964c5460-9c66-11ec-ad3a-001999f8d30b">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><lt>16.24.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
<p>AST-2022-004 - The header length on incoming STUN
messages that contain an ERROR-CODE attribute is not
properly checked. This can result in an integer underflow.
Note, this requires ICE or WebRTC support to be in use
with a malicious remote party.</p>
<p>AST-2022-005 - When acting as a UAC, and when placing
an outgoing call to a target that then forks Asterisk may
experience undefined behavior (crashes, hangs, etc) after
a dialog set is prematurely freed.</p>
<p>AST-2022-006 - If an incoming SIP message contains a
malformed multi-part body an out of bounds read access
may occur, which can result in undefined behavior. Note,
its currently uncertain if there is any externally
exploitable vector within Asterisk for this issue, but
providing this as a security issue out of caution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37706</cvename>
<cvename>CVE-2022-23608</cvename>
<cvename>CVE-2022-21723</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2022-004.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2022-005.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2022-006.html</url>
</references>
<dates>
<discovery>2022-03-03</discovery>
<entry>2022-03-05</entry>
</dates>
</vuln>
<vuln vid="e0914087-9a09-11ec-9e61-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>99.0.4844.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html">
<p>This release contains 28 security fixes, including:</p>
<ul>
<li>[1289383] High CVE-2022-0789: Heap buffer overflow in ANGLE.
Reported by SeongHwan Park (SeHwa) on 2022-01-21</li>
<li>[1274077] High CVE-2022-0790: Use after free in Cast UI.
Reported by Anonymous on 2021-11-26</li>
<li>[1278322] High CVE-2022-0791: Use after free in Omnibox.
Reported by Zhihua Yao of KunLun Lab on 2021-12-09</li>
<li>[1285885] High CVE-2022-0792: Out of bounds read in ANGLE.
Reported by Jaehun Jeong (@n3sk) of Theori on 2022-01-11</li>
<li>[1291728] High CVE-2022-0793: Use after free in Views. Reported
by Thomas Orlita on 2022-01-28</li>
<li>[1294097] High CVE-2022-0794: Use after free in WebShare.
Reported by Khalil Zhani on 2022-02-04</li>
<li>[1282782] High CVE-2022-0795: Type Confusion in Blink Layout.
Reported by 0x74960 on 2021-12-27</li>
<li>[1295786] High CVE-2022-0796: Use after free in Media. Reported
by Cassidy Kim of Amber Security Lab, OPPO Mobile
Telecommunications Corp. Ltd. on 2022-02-10</li>
<li>[1281908] High CVE-2022-0797: Out of bounds memory access in
Mojo. Reported by Sergei Glazunov of Google Project Zero on
2021-12-21</li>
<li>[1283402] Medium CVE-2022-0798: Use after free in MediaStream.
Reported by Samet Bekmezci @sametbekmezci on 2021-12-30</li>
<li>[1279188] Medium CVE-2022-0799: Insufficient policy enforcement
in Installer. Reported by Abdelhamid Naceri (halov) on
2021-12-12</li>
<li>[1242962] Medium CVE-2022-0800: Heap buffer overflow in Cast UI.
Reported by Khalil Zhani on 2021-08-24</li>
<li>[1231037] Medium CVE-2022-0801: Inappropriate implementation in
HTML parser. Reported by Michal Bentkowski of Securitum on
2021-07-20</li>
<li>[1270052] Medium CVE-2022-0802: Inappropriate implementation in
Full screen mode. Reported by Irvan Kurniawan (sourc7) on
2021-11-14</li>
<li>[1280233] Medium CVE-2022-0803: Inappropriate implementation in
Permissions. Reported by Abdulla Aldoseri on 2021-12-15</li>
<li>[1264561] Medium CVE-2022-0804: Inappropriate implementation in
Full screen mode. Reported by Irvan Kurniawan (sourc7) on
2021-10-29</li>
<li>[1290700] Medium CVE-2022-0805: Use after free in Browser
Switcher. Reported by raven at KunLun Lab on 2022-01-25</li>
<li>[1283434] Medium CVE-2022-0806: Data leak in Canvas. Reported by
Paril on 2021-12-31</li>
<li>[1287364] Medium CVE-2022-0807: Inappropriate implementation in
Autofill. Reported by Alesandro Ortiz on 2022-01-14</li>
<li>[1292271] Medium CVE-2022-0808: Use after free in Chrome OS
Shell. Reported by @ginggilBesel on 2022-01-29</li>
<li>[1293428] Medium CVE-2022-0809: Out of bounds memory access in
WebXR. Reported by @uwu7586 on 2022-02-03</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0789</cvename>
<cvename>CVE-2022-0790</cvename>
<cvename>CVE-2022-0791</cvename>
<cvename>CVE-2022-0792</cvename>
<cvename>CVE-2022-0793</cvename>
<cvename>CVE-2022-0794</cvename>
<cvename>CVE-2022-0795</cvename>
<cvename>CVE-2022-0796</cvename>
<cvename>CVE-2022-0797</cvename>
<cvename>CVE-2022-0798</cvename>
<cvename>CVE-2022-0799</cvename>
<cvename>CVE-2022-0800</cvename>
<cvename>CVE-2022-0801</cvename>
<cvename>CVE-2022-0802</cvename>
<cvename>CVE-2022-0803</cvename>
<cvename>CVE-2022-0804</cvename>
<cvename>CVE-2022-0805</cvename>
<cvename>CVE-2022-0806</cvename>
<cvename>CVE-2022-0807</cvename>
<cvename>CVE-2022-0808</cvename>
<cvename>CVE-2022-0809</cvename>
<url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-03-01</discovery>
<entry>2022-03-02</entry>
</dates>
</vuln>
<vuln vid="a80c6273-988c-11ec-83ac-080027415d17">
<topic>cyrus-sasl -- Fix off by one error</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><ge>2.1.27</ge><lt>2.1.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports:</p>
<blockquote cite="https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28">
<p>Fix off by one error</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-19906</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906</url>
</references>
<dates>
<discovery>2019-12-19</discovery>
<entry>2022-02-28</entry>
</dates>
</vuln>
<vuln vid="0eab001a-9708-11ec-96c9-589cfc0f81b0">
<topic>typo3 -- XSS vulnerability in svg-sanitize</topic>
<affects>
<package>
<name>typo3-10-php74</name>
<range><lt>10.4.25</lt></range>
</package>
<package>
<name>typo3-11-php74</name>
<name>typo3-11-php80</name>
<name>typo3-11-php81</name>
<range><lt>11.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The TYPO3 project reports:</p>
<blockquote cite="https://typo3.org/article/typo3-psa-2022-001">
<p>The SVG sanitizer library enshrined/svg-sanitize before version
0.15.0 did not remove HTML elements wrapped in a CDATA section.
As a result, SVG content embedded in HTML (fetched as text/html)
was susceptible to cross-site scripting. Plain SVG files
(fetched as image/svg+xml) were not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23638</cvename>
<url>https://github.com/typo3/typo3/commit/9940defb21</url>
<url>https://typo3.org/article/typo3-psa-2022-001</url>
</references>
<dates>
<discovery>2022-02-22</discovery>
<entry>2022-02-27</entry>
</dates>
</vuln>
<vuln vid="d71d154a-8b83-11ec-b369-6c3be5272acd">
<topic>Grafana -- Teams API IDOR</topic>
<affects>
<package>
<name>grafana6</name>
<range><ge>6.0.0</ge></range>
</package>
<package>
<name>grafana7</name>
<range><lt>7.5.15</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
<p>On Jan. 18, an external security researcher, Kürşad ALSAN from <a href="https://www.nspect.io/">NSPECT.IO</a> (<a href="https://twitter.com/nspectio">@nspectio</a> on Twitter), contacted Grafana to disclose an IDOR (Insecure Direct Object Reference) vulnerability on Grafana Teams APIs. This vulnerability only impacts the following API endpoints:</p>
<ul>
<li><strong>/teams/:teamId</strong> - an authenticated attacker can view unintended data by querying for the specific team ID.</li>
<li><strong>/teams/:search</strong> - an authenticated attacker can search for teams and see the total number of available teams, including for those teams that the user does not have access to.</li>
<li><strong>/teams/:teamId/members</strong> - when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID.</li>
</ul>
<p>We believe that this vulnerability is rated at CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21713</cvename>
<url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
</references>
<dates>
<discovery>2022-01-18</discovery>
<entry>2022-02-12</entry>
</dates>
</vuln>
<vuln vid="d4284c2e-8b83-11ec-b369-6c3be5272acd">
<topic>Grafana -- CSRF</topic>
<affects>
<package>
<name>grafana6</name>
<range><ge>6.0.0</ge></range>
</package>
<package>
<name>grafana7</name>
<range><lt>7.5.15</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
<p>On Jan. 18, security researchers <a href="https://twitter.com/jub0bs">@jub0bs</a> and <a href="https://twitter.com/theabrahack">@abrahack</a> contacted Grafana to <a href="https://jub0bs.com/posts/2022-02-08-cve-2022-21703-writeup/">disclose a CSRF vulnerability</a> which allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21703</cvename>
<url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
</references>
<dates>
<discovery>2022-01-18</discovery>
<entry>2022-02-12</entry>
</dates>
</vuln>
<vuln vid="cecbc674-8b83-11ec-b369-6c3be5272acd">
<topic>Grafana -- XSS</topic>
<affects>
<package>
<name>grafana6</name>
<range><ge>6.0.0</ge></range>
</package>
<package>
<name>grafana7</name>
<range><lt>7.5.15</lt></range>
</package>
<package>
<name>grafana8</name>
<range><lt>8.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
<p>On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources. Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same Grafana org. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21702</cvename>
<url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
</references>
<dates>
<discovery>2022-01-16</discovery>
<entry>2022-02-12</entry>
</dates>
</vuln>
<vuln vid="7695b0af-958f-11ec-9aa3-4ccc6adda413">
<topic>cryptopp -- ElGamal implementation allows plaintext recovery</topic>
<affects>
<package>
<name>cryptopp</name>
<range><lt>8.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Crypto++ 8.6 release notes reports:</p>
<blockquote cite="https://www.cryptopp.com/release860.html">
<p>The ElGamal implementation in Crypto++ through 8.5 allows plaintext
recovery because, during interaction between two cryptographic
libraries, a certain dangerous combination of the prime defined by
the receiver's public key, the generator defined by the receiver's
public key, and the sender's ephemeral exponents can lead to a
cross-configuration attack against OpenPGP.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-40530</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-40530</url>
</references>
<dates>
<discovery>2021-09-06</discovery>
<entry>2022-02-24</entry>
</dates>
</vuln>
<vuln vid="5e1440c6-95af-11ec-b320-f8b156b6dcc8">
<topic>flac -- fix encoder bug</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FLAC 1.3.4 release reports:</p>
<blockquote cite="https://xiph.org/flac/changelog.html">
<p>Fix 12 decoder bugs found by oss-fuzz.</p>
<p>Fix encoder bug CVE-2021-0561.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-0561</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0561</url>
</references>
<dates>
<discovery>2022-02-20</discovery>
<entry>2022-02-24</entry>
</dates>
</vuln>
<vuln vid="022dde12-8f4a-11ec-83ac-080027415d17">
<topic>cyrus-sasl -- Escape password for SQL insert/update commands</topic>
<affects>
<package>
<name>cyrus-sasl-sql</name>
<range><ge>2.1.27</ge><lt>2.1.27_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports:</p>
<blockquote cite="https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28">
<p>Escape password for SQL insert/update commands.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24407</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407</url>
</references>
<dates>
<discovery>2022-02-04</discovery>
<entry>2022-02-23</entry>
</dates>
</vuln>
<vuln vid="85d976be-93e3-11ec-aaad-14dae9d5a9d2">
<topic>The Update Framwork -- path traversal vulnerability</topic>
<affects>
<package>
<name>py37-tuf</name>
<name>py38-tuf</name>
<name>py39-tuf</name>
<name>py310-tuf</name>
<name>py311-tuf</name>
<range><le>0.18.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-41131">
<p>python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41131</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-41131</url>
</references>
<dates>
<discovery>2021-10-22</discovery>
<entry>2022-02-22</entry>
</dates>
</vuln>
<vuln vid="1cd565da-455e-41b7-a5b9-86ad8e81e33e">
<topic>seatd-launch -- remove files with escalated privileges with SUID</topic>
<affects>
<package>
<name>seatd</name>
<range><ge>0.6.0</ge><lt>0.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kenny Levinsen reports:</p>
<blockquote cite="https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E">
<p>seatd-launch could use a user-specified socket path instead of the
internally generated socket path, and would unlink the socket path
before use to guard against collision with leftover sockets. This
meant that a caller could freely control what file path would be
unlinked and replaced with a user-owned seatd socket for the duration
of the session.</p>
<p>If seatd-launch had the SUID bit set, this could be used by a
malicious user to remove files with the privileges of the owner of
seatd-launch, which is likely root, and replace it with a user-owned
domain socket.</p>
<p>This does not directly allow retrieving the contents of existing
files, and the user-owned socket file is at the current time not
believed to be directly useful for further exploitation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E</url>
<cvename>CVE-2022-25643</cvename>
</references>
<dates>
<discovery>2022-02-21</discovery>
<entry>2022-02-21</entry>
<modified>2022-02-22</modified>
</dates>
</vuln>
<vuln vid="43ae57f6-92ab-11ec-81b4-2cf05d620ecc">
<topic>Qt5 -- QProcess unexpected search path</topic>
<affects>
<package>
<name>qt5-core</name>
<range><lt>5.15.2p263_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Qt Company reports:</p>
<blockquote cite="https://lists.qt-project.org/pipermail/announce/2022-February/000333.html">
<p>Recently, the Qt Project's security team was made aware of an issue regarding QProcess and determined it to be a security issue on Unix-based platforms only. We do not believe this to be a considerable risk for applications as the likelihood of it being triggered is minimal.
</p>
<p>Specifically, the problem is around using QProcess to start an application without having an absolute path, and as a result, it depends on it finding it in the PATH environment variable. As a result, it may be possible for an attacker to place their copy of the executable in question inside the working/current directory for the QProcess and have it invoked that instead.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-25255</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25255</url>
</references>
<dates>
<discovery>2022-02-17</discovery>
<entry>2022-02-21</entry>
</dates>
</vuln>
<vuln vid="4d763c65-9246-11ec-9aa3-4ccc6adda413">
<topic>libmysoft -- Heap-based buffer overflow vulnerability</topic>
<affects>
<package>
<name>libmysofa</name>
<range><lt>1.2.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zhengjie Du reports:</p>
<blockquote cite="https://huntr.dev/bounties/7ca8d9ea-e2a6-4294-af28-70260bb53bc1/">
<p>There are some heap-buffer-overflows in mysofa2json of
libmysofa. They are in function loudness, mysofa_check and
readOHDRHeaderMessageDataLayout.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3756</cvename>
<url>https://www.huntr.dev/bounties/7ca8d9ea-e2a6-4294-af28-70260bb53bc1/</url>
</references>
<dates>
<discovery>2021-09-27</discovery>
<entry>2022-02-20</entry>
</dates>
</vuln>
<vuln vid="27bf9378-8ffd-11ec-8be6-d4c9ef517024">
<topic>MariaDB -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-client</name>
<range><lt>10.3.34</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.34</lt></range>
</package>
<package>
<name>mariadb104-client</name>
<range><lt>10.4.24</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.24</lt></range>
</package>
<package>
<name>mariadb105-client</name>
<range><lt>10.5.15</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MariaDB reports:</p>
<blockquote cite="https://mariadb.com/kb/en/cve/">
<p>MariaDB reports 5 vulnerabilities in supported versions
resulting from fuzzing tests</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-46661</cvename>
<cvename>CVE-2021-46663</cvename>
<cvename>CVE-2021-46664</cvename>
<cvename>CVE-2021-46665</cvename>
<cvename>CVE-2021-46668</cvename>
<url>https://mariadb.com/kb/en/cve/</url>
<url>https://mariadb.com/kb/en/mdb-10334-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10424-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10515-rn/</url>
</references>
<dates>
<discovery>2022-02-12</discovery>
<entry>2022-02-18</entry>
</dates>
</vuln>
<vuln vid="096ab080-907c-11ec-bb14-002324b2fba8">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/50974">
<p>crypto/elliptic: fix IsOnCurve for big.Int values that are not
valid coordinates</p>
<p>Some big.Int values that are not valid field elements (negative or
overflowing) might cause Curve.IsOnCurve to incorrectly return true.
Operating on those values may cause a panic or an invalid curve
operation. Note that Unmarshal will never return such values.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/50699">
<p>math/big: prevent large memory consumption in Rat.SetString</p>
<p>An attacker can cause unbounded memory growth in a program using
(*Rat).SetString due to an unhandled overflow.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/35671">
<p>cmd/go: prevent branches from materializing into versions</p>
<p>A branch whose name resembles a version tag (such as "v1.0.0" or
"subdir/v2.0.0-dev") can be considered a valid version by the go
command. Materializing versions from branches might be unexpected
and bypass ACLs that limit the creation of tags but not branches.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23806</cvename>
<url>https://github.com/golang/go/issues/50974</url>
<cvename>CVE-2022-23772</cvename>
<url>https://github.com/golang/go/issues/50699</url>
<cvename>CVE-2022-23773</cvename>
<url>https://github.com/golang/go/issues/35671</url>
</references>
<dates>
<discovery>2022-02-10</discovery>
<entry>2022-02-18</entry>
</dates>
</vuln>
<vuln vid="e12432af-8e73-11ec-8bc4-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>98.0.4758.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html">
<p>This release contains 11 security fixes, including:</p>
<ul>
<li>[1290008] High CVE-2022-0603: Use after free in File Manager.
Reported by Chaoyuan Peng (@ret2happy) on 2022-01-22</li>
<li>[1273397] High CVE-2022-0604: Heap buffer overflow in Tab
Groups. Reported by Krace on 2021-11-24</li>
<li>[1286940] High CVE-2022-0605: Use after free in Webstore API.
Reported by Thomas Orlita on 2022-01-13</li>
<li>[1288020] High CVE-2022-0606: Use after free in ANGLE. Reported
by Cassidy Kim of Amber Security Lab, OPPO Mobile
Telecommunications Corp. Ltd. on 2022-01-17</li>
<li>[1250655] High CVE-2022-0607: Use after free in GPU. Reported by
0x74960 on 2021-09-17</li>
<li>[1270333] High CVE-2022-0608: Integer overflow in Mojo. Reported
by Sergei Glazunov of Google Project Zero on 2021-11-16</li>
<li>[1296150] High CVE-2022-0609: Use after free in Animation.
Reported by Adam Weidemann and Clément Lecigne of Google'
Threat Analysis Group on 2022-02-10</li>
<li>[1285449] Medium CVE-2022-0610: Inappropriate implementation in
Gamepad API. Reported by Anonymous on 2022-01-08</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0603</cvename>
<cvename>CVE-2022-0604</cvename>
<cvename>CVE-2022-0605</cvename>
<cvename>CVE-2022-0606</cvename>
<cvename>CVE-2022-0607</cvename>
<cvename>CVE-2022-0608</cvename>
<cvename>CVE-2022-0609</cvename>
<cvename>CVE-2022-0610</cvename>
<url>https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2022-02-14</discovery>
<entry>2022-02-15</entry>
</dates>
</vuln>
<vuln vid="24049967-88ec-11ec-88f5-901b0e934d69">
<topic>py-twisted -- cookie and authorization headers are leaked when following cross-origin redirects</topic>
<affects>
<package>
<name>py37-twisted</name>
<name>py38-twisted</name>
<name>py39-twisted</name>
<name>py310-twisted</name>
<range><lt>22.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Twisted developers report:</p>
<blockquote cite="https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx">
<p> Cookie and Authorization headers are leaked when following cross-origin redirects in <code>twited.web.client.RedirectAgent</code> and <code>twisted.web.client.BrowserLikeRedirectAgent</code>.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx</url>
</references>
<dates>
<discovery>2022-02-07</discovery>
<entry>2022-02-13</entry>
</dates>
</vuln>
<vuln vid="d923fb0c-8c2f-11ec-aa85-0800270512f4">
<topic>zsh -- Arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>zsh</name>
<range><lt>5.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Marc Cornellà reports:</p>
<blockquote cite="https://zsh.sourceforge.io/releases.html">
<p>
Some prompt expansion sequences, such as %F, support 'arguments'
which are themselves expanded in case they contain colour values,
etc. This additional expansion would trigger PROMPT_SUBST evaluation,
if enabled. This could be abused to execute code the user didn't
expect. e.g., given a certain prompt configuration, an attacker
could trick a user into executing arbitrary code by having them
check out a Git branch with a specially crafted name.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45444</cvename>
<url>https://zsh.sourceforge.io/releases.html</url>
</references>
<dates>
<discovery>2022-02-12</discovery>
<entry>2022-02-12</entry>
</dates>
</vuln>
<vuln vid="972ba0e8-8b8a-11ec-b369-6c3be5272acd">
<topic>Node.js -- January 2022 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><ge>12.0.0</ge><lt>12.22.9</lt></range>
<range><ge>14.0.0</ge><lt>14.18.3</lt></range>
<range><ge>16.0.0</ge><lt>16.13.2</lt></range>
<range><ge>17.0.0</ge><lt>17.3.1</lt></range>
</package>
<package>
<name>node16</name>
<range><lt>16.13.2</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/">
<h1>Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)</h1>
<p>Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.</p>
<h1>Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)</h1>
<p>Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.</p>
<h1>Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)</h1>
<p>Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.</p>
<h1>Prototype pollution via <code>console.table</code> properties (Low)(CVE-2022-21824)</h1>
<p>Due to the formatting logic of the <code>console.table()</code> function it was not safe to allow user controlled input to be passed to the <code>properties</code> parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be <code>__proto__</code>. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44531</cvename>
<cvename>CVE-2021-44532</cvename>
<cvename>CVE-2021-44533</cvename>
<cvename>CVE-2022-21824</cvename>
<url>https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/</url>
</references>
<dates>
<discovery>2022-01-10</discovery>
<entry>2022-02-12</entry>
</dates>
</vuln>
<vuln vid="0b0ad196-1ee8-4a98-89b1-4d5d82af49a9">
<topic>jenkins -- DoS vulnerability in bundled XStream library</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.334</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.319.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2022-02-09/">
<h1>Description</h1>
<h5>(Medium) SECURITY-2602 / CVE-2021-43859 (upstream issue), CVE-2022-0538 (Jenkins-specific converters)</h5>
<p>DoS vulnerability in bundled XStream library</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43859</cvename>
<cvename>CVE-2022-0538</cvename>
<url>https://www.jenkins.io/security/advisory/2022-02-09/</url>
</references>
<dates>
<discovery>2022-02-09</discovery>
<entry>2022-02-10</entry>
</dates>
</vuln>
<vuln vid="ff5606f7-8a45-11ec-8be6-d4c9ef517024">
<topic>MariaDB -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-client</name>
<range><lt>10.3.33</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.33</lt></range>
</package>
<package>
<name>mariadb104-client</name>
<range><lt>10.4.23</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.23</lt></range>
</package>
<package>
<name>mariadb105-client</name>
<range><lt>10.5.14</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MariaDB reports:</p>
<blockquote cite="https://mariadb.com/kb/en/cve/">
<p>MariaDB reports 5 vulnerabilities in supported versions
without further detailed information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-24052</cvename>
<cvename>CVE-2022-24051</cvename>
<cvename>CVE-2022-24050</cvename>
<cvename>CVE-2022-24048</cvename>
<cvename>CVE-2021-46659</cvename>
<url>https://mariadb.com/kb/en/cve/</url>
<url>https://mariadb.com/kb/en/mdb-10333-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10423-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10514-rn/</url>
</references>
<dates>
<discovery>2022-02-10</discovery>
<entry>2022-02-10</entry>
<modified>2022-02-17</modified>
</dates>
</vuln>
<vuln vid="fc2a9541-8893-11ec-9d01-80ee73419af3">
<topic>xrdp -- privilege escalation</topic>
<affects>
<package>
<name>xrdp</name>
<range><ge>0.9.17,1</ge><lt>0.9.18.1,1</lt></range>
</package>
<package>
<name>xrdp-devel</name>
<range><ge>0.9.17,1</ge><lt>0.9.18.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp project reports:</p>
<blockquote cite="https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32">
<p>An integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is accessible to a sesman server (listens by default on localhost when installing xrdp, but can be remote if configured otherwise) to execute code as root.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23613</cvename>
<url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32</url>
</references>
<dates>
<discovery>2022-01-23</discovery>
<entry>2022-02-08</entry>
<modified>2022-02-15</modified>
</dates>
</vuln>
<vuln vid="3507bfb3-85d5-11ec-8c9c-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.7.0</ge><lt>14.7.1</lt></range>
<range><ge>14.6.0</ge><lt>14.6.4</lt></range>
<range><ge>0</ge><lt>14.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/">
<p>Arbitrary POST requests via special HTML attributes in Jupyter Notebooks</p>
<p>DNS Rebinding vulnerability in Irker IRC Gateway integration</p>
<p>Missing certificate validation for external CI services</p>
<p>Blind SSRF Through Project Import</p>
<p>Open redirect vulnerability in Jira Integration</p>
<p>Issue link was disclosing the linked issue</p>
<p>Service desk email accessible by project non-members</p>
<p>Authenticated users can search other users by their private email</p>
<p>"External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request</p>
<p>Deleting packages in bulk from package registries may cause table locks</p>
<p>Autocomplete enabled on specific pages</p>
<p>Possible SSRF due to not blocking shared address space</p>
<p>System notes reveals private project path when Issue is moved to a public project</p>
<p>Timeout for pages using Markdown</p>
<p>Certain branch names could not be protected</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0427</cvename>
<cvename>CVE-2022-0425</cvename>
<cvename>CVE-2022-0123</cvename>
<cvename>CVE-2022-0136</cvename>
<cvename>CVE-2022-0283</cvename>
<cvename>CVE-2022-0390</cvename>
<cvename>CVE-2022-0373</cvename>
<cvename>CVE-2022-0371</cvename>
<cvename>CVE-2021-39943</cvename>
<cvename>CVE-2022-0477</cvename>
<cvename>CVE-2022-0167</cvename>
<cvename>CVE-2022-0249</cvename>
<cvename>CVE-2022-0344</cvename>
<cvename>CVE-2022-0488</cvename>
<cvename>CVE-2021-39931</cvename>
<url>https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/</url>
</references>
<dates>
<discovery>2022-02-03</discovery>
<entry>2022-02-04</entry>
</dates>
</vuln>
<vuln vid="e852f43c-846e-11ec-b043-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>98.0.4758.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html">
<p>This release contains 27 security fixes, including:</p>
<ul>
<li>[1284584] High CVE-2022-0452: Use after free in Safe Browsing.
Reported by avaue at S.S.L. on 2022-01-05</li>
<li>[1284916] High CVE-2022-0453: Use after free in Reader Mode.
Reported by Rong Jian of VRI on 2022-01-06</li>
<li>[1287962] High CVE-2022-0454: Heap buffer overflow in ANGLE.
Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
2022-01-17</li>
<li>[1270593] High CVE-2022-0455: Inappropriate implementation in
Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on
2021-11-16</li>
<li>[1289523] High CVE-2022-0456: Use after free in Web Search.
Reported by Zhihua Yao of KunLun Lab on 2022-01-21</li>
<li>[1274445] High CVE-2022-0457: Type Confusion in V8. Reported by
rax of the Group0x58 on 2021-11-29</li>
<li>[1267060] High CVE-2022-0458: Use after free in Thumbnail Tab
Strip. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-11-05</li>
<li>[1244205] High CVE-2022-0459: Use after free in Screen Capture.
Reported by raven (@raid_akame) on 2021-08-28</li>
<li>[1250227] Medium CVE-2022-0460: Use after free in Window Dialog.
Reported by 0x74960 on 2021-09-16</li>
<li>[1256823] Medium CVE-2022-0461: Policy bypass in COOP. Reported
by NDevTK on 2021-10-05</li>
<li>[1270470] Medium CVE-2022-0462: Inappropriate implementation in
Scroll. Reported by Youssef Sammouda on 2021-11-16</li>
<li>[1268240] Medium CVE-2022-0463: Use after free in Accessibility.
Reported by Zhihua Yao of KunLun Lab on 2021-11-09</li>
<li>[1270095] Medium CVE-2022-0464: Use after free in Accessibility.
Reported by Zhihua Yao of KunLun Lab on 2021-11-14</li>
<li>[1281941] Medium CVE-2022-0465: Use after free in Extensions.
Reported by Samet Bekmezci @sametbekmezci on 2021-12-22</li>
<li>[1115460] Medium CVE-2022-0466: Inappropriate implementation in
Extensions Platform. Reported by David Erceg on 2020-08-12</li>
<li>[1239496] Medium CVE-2022-0467: Inappropriate implementation in
Pointer Lock. Reported by Alesandro Ortiz on 2021-08-13</li>
<li>[1252716] Medium CVE-2022-0468: Use after free in Payments.
Reported by Krace on 2021-09-24</li>
<li>[1279531] Medium CVE-2022-0469: Use after free in Cast. Reported
by Thomas Orlita on 2021-12-14</li>
<li>[1269225] Low CVE-2022-0470: Out of bounds memory access in V8.
Reported by Looben Yang on 2021-11-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0452</cvename>
<cvename>CVE-2022-0453</cvename>
<cvename>CVE-2022-0454</cvename>
<cvename>CVE-2022-0455</cvename>
<cvename>CVE-2022-0456</cvename>
<cvename>CVE-2022-0457</cvename>
<cvename>CVE-2022-0458</cvename>
<cvename>CVE-2022-0459</cvename>
<cvename>CVE-2022-0460</cvename>
<cvename>CVE-2022-0461</cvename>
<cvename>CVE-2022-0462</cvename>
<cvename>CVE-2022-0463</cvename>
<cvename>CVE-2022-0464</cvename>
<cvename>CVE-2022-0465</cvename>
<cvename>CVE-2022-0466</cvename>
<cvename>CVE-2022-0467</cvename>
<cvename>CVE-2022-0468</cvename>
<cvename>CVE-2022-0469</cvename>
<cvename>CVE-2022-0470</cvename>
<url>https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-02-01</discovery>
<entry>2022-02-02</entry>
</dates>
</vuln>
<vuln vid="1d3677a8-9143-42d8-84a3-0585644dff4b">
<topic>h2o -- uninitialised memory access in HTTP3</topic>
<affects>
<package>
<name>h2o-devel</name>
<range><lt>2.3.0.d.20220131</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Emil Lerner reports:</p>
<blockquote cite="https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4">
<p>When receiving QUIC frames in certain order, HTTP/3 server-side
implementation of h2o can be misguided to treat uninitialized
memory as HTTP/3 frames that have been received. When h2o is
used as a reverse proxy, an attacker can abuse this vulnerability
to send internal state of h2o to backend servers controlled by
the attacker or third party. Also, if there is an HTTP endpoint
that reflects the traffic sent from the client, an attacker can
use that reflector to obtain internal state of h2o.</p>
<p>This internal state includes traffic of other connections in
unencrypted form and TLS session tickets.</p>
<p>This vulnerability exists in h2o server with HTTP/3
support, between commit 93af138 and d1f0f65. None of the
released versions of h2o are affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43848</cvename>
<url>https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4</url>
</references>
<dates>
<discovery>2021-01-31</discovery>
<entry>2022-02-02</entry>
</dates>
</vuln>
<vuln vid="b1b6d623-83e4-11ec-90de-1c697aa5a594">
<topic>FreeBSD -- vt console buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_6</lt></range>
<range><ge>12.2</ge><lt>12.2_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Under certain conditions involving use of the highlight buffer
while text is scrolling on the console, console data may overwrite
data structures associated with the system console or other kernel
memory.</p>
<h1>Impact:</h1>
<p>Users with access to the system console may be able to cause system
misbehaviour.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29632</cvename>
<freebsdsa>SA-22:01.vt</freebsdsa>
</references>
<dates>
<discovery>2022-01-11</discovery>
<entry>2022-02-02</entry>
</dates>
</vuln>
<vuln vid="8579074c-839f-11ec-a3b2-005056a311d1">
<topic>samba -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>samba413</name>
<range><lt>4.13.17</lt></range>
</package>
<package>
<name>samba414</name>
<range><lt>4.14.12</lt></range>
</package>
<package>
<name>samba415</name>
<range><lt>4.15.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<ul>
<li>CVE-2021-43566: Malicious client using an SMB1 or NFS race to allow
a directory to be created in an area of the server file system not
exported under the share definition.</li>
<li>CVE-2021-44141: Information leak via symlinks of existance of files
or directories outside of the exported share.</li>
<li>CVE-2021-44142: Out-of-bounds heap read/write vulnerability
in VFS module vfs_fruit allows code execution.</li>
<li>CVE-2022-0336: Samba AD users with permission to write to
an account can impersonate arbitrary services.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43566</cvename>
<cvename>CVE-2021-44141</cvename>
<cvename>CVE-2021-44142</cvename>
<cvename>CVE-2022-0336</cvename>
<url>https://www.samba.org/samba/security/CVE-2021-43566.html</url>
<url>https://www.samba.org/samba/security/CVE-2021-44141.html</url>
<url>https://www.samba.org/samba/security/CVE-2021-44142.html</url>
<url>https://www.samba.org/samba/security/CVE-2022-0336.html</url>
</references>
<dates>
<discovery>2022-01-31</discovery>
<entry>2022-02-01</entry>
</dates>
</vuln>
<vuln vid="ee26f513-826e-11ec-8be6-d4c9ef517024">
<topic>Rust -- Race condition enabling symlink following</topic>
<affects>
<package>
<name>rust</name>
<range><lt>1.58.1</lt></range>
</package>
<package>
<name>rust-nightly</name>
<range><lt>1.60.0.20220202</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html">
<p>The Rust Security Response WG was notified that the
std::fs::remove_dir_all standard library function is vulnerable to a
race condition enabling symlink following (CWE-363). An attacker could
use this security issue to trick a privileged program into deleting
files and directories the attacker couldn't otherwise access or
delete.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-21658</cvename>
<url>https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html</url>
</references>
<dates>
<discovery>2022-01-20</discovery>
<entry>2022-01-31</entry>
<modified>2022-02-03</modified>
</dates>
</vuln>
<vuln vid="b0c83e1a-8153-11ec-84f9-641c67a117d8">
<topic>varnish -- Request Smuggling Vulnerability</topic>
<affects>
<package>
<name>varnish6</name>
<range><lt>6.6.2</lt></range>
</package>
<package>
<name>varnish4</name>
<range><lt>4.1.11r6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00008.html">
<p>A request smuggling attack can be performed on HTTP/1 connections on
Varnish Cache servers. The smuggled request would be treated as an additional
request by the Varnish server, go through normal VCL processing, and injected
as a spurious response on the client connection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-23959</cvename>
<url>https://varnish-cache.org/security/VSV00008.html</url>
<url>https://docs.varnish-software.com/security/VSV00008/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23959</url>
</references>
<dates>
<discovery>2022-01-25</discovery>
<entry>2022-01-29</entry>
</dates>
</vuln>
<vuln vid="b6ef8a53-8062-11ec-9af3-fb232efe4d2e">
<topic>OpenEXR -- Heap-buffer-overflow in Imf_3_1::LineCompositeTask::execute</topic>
<affects>
<package>
<name>openexr</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022">
<p>[OpenEXR Version 3.1.4 is a] patch release that [...]
addresses one public security vulnerability:
CVE-2021-45942 Heap-buffer-overflow in
Imf_3_1::LineCompositeTask::execute [and several]
specific OSS-fuzz issues [...].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45942</cvename>
<url>https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022</url>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41416</url> <!-- reported for dates.discovery below -->
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41999</url> <!-- reported 2021-12-04 -->
<url>https://github.com/AcademySoftwareFoundation/openexr/pull/1209</url> <!-- fix for CVE-inducing issue -->
</references>
<dates>
<discovery>2021-11-26</discovery>
<entry>2022-01-28</entry>
</dates>
</vuln>
<vuln vid="1aaaa5c6-804d-11ec-8be6-d4c9ef517024">
<topic>OpenSSL -- BN_mod_exp incorrect results on MIPS</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1m,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.1</lt></range>
</package>
<package>
<name>openssl-quictls</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20220128.txt">
<p>BN_mod_exp may produce incorrect results on MIPS (Moderate)</p>
<p>There is a carry propagation bug in the MIPS32 and MIPS64 squaring
procedure. Many EC algorithms are affected, including some of the
TLS 1.3 default curves. Impact was not analyzed in detail, because the
pre-requisites for attack are considered unlikely and include reusing
private keys. Analysis suggests that attacks against RSA and DSA as a
result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible
(although very difficult) because most of the work necessary to deduce
information about a private key may be performed offline. The amount
of resources required for such an attack would be significant.
However, for an attack on TLS to be meaningful, the server would have
to share the DH private key among multiple clients, which is no longer
an option since CVE-2016-0701.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-4160</cvename>
<url>https://www.openssl.org/news/secadv/20220128.txt</url>
</references>
<dates>
<discovery>2022-01-28</discovery>
<entry>2022-01-28</entry>
</dates>
</vuln>
<vuln vid="65847d9d-7f3e-11ec-8624-b42e991fc52e">
<topic>mustache - Possible Remote Code Execution</topic>
<affects>
<package>
<name>phpmustache</name>
<range><lt>2.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>huntr.dev reports:</p>
<blockquote cite="https://huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7/">
<p>In Mustache.php v2.0.0 through v2.14.0, Sections tag can
lead to arbitrary php code execution even if
strict_callables is true when section value is
controllable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0323</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-0323</url>
</references>
<dates>
<discovery>2022-01-20</discovery>
<entry>2022-01-27</entry>
</dates>
</vuln>
<vuln vid="0f8bf913-7efa-11ec-8c04-2cf05d620ecc">
<topic>polkit -- Local Privilege Escalation</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.120_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualys reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2022/q1/80">
<p>We discovered a Local Privilege Escalation (from any user to root) in
polkit's pkexec, a SUID-root program that is installed by default on
every major Linux distribution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-4034</cvename>
<url>https://seclists.org/oss-sec/2022/q1/80</url>
<freebsdpr>ports/261482</freebsdpr>
</references>
<dates>
<discovery>2022-01-25</discovery>
<entry>2022-01-26</entry>
</dates>
</vuln>
<vuln vid="ccaea96b-7dcd-11ec-93df-00224d821998">
<topic>strongswan - Incorrect Handling of Early EAP-Success Messages</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/releases/tag/5.9.5">
<p>Fixed a vulnerability in the EAP client implementation
that was caused by incorrectly handling early EAP-Success
messages. It may allow to bypass the client and in some
scenarios even the server authentication, or could lead to
a denial-of-service attack. This vulnerability has been
registered as CVE-2021-45079.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45079</cvename>
<url>https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-(cve-2021-45079).html</url>
</references>
<dates>
<discovery>2021-12-16</discovery>
<entry>2022-01-25</entry>
</dates>
</vuln>
<vuln vid="58528a94-5100-4208-a04d-edc01598cf01">
<topic>strongswan - denial-of-service vulnerability in the gmp plugin/denial-of-service vulnerability in the in-memory certificate cache</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/releases/tag/5.9.4">
<p>Fixed a denial-of-service vulnerability in the gmp plugin that
was caused by an integer overflow when processing RSASSA-PSS
signatures with very large salt lengths. This vulnerability has
been registered as CVE-2021-41990.</p>
<p>Fixed a denial-of-service vulnerability in the in-memory
certificate cache if certificates are replaced and a very large
random value caused an integer overflow. This vulnerability has
been registered as CVE-2021-41991.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41990</cvename>
<cvename>CVE-2021-41991</cvename>
<url>https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41990).html</url>
<url>https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html</url>
</references>
<dates>
<discovery>2021-10-04</discovery>
<entry>2022-01-25</entry>
</dates>
</vuln>
<vuln vid="309c35f4-7c9f-11ec-a739-206a8a720317">
<topic>aide -- heap-based buffer overflow</topic>
<affects>
<package>
<name>aide</name>
<range><lt>0.17.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Bouman reports:</p>
<blockquote cite="INSERT URL HERE">
<p>AIDE before 0.17.4 allows local users to obtain root privileges
via crafted file metadata (such as XFS extended attributes or
tmpfs ACLs), because of a heap-based buffer overflow.</p>
<p>Aide uses a fixed size (16k bytes) for the return buffer in
encode_base64/decode_base64 functions. This results in a segfault
if aide processes a file with too large extended attribute value
or ACL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45417</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45417</url>
</references>
<dates>
<discovery>2022-01-15</discovery>
<entry>2022-01-23</entry>
</dates>
</vuln>
<vuln vid="51496cbc-7a0e-11ec-a323-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>97.0.4692.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html">
<p>This release contains 26 security fixes, including:</p>
<ul>
<li>[1284367] Critical CVE-2022-0289: Use after free in Safe
browsing. Reported by Sergei Glazunov of Google Project Zero on
2022-01-05</li>
<li>[1260134][1260007] High CVE-2022-0290: Use after free in Site
isolation. Reported by Brendon Tiszka and Sergei Glazunov of
Google Project Zero on 2021-10-15</li>
<li>[1281084] High CVE-2022-0291: Inappropriate implementation in
Storage. Reported by Anonymous on 2021-12-19</li>
<li>[1270358] High CVE-2022-0292: Inappropriate implementation in
Fenced Frames. Reported by Brendon Tiszka on 2021-11-16</li>
<li>[1283371] High CVE-2022-0293: Use after free in Web packaging.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
2021-12-30</li>
<li>[1273017] High CVE-2022-0294: Inappropriate implementation in
Push messaging. Reported by Rong Jian and Guang Gong of 360 Alpha
Lab on 2021-11-23</li>
<li>[1278180] High CVE-2022-0295: Use after free in Omnibox.
Reported by Weipeng Jiang (@Krace) and Guang Gong of 360
Vulnerability Research Institute on 2021-12-09</li>
<li>[1283375] High CVE-2022-0296: Use after free in Printing.
Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability
Research Institute on 2021-12-30</li>
<li>[1274316] High CVE-2022-0297: Use after free in Vulkan. Reported
by Cassidy Kim of Amber Security Lab, OPPO Mobile
Telecommunications Corp. Ltd. on 2021-11-28</li>
<li>[1212957] High CVE-2022-0298: Use after free in Scheduling.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-25</li>
<li>[1275438] High CVE-2022-0300: Use after free in Text Input
Method Editor. Reported by Rong Jian and Guang Gong of 360 Alpha
Lab on 2021-12-01</li>
<li>[1276331] High CVE-2022-0301: Heap buffer overflow in DevTools.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2021-12-03</li>
<li>[1278613] High CVE-2022-0302: Use after free in Omnibox.
Reported by Weipeng Jiang (@Krace) and Guang Gong of 360
Vulnerability Research Institute on 2021-12-10</li>
<li>[1281979] High CVE-2022-0303: Race in GPU Watchdog. Reported by
Yigit Can YILMAZ (@yilmazcanyigit) on 2021-12-22</li>
<li>[1282118] High CVE-2022-0304: Use after free in Bookmarks.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
2021-12-22</li>
<li>[1282354] High CVE-2022-0305: Inappropriate implementation in
Service Worker API. Reported by @uwu7586 on 2021-12-23</li>
<li>[1283198] High CVE-2022-0306: Heap buffer overflow in PDFium.
Reported by Sergei Glazunov of Google Project Zero on
2021-12-29</li>
<li>[1281881] Medium CVE-2022-0307: Use after free in Optimization
Guide. Reported by Samet Bekmezci @sametbekmezci on
2021-12-21</li>
<li>[1282480] Medium CVE-2022-0308: Use after free in Data Transfer.
Reported by @ginggilBesel on 2021-12-24</li>
<li>[1240472] Medium CVE-2022-0309: Inappropriate implementation in
Autofill. Reported by Alesandro Ortiz on 2021-08-17</li>
<li>[1283805] Medium CVE-2022-0310: Heap buffer overflow in Task
Manager. Reported by Samet Bekmezci @sametbekmezci on
2022-01-03</li>
<li>[1283807] Medium CVE-2022-0311: Heap buffer overflow in Task
Manager. Reported by Samet Bekmezci @sametbekmezci on
2022-01-03</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0289</cvename>
<cvename>CVE-2022-0290</cvename>
<cvename>CVE-2022-0291</cvename>
<cvename>CVE-2022-0292</cvename>
<cvename>CVE-2022-0293</cvename>
<cvename>CVE-2022-0294</cvename>
<cvename>CVE-2022-0295</cvename>
<cvename>CVE-2022-0296</cvename>
<cvename>CVE-2022-0297</cvename>
<cvename>CVE-2022-0298</cvename>
<cvename>CVE-2022-0300</cvename>
<cvename>CVE-2022-0301</cvename>
<cvename>CVE-2022-0302</cvename>
<cvename>CVE-2022-0303</cvename>
<cvename>CVE-2022-0304</cvename>
<cvename>CVE-2022-0305</cvename>
<cvename>CVE-2022-0306</cvename>
<cvename>CVE-2022-0307</cvename>
<cvename>CVE-2022-0308</cvename>
<cvename>CVE-2022-0309</cvename>
<cvename>CVE-2022-0310</cvename>
<cvename>CVE-2022-0311</cvename>
<url>https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2022-01-19</discovery>
<entry>2022-01-20</entry>
</dates>
</vuln>
<vuln vid="7262f826-795e-11ec-8be6-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-connector-odbc</name>
<range><lt>8.0.28</lt></range>
</package>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.28</lt></range>
</package>
<package>
<name>mysql-connector-java</name>
<range><lt>8.0.28</lt></range>
</package>
<package>
<name>mysql-connector-java51</name>
<range><lt>8.0.28</lt></range>
</package>
<package>
<name>mysql-server55</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>mysql-server56</name>
<range><lt>5.6.52</lt></range>
</package>
<package>
<name>mysql-server57</name>
<range><lt>5.7.37</lt></range>
</package>
<package>
<name>mysql-server80</name>
<range><lt>8.0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2022.html#AppendixMSQL">
<p>This Critical Patch Update contains 78 new security patches for
Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.<br/>
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 7.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22946</cvename>
<cvename>CVE-2021-3712</cvename>
<cvename>CVE-2022-21278</cvename>
<cvename>CVE-2022-21351</cvename>
<cvename>CVE-2022-21363</cvename>
<cvename>CVE-2022-21358</cvename>
<cvename>CVE-2022-21352</cvename>
<cvename>CVE-2022-21367</cvename>
<cvename>CVE-2022-21301</cvename>
<cvename>CVE-2022-21378</cvename>
<cvename>CVE-2022-21302</cvename>
<cvename>CVE-2022-21254</cvename>
<cvename>CVE-2022-21348</cvename>
<cvename>CVE-2022-21270</cvename>
<cvename>CVE-2022-21256</cvename>
<cvename>CVE-2022-21379</cvename>
<cvename>CVE-2022-21362</cvename>
<cvename>CVE-2022-21374</cvename>
<cvename>CVE-2022-21253</cvename>
<cvename>CVE-2022-21264</cvename>
<cvename>CVE-2022-21297</cvename>
<cvename>CVE-2022-21339</cvename>
<cvename>CVE-2022-21342</cvename>
<cvename>CVE-2022-21370</cvename>
<cvename>CVE-2022-21304</cvename>
<cvename>CVE-2022-21344</cvename>
<cvename>CVE-2022-21303</cvename>
<cvename>CVE-2022-21368</cvename>
<cvename>CVE-2022-21245</cvename>
<cvename>CVE-2022-21265</cvename>
<cvename>CVE-2022-21249</cvename>
<cvename>CVE-2022-21372</cvename>
<url>https://www.oracle.com/security-alerts/cpujan2022.html#AppendixMSQL</url>
</references>
<dates>
<discovery>2022-01-18</discovery>
<entry>2022-01-19</entry>
</dates>
</vuln>
<vuln vid="e3ec8b30-757b-11ec-922f-654747404482">
<topic>Prosody XMPP server advisory 2022-01-13</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.11.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody teaM reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20220113/">
<p>It was discovered that an internal Prosody library to load XML based on
does not properly restrict the XML features allowed in parsed
XML data. Given suitable attacker input, this results in expansion of
recursive entity references from DTDs (CWE-776). In addition,
depending on the libexpat version used, it may also allow injections
using XML External Entity References (CWE-611).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0217</cvename>
<url>https://prosody.im/security/advisory_20220113/</url>
</references>
<dates>
<discovery>2022-01-10</discovery>
<entry>2022-01-14</entry>
</dates>
</vuln>
<vuln vid="79b65dc5-749f-11ec-8be6-d4c9ef517024">
<topic>WordPress -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>5.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WordPress project reports:</p>
<blockquote cite="https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/">
<ul><li>Issue with stored XSS through post slugs</li>
<li>Issue with Object injection in some multisite installations</li>
<li>SQL injection vulnerability in WP_Query</li>
<li>SQL injection vulnerability in WP_Meta_Query</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/</url>
</references>
<dates>
<discovery>2022-01-06</discovery>
<entry>2022-01-13</entry>
</dates>
</vuln>
<vuln vid="2a6106c6-73e5-11ec-8fa2-0800270512f4">
<topic>clamav -- invalid pointer read that may cause a crash</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.104.2,1</lt></range>
</package>
<package>
<name>clamav-lts</name>
<range><lt>0.103.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Laurent Delosieres reports:</p>
<blockquote cite="https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html">
<p>
Fix for invalid pointer read that may cause a crash. This issue affects
0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and the
<code>CL_SCAN_GENERAL_COLLECT_METADATA</code> scan option
(the <code>clamscan --gen-json</code> option) is enabled.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-20698</cvename>
<url>https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html</url>
</references>
<dates>
<discovery>2022-01-12</discovery>
<entry>2022-01-12</entry>
</dates>
</vuln>
<vuln vid="672eeea9-a070-4f88-b0f1-007e90a2cbc3">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.330</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.319.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-11-04/">
<h1>Description</h1>
<h5>(Medium) SECURITY-2558 / CVE-2022-20612</h5>
<p>CSRF vulnerability in build triggers</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-20612</cvename>
<url>https://www.jenkins.io/security/advisory/2022-01-12/</url>
</references>
<dates>
<discovery>2022-01-12</discovery>
<entry>2022-01-12</entry>
</dates>
</vuln>
<vuln vid="43f84437-73ab-11ec-a587-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.6.0</ge><lt>14.6.2</lt></range>
<range><ge>14.5.0</ge><lt>14.5.3</lt></range>
<range><ge>7.7</ge><lt>14.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/">
<p>Arbitrary file read via group import feature</p>
<p>Stored XSS in notes</p>
<p>Lack of state parameter on GitHub import project OAuth</p>
<p>Vulnerability related fields are available to unauthorized users on GraphQL API</p>
<p>Deleting packages may cause table locks</p>
<p>IP restriction bypass via GraphQL</p>
<p>Repository content spoofing using Git replacement references</p>
<p>Users can import members from projects that they are not a maintainer on through API</p>
<p>Possibility to direct user to malicious site through Slack integration</p>
<p>Bypassing file size limits to the NPM package repository</p>
<p>User with expired password can still access sensitive information</p>
<p>Incorrect port validation allows access to services on ports 80 and 443 if GitLab is configured to run on another port</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39946</cvename>
<cvename>CVE-2022-0154</cvename>
<cvename>CVE-2022-0152</cvename>
<cvename>CVE-2022-0151</cvename>
<cvename>CVE-2022-0172</cvename>
<cvename>CVE-2022-0090</cvename>
<cvename>CVE-2022-0125</cvename>
<cvename>CVE-2022-0124</cvename>
<cvename>CVE-2021-39942</cvename>
<cvename>CVE-2022-0093</cvename>
<cvename>CVE-2021-39927</cvename>
<url>https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/</url>
</references>
<dates>
<discovery>2022-01-11</discovery>
<entry>2022-01-12</entry>
</dates>
</vuln>
<vuln vid="b927b654-7146-11ec-ad4b-5404a68ad561">
<topic>uriparser -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog">
<p>Fix a bug affecting both uriNormalizeSyntax* and uriMakeOwner*
functions where the text range in .hostText would not be duped using
malloc but remain unchanged (and hence "not owned") for URIs with
an IPv4 or IPv6 address hostname; depending on how an application
uses uriparser, this could lead the application into a use-after-free
situation.
As the second half, fix uriFreeUriMembers* functions that would not
free .hostText memory for URIs with an IPv4 or IPv6 address host;
also, calling uriFreeUriMembers* multiple times on a URI of this
very nature would result in trying to free pointers to stack
(rather than heap) memory.
Fix functions uriNormalizeSyntax* for out-of-memory situations
(i.e. malloc returning NULL) for URIs containing empty segments
(any of user info, host text, query, or fragment) where previously
pointers to stack (rather than heap) memory were freed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-46141</cvename>
<cvename>CVE-2021-46142</cvename>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog</url>
</references>
<dates>
<discovery>2022-01-06</discovery>
<entry>2022-01-09</entry>
</dates>
</vuln>
<vuln vid="d3e023fb-6e88-11ec-b948-080027240888">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py37-django22</name>
<name>py38-django22</name>
<name>py39-django22</name>
<range><lt>2.2.26</lt></range>
</package>
<package>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>py37-django40</name>
<name>py38-django40</name>
<name>py39-django40</name>
<range><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2022/jan/04/security-releases/">
<p>CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator.</p>
<p>CVE-2021-45116: Potential information disclosure in dictsort template filter.</p>
<p>CVE-2021-45452: Potential directory-traversal via Storage.save().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45115</cvename>
<cvename>CVE-2021-45116</cvename>
<cvename>CVE-2021-45452</cvename>
<url>https://www.djangoproject.com/weblog/2022/jan/04/security-releases/</url>
</references>
<dates>
<discovery>2021-12-20</discovery>
<entry>2022-01-06</entry>
</dates>
</vuln>
<vuln vid="9c990e67-6e30-11ec-82db-b42e991fc52e">
<topic>routinator -- multiple vulnerabilities</topic>
<affects>
<package>
<name>routinator</name>
<range><lt>0.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nlnetlabs reports:</p>
<blockquote cite="https://nlnetlabs.nl/projects/rpki/security-advisories/">
<p>Release 0.10.2 contains fixes for the following issues:</p>
<ul>
<li>Medium CVE-2021-43172: Infinite length chain of RRDP
repositories. Credit: Koen van Hove. Date: 2021-11-09</li>
<li>Medium CVE-2021-43173: Hanging RRDP request.
Credit: Koen van Hove. Date: 2021-11-09</li>
<li>Medium CVE-2021-43174: gzip transfer encoding caused
out-of-memory crash. Credit Koen van Hove. Date: 2021-11-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43172</cvename>
<cvename>CVE-2021-43173</cvename>
<cvename>CVE-2021-43174</cvename>
<url>https://nlnetlabs.nl/projects/rpki/security-advisories/</url>
</references>
<dates>
<discovery>2021-11-09</discovery>
<entry>2022-01-05</entry>
</dates>
</vuln>
<vuln vid="9eeccbf3-6e26-11ec-bb10-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>97.0.4692.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html">
<p>This release contains 37 security fixes, including:</p>
<ul>
<li>[$TBD][1275020] Critical CVE-2022-0096: Use after free in
Storage. Reported by Yangkang (@dnpushme) of 360 ATA on
2021-11-30</li>
<li>[1117173] High CVE-2022-0097: Inappropriate implementation in
DevTools. Reported by David Erceg on 2020-08-17</li>
<li>[1273609] High CVE-2022-0098: Use after free in Screen Capture.
Reported by @ginggilBesel on 2021-11-24</li>
<li>[1245629] High CVE-2022-0099: Use after free in Sign-in.
Reported by Rox on 2021-09-01</li>
<li>[1238209] High CVE-2022-0100: Heap buffer overflow in Media
streams API. Reported by Cassidy Kim of Amber Security Lab, OPPO
Mobile Telecommunications Corp. Ltd. on 2021-08-10</li>
<li>[1249426] High CVE-2022-0101: Heap buffer overflow in Bookmarks.
Reported by raven (@raid_akame) on 2021-09-14</li>
<li>[1260129] High CVE-2022-0102: Type Confusion in V8 . Reported by
Brendon Tiszka on 2021-10-14</li>
<li>[1272266] High CVE-2022-0103: Use after free in SwiftShader.
Reported by Abraruddin Khan and Omair on 2021-11-21</li>
<li>[1273661] High CVE-2022-0104: Heap buffer overflow in ANGLE.
Reported by Abraruddin Khan and Omair on 2021-11-25</li>
<li>[1274376] High CVE-2022-0105: Use after free in PDF. Reported by
Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications
Corp. Ltd. on 2021-11-28</li>
<li>[1278960] High CVE-2022-0106: Use after free in Autofill.
Reported by Khalil Zhani on 2021-12-10</li>
<li>[1248438] Medium CVE-2022-0107: Use after free in File Manager
API. Reported by raven (@raid_akame) on 2021-09-10</li>
<li>[1248444] Medium CVE-2022-0108: Inappropriate implementation in
Navigation. Reported by Luan Herrera (@lbherrera_) on
2021-09-10</li>
<li>[1261689] Medium CVE-2022-0109: Inappropriate implementation in
Autofill. Reported by Young Min Kim (@ylemkimon), CompSec Lab at
Seoul National University on 2021-10-20</li>
<li>[1237310] Medium CVE-2022-0110: Incorrect security UI in
Autofill. Reported by Alesandro Ortiz on 2021-08-06</li>
<li>[1241188] Medium CVE-2022-0111: Inappropriate implementation in
Navigation. Reported by garygreen on 2021-08-18</li>
<li>[1255713] Medium CVE-2022-0112: Incorrect security UI in Browser
UI. Reported by Thomas Orlita on 2021-10-04</li>
<li>[1039885] Medium CVE-2022-0113: Inappropriate implementation in
Blink. Reported by Luan Herrera (@lbherrera_) on 2020-01-07</li>
<li>[1267627] Medium CVE-2022-0114: Out of bounds memory access in
Web Serial. Reported by Looben Yang on 2021-11-06</li>
<li>[1268903] Medium CVE-2022-0115: Uninitialized Use in File API.
Reported by Mark Brand of Google Project Zero on 2021-11-10</li>
<li>[1272250] Medium CVE-2022-0116: Inappropriate implementation in
Compositing. Reported by Irvan Kurniawan (sourc7) on
2021-11-20</li>
<li>[1115847] Low CVE-2022-0117: Policy bypass in Service Workers.
Reported by Dongsung Kim (@kid1ng) on 2020-08-13</li>
<li>[1238631] Low CVE-2022-0118: Inappropriate implementation in
WebShare. Reported by Alesandro Ortiz on 2021-08-11</li>
<li>[1262953] Low CVE-2022-0120: Inappropriate implementation in
Passwords. Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0096</cvename>
<cvename>CVE-2022-0097</cvename>
<cvename>CVE-2022-0098</cvename>
<cvename>CVE-2022-0099</cvename>
<cvename>CVE-2022-0100</cvename>
<cvename>CVE-2022-0101</cvename>
<cvename>CVE-2022-0102</cvename>
<cvename>CVE-2022-0103</cvename>
<cvename>CVE-2022-0104</cvename>
<cvename>CVE-2022-0105</cvename>
<cvename>CVE-2022-0106</cvename>
<cvename>CVE-2022-0107</cvename>
<cvename>CVE-2022-0108</cvename>
<cvename>CVE-2022-0109</cvename>
<cvename>CVE-2022-0110</cvename>
<cvename>CVE-2022-0111</cvename>
<cvename>CVE-2022-0112</cvename>
<cvename>CVE-2022-0113</cvename>
<cvename>CVE-2022-0114</cvename>
<cvename>CVE-2022-0115</cvename>
<cvename>CVE-2022-0116</cvename>
<cvename>CVE-2022-0117</cvename>
<cvename>CVE-2022-0118</cvename>
<cvename>CVE-2022-0120</cvename>
<url>https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2022-01-04</discovery>
<entry>2022-01-05</entry>
</dates>
</vuln>
<vuln vid="47197b47-6a1a-11ec-8be6-d4c9ef517024">
<topic>Roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="://roundcube.net/news/2021/12/30/update-1.5.2-released">
<p>Cross-site scripting (XSS) via HTML messages with malicious CSS
content</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2021/12/30/update-1.5.2-released</url>
</references>
<dates>
<discovery>2021-12-30</discovery>
<entry>2021-12-31</entry>
</dates>
</vuln>
<vuln vid="c1b2b492-6999-11ec-a50c-001cc0382b2f">
<topic>Mbed TLS -- Potential double-free after an out of memory error</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.12</lt></range>
<range><ge>2.17.0</ge><lt>2.28.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manuel Pégourié-Gonnard reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12">
<p>If mbedtls_ssl_set_session() or mbedtls_ssl_get_session() were to
fail with MBEDTLS_ERR_SSL_ALLOC_FAILED (in an out of memory
condition), then calling mbedtls_ssl_session_free() and
mbedtls_ssl_free() in the usual manner would cause an internal
session buffer to be freed twice, due to two structures both having
valid pointers to it after a call to ssl_session_copy().</p>
<p>An attacker could potentially trigger the out of memory condition,
and therefore use this bug to create memory corruption, which could
then be further exploited or targetted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44732</cvename>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12</url>
</references>
<dates>
<discovery>2021-12-14</discovery>
<entry>2021-12-30</entry>
</dates>
</vuln>
<vuln vid="ede832bf-6576-11ec-a636-000c29061ce6">
<topic>OpenDMARC - Remote denial of service</topic>
<affects>
<package>
<name>opendmarc</name>
<range><ge>1.4.1</ge><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenDMARC 1.4.1 and 1.4.1.1 will dereference a NULL pointer when
encountering a multi-value From: header field. A remote attacker can
send a specially crafted message resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2021-34555</cvename>
<url>https://github.com/trusteddomainproject/OpenDMARC/issues/179</url>
</references>
<dates>
<discovery>2021-06-09</discovery>
<entry>2021-12-30</entry>
</dates>
</vuln>
<vuln vid="937aa1d6-685e-11ec-a636-000c29061ce6">
<topic>OpenDMARC - Multiple vulnerabilities</topic>
<affects>
<package>
<name>opendmarc</name>
<range><lt>1.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenDMARC releases prior to 1.4.1 are susceptible to the following
vulnerabilities:</p>
<ul>
<li>(CVE-2019-16378) OpenDMARC through 1.3.2 and 1.4.x through
1.4.0-Beta1 is prone to a signature-bypass vulnerability with
multiple From: addresses, which might affect applications that
consider a domain name to be relevant to the origin of an e-mail
message.</li>
<li>(CVE-2019-20790) OpenDMARC through 1.3.2 and 1.4.x, when used
with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC
authentication in situations where the HELO field is inconsistent
with the MAIL FROM field.</li>
<li>(CVE-2020-12272) OpenDMARC through 1.3.2 and 1.4.x allows
attacks that inject authentication results to provide false
information about the domain that originated an e-mail
message.</li>
<li>(CVE-2020-12460) OpenDMARC through 1.3.2 and 1.4.x through
1.4.0-Beta1 has improper null termination in the function
opendmarc_xml_parse that can result in a one-byte heap overflow in
opendmarc_xml when parsing a specially crafted DMARC aggregate
report. This can cause remote memory corruption.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2019-16378</cvename>
<cvename>CVE-2019-20790</cvename>
<cvename>CVE-2020-12272</cvename>
<cvename>CVE-2020-12460</cvename>
<url>https://github.com/trusteddomainproject/OpenDMARC/blob/rel-opendmarc-1-4-1-1/RELEASE_NOTES</url>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-12-30</entry>
</dates>
</vuln>
<vuln vid="a4ff3673-d742-4b83-8c2b-3ddafe732034">
<topic>minio -- User privilege escalation</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2021.12.27.07.23.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>minio developers report:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx">
<p>AddUser() API endpoint was exposed to a legacy behavior. i.e it accepts a "policy" field</p>
<p>This API is mainly used to create a user or update a user's password.</p>
<p>However, a malicious client can hand-craft an HTTP API call that allows for updating Policy for a user and gaining higher privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43858</cvename>
<url>https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx</url>
</references>
<dates>
<discovery>2021-12-27</discovery>
<entry>2021-12-29</entry>
</dates>
</vuln>
<vuln vid="ed8a4215-675c-11ec-8dd4-a0f3c100ae18">
<topic>Pillow -- Regular Expression Denial of Service (ReDoS)</topic>
<affects>
<package>
<name>py38-pillow</name>
<range><ge>5.2.0</ge><lt>8.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Advisory Database reports:</p>
<blockquote cite="https://github.com/advisories/GHSA-98vv-pw6r-q6q4">
<p>Uncontrolled Resource Consumption in pillow.</p>
<p>The package pillow from 0 and before 8.3.2 are vulnerable to Regular
Expression Denial of Service (ReDoS) via the getrgb function.</p>
<p>References:</p>
<ul>
<li>https://nvd.nist.gov/vuln/detail/CVE-2021-23437</li>
<li>https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b</li>
<li>https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html</li>
<li>https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443</li>
<li>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/</li>
<li>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-23437</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-23437</url>
</references>
<dates>
<discovery>2021-09-02</discovery>
<entry>2021-09-03</entry>
</dates>
</vuln>
<vuln vid="d1be3d73-6737-11ec-9eea-589cfc007716">
<topic>OpenSearch -- Log4Shell</topic>
<affects>
<package>
<name>opensearch</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSearch reports:</p>
<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-1-2-3/">
<p>CVE-2021-45105 for Log4j was issued after the release of OpenSearch 1.2.2. This CVE advises upgrading to Log4j 2.17.0. While there has been no observed reproduction of the issue described in CVE-2021-45105 in OpenSearch, we have released OpenSearch 1.2.3 which updates Log4j to version 2.17.0.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45105</cvename>
<url>https://opensearch.org/blog/releases/2021/12/update-1-2-3/</url>
</references>
<dates>
<discovery>2021-12-16</discovery>
<entry>2021-12-27</entry>
</dates>
</vuln>
<vuln vid="b0f49cb9-6736-11ec-9eea-589cfc007716">
<topic>OpenSearch -- Log4Shell</topic>
<affects>
<package>
<name>opensearch</name>
<range><lt>1.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSearch reports:</p>
<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-1-2-2/">
<p>CVE-2021-45046 was issued shortly following the release of OpenSearch 1.2.1. This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Out of an abundance of caution, the team is releasing OpenSearch 1.2.2 which includes Log4j 2.16.0. While there has been no observed reproduction of the issue described in CVE-2021-45046, Log4j 2.16.0 takes much more extensive JNDI mitigation measures.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45046</cvename>
<url>https://opensearch.org/blog/releases/2021/12/update-1-2-2/</url>
</references>
<dates>
<discovery>2021-12-14</discovery>
<entry>2021-12-27</entry>
</dates>
</vuln>
<vuln vid="1135e939-62b4-11ec-b8e2-1c1b0d9ea7e6">
<topic>opengrok -- Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok.</topic>
<affects>
<package>
<name>opengrok</name>
<range><le>1.6.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bobby Rauch of Accenture reports:</p>
<blockquote cite="https://medium.com/@bobbyrsec/oracle-opengrok-rce-cve-2021-2322-a284e5621bfe">
<p>I ended up finding OpenGrok, and after careful testing, discovered that OpenGrok insecurely deserializes XML input, which can lead to Remote Code Execution. This vulnerability was found in all versions of OpenGrok <1.6.8 and was reported to Oracle. The vulnerability has now been patched in OpenGrok 1.6.9, and has been issued a CVE. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2322)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-2322</cvename>
<url>https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html</url>
<url>https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html</url>
<url>https://github.com/oracle/opengrok/pull/3528</url>
</references>
<dates>
<discovery>2021-04-07</discovery>
<entry>2021-12-21</entry>
</dates>
</vuln>
<vuln vid="0a50bb48-625f-11ec-a1fb-080027cb2f6f">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki135</name>
<range><lt>1.35.5</lt></range>
</package>
<package>
<name>mediawiki136</name>
<range><lt>1.36.3</lt></range>
</package>
<package>
<name>mediawiki137</name>
<range><lt>1.37.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA/">
<p>(T292763. CVE-2021-44854) REST API incorrectly publicly caches
autocomplete search results from private wikis.</p>
<p>(T271037, CVE-2021-44856) Title blocked in AbuseFilter can be created via
Special:ChangeContentModel.</p>
<p>(T297322, CVE-2021-44857) Unauthorized users can use action=mcrundo to
replace the content of arbitrary pages.</p>
<p> (T297322, CVE-2021-44858) Unauthorized users can view contents of private
wikis using various actions.</p>
<p>(T297574, CVE-2021-45038) Unauthorized users can access private wiki
contents using rollback action</p>
<p>(T293589, CVE-2021-44855) Blind Stored XSS in VisualEditor media dialog.</p>
<p>(T294686) Special:Nuke doesn't actually delete pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44854</cvename>
<cvename>CVE-2021-44856</cvename>
<cvename>CVE-2021-44857</cvename>
<cvename>CVE-2021-44858</cvename>
<cvename>CVE-2021-45038</cvename>
<cvename>CVE-2021-44855</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA/</url>
</references>
<dates>
<discovery>2021-12-01</discovery>
<entry>2021-12-21</entry>
</dates>
</vuln>
<vuln vid="650734b2-7665-4170-9a0a-eeced5e10a5e">
<topic>graylog -- remote code execution in log4j from user-controlled log input</topic>
<affects>
<package>
<name>graylog</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="https://logging.apache.org/log4j/2.x/security.html">
<p>It was found that the fix to address CVE-2021-44228 in Apache
Log4j 2.15.0 was incomplete in certain non-default
configurations. This could allows attackers with control over
Thread Context Map (MDC) input data when the logging
configuration uses a non-default Pattern Layout with either a
Context Lookup (for example, $${ctx:loginId}) or a Thread
Context Map pattern (%X, %mdc, or %MDC) to craft malicious input
data using a JNDI Lookup pattern resulting in a denial of
service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt
to restrict JNDI LDAP lookups to localhost by default. Log4j
2.16.0 fixes this issue by removing support for message lookup
patterns and disabling JNDI functionality by default.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-45046</cvename>
<url>https://github.com/Graylog2/graylog2-server/commit/d3e441f</url>
<url>https://github.com/Graylog2/graylog2-server/commit/dd24b85</url>
<url>https://logging.apache.org/log4j/2.x/security.html</url>
</references>
<dates>
<discovery>2021-11-14</discovery>
<entry>2021-12-17</entry>
</dates>
</vuln>
<vuln vid="ca982e2d-61a9-11ec-8be6-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>moderate: Possible NULL dereference or SSRF in forward proxy
configurations in Apache HTTP Server 2.4.51 and earlier (CVE-2021-44224)
<br/>A crafted URI sent to httpd configured as a forward proxy
(ProxyRequests on) can cause a crash (NULL pointer dereference) or, for
configurations mixing forward and reverse proxy declarations, can allow
for requests to be directed to a declared Unix Domain Socket endpoint
(Server Side Request Forgery).</p>
<p>high: Possible buffer overflow when parsing multipart content in
mod_lua of Apache HTTP Server 2.4.51 and earlier (CVE-2021-44790)<br/>A
carefully crafted request body can cause a buffer overflow in the
mod_lua multipart parser (r:parsebody() called from Lua scripts).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44224</cvename>
<cvename>CVE-2021-44790</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2021-12-20</discovery>
<entry>2021-12-20</entry>
</dates>
</vuln>
<vuln vid="1ea05bb8-5d74-11ec-bb1e-001517a2e1a4">
<topic>serviio -- affected by log4j vulnerability</topic>
<affects>
<package>
<name>serviio</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Serviio reports:</p>
<blockquote cite="https://serviio.org/news/124-version-2-2-1-released">
<p>Serviio is affectred by the log4j vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44228</cvename>
</references>
<dates>
<discovery>2021-12-13</discovery>
<entry>2021-12-15</entry>
</dates>
</vuln>
<vuln vid="897e1962-5d5a-11ec-a3ed-040e3c3cf7e7">
<topic>Privoxy -- Multiple vulnerabilities (memory leak, XSS)</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>3.0.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy reports:</p>
<blockquote cite="https://lists.privoxy.org/pipermail/privoxy-announce/2021-December/000009.html">
<p>cgi_error_no_template(): Encode the template name to prevent
XSS (cross-site scripting) when Privoxy is configured to servce
the user-manual itself.</p>
<p>Commit 0e668e9409c. OVE-20211102-0001. CVE-2021-44543.
Reported by: Artem Ivanov</p>
<p>get_url_spec_param(): Free memory of compiled pattern spec
before bailing.
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit 652b4b7cb0. OVE-20211201-0003. CVE-2021-44540.</p>
<p>process_encrypted_request_headers(): Free header memory when
failing to get the request destination.
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit 0509c58045. OVE-20211201-0002. CVE-2021-44541.</p>
<p>send_http_request(): Prevent memory leaks when handling errors
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit c48d1d6d08. OVE-20211201-0001. CVE-2021-44542.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44540</cvename>
<cvename>CVE-2021-44541</cvename>
<cvename>CVE-2021-44542</cvename>
<cvename>CVE-2021-44543</cvename>
<url>https://lists.privoxy.org/pipermail/privoxy-announce/2021-December/000009.html</url>
</references>
<dates>
<discovery>2021-12-09</discovery>
<entry>2021-12-15</entry>
</dates>
</vuln>
<vuln vid="0132ca5b-5d11-11ec-8be6-d4c9ef517024">
<topic>OpenSSL -- Certificate validation issue</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20211214.txt">
<p>Invalid handling of X509_verify_cert() internal errors in libssl
(Moderate)</p>
<p>Internally libssl in OpenSSL calls X509_verify_cert() on the client
side to verify a certificate supplied by a server. That function may
return a negative return value to indicate an internal error (for
example out of memory). Such a negative return value is mishandled by
OpenSSL and will cause an IO function (such as SSL_connect() or
SSL_do_handshake()) to not indicate success and a subsequent call to
SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY.
This return value is only supposed to be returned by OpenSSL if the
application has previously called SSL_CTX_set_cert_verify_callback().
Since most applications do not do this the
SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be
totally unexpected and applications may not behave correctly as a
result. The exact behaviour will depend on the application but it
could result in crashes, infinite loops or other similar incorrect
responses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-4044</cvename>
<url>https://www.openssl.org/news/secadv/20211214.txt</url>
</references>
<dates>
<discovery>2021-12-14</discovery>
<entry>2021-12-14</entry>
</dates>
</vuln>
<vuln vid="515df85a-5cd7-11ec-a16d-001517a2e1a4">
<topic>bastillion -- log4j vulnerability</topic>
<affects>
<package>
<name>bastillion</name>
<range><lt>3.10.00_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FreeBSD port maintainer reports:</p>
<blockquote>
<p>Bastillion uses log4j.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44228</cvename>
</references>
<dates>
<discovery>2021-12-10</discovery>
<entry>2021-12-14</entry>
</dates>
</vuln>
<vuln vid="fb9ba490-5cc4-11ec-aac7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>96.0.4664.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html">
<p>This release contains 5 security fixes, including:</p>
<ul>
<li>[1263457] Critical CVE-2021-4098: Insufficient data validation
in Mojo. Reported by Sergei Glazunov of Google Project Zero on
2021-10-26</li>
<li>[1270658] High CVE-2021-4099: Use after free in Swiftshader.
Reported by Aki Helin of Solita on 2021-11-16</li>
<li>[1272068] High CVE-2021-4100: Object lifecycle issue in ANGLE.
Reported by Aki Helin of Solita on 2021-11-19</li>
<li>[1262080] High CVE-2021-4101: Heap buffer overflow in
Swiftshader. Reported by Abraruddin Khan and Omair on
2021-10-21</li>
<li>[1278387] High CVE-2021-4102: Use after free in V8. Reported by
Anonymous on 2021-12-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-4098</cvename>
<cvename>CVE-2021-4099</cvename>
<cvename>CVE-2021-4100</cvename>
<cvename>CVE-2021-4101</cvename>
<cvename>CVE-2021-4102</cvename>
<url>https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2021-12-13</discovery>
<entry>2021-12-14</entry>
</dates>
</vuln>
<vuln vid="0dcf68fa-5c31-11ec-875e-901b0e9408dc">
<topic>Matrix clients -- several vulnerabilities</topic>
<affects>
<package>
<name>cinny</name>
<range><lt>1.6.0</lt></range>
</package>
<package>
<name>element-web</name>
<range><lt>1.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk">
<p>Today we are releasing security updates to libolm, matrix-js-sdk,
and several clients including Element Web / Desktop. Users are
encouraged to upgrade as soon as possible.</p>
<p>These releases mitigate a buffer overflow in olm_session_describe,
a libolm debugging function used by matrix-js-sdk in its end-to-end
encryption (E2EE) implementation. If you rely on matrix-js-sdk for
E2EE, you are affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk</url>
</references>
<dates>
<discovery>2021-12-03</discovery>
<entry>2021-12-13</entry>
</dates>
</vuln>
<vuln vid="93a1c9a7-5bef-11ec-a47a-001517a2e1a4">
<topic>openhab -- log4j remote code injection</topic>
<affects>
<package>
<name>openhab2</name>
<name>openhab</name>
<range><le>2.5.12</le></range>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openhab reports:</p>
<blockquote cite="https://github.com/openhab/openhab-distro/security/advisories/GHSA-j99j-qp89-pcfq">
<p>Any openHAB instance that is publicly available or which consumes untrusted content from remote servers is potentially a target of this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44228</cvename>
<url>https://github.com/openhab/openhab-distro/security/advisories/GHSA-j99j-qp89-pcfq</url>
<url>https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr</url>
<url>https://github.com/advisories/GHSA-jfh8-c2jp-5v3q</url>
</references>
<dates>
<discovery>2021-12-10</discovery>
<entry>2021-12-13</entry>
</dates>
</vuln>
<vuln vid="66cf7c43-5be3-11ec-a587-001b217b3468">
<topic>Solr -- Apache Log4J</topic>
<affects>
<package>
<name>apache-solr</name>
<range><lt>8.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Solr reports:</p>
<blockquote cite="https://solr.apache.org/security.html">
<p>Apache Solr affected by Apache Log4J</p>
</blockquote>
</body>
</description>
<references>
<url>https://solr.apache.org/security.html</url>
</references>
<dates>
<discovery>2021-12-10</discovery>
<entry>2021-12-13</entry>
<modified>2021-12-13</modified>
</dates>
</vuln>
<vuln vid="4b1ac5a3-5bd4-11ec-8602-589cfc007716">
<topic>OpenSearch -- Log4Shell</topic>
<affects>
<package>
<name>opensearch</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSearch reports:</p>
<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/">
<p>A <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/">recently published</a> security issue (<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">CVE-2021-44228</a>) affects several versions of the broadly-used <a href="https://logging.apache.org/log4j/2.x/">Apache Log4j</a> library. Some software in the OpenSearch project includes versions of Log4j referenced in this CVE. While, at time of writing, the team has not found a reproduceable example in OpenSearch of remote code execution (RCE) described in this issue, its severity is such that all users should take mitigation measures. As recommended by the advisory, the team has released OpenSearch 1.2.1, which updates Log4j to version 2.15.0. For those who cannot upgrade to 1.2.1, the <a href="https://logging.apache.org/log4j/2.x/">Log4j website outlines additional measures to mitigate the issue</a>. This patch release also addresses <a href="https://alas.aws.amazon.com/AL2/ALAS-2021-1722.html">CVE-2021-4352</a> in the OpenSearch Docker distributions..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44228</cvename>
<url>https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/</url>
</references>
<dates>
<discovery>2021-12-11</discovery>
<entry>2021-12-13</entry>
</dates>
</vuln>
<vuln vid="c2a7de31-5b42-11ec-8398-6c3be5272acd">
<topic>Grafana -- Directory Traversal</topic>
<affects>
<package>
<name>grafana</name>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Security Labs reports:</p>
<blockquote cite="https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m">
<p>A vulnerability through which authenticated users could read out fully lowercase or fully uppercase <code>.md</code> files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary <code>.csv</code> files through directory traversal. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud">Grafana Cloud</a> been vulnerable.</p>
<p><strong>The vulnerable URL path is:</strong> <code>/api/ds/query</code></p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43815</cvename>
<url>https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/</url>
</references>
<dates>
<discovery>2021-12-09</discovery>
<entry>2021-12-12</entry>
</dates>
</vuln>
<vuln vid="a994ff7d-5b3f-11ec-8398-6c3be5272acd">
<topic>Grafana -- Directory Traversal</topic>
<affects>
<package>
<name>grafana</name>
<range><ge>5.0.0</ge><lt>7.5.12</lt></range>
<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
</package>
<package>
<name>grafana6</name>
<range><ge>6.0.0</ge></range>
</package>
<package>
<name>grafana7</name>
<range><ge>7.0.0</ge><lt>7.5.12</lt></range>
</package>
<package>
<name>grafana8</name>
<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Security Labs reports:</p>
<blockquote cite="https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q">
<p>A vulnerability through which authenticated users could read out fully lowercase or fully uppercase <code>.md</code> files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary <code>.csv</code> files through directory traversal. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud">Grafana Cloud</a> been vulnerable.</p>
<p><strong>The vulnerable URL path is:</strong> <code>/api/plugins/.*/markdown/.*</code> for <code>.md</code> files</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43813</cvename>
<url>https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/</url>
</references>
<dates>
<discovery>2021-12-09</discovery>
<entry>2021-12-12</entry>
</dates>
</vuln>
<vuln vid="e33880ed-5802-11ec-8398-6c3be5272acd">
<topic>Grafana -- Path Traversal</topic>
<affects>
<package>
<name>grafana8</name>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.0.7</lt></range>
<range><ge>8.1.0</ge><lt>8.1.8</lt></range>
<range><ge>8.2.0</ge><lt>8.2.7</lt></range>
<range><ge>8.3.0</ge><lt>8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/">
<p>Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud/?pg=blog">Grafana Cloud</a> been vulnerable.</p>
<p><strong>The vulnerable URL path is:</strong> <grafana_host_url><em>/public/plugins/<“plugin-id”></em> where <em><“plugin-id”></em> is the plugin ID for any installed plugin.</p>
<p>Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:</p>
<ul>
<li><grafana_host_url>/public/plugins/alertlist/</li>
<li><grafana_host_url>/public/plugins/annolist/</li>
<li><grafana_host_url>/public/plugins/barchart/</li>
<li><grafana_host_url>/public/plugins/bargauge/</li>
<li><grafana_host_url>/public/plugins/candlestick/</li>
<li><grafana_host_url>/public/plugins/cloudwatch/</li>
<li><grafana_host_url>/public/plugins/dashlist/</li>
<li><grafana_host_url>/public/plugins/elasticsearch/</li>
<li><grafana_host_url>/public/plugins/gauge/</li>
<li><grafana_host_url>/public/plugins/geomap/</li>
<li><grafana_host_url>/public/plugins/gettingstarted/</li>
<li><grafana_host_url>/public/plugins/grafana-azure-monitor-datasource/</li>
<li><grafana_host_url>/public/plugins/graph/</li>
<li><grafana_host_url>/public/plugins/heatmap/</li>
<li><grafana_host_url>/public/plugins/histogram/</li>
<li><grafana_host_url>/public/plugins/influxdb/</li>
<li><grafana_host_url>/public/plugins/jaeger/</li>
<li><grafana_host_url>/public/plugins/logs/</li>
<li><grafana_host_url>/public/plugins/loki/</li>
<li><grafana_host_url>/public/plugins/mssql/</li>
<li><grafana_host_url>/public/plugins/mysql/</li>
<li><grafana_host_url>/public/plugins/news/</li>
<li><grafana_host_url>/public/plugins/nodeGraph/</li>
<li><grafana_host_url>/public/plugins/opentsdb</li>
<li><grafana_host_url>/public/plugins/piechart/</li>
<li><grafana_host_url>/public/plugins/pluginlist/</li>
<li><grafana_host_url>/public/plugins/postgres/</li>
<li><grafana_host_url>/public/plugins/prometheus/</li>
<li><grafana_host_url>/public/plugins/stackdriver/</li>
<li><grafana_host_url>/public/plugins/stat/</li>
<li><grafana_host_url>/public/plugins/state-timeline/</li>
<li><grafana_host_url>/public/plugins/status-history/</li>
<li><grafana_host_url>/public/plugins/table/</li>
<li><grafana_host_url>/public/plugins/table-old/</li>
<li><grafana_host_url>/public/plugins/tempo/</li>
<li><grafana_host_url>/public/plugins/testdata/</li>
<li><grafana_host_url>/public/plugins/text/</li>
<li><grafana_host_url>/public/plugins/timeseries/</li>
<li><grafana_host_url>/public/plugins/welcome/</li>
<li><grafana_host_url>/public/plugins/zipkin/</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43798</cvename>
<url>https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/</url>
</references>
<dates>
<discovery>2021-12-03</discovery>
<entry>2021-12-11</entry>
</dates>
</vuln>
<vuln vid="99bff2bd-4852-11ec-a828-6c3be5272acd">
<topic>Grafana -- Incorrect Access Control</topic>
<affects>
<package>
<name>grafana8</name>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/">
<p>When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41244</cvename>
<url>https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/</url>
</references>
<dates>
<discovery>2021-11-02</discovery>
<entry>2021-12-11</entry>
</dates>
</vuln>
<vuln vid="4b478274-47a0-11ec-bd24-6c3be5272acd">
<topic>Grafana -- XSS</topic>
<affects>
<package>
<name>grafana8</name>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/">
<p>If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.</p>
<p>The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.</p>
<p>There are two ways an unauthenticated user can open a page in Grafana that contains the login button:</p>
<ul>
<li>Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.</li>
<li>The link is to an unauthenticated page. The following pages are vulnerable:
<ul>
<li><code>/dashboard-solo/snapshot/*</code></li>
<li><code>/dashboard/snapshot/*</code></li>
<li><code>/invite/:code</code></li>
</ul>
</li>
</ul>
<p>The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: <code>{{ }}</code></p>
<p>An example of an expression would be: <code>{{constructor.constructor(‘alert(1)’)()}}</code>. This can be included in the link URL like this:</p>
<p><a href="https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1">https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1</a></p>
<p>When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41174</cvename>
<url>https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/</url>
</references>
<dates>
<discovery>2021-10-21</discovery>
<entry>2021-12-11</entry>
</dates>
</vuln>
<vuln vid="942fff11-5ac4-11ec-89ea-c85b76ce9b5a">
<topic>p7zip -- usage of uninitialized memory</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>18.05</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-10115">
<p>
Incorrect initialization logic of RAR decoder objects in
7-Zip 18.03 and before can lead to usage of
uninitialized memory, allowing remote attackers to cause
a denial of service (segmentation fault) or execute
arbitrary code via a crafted RAR archive.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10115</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-10115</url>
</references>
<dates>
<discovery>2018-05-02</discovery>
<entry>2021-12-11</entry>
</dates>
</vuln>
<vuln vid="3fadd7e4-f8fb-45a0-a218-8fd6423c338f">
<topic>graylog -- include log4j patches</topic>
<affects>
<package>
<name>graylog</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation repos:</p>
<blockquote cite="https://logging.apache.org/log4j/2.x/security.html">
<p>Apache Log4j2 JNDI features do not protect against attacker
controlled LDAP and other JNDI related endpoints. An attacker
who can control log messages or paramters can execute arbitrary
code from attacker-controller LDAP servers when message lookup
substitution is enabled.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44228</cvename>
<url>https://github.com/Graylog2/graylog2-server/commit/d3e441f1126f0dc292e986879039a87c59375b2a</url>
<url>https://logging.apache.org/log4j/2.x/security.html</url>
</references>
<dates>
<discovery>2021-12-10</discovery>
<entry>2021-12-11</entry>
</dates>
</vuln>
<vuln vid="720505fe-593f-11ec-9ba8-002324b2fba8">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/50058">
<p>net/http: limit growth of header canonicalization cache. An
attacker can cause unbounded memory growth in a Go server accepting
HTTP/2 requests.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/50057">
<p>syscall: don’t close fd 0 on ForkExec error. When a Go program
running on a Unix system is out of file descriptors and calls
syscall.ForkExec (including indirectly by using the os/exec
package), syscall.ForkExec can close file descriptor 0 as it fails.
If this happens (or can be provoked) repeatedly, it can result in
misdirected I/O such as writing network traffic intended for one
connection to a different connection, or content intended for one
file to a different one.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44716</cvename>
<url>https://github.com/golang/go/issues/50058</url>
<cvename>CVE-2021-44717</cvename>
<url>https://github.com/golang/go/issues/50057</url>
</references>
<dates>
<discovery>2021-12-08</discovery>
<entry>2021-12-09</entry>
</dates>
</vuln>
<vuln vid="18ac074c-579f-11ec-aac7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>96.0.4664.93</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html">
<p>This release contains 22 security fixes, including:</p>
<ul>
<li>[1267661] High CVE-2021-4052: Use after free in web apps.
Reported by Wei Yuan of MoyunSec VLab on 2021-11-07</li>
<li>[1267791] High CVE-2021-4053: Use after free in UI. Reported by
Rox on 2021-11-08</li>
<li>[1265806] High CVE-2021-4079: Out of bounds write in WebRTC.
Reported by Brendon Tiszka on 2021-11-01</li>
<li>[1239760] High CVE-2021-4054: Incorrect security UI in autofill.
Reported by Alesandro Ortiz on 2021-08-13</li>
<li>[1268738] High CVE-2021-4078: Type confusion in V8. Reported by
Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on
2021-11-09</li>
<li>[1266510] High CVE-2021-4055: Heap buffer overflow in
extensions. Reported by Chen Rong on 2021-11-03</li>
<li>[1260939] High CVE-2021-4056: Type Confusion in loader. Reported
by @__R0ng of 360 Alpha Lab on 2021-10-18</li>
<li>[1262183] High CVE-2021-4057: Use after free in file API.
Reported by Sergei Glazunov of Google Project Zero on
2021-10-21</li>
<li>[1267496] High CVE-2021-4058: Heap buffer overflow in ANGLE.
Reported by Abraruddin Khan and Omair on 2021-11-06</li>
<li>[1270990] High CVE-2021-4059: Insufficient data validation in
loader. Reported by Luan Herrera (@lbherrera_) on 2021-11-17</li>
<li>[1271456] High CVE-2021-4061: Type Confusion in V8. Reported by
Paolo Severini on 2021-11-18</li>
<li>[1272403] High CVE-2021-4062: Heap buffer overflow in BFCache.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-11-22</li>
<li>[1273176] High CVE-2021-4063: Use after free in developer tools.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2021-11-23</li>
<li>[1273197] High CVE-2021-4064: Use after free in screen capture.
Reported by @ginggilBesel on 2021-11-23</li>
<li>[1273674] High CVE-2021-4065: Use after free in autofill.
Reported by 5n1p3r0010 on 2021-11-25</li>
<li>[1274499] High CVE-2021-4066: Integer underflow in ANGLE.
Reported by Jaehun Jeong(@n3sk) of Theori on 2021-11-29</li>
<li>[1274641] High CVE-2021-4067: Use after free in window manager.
Reported by @ginggilBesel on 2021-11-29</li>
<li>[1265197] Low CVE-2021-4068: Insufficient validation of
untrusted input in new tab page. Reported by NDevTK on
2021-10-31</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-4052</cvename>
<cvename>CVE-2021-4053</cvename>
<cvename>CVE-2021-4054</cvename>
<cvename>CVE-2021-4055</cvename>
<cvename>CVE-2021-4056</cvename>
<cvename>CVE-2021-4057</cvename>
<cvename>CVE-2021-4058</cvename>
<cvename>CVE-2021-4059</cvename>
<cvename>CVE-2021-4061</cvename>
<cvename>CVE-2021-4062</cvename>
<cvename>CVE-2021-4063</cvename>
<cvename>CVE-2021-4064</cvename>
<cvename>CVE-2021-4065</cvename>
<cvename>CVE-2021-4066</cvename>
<cvename>CVE-2021-4067</cvename>
<cvename>CVE-2021-4068</cvename>
<cvename>CVE-2021-4078</cvename>
<cvename>CVE-2021-4079</cvename>
<url>https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-12-06</discovery>
<entry>2021-12-07</entry>
</dates>
</vuln>
<vuln vid="b299417a-5725-11ec-a587-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.5.0</ge><lt>14.5.2</lt></range>
<range><ge>14.4.0</ge><lt>14.4.4</lt></range>
<range><ge>0</ge><lt>14.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/">
<p>Group members with developer role can escalate their privilege to maintainer on projects that they import</p>
<p>When user registration is limited, external users that aren't developers shouldn't have access to the CI Lint API</p>
<p>Collision in access memoization leads to potential elevated privileges on groups and projects</p>
<p>Project access token names are returned for unauthenticated requesters</p>
<p>Sensitive info disclosure in logs</p>
<p>Disclosure of a user's custom project and group templates</p>
<p>ReDoS in Maven package version</p>
<p>Potential denial of service via the Diff feature</p>
<p>Regular Expression Denial of Service via user comments</p>
<p>Service desk email accessible by any project member</p>
<p>Regular Expression Denial of Service via quick actions</p>
<p>IDOR in "external status check" API leaks data about any status check on the instance</p>
<p>Default branch name visible in public projects restricting access to the source code repository</p>
<p>Deploy token allows access to disabled project Wiki</p>
<p>Regular Expression Denial of Service via deploy Slash commands</p>
<p>Users can reply to Vulnerability Report discussions despite Only Project Members settings</p>
<p>Unauthorised deletion of protected branches</p>
<p>Author can approve Merge Request after having access revoked</p>
<p>HTML Injection via Swagger UI</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39944</cvename>
<cvename>CVE-2021-39935</cvename>
<cvename>CVE-2021-39937</cvename>
<cvename>CVE-2021-39915</cvename>
<cvename>CVE-2021-39919</cvename>
<cvename>CVE-2021-39930</cvename>
<cvename>CVE-2021-39940</cvename>
<cvename>CVE-2021-39932</cvename>
<cvename>CVE-2021-39933</cvename>
<cvename>CVE-2021-39934</cvename>
<cvename>CVE-2021-39917</cvename>
<cvename>CVE-2021-39916</cvename>
<cvename>CVE-2021-39941</cvename>
<cvename>CVE-2021-39936</cvename>
<cvename>CVE-2021-39938</cvename>
<cvename>CVE-2021-39918</cvename>
<cvename>CVE-2021-39931</cvename>
<cvename>CVE-2021-39945</cvename>
<cvename>CVE-2021-39910</cvename>
<url>https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/</url>
</references>
<dates>
<discovery>2021-12-06</discovery>
<entry>2021-12-07</entry>
</dates>
</vuln>
<vuln vid="47695a9c-5377-11ec-8be6-d4c9ef517024">
<topic>NSS -- Memory corruption</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/">
<p>Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures (Critical)</p>
<p>NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR
are vulnerable to a heap overflow when handling DER-encoded DSA or
RSA-PSS signatures. Applications using NSS for handling signatures
encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be
impacted. Applications using NSS for certificate validation or other
TLS, X.509, OCSP or CRL functionality may be impacted, depending on
how they configure NSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43527</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/</url>
</references>
<dates>
<discovery>2021-12-01</discovery>
<entry>2021-12-02</entry>
</dates>
</vuln>
<vuln vid="0d6efbe3-52d9-11ec-9472-e3667ed6088e">
<topic>mailman < 2.1.38 -- CSRF vulnerability of list mod or member against list admin page</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.38</lt></range>
</package>
<package>
<name>mailman-exim4</name>
<range><lt>2.1.38</lt></range>
</package>
<package>
<name>mailman-exim4-with-htdig</name>
<range><lt>2.1.38</lt></range>
</package>
<package>
<name>mailman-postfix</name>
<range><lt>2.1.38</lt></range>
</package>
<package>
<name>mailman-postfix-with-htdig</name>
<range><lt>2.1.38</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1952384">
<p>A list moderator or list member can potentially carry out a CSRF attack
by getting a list admin to visit a crafted web page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-44227</cvename>
<url>https://bugs.launchpad.net/mailman/+bug/1952384</url>
<url>https://www.mail-archive.com/mailman-users@python.org/msg73979.html</url>
</references>
<dates>
<discovery>2021-11-25</discovery>
<entry>2021-12-01</entry>
</dates>
</vuln>
<vuln vid="4548ec97-4d38-11ec-a539-0800270512f4">
<topic>rubygem-cgi -- cookie prefix spoofing in CGI::Cookie.parse</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>ruby26</name>
<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>rubygem-cgi</name>
<range><lt>0.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ooooooo_q reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/">
<p>
The old versions of <code>CGI::Cookie.parse</code> applied
URL decoding to cookie names. An attacker could exploit
this vulnerability to spoof security prefixes in cookie
names, which may be able to trick a vulnerable
application.
</p>
<p>
By this fix, <code>CGI::Cookie.parse</code> no longer
decodes cookie names. Note that this is an incompatibility
if cookie names that you are using include
non-alphanumeric characters that are URL-encoded.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41819</cvename>
<url>https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/</url>
</references>
<dates>
<discovery>2021-11-24</discovery>
<entry>2021-11-24</entry>
</dates>
</vuln>
<vuln vid="2c6af5c3-4d36-11ec-a539-0800270512f4">
<topic>rubygem-cgi -- buffer overrun in CGI.escape_html</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>rubygem-cgi</name>
<range><lt>0.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chamal reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/">
<p>
A security vulnerability that causes buffer overflow when
you pass a very large string (> 700 MB) to
<code>CGI.escape_html</code> on a platform where
<code>long</code> type takes 4 bytes, typically, Windows.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41816</cvename>
<url>https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/</url>
</references>
<dates>
<discovery>2021-11-24</discovery>
<entry>2021-11-24</entry>
</dates>
</vuln>
<vuln vid="27aa2253-4c72-11ec-b6b9-e86a64caca56">
<topic>py-matrix-synapse -- several vulnerabilities</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<range><lt>1.47.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2021/11/23/synapse-1-47-1-released">
<p>This release patches one high severity issue affecting
Synapse installations 1.47.0 and earlier using the media repository.
An attacker could cause these Synapses to download a remote file
and store it in a directory outside the media repository.</p>
<p>Note that:</p>
<ul>
<li>This only affects homeservers using Synapse's built-in media
repository, as opposed to synapse-s3-storage-provider or
matrix-media-repo.</li>
<li>Attackers cannot control the exact name or destination of the
stored file.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/259994</freebsdpr>
<cvename>CVE-2021-41281</cvename>
<url>https://matrix.org/blog/2021/11/23/synapse-1-47-1-released</url>
</references>
<dates>
<discovery>2021-11-18</discovery>
<entry>2021-11-23</entry>
</dates>
</vuln>
<vuln vid="0bf816f6-3cfe-11ec-86cd-dca632b19f10">
<topic>advancecomp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>advancecomp</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joonun Jang reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889270">
<p>heap buffer overflow running advzip with "-l poc" option</p>
<p>Running 'advzip -l poc' with the attached file raises heap buffer overflow
which may allow a remote attacker to cause unspecified impact including denial-of-service attack.
I expected the program to terminate without segfault, but the program crashes as follow. [...]
</p>
</blockquote>
<p>and other vulnerabilities.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1056</cvename>
<cvename>CVE-2019-8379</cvename>
<cvename>CVE-2019-8383</cvename>
<cvename>CVE-2019-9210</cvename>
</references>
<dates>
<discovery>2018-07-29</discovery>
<entry>2021-11-19</entry>
</dates>
</vuln>
<vuln vid="b8c0cbca-472d-11ec-83dc-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>96.0.4664.45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html">
<p>This release contains 25 security fixes, including:</p>
<ul>
<li>[1263620] High CVE-2021-38008: Use after free in media. Reported
by Marcin Towalski of Cisco Talos on 2021-10-26</li>
<li>[1260649] High CVE-2021-38009: Inappropriate implementation in
cache. Reported by Luan Herrera (@lbherrera_) on 2021-10-16</li>
<li>[1240593] High CVE-2021-38006: Use after free in storage
foundation. Reported by Sergei Glazunov of Google Project Zero on
2021-08-17</li>
<li>[1254189] High CVE-2021-38007: Type Confusion in V8. Reported by
Polaris Feng and SGFvamll at Singular Security Lab on
2021-09-29</li>
<li>[1241091] High CVE-2021-38005: Use after free in loader.
Reported by Sergei Glazunov of Google Project Zero on
2021-08-18</li>
<li>[1264477] High CVE-2021-38010: Inappropriate implementation in
service workers. Reported by Sergei Glazunov of Google Project
Zero on 2021-10-28</li>
<li>[1268274] High CVE-2021-38011: Use after free in storage
foundation. Reported by Sergei Glazunov of Google Project Zero on
2021-11-09</li>
<li>[1262791] Medium CVE-2021-38012: Type Confusion in V8. Reported
by Yonghwi Jin (@jinmo123) on 2021-10-24</li>
<li>[1242392] Medium CVE-2021-38013: Heap buffer overflow in
fingerprint recognition. Reported by raven (@raid_akame) on
2021-08-23</li>
<li>[1248567] Medium CVE-2021-38014: Out of bounds write in
Swiftshader. Reported by Atte Kettunen of OUSPG on 2021-09-10</li>
<li>[957553] Medium CVE-2021-38015: Inappropriate implementation in
input. Reported by David Erceg on 2019-04-29</li>
<li>[1244289] Medium CVE-2021-38016: Insufficient policy
enforcement in background fetch. Reported by Maurice Dauer on
2021-08-28</li>
<li>[1256822] Medium CVE-2021-38017: Insufficient policy enforcement
in iframe sandbox. Reported by NDevTK on 2021-10-05</li>
<li>[1197889] Medium CVE-2021-38018: Inappropriate implementation in
navigation. Reported by Alesandro Ortiz on 2021-04-11</li>
<li>[1251179] Medium CVE-2021-38019: Insufficient policy enforcement
in CORS. Reported by Maurice Dauer on 2021-09-20</li>
<li>[1259694] Medium CVE-2021-38020: Insufficient policy enforcement
in contacts picker. Reported by Luan Herrera (@lbherrera_) on
2021-10-13</li>
<li>[1233375] Medium CVE-2021-38021: Inappropriate implementation in
referrer. Reported by Prakash (@1lastBr3ath) and Jun Kokatsu on
2021-07-27</li>
<li>[1248862] Low CVE-2021-38022: Inappropriate implementation in
WebAuthentication. Reported by Michal Kepkowski on 2021-09-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-38005</cvename>
<cvename>CVE-2021-38006</cvename>
<cvename>CVE-2021-38007</cvename>
<cvename>CVE-2021-38008</cvename>
<cvename>CVE-2021-38009</cvename>
<cvename>CVE-2021-38010</cvename>
<cvename>CVE-2021-38011</cvename>
<cvename>CVE-2021-38012</cvename>
<cvename>CVE-2021-38013</cvename>
<cvename>CVE-2021-38014</cvename>
<cvename>CVE-2021-38015</cvename>
<cvename>CVE-2021-38016</cvename>
<cvename>CVE-2021-38017</cvename>
<cvename>CVE-2021-38018</cvename>
<cvename>CVE-2021-38019</cvename>
<cvename>CVE-2021-38020</cvename>
<cvename>CVE-2021-38021</cvename>
<cvename>CVE-2021-38022</cvename>
<url>https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-11-15</discovery>
<entry>2021-11-16</entry>
</dates>
</vuln>
<vuln vid="6916ea94-4628-11ec-bbe2-0800270512f4">
<topic>rubygem-date -- Regular Expression Denial of Service Vunlerability of Date Parsing Methods</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>ruby26</name>
<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
</package>
<package>
<name>ruby27</name>
<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
</package>
<package>
<name>rubygem-date</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stanislav Valkanov reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/">
<p>
Date's parsing methods including <code>Date.parse</code>
are using Regexps internally, some of which are vulnerable
against regular expression denial of service. Applications
and libraries that apply such methods to untrusted input
may be affected.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41817</cvename>
<url>https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/</url>
</references>
<dates>
<discovery>2021-11-15</discovery>
<entry>2021-11-15</entry>
<modified>2021-11-24</modified>
</dates>
</vuln>
<vuln vid="42a4d82d-4603-11ec-8be6-d4c9ef517024">
<topic>Roundcube -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.4.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports:</p>
<blockquote cite="https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released">
<p>XSS issue in handling attachment filename extension in mimetype mismatch warning</p>
<p>possible SQL injection via some session variables</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released</url>
</references>
<dates>
<discovery>2021-11-12</discovery>
<entry>2021-11-15</entry>
</dates>
</vuln>
<vuln vid="9d7a2b54-4468-11ec-8532-0d24c37c72c8">
<topic>mailman -- 2.1.37 fixes XSS via user options, and moderator offline brute-force vuln against list admin password</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.37</lt></range>
</package>
<package>
<name>mailman-exim4</name>
<range><lt>2.1.37</lt></range>
</package>
<package>
<name>mailman-exim4-with-htdig</name>
<range><lt>2.1.37</lt></range>
</package>
<package>
<name>mailman-postfix</name>
<range><lt>2.1.37</lt></range>
</package>
<package>
<name>mailman-postfix-with-htdig</name>
<range><lt>2.1.37</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1879/NEWS#L8">
<p>A potential XSS attack via the user options page has been reported by
Harsh Jaiswal. This is fixed. CVE-2021-43331 (LP: #1949401).</p>
<p>A potential for for a list moderator to carry out an off-line brute force
attack to obtain the list admin password has been reported by Andre
Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
CVE-2021-43332 (LP: #1949403)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-43331</cvename>
<cvename>CVE-2021-43332</cvename>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1879/NEWS#L8</url>
<url>https://bugs.launchpad.net/mailman/+bug/1949401</url>
<url>https://bugs.launchpad.net/mailman/+bug/1949403</url>
</references>
<dates>
<discovery>2021-11-01</discovery>
<entry>2021-11-13</entry>
</dates>
</vuln>
<vuln vid="2ccd71bd-426b-11ec-87db-6cc21735f730">
<topic>PostgreSQL -- Possible man-in-the-middle attacks</topic>
<affects>
<package>
<name>postgresql14-server</name>
<range><lt>14.1</lt></range>
</package>
<package>
<name>postgresql13-server</name>
<range><lt>13.5</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.9</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.14</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.19</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/">
<p> CVE-2021-23214: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could be abused to send faked SQL commands to the server, although that would only work if the server did not demand any authentication data. (However, a server relying on SSL certificate authentication might well not do so.) </p>
<p> CVE-2021-23222: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214. </p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-23214</cvename>
<cvename>CVE-2021-23222</cvename>
</references>
<dates>
<discovery>2021-11-08</discovery>
<entry>2021-11-10</entry>
</dates>
</vuln>
<vuln vid="bfea59e0-41ee-11ec-9bac-589cfc007716">
<topic>puppet -- Silent Configuration Failure</topic>
<affects>
<package>
<name>puppet6</name>
<range><lt>6.25.1</lt></range>
</package>
<package>
<name>puppet7</name>
<range><lt>7.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/security/cve/cve-2021-27025">
<p>A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-27025</cvename>
<url>https://puppet.com/security/cve/cve-2021-27025</url>
</references>
<dates>
<discovery>2021-11-09</discovery>
<entry>2021-11-10</entry>
</dates>
</vuln>
<vuln vid="3bd3c9f8-41ee-11ec-9bac-589cfc007716">
<topic>puppet -- Unsafe HTTP Redirect</topic>
<affects>
<package>
<name>puppet6</name>
<range><lt>6.25.1</lt></range>
</package>
<package>
<name>puppet7</name>
<range><lt>7.12.1</lt></range>
</package>
<package>
<name>puppetserver6</name>
<range><lt>6.17.1</lt></range>
</package>
<package>
<name>puppetserver7</name>
<range><lt>7.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/security/cve/cve-2021-27023">
<p>A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-27023</cvename>
<url>https://puppet.com/security/cve/cve-2021-27023</url>
</references>
<dates>
<discovery>2021-11-09</discovery>
<entry>2021-11-10</entry>
</dates>
</vuln>
<vuln vid="646923b0-41c7-11ec-a3b2-005056a311d1">
<topic>samba -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>samba413</name>
<range><lt>4.13.14</lt></range>
</package>
<package>
<name>samba414</name>
<range><lt>4.14.10</lt></range>
</package>
<package>
<name>samba415</name>
<range><lt>4.15.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<ul>
<li>CVE-2020-25717: A user in an AD Domain could become root on domain
members.</li>
<li>CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos
tickets issued by an RODC.</li>
<li>CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC
in Kerberos tickets.</li>
<li>CVE-2020-25721: Kerberos acceptors need easy access to stable
AD identifiers (eg objectSid).</li>
<li>CVE-2020-25722: Samba AD DC did not do sufficient access and
conformance checking of data stored.</li>
<li>CVE-2016-2124: SMB1 client connections can be downgraded to plaintext
authentication.</li>
<li>CVE-2021-3738: Use after free in Samba AD DC RPC server.</li>
<li>CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-25717</cvename>
<cvename>CVE-2020-25718</cvename>
<cvename>CVE-2020-25719</cvename>
<cvename>CVE-2020-25721</cvename>
<cvename>CVE-2020-25722</cvename>
<cvename>CVE-2016-2124</cvename>
<cvename>CVE-2021-3738</cvename>
<cvename>CVE-2021-23192</cvename>
<url>https://www.samba.org/samba/security/CVE-2020-25717.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-25718.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-25719.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-25721.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-25722.html</url>
<url>https://www.samba.org/samba/security/CVE-2016-2124.html</url>
<url>https://www.samba.org/samba/security/CVE-2021-3738.html</url>
<url>https://www.samba.org/samba/security/CVE-2021-23192.html</url>
</references>
<dates>
<discovery>2021-11-10</discovery>
<entry>2021-11-10</entry>
</dates>
</vuln>
<vuln vid="17702e54-3da0-11ec-b7e0-3085a9a95629">
<topic>pyrad -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-pyrad</name>
<name>py37-pyrad</name>
<name>py38-pyrad</name>
<name>py39-pyrad</name>
<name>py310-pyrad</name>
<range><lt>2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathaniel McCallum reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=911682">
<p>packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.</p>
</blockquote>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=911685">
<p>The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0294</cvename>
<cvename>CVE-2013-0342</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=911682</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=911685</url>
</references>
<dates>
<discovery>2013-01-15</discovery>
<entry>2021-11-05</entry>
</dates>
</vuln>
<vuln vid="930def19-3e05-11ec-9ba8-002324b2fba8">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/48990">
<p>debug/macho fails out when loading a file that contains a dynamic
symbol table command that indicates a larger number of symbols than
exist in the loaded symbol table.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/48085">
<p>Previously, opening a zip with (*Reader).Open could result in a
panic if the zip contained a file whose name was exclusively made up
of slash characters or ".." path elements. Open could also panic if
passed the empty string directly as an argument.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41771</cvename>
<url>https://github.com/golang/go/issues/48990</url>
<cvename>CVE-2021-41772</cvename>
<url>https://github.com/golang/go/issues/48085</url>
</references>
<dates>
<discovery>2021-11-04</discovery>
<entry>2021-11-05</entry>
</dates>
</vuln>
<vuln vid="2bf56269-90f8-4a82-b82f-c0e289f2a0dc">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.319</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.303.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-11-04/">
<h1>Description</h1>
<h5>(Critical) SECURITY-2455 / CVE-2021-21685, CVE-2021-21686, CVE-2021-21687, CVE-2021-21688, CVE-2021-21689, CVE-2021-21690, CVE-2021-21691, CVE-2021-21692, CVE-2021-21693, CVE-2021-21694, CVE-2021-21695</h5>
<p>Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control</p>
<h5>(High) SECURITY-2423 / CVE-2021-21696</h5>
<p>Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin</p>
<h5>(High) SECURITY-2428 / CVE-2021-21697</h5>
<p>Agent-to-controller access control allows reading/writing most content of build directories</p>
<h5>(Medium) SECURITY-2506 / CVE-2021-21698</h5>
<p>Path traversal vulnerability in Subversion Plugin allows reading arbitrary files</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21685</cvename>
<cvename>CVE-2021-21686</cvename>
<cvename>CVE-2021-21687</cvename>
<cvename>CVE-2021-21688</cvename>
<cvename>CVE-2021-21689</cvename>
<cvename>CVE-2021-21690</cvename>
<cvename>CVE-2021-21691</cvename>
<cvename>CVE-2021-21692</cvename>
<cvename>CVE-2021-21693</cvename>
<cvename>CVE-2021-21694</cvename>
<cvename>CVE-2021-21695</cvename>
<cvename>CVE-2021-21696</cvename>
<cvename>CVE-2021-21697</cvename>
<cvename>CVE-2021-21698</cvename>
<url>https://www.jenkins.io/security/advisory/2021-11-04/</url>
</references>
<dates>
<discovery>2021-11-04</discovery>
<entry>2021-11-04</entry>
</dates>
</vuln>
<vuln vid="df794e5d-3975-11ec-84e8-0800273f11ea">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.15.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.15.5:</p>
<blockquote cite="https://blog.gitea.io/2021/10/gitea-1.15.5-is-released/">
<ul>
<li>Upgrade Bluemonday to v1.0.16 (#17372) (#17374)</li>
<li>Ensure correct SSH permissions check for private and restricted users (#17370) (#17373)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.15.5</url>
<freebsdpr>ports/259548</freebsdpr>
</references>
<dates>
<discovery>2021-10-21</discovery>
<entry>2021-11-04</entry>
</dates>
</vuln>
<vuln vid="33557582-3958-11ec-90ba-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.4.0</ge><lt>14.4.1</lt></range>
<range><ge>14.3.0</ge><lt>14.3.4</lt></range>
<range><ge>0</ge><lt>14.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/">
<p>Stored XSS via ipynb files</p>
<p>Pipeline schedules on imported projects can be set to automatically active after import</p>
<p>Potential Denial of service via Workhorse</p>
<p>Improper Access Control allows Merge Request creator to bypass locked status</p>
<p>Projects API discloses ID and name of private groups</p>
<p>Severity of an incident can be changed by a guest user</p>
<p>System root password accidentally written to log file</p>
<p>Potential DoS via a malformed TIFF image</p>
<p>Bypass of CODEOWNERS Merge Request approval requirement</p>
<p>Change project visibility to a restricted option</p>
<p>Project exports leak external webhook token value</p>
<p>SCIM token is visible after creation</p>
<p>Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered</p>
<p>Regular expression denial of service issue when cleaning namespace path</p>
<p>Prevent creation of scopeless apps using applications API</p>
<p>Webhook data exposes assignee's private email address</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39906</cvename>
<cvename>CVE-2021-39895</cvename>
<cvename>CVE-2021-39907</cvename>
<cvename>CVE-2021-39904</cvename>
<cvename>CVE-2021-39905</cvename>
<cvename>CVE-2021-39902</cvename>
<cvename>CVE-2021-39913</cvename>
<cvename>CVE-2021-39912</cvename>
<cvename>CVE-2021-39909</cvename>
<cvename>CVE-2021-39903</cvename>
<cvename>CVE-2021-39898</cvename>
<cvename>CVE-2021-39901</cvename>
<cvename>CVE-2021-39897</cvename>
<cvename>CVE-2021-39914</cvename>
<cvename>CVE-2021-39911</cvename>
<url>https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/</url>
</references>
<dates>
<discovery>2021-10-28</discovery>
<entry>2021-10-30</entry>
</dates>
</vuln>
<vuln vid="976d7bf9-38ea-11ec-b3b0-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>95.0.4638.69</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html">
<p>This release contains 8 security fixes, including:</p>
<ul>
<li>[1259864] High CVE-2021-37997 : Use after free in Sign-In.
Reported by Wei Yuan of MoyunSec VLab on 2021-10-14</li>
<li>[1259587] High CVE-2021-37998 : Use after free in Garbage
Collection. Reported by Cassidy Kim of Amber Security Lab, OPPO
Mobile Telecommunications Corp. Ltd. on 2021-10-13</li>
<li>[1251541] High CVE-2021-37999 : Insufficient data validation in
New Tab Page. Reported by Ashish Arun Dhone on 2021-09-21</li>
<li>[1249962] High CVE-2021-38000 : Insufficient validation of
untrusted input in Intents. Reported by Clement Lecigne, Neel
Mehta, and Maddie Stone of Google Threat Analysis Group on
2021-09-15</li>
<li>[1260577] High CVE-2021-38001 : Type Confusion in V8. Reported
by @s0rrymybad of Kunlun Lab via Tianfu Cup on 2021-10-16</li>
<li>[1260940] High CVE-2021-38002 : Use after free in Web Transport.
Reported by @__R0ng of 360 Alpha Lab, ? via Tianfu Cup on
2021-10-16</li>
<li>[1263462] High CVE-2021-38003 : Inappropriate implementation in
V8. Reported by Clément Lecigne from Google TAG and Samuel Gross
from Google Project Zero on 2021-10-26</li>
</ul>
<p>Google is aware that exploits for CVE-2021-38000 and
CVE-2021-38003 exist in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37997</cvename>
<cvename>CVE-2021-37998</cvename>
<cvename>CVE-2021-37999</cvename>
<cvename>CVE-2021-38000</cvename>
<cvename>CVE-2021-38001</cvename>
<cvename>CVE-2021-38002</cvename>
<cvename>CVE-2021-38003</cvename>
<url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html</url>
</references>
<dates>
<discovery>2021-10-28</discovery>
<entry>2021-10-29</entry>
</dates>
</vuln>
<vuln vid="c848059a-318b-11ec-aa15-0800270512f4">
<topic>fail2ban -- possible RCE vulnerability in mailing action using mailutils</topic>
<affects>
<package>
<name>py36-fail2ban</name>
<name>py37-fail2ban</name>
<name>py38-fail2ban</name>
<name>py39-fail2ban</name>
<name>py310-fail2ban</name>
<range><lt>0.11.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Żoczek reports:</p>
<blockquote cite="https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm">
<p>
Command <code>mail</code> from mailutils package used in mail actions
like <code>mail-whois</code> can execute command if unescaped sequences
(<code>\n~</code>) are available in "foreign" input (for instance in
whois output).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32749</cvename>
<url>https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm</url>
</references>
<dates>
<discovery>2021-07-16</discovery>
<entry>2021-10-28</entry>
</dates>
</vuln>
<vuln vid="757ee63b-269a-11ec-a616-6c3be5272acd">
<topic>Grafana -- Snapshot authentication bypass</topic>
<affects>
<package>
<name>grafana8</name>
<name>grafana7</name>
<name>grafana6</name>
<name>grafana</name>
<range><ge>8.0.0</ge><lt>8.1.6</lt></range>
<range><ge>2.0.1</ge><lt>7.5.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/">
<p>Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:</p>
<ul>
<li><code>/dashboard/snapshot/:key</code>, or</li>
<li><code>/api/snapshots/:key</code></li>
</ul>
<p>If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:</p>
<ul>
<li><code>/api/snapshots-delete/:deleteKey</code></li>
</ul>
<p>Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:</p>
<ul>
<li><code>/api/snapshots/:key</code>, or</li>
<li><code>/api/snapshots-delete/:deleteKey</code></li>
</ul>
<p>The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39226</cvename>
<url>https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/</url>
</references>
<dates>
<discovery>2021-09-15</discovery>
<entry>2021-10-06</entry>
</dates>
</vuln>
<vuln vid="f4b15f7d-d33a-4cd0-a97b-709d6af0e43e">
<topic>minio -- policy restriction issue</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2021.10.23.03.28.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>minio developers report:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c">
<p>Looks like policy restriction was not working properly for normal users when they are not svc or STS accounts.</p>
<ul>
<li>svc accounts are now properly fixed to get right permissions when its inherited, so we do not have to set 'owner = true'</li>
<li>sts accounts have always been using right permissions, do not need an explicit lookup</li>
<li>regular users always have proper policy mapping</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41137</cvename>
<url>https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c</url>
</references>
<dates>
<discovery>2021-10-12</discovery>
<entry>2021-10-23</entry>
</dates>
</vuln>
<vuln vid="8d65aa3b-31ce-11ec-8c32-a14e8e520dc7">
<topic>mailman -- brute-force vuln on list admin password, and CSRF vuln in releases before 2.1.35</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.35</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1873/NEWS#L8">
<p>A potential for for a list member to carry out an off-line brute
force attack to obtain the list admin password has been reported by
Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is
fixed.</p>
<p>A CSRF attack via the user options page could allow takeover of a
users account. This is fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-42096</cvename>
<cvename>CVE-2021-42097</cvename>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1873/NEWS#L8</url>
<url>https://bugs.launchpad.net/mailman/+bug/1947639</url>
<url>https://bugs.launchpad.net/mailman/+bug/1947640</url>
</references>
<dates>
<discovery>2021-10-18</discovery>
<entry>2021-10-20</entry>
</dates>
</vuln>
<vuln vid="bdaecfad-3117-11ec-b3b0-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>95.0.4638.54</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html">
<p>This release contains 19 security fixes, including:</p>
<ul>
<li>[1246631] High CVE-2021-37981: Heap buffer overflow in Skia.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-09-04</li>
<li>[1248661] High CVE-2021-37982: Use after free in Incognito.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2021-09-11</li>
<li>[1249810] High CVE-2021-37983: Use after free in Dev Tools.
Reported by Zhihua Yao of KunLun Lab on 2021-09-15</li>
<li>[1253399] High CVE-2021-37984: Heap buffer overflow in PDFium.
Reported by Antti Levomäki, Joonas Pihlaja andChristian Jali
from Forcepoint on 2021-09-27</li>
<li>[1241860] High CVE-2021-37985: Use after free in V8. Reported
by Yangkang (@dnpushme) of 360 ATA on 2021-08-20</li>
<li>[1242404] Medium CVE-2021-37986: Heap buffer overflow in
Settings. Reported by raven (@raid_akame) on 2021-08-23</li>
<li>[1206928] Medium CVE-2021-37987: Use after free in Network APIs.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-08</li>
<li>[1228248] Medium CVE-2021-37988: Use after free in Profiles.
Reported by raven (@raid_akame) on 2021-07-12</li>
<li>[1233067] Medium CVE-2021-37989: Inappropriate implementation
in Blink. Reported by Matt Dyas, Ankur Sundara on 2021-07-26</li>
<li>[1247395] Medium CVE-2021-37990: Inappropriate implementation
in WebView. Reported by Kareem Selim of CyShield on
2021-09-07</li>
<li>[1250660] Medium CVE-2021-37991: Race in V8. Reported by Samuel
Gross of Google Project Zero on 2021-09-17</li>
<li>[1253746] Medium CVE-2021-37992: Out of bounds read in WebAudio.
Reported by sunburst@Ant Security Light-Year Lab on
2021-09-28</li>
<li>[1255332] Medium CVE-2021-37993: Use after free in PDF
Accessibility. Reported by Cassidy Kim of Amber Security Lab,
OPPO Mobile Telecommunications Corp. Ltd. on 2021-10-02</li>
<li>[1243020] Medium CVE-2021-37996: Insufficient validation of
untrusted input in Downloads. Reported by Anonymous on
2021-08-24</li>
<li>[1100761] Low CVE-2021-37994: Inappropriate implementation in
iFrame Sandbox. Reported by David Erceg on 2020-06-30</li>
<li>[1242315] Low CVE-2021-37995: Inappropriate implementation in
WebApp Installer. Reported by Terence Eden on 2021-08-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37981</cvename>
<cvename>CVE-2021-37982</cvename>
<cvename>CVE-2021-37983</cvename>
<cvename>CVE-2021-37984</cvename>
<cvename>CVE-2021-37985</cvename>
<cvename>CVE-2021-37986</cvename>
<cvename>CVE-2021-37987</cvename>
<cvename>CVE-2021-37988</cvename>
<cvename>CVE-2021-37989</cvename>
<cvename>CVE-2021-37990</cvename>
<cvename>CVE-2021-37991</cvename>
<cvename>CVE-2021-37992</cvename>
<cvename>CVE-2021-37993</cvename>
<cvename>CVE-2021-37994</cvename>
<cvename>CVE-2021-37995</cvename>
<cvename>CVE-2021-37996</cvename>
<url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2021-10-19</discovery>
<entry>2021-10-19</entry>
</dates>
</vuln>
<vuln vid="c9387e4d-2f5f-11ec-8be6-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-server</name>
<range><lt>5.7.36</lt></range>
</package>
<package>
<name>mysql80-client</name>
<range><lt>8.0.27</lt></range>
</package>
<package>
<name>mysql-connector-java</name>
<range><lt>8.0.27</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.27</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.32</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.22</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2021.html">
<p>This Critical Patch Update contains 66 new security patches for
Oracle MySQL. 8 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.<br/>
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 9.8.</p>
<p>Note: MariaDB only vulnerable against CVE-2021-35604</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuoct2021.html</url>
<cvename>CVE-2021-22931</cvename>
<cvename>CVE-2021-3711</cvename>
<cvename>CVE-2021-22926</cvename>
<cvename>CVE-2021-36222</cvename>
<cvename>CVE-2021-35583</cvename>
<cvename>CVE-2021-35610</cvename>
<cvename>CVE-2021-35597</cvename>
<cvename>CVE-2021-35607</cvename>
<cvename>CVE-2021-2481</cvename>
<cvename>CVE-2021-35590</cvename>
<cvename>CVE-2021-35592</cvename>
<cvename>CVE-2021-35593</cvename>
<cvename>CVE-2021-35594</cvename>
<cvename>CVE-2021-35598</cvename>
<cvename>CVE-2021-35621</cvename>
<cvename>CVE-2021-2471</cvename>
<cvename>CVE-2021-35604</cvename>
<cvename>CVE-2021-35612</cvename>
<cvename>CVE-2021-35608</cvename>
<cvename>CVE-2021-35602</cvename>
<cvename>CVE-2021-35577</cvename>
<cvename>CVE-2021-2478</cvename>
<cvename>CVE-2021-2479</cvename>
<cvename>CVE-2021-35537</cvename>
<cvename>CVE-2021-35591</cvename>
<cvename>CVE-2021-35596</cvename>
<cvename>CVE-2021-35648</cvename>
<cvename>CVE-2021-35631</cvename>
<cvename>CVE-2021-35626</cvename>
<cvename>CVE-2021-35627</cvename>
<cvename>CVE-2021-35628</cvename>
<cvename>CVE-2021-35629</cvename>
<cvename>CVE-2021-35575</cvename>
<cvename>CVE-2021-35634</cvename>
<cvename>CVE-2021-35635</cvename>
<cvename>CVE-2021-35636</cvename>
<cvename>CVE-2021-35638</cvename>
<cvename>CVE-2021-35641</cvename>
<cvename>CVE-2021-35642</cvename>
<cvename>CVE-2021-35643</cvename>
<cvename>CVE-2021-35644</cvename>
<cvename>CVE-2021-35645</cvename>
<cvename>CVE-2021-35646</cvename>
<cvename>CVE-2021-35647</cvename>
<cvename>CVE-2021-35630</cvename>
<cvename>CVE-2021-35637</cvename>
<cvename>CVE-2021-35546</cvename>
<cvename>CVE-2021-35622</cvename>
<cvename>CVE-2021-35624</cvename>
<cvename>CVE-2021-35639</cvename>
<cvename>CVE-2021-35632</cvename>
<cvename>CVE-2021-35584</cvename>
<cvename>CVE-2021-35613</cvename>
<cvename>CVE-2021-35640</cvename>
<cvename>CVE-2021-35633</cvename>
<cvename>CVE-2021-35625</cvename>
<cvename>CVE-2021-35623</cvename>
<cvename>CVE-2021-35618</cvename>
</references>
<dates>
<discovery>2021-10-16</discovery>
<entry>2021-10-17</entry>
<modified>2021-11-09</modified>
</dates>
</vuln>
<vuln vid="a9c5e89d-2d15-11ec-8363-0022489ad614">
<topic>Node.js -- October 2021 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><lt>16.11.1</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/">
<h1>HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)</h1>
<p>The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).</p>
<h1>HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)</h1>
<p>The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22959</cvename>
<cvename>CVE-2021-22960</cvename>
<url>https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/</url>
</references>
<dates>
<discovery>2021-10-12</discovery>
<entry>2021-10-14</entry>
</dates>
</vuln>
<vuln vid="2a1b931f-2b86-11ec-8acd-c80aa9043978">
<topic>OpenSSH -- OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand</topic>
<affects>
<package>
<name>openssh-portable</name>
<name>openssh-portable-hpn</name>
<name>openssh-portable-gssapi</name>
<range><ge>6.2.p1,1</ge><lt>8.7.p1_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenBSD Project reports:</p>
<blockquote cite="https://www.openssh.com/txt/release-8.8">
<p>
sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
supplemental groups when executing an AuthorizedKeysCommand or
AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to run the
command as a different user. Instead these commands would inherit
the groups that sshd(8) was started with.
</p>
<p>
Depending on system configuration, inherited groups may allow
AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
gain unintended privilege.
</p>
<p>
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
enabled by default in sshd_config(5).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41617</cvename>
<url>https://www.openssh.com/txt/release-8.8</url>
</references>
<dates>
<discovery>2021-09-26</discovery>
<entry>2021-10-12</entry>
</dates>
</vuln>
<vuln vid="a7dd4c2d-77e4-46de-81a2-c453c317f9de">
<topic>couchdb -- user privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>3.1.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cory Sabol reports:</p>
<blockquote cite="https://docs.couchdb.org/en/stable/cve/2021-38295.html">
<p>A malicious user with permission to create documents in a
database is able to attach a HTML attachment to a document.
If a CouchDB admin opens that attachment in a browser, e.g.
via the CouchDB admin interface Fauxton, any JavaScript code
embedded in that HTML attachment will be executed within the
security context of that admin. A similar route is available
with the already deprecated _show and _list functionality.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39205</cvename>
<url>https://docs.couchdb.org/en/stable/cve/2021-38295.html</url>
</references>
<dates>
<discovery>2021-08-09</discovery>
<entry>2021-10-12</entry>
</dates>
</vuln>
<vuln vid="9a8514f3-2ab8-11ec-b3a1-8c164582fbac">
<topic>Ansible -- Ansible user credentials disclosure in ansible-connection module</topic>
<affects>
<package>
<name>py36-ansible-core</name>
<name>py37-ansible-core</name>
<name>py38-ansible-core</name>
<name>py39-ansible-core</name>
<name>py310-ansible-core</name>
<range><lt>2.11.6</lt></range>
</package>
<package>
<name>py36-ansible-base</name>
<name>py37-ansible-base</name>
<name>py38-ansible-base</name>
<name>py39-ansible-base</name>
<name>py310-ansible-base</name>
<range><lt>2.10.15</lt></range>
</package>
<package>
<name>py36-ansible2</name>
<name>py37-ansible2</name>
<name>py38-ansible2</name>
<name>py39-ansible2</name>
<name>py310-ansible2</name>
<range><lt>2.9.27</lt></range>
</package>
<package>
<name>py36-ansible</name>
<name>py37-ansible</name>
<name>py38-ansible</name>
<name>py39-ansible</name>
<name>py310-ansible</name>
<range><lt>2.9.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="">
<p>A flaw was found in Ansible Engine's ansible-connection
module, where sensitive information such as the Ansible
user credentials is disclosed by default in the traceback
error message. The highest threat from this vulnerability
is to confidentiality.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3620</cvename>
<url>https://access.redhat.com/security/cve/CVE-2021-3620</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-3620</url>
<url>https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#v2-9-27</url>
<url>https://github.com/ansible/ansible/blob/stable-2.10/changelogs/CHANGELOG-v2.10.rst#v2-10-15</url>
<url>https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#v2-11-6</url>
</references>
<dates>
<discovery>2021-06-25</discovery>
<entry>2021-10-11</entry>
</dates>
</vuln>
<vuln vid="04d2cf7f-2942-11ec-b48c-1c1b0d9ea7e6">
<topic>Apache OpenOffice -- multiple vulnerabilities.</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.11</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1633255994,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openoffice project reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-33035">
<p>Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41830">
<p>It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory </p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41831">
<p>It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41832">
<p>It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33035</cvename>
<cvename>CVE-2021-41830</cvename>
<cvename>CVE-2021-41831</cvename>
<cvename>CVE-2021-41832</cvename>
<url>https://cwiki.apache.org/confluence/display/OOOUSERS/AOO+4.1.11+Release+Notes/#AOO4.1.11ReleaseNotes-Security</url>
</references>
<dates>
<discovery>2021-05-04</discovery>
<entry>2021-10-09</entry>
</dates>
</vuln>
<vuln vid="4fce9635-28c0-11ec-9ba8-002324b2fba8">
<topic>go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/48797">
<p>When invoking functions from WASM modules, built using GOARCH=wasm
GOOS=js, passing very large arguments can cause portions of the module
to be overwritten with data from the arguments.</p>
<p>If using wasm_exec.js to execute WASM modules, users will need to
replace their copy after rebuilding any modules.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-38297</cvename>
<url>https://github.com/golang/go/issues/48797</url>
</references>
<dates>
<discovery>2021-10-06</discovery>
<entry>2021-10-09</entry>
</dates>
</vuln>
<vuln vid="7d3d94d3-2810-11ec-9c51-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>94.0.4606.81</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html">
<p>This release contains 4 security fixes, including:</p>
<ul>
<li>[1252878] High CVE-2021-37977: Use after free in Garbage
Collection. Reported by Anonymous on 2021-09-24</li>
<li>[1236318] High CVE-2021-37978: Heap buffer overflow in Blink.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-08-04</li>
<li>[1247260] High CVE-2021-37979: Heap buffer overflow in WebRTC.
Reported by Marcin Towalski of Cisco Talos on 2021-09-07</li>
<li>[1254631] High CVE-2021-37980: Inappropriate implementation in
Sandbox. Reported by Yonghwi Jin (@jinmo123) on 2021-09-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37977</cvename>
<cvename>CVE-2021-37978</cvename>
<cvename>CVE-2021-37979</cvename>
<cvename>CVE-2021-37980</cvename>
<url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-10-07</discovery>
<entry>2021-10-08</entry>
</dates>
</vuln>
<vuln vid="d001c189-2793-11ec-8fb1-206a8a720317">
<topic>Apache httpd -- Path Traversal and Remote Code Execution</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.49</ge><lt>2.4.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache http server project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>critical: Path Traversal and Remote Code Execution in Apache HTTP
Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
(CVE-2021-42013).</p>
<p>It was found that the fix for CVE-2021-41773 in Apache HTTP
Server 2.4.50 was insufficient. An attacker could use a path
traversal attack to map URLs to files outside the directories
configured by Alias-like directives.</p>
<p>If files outside of these directories are not protected by the
usual default configuration "require all denied", these requests
can succeed. If CGI scripts are also enabled for these aliased
pathes, this could allow for remote code execution.</p>
<p>This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
earlier versions.</p>
<p>Acknowledgements: Reported by Juan Escobar from Dreamlab
Technologies, Fernando Munoz from NULL Life CTF Team, and
Shungo Kumasaka</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-42013</cvename>
</references>
<dates>
<discovery>2021-10-07</discovery>
<entry>2021-10-07</entry>
</dates>
</vuln>
<vuln vid="9bad457e-b396-4452-8773-15bec67e1ceb">
<topic>jenkins -- Jenkins core bundles vulnerable version of the commons-httpclient library</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.315</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.303.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-10-06/">
<h1>Description</h1>
<h5>(Medium) SECURITY-2475 / CVE-2014-3577</h5>
<p>Jenkins core bundles vulnerable version of the commons-httpclient library</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3577</cvename>
<url>https://www.jenkins.io/security/advisory/2021-10-06/</url>
</references>
<dates>
<discovery>2021-10-06</discovery>
<entry>2021-10-07</entry>
</dates>
</vuln>
<vuln vid="25b78bdd-25b8-11ec-a341-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.49</ge><lt>2.4.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache http server project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>moderate: null pointer dereference in h2 fuzzing
(CVE-2021-41524)</li>
<li>important: Path traversal and file disclosure vulnerability in
Apache HTTP Server 2.4.49 (CVE-2021-41773)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41524</cvename>
<cvename>CVE-2021-41773</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2021-10-05</discovery>
<entry>2021-10-05</entry>
<modified>2021-10-06</modified>
</dates>
</vuln>
<vuln vid="f05dbd1f-2599-11ec-91be-001b217b3468">
<topic>Bacula-Web -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>bacula-web</name>
<range><lt>8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bacula-Web reports:</p>
<blockquote cite="https://www.bacula-web.org/releases/2021-07-11-bacula-web-8.4.2/">
<p>Address Smarty CVE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26119</cvename>
<cvename>CVE-2021-26120</cvename>
<url>https://www.bacula-web.org/releases/2021-07-11-bacula-web-8.4.2/</url>
</references>
<dates>
<discovery>2021-07-11</discovery>
<entry>2021-10-05</entry>
</dates>
</vuln>
<vuln vid="9b4806c1-257f-11ec-9db5-0800270512f4">
<topic>redis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redis-devel</name>
<range><lt>7.0.0.20211005</lt></range>
</package>
<package>
<name>redis</name>
<range><lt>6.2.6</lt></range>
</package>
<package>
<name>redis6</name>
<range><lt>6.0.16</lt></range>
</package>
<package>
<name>redis5</name>
<range><lt>5.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redis Team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/GS_9L2KCk9g/m/Q7ZN1R1cDAAJ">
<dl>
<dt>CVE-2021-41099</dt>
<dd>
Integer to heap buffer overflow handling certain string commands
and network payloads, when proto-max-bulk-len is manually configured.
</dd>
<dt>CVE-2021-32762</dt>
<dd>
Integer to heap buffer overflow issue in redis-cli and redis-sentinel
parsing large multi-bulk replies on some older and less common platforms.
</dd>
<dt>CVE-2021-32687</dt>
<dd>
Integer to heap buffer overflow with intsets, when set-max-intset-entries
is manually configured to a non-default, very large value.
</dd>
<dt>CVE-2021-32675</dt>
<dd>
Denial Of Service when processing RESP request payloads with a large
number of elements on many connections.
</dd>
<dt>CVE-2021-32672</dt>
<dd>
Random heap reading issue with Lua Debugger.
</dd>
<dt>CVE-2021-32628</dt>
<dd>
Integer to heap buffer overflow handling ziplist-encoded data types,
when configuring a large, non-default value for hash-max-ziplist-entries,
hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value.
</dd>
<dt>CVE-2021-32627</dt>
<dd>
Integer to heap buffer overflow issue with streams, when configuring
a non-default, large value for proto-max-bulk-len and
client-query-buffer-limit.
</dd>
<dt>CVE-2021-32626</dt>
<dd>
Specially crafted Lua scripts may result with Heap buffer overflow.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41099</cvename>
<cvename>CVE-2021-32762</cvename>
<cvename>CVE-2021-32687</cvename>
<cvename>CVE-2021-32675</cvename>
<cvename>CVE-2021-32672</cvename>
<cvename>CVE-2021-32628</cvename>
<cvename>CVE-2021-32627</cvename>
<cvename>CVE-2021-32626</cvename>
<url>https://groups.google.com/g/redis-db/c/GS_9L2KCk9g</url>
</references>
<dates>
<discovery>2021-10-04</discovery>
<entry>2021-10-05</entry>
</dates>
</vuln>
<vuln vid="f84ab297-2285-11ec-9e79-08002789875b">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.16</lt></range>
</package>
<package>
<name>mediawiki135</name>
<range><lt>1.35.4</lt></range>
</package>
<package>
<name>mediawiki136</name>
<range><lt>1.36.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/">
<p>(T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.</p>
<p>(T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
table scan.</p>
<p>(T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
Special:Contributions.</p>
<p>(T279090, CVE-2021-41801) SECURITY: ReplaceText continues performing
actions if the user no longer has the correct permission (such as by being
blocked).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-41798</cvename>
<cvename>CVE-2021-41799</cvename>
<cvename>CVE-2021-41800</cvename>
<cvename>CVE-2021-41801</cvename>
<url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/</url>
</references>
<dates>
<discovery>2021-06-24</discovery>
<entry>2021-10-01</entry>
</dates>
</vuln>
<vuln vid="777edbbe-2230-11ec-8869-704d7b472482">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>94.0.4606.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases/Stable updates reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html">
<p>This release contains 4 security fixes, including:</p>
<ul>
<li>[1245578] High CVE-2021-37974: Use after free in Safe Browsing.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2021-09-01</li>
<li>[1252918] High CVE-2021-37975: Use after free in V8. Reported by
Anonymous on 2021-09-24</li>
<li>[1251787] Medium CVE-2021-37976: Information leak in core.
Reported by Clement Lecigne from Google TAG, with technical
assistance from Sergei Glazunov and Mark Brand from Google
Project Zero on 2021-09-21</li>
</ul>
<p>Google is aware the exploits for CVE-2021-37975 and CVE-2021-37976
exist in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37974</cvename>
<cvename>CVE-2021-37975</cvename>
<cvename>CVE-2021-37976</cvename>
<url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2021-09-30</discovery>
<entry>2021-09-30</entry>
</dates>
</vuln>
<vuln vid="1bdd4db6-2223-11ec-91be-001b217b3468">
<topic>Gitlab -- vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.3.0</ge><lt>14.3.1</lt></range>
<range><ge>14.2.0</ge><lt>14.2.5</lt></range>
<range><ge>0</ge><lt>14.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/">
<p>Stored XSS in merge request creation page</p>
<p>Denial-of-service attack in Markdown parser</p>
<p>Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown</p>
<p>DNS Rebinding vulnerability in Gitea importer</p>
<p>Exposure of trigger tokens on project exports</p>
<p>Improper access control for users with expired password</p>
<p>Access tokens are not cleared after impersonation</p>
<p>Reflected Cross-Site Scripting in Jira Integration</p>
<p>DNS Rebinding vulnerability in Fogbugz importer</p>
<p>Access tokens persist after project deletion</p>
<p>User enumeration vulnerability</p>
<p>Potential DOS via API requests</p>
<p>Pending invitations of public groups and public projects are visible to any user</p>
<p>Bypass Disabled Repo by URL Project Creation</p>
<p>Low privileged users can see names of the private groups shared in projects</p>
<p>API discloses sensitive info to low privileged users</p>
<p>Epic listing do not honour group memberships</p>
<p>Insecure Direct Object Reference vulnerability may lead to protected branch names getting disclosed</p>
<p>Low privileged users can import users from projects that they they are not a maintainer on</p>
<p>Potential DOS via dependencies API</p>
<p>Create a project with unlimited repository size through malicious Project Import</p>
<p>Bypass disabled Bitbucket Server import source project creation</p>
<p>Requirement to enforce 2FA is not honored when using git commands</p>
<p>Content spoofing vulnerability</p>
<p>Improper session management in impersonation feature</p>
<p>Create OAuth application with arbitrary scopes through content spoofing</p>
<p>Lack of account lockout on change password functionality</p>
<p>Epic reference was not updated while moved between groups</p>
<p>Missing authentication allows disabling of two-factor authentication</p>
<p>Information disclosure in SendEntry</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39885</cvename>
<cvename>CVE-2021-39877</cvename>
<cvename>CVE-2021-39887</cvename>
<cvename>CVE-2021-39867</cvename>
<cvename>CVE-2021-39869</cvename>
<cvename>CVE-2021-39872</cvename>
<cvename>CVE-2021-39878</cvename>
<cvename>CVE-2021-39866</cvename>
<cvename>CVE-2021-39882</cvename>
<cvename>CVE-2021-39875</cvename>
<cvename>CVE-2021-39870</cvename>
<cvename>CVE-2021-39884</cvename>
<cvename>CVE-2021-39883</cvename>
<cvename>CVE-2021-22259</cvename>
<cvename>CVE-2021-39868</cvename>
<cvename>CVE-2021-39871</cvename>
<cvename>CVE-2021-39874</cvename>
<cvename>CVE-2021-39873</cvename>
<cvename>CVE-2021-39881</cvename>
<cvename>CVE-2021-39886</cvename>
<cvename>CVE-2021-39879</cvename>
<url>https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/</url>
</references>
<dates>
<discovery>2021-09-30</discovery>
<entry>2021-09-30</entry>
</dates>
</vuln>
<vuln vid="5436f9a2-2190-11ec-a90b-0cc47a49470e">
<topic>ha -- Directory traversals</topic>
<affects>
<package>
<name>ha</name>
<range><lt>0.999b_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Cherepanov reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/01/18/8">
<p>Version 0.999b and older of ha archiver is susceptible to directory
traversal vulnerabilities via absolute and relative paths.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1198</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/01/18/8</url>
</references>
<dates>
<discovery>2015-01-18</discovery>
<entry>2021-09-30</entry>
</dates>
</vuln>
<vuln vid="730e922f-20e7-11ec-a574-080027eedc6a">
<topic>nexus2-oss -- Apache ActiveMQ JMX vulnerability</topic>
<affects>
<package>
<name>nexus2-oss</name>
<range><lt>2.14.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sonatype reports:</p>
<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage">
<ul><li>CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack</li></ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-13920</cvename>
<url>https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage</url>
</references>
<dates>
<discovery>2020-12-28</discovery>
<entry>2021-09-29</entry>
</dates>
</vuln>
<vuln vid="b2f1f86f-20e6-11ec-a574-080027eedc6a">
<topic>nexus2-oss -- NXRM2 Directory Traversal vulnerability</topic>
<affects>
<package>
<name>nexus2-oss</name>
<range><lt>2.14.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sonatype reports:</p>
<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManager2.14.20">
<ul><li>CVE-2020-15012: NXRM2 Directory Traversal vulnerability</li></ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15012</cvename>
<url>https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage</url>
</references>
<dates>
<discovery>2020-06-23</discovery>
<entry>2021-09-29</entry>
</dates>
</vuln>
<vuln vid="576aa394-1d85-11ec-8b7d-4f5b624574e2">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.32.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports vulnerabilities:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2021-0005.html">
<ul><li>CVE-2021-30858: Processing maliciously crafted web content may lead to arbitrary code execution.</li></ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30858</cvename>
<url>https://webkitgtk.org/security/WSA-2021-0005.html</url>
</references>
<dates>
<discovery>2021-09-20</discovery>
<entry>2021-09-24</entry>
</dates>
</vuln>
<vuln vid="b6c875f1-1d76-11ec-ae80-704d7b472482">
<topic>chromium -- use after free in Portals</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>94.0.4606.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html">
<p>][1251727] High CVE-2021-37973 : Use after free in Portals.
Reported by Clement Lecigne from Google TAG, with technical
assistance from Sergei Glazunov and Mark Brand from Google Project
Zero on 2021-09-21</p>
<p>Google is aware that an exploit for CVE-2021-37973 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37973</cvename>
<url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2021-09-24</discovery>
<entry>2021-09-24</entry>
</dates>
</vuln>
<vuln vid="d4d21998-bdc4-4a09-9849-2898d9b41459">
<topic>zeek -- several vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.4">
<p> Paths from log stream make it into system() unchecked,
potentially leading to commands being run on the system
unintentionally. This requires either bad scripting or a
malicious package to be installed, and is considered low
severity. </p>
<p> Fix potential unbounded state growth in the PIA
analyzer when receiving a connection with either a large
number of zero-length packets, or one which continues
ack-ing unseen segments. It is possible to run Zeek out
of memory in these instances and cause it to crash. Due
to the possibility of this happening with packets received
from the network, this is a potential DoS vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.4</url>
</references>
<dates>
<discovery>2021-08-26</discovery>
<entry>2021-09-22</entry>
</dates>
</vuln>
<vuln vid="7bba5b3b-1b7f-11ec-b335-d4c9ef517024">
<topic>mod_auth_mellon -- Redirect URL validation bypass</topic>
<affects>
<package>
<name>mod_auth_mellon</name>
<range><lt>0.18.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Hrozek reports:</p>
<blockquote cite="https://github.com/latchset/mod_auth_mellon/releases/tag/v0.18.0">
<p>Version 0.17.0 and older of mod_auth_mellon allows the redirect URL
validation to be bypassed by specifying an URL formatted as
///fishing-site.example.com/logout.html</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13038</cvename>
<url>https://github.com/latchset/mod_auth_mellon/releases/tag/v0.18.0</url>
</references>
<dates>
<discovery>2021-07-30</discovery>
<entry>2021-09-22</entry>
</dates>
</vuln>
<vuln vid="7062bce0-1b17-11ec-9d9d-0022489ad614">
<topic>Node.js -- August 2021 Security Releases (2)</topic>
<affects>
<package>
<name>node14</name>
<range><lt>14.17.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/">
<h1>npm 6 update - node-tar, arborist, npm cli modules</h1>
<p>These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32803</cvename>
<cvename>CVE-2021-32804</cvename>
<cvename>CVE-2021-37701</cvename>
<cvename>CVE-2021-37712</cvename>
<cvename>CVE-2021-37713</cvename>
<cvename>CVE-2021-39134</cvename>
<cvename>CVE-2021-39135</cvename>
<url>https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/</url>
</references>
<dates>
<discovery>2021-08-31</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="b092bd4f-1b16-11ec-9d9d-0022489ad614">
<topic>Node.js -- August 2021 Security Releases</topic>
<affects>
<package>
<name>node14</name>
<range><lt>14.17.4</lt></range>
</package>
<package>
<name>node</name>
<range><lt>16.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/">
<h1>cares upgrade - Improper handling of untypical characters in domain names (High) (CVE-2021-22931)</h1>
<p>Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.</p>
<h1>Use after free on close http2 on stream canceling (High) (CVE-2021-22940)</h1>
<p>Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930.</p>
<h1>Incomplete validation of rejectUnauthorized parameter (Low) (CVE-2021-22939)</h1>
<p>If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22931</cvename>
<cvename>CVE-2021-22940</cvename>
<cvename>CVE-2021-22939</cvename>
<url>https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/</url>
</references>
<dates>
<discovery>2021-08-11</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="f53dab71-1b15-11ec-9d9d-0022489ad614">
<topic>Node.js -- July 2021 Security Releases (2)</topic>
<affects>
<package>
<name>node14</name>
<range><lt>14.17.4</lt></range>
</package>
<package>
<name>node</name>
<range><lt>16.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="ihttps://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/">
<h1>Use after free on close http2 on stream canceling (High) (CVE-2021-22930)</h1>
<p>Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22930</cvename>
<url>https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/</url>
</references>
<dates>
<discovery>2021-07-29</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="c174118e-1b11-11ec-9d9d-0022489ad614">
<topic>Node.js -- July 2021 Security Releases</topic>
<affects>
<package>
<name>node14</name>
<range><lt>14.17.2</lt></range>
</package>
<package>
<name>node</name>
<range><lt>16.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/">
<h1>libuv upgrade - Out of bounds read (Medium) (CVE-2021-22918)</h1>
<p>Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.</p>
<h1>Windows installer - Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)</h1>
<p>Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.</p>
<h1>npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)</h1>
<p>This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks.</p>
<h1>npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)</h1>
<p>This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22918</cvename>
<cvename>CVE-2021-22921</cvename>
<cvename>CVE-2021-27290</cvename>
<cvename>CVE-2021-23362</cvename>
<url>https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/</url>
</references>
<dates>
<discovery>2021-07-01</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="3551e106-1b17-11ec-a8a7-704d7b472482">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>94.0.4606.54</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html">
<p>This update contains 19 security fixes, including:</p>
<ul>
<li>[1243117] High CVE-2021-37956: Use after free in Offline use.
Reported by Huyna at Viettel Cyber Security on 2021-08-24</li>
<li>[1242269] High CVE-2021-37957: Use after free in WebGPU.
Reported by Looben Yang on 2021-08-23</li>
<li>[1223290] High CVE-2021-37958: Inappropriate implementation in
Navigation. Reported by James Lee (@Windowsrcer) on
2021-06-24</li>
<li>[1229625] High CVE-2021-37959: Use after free in Task Manager.
Reported by raven (@raid_akame) on 2021-07-15</li>
<li>[1247196] High CVE-2021-37960: Inappropriate implementation in
Blink graphics. Reported by Atte Kettunen of OUSPG on
2021-09-07</li>
<li>[1228557] Medium CVE-2021-37961: Use after free in Tab Strip.
Reported by Khalil Zhani on 2021-07-13</li>
<li>[1231933] Medium CVE-2021-37962: Use after free in Performance
Manager. Reported by Sri on 2021-07-22</li>
<li>[1199865] Medium CVE-2021-37963: Side-channel information
leakage in DevTools. Reported by Daniel Genkin and Ayush Agarwal,
University of Michigan, Eyal Ronen and Shaked Yehezkel, Tel Aviv
University, Sioli O'Connell, University of Adelaide, and Jason
Kim, Georgia Institute of Technology on 2021-04-16</li>
<li>[1203612] Medium CVE-2021-37964: Inappropriate implementation in
ChromeOS Networking. Reported by Hugo Hue and Sze Yiu Chau of the
Chinese University of Hong Kong on 2021-04-28</li>
<li>[1239709] Medium CVE-2021-37965: Inappropriate implementation in
Background Fetch API. Reported by Maurice Dauer on 2021-08-13</li>
<li>[1238944] Medium CVE-2021-37966: Inappropriate implementation in
Compositing. Reported by Mohit Raj (shadow2639) on 2021-08-11</li>
<li>[1243622] Medium CVE-2021-37967: Inappropriate implementation in
Background Fetch API. Reported by SorryMybad (@S0rryMybad) of
Kunlun Lab on 2021-08-26</li>
<li>[1245053] Medium CVE-2021-37968: Inappropriate implementation in
Background Fetch API. Reported by Maurice Dauer on 2021-08-30</li>
<li>[1245879] Medium CVE-2021-37969: Inappropriate implementation in
Google Updater. Reported by Abdelhamid Naceri (halov) on
2021-09-02</li>
<li>[1248030] Medium CVE-2021-37970: Use after free in File System
API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
2021-09-09</li>
<li>[1219354] Low CVE-2021-37971: Incorrect security UI in Web
Browser UI. Reported by Rayyan Bijoora on 2021-06-13</li>
<li>[1234259] Low CVE-2021-37972: Out of bounds read in
libjpeg-turbo. Reported by Xu Hanyu and Lu Yutao from
Panguite-Forensics-Lab of Qianxin on 2021-07-29</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37956</cvename>
<cvename>CVE-2021-37957</cvename>
<cvename>CVE-2021-37958</cvename>
<cvename>CVE-2021-37959</cvename>
<cvename>CVE-2021-37960</cvename>
<cvename>CVE-2021-37961</cvename>
<cvename>CVE-2021-37962</cvename>
<cvename>CVE-2021-37963</cvename>
<cvename>CVE-2021-37964</cvename>
<cvename>CVE-2021-37965</cvename>
<cvename>CVE-2021-37966</cvename>
<cvename>CVE-2021-37967</cvename>
<cvename>CVE-2021-37968</cvename>
<cvename>CVE-2021-37969</cvename>
<cvename>CVE-2021-37970</cvename>
<cvename>CVE-2021-37971</cvename>
<cvename>CVE-2021-37972</cvename>
<url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2021-09-21</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="57b1ee25-1a7c-11ec-9376-0800272221cc">
<topic>libssh -- possible heap-buffer overflow vulnerability</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.9.1</ge><le>0.9.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libssh security advisories:</p>
<blockquote cite="https://www.libssh.org/security/advisories/CVE-2021-3634.txt">
<p>The SSH protocol keeps track of two shared secrets during the lifetime
of the session. One of them is called `secret_hash` and and the other
`session_id`. Initially, both of them are the same, but after key
re-exchange, previous `session_id` is kept and used as an input to new
`secret_hash`.</p>
<p>Historically, both of these buffers had shared length variable, which
worked as long as these buffers were same. But the key re-exchange
operation can also change the key exchange method, which can be based on
hash of different size, eventually creating `secret_hash` of different
size than the `session_id` has.</p>
<p>This becomes an issue when the `session_id` memory is zeroized or when
it is used again during second key re-exchange.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3634</cvename>
<url>https://www.libssh.org/security/advisories/CVE-2021-3634.txt</url>
<url>https://www.libssh.org/2021/08/26/libssh-0-9-6-security-release/</url>
</references>
<dates>
<discovery>2021-08-26</discovery>
<entry>2021-09-21</entry>
</dates>
</vuln>
<vuln vid="882a38f9-17dd-11ec-b335-d4c9ef517024">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>moderate: Request splitting via HTTP/2 method injection and
mod_proxy (CVE-2021-33193)</li>
<li>moderate: NULL pointer dereference in httpd core
(CVE-2021-34798)</li>
<li>moderate: mod_proxy_uwsgi out of bound read (CVE-2021-36160)</li>
<li>low: ap_escape_quotes buffer overflow (CVE-2021-39275)</li>
<li>high: mod_proxy SSRF (CVE-2021-40438)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33193</cvename>
<cvename>CVE-2021-34798</cvename>
<cvename>CVE-2021-36160</cvename>
<cvename>CVE-2021-39275</cvename>
<cvename>CVE-2021-40438</cvename>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2021-09-16</discovery>
<entry>2021-09-17</entry>
<modified>2021-09-28</modified>
</dates>
</vuln>
<vuln vid="c9221ec9-17a2-11ec-b335-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.20.0</ge><lt>7.79.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<ul>
<li>UAF and double-free in MQTT sending (CVE-2021-22945)</li>
<li>Protocol downgrade required TLS bypassed (CVE-2021-22946)</li>
<li>STARTTLS protocol injection via MITM (CVE-2021-22945)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22945</cvename>
<cvename>CVE-2021-22946</cvename>
<cvename>CVE-2021-22947</cvename>
<url>https://curl.se/docs/security.html</url>
</references>
<dates>
<discovery>2021-09-15</discovery>
<entry>2021-09-17</entry>
<modified>2021-09-28</modified>
</dates>
</vuln>
<vuln vid="15e74795-0fd7-11ec-9f2e-dca632b19f10">
<topic>libpano13 -- arbitrary memory access through format string vulnerability</topic>
<affects>
<package>
<name>libpano13</name>
<range><lt>2.9.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libpano13 developers reports:</p>
<blockquote cite="https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/README.txt">
<p>Fix crash and security issue caused by malformed filename prefix</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-20307</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-20307</url>
</references>
<dates>
<discovery>2021-05-04</discovery>
<entry>2021-09-07</entry>
</dates>
</vuln>
<vuln vid="49c35943-0eeb-421c-af4f-78e04582e5fb">
<topic>seatd-launch -- privilege escalation with SUID</topic>
<affects>
<package>
<name>seatd</name>
<range><ge>0.6.0</ge><lt>0.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kenny Levinsen reports:</p>
<blockquote cite="https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E">
<p>seatd-launch used execlp, which reads the PATH environment variable to
search for the requested executable, to execute seatd. This meant that
the caller could freely control what executable was loaded by adding a
user-writable directory to PATH.</p>
<p>If seatd-launch had the SUID bit set, this could be used by a
malicious user with the ability to execute seatd-launch to mount a
privilege escalation attack to the owner of seatd-launch, which is
likely root.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E</url>
<cvename>CVE-2021-41387</cvename>
</references>
<dates>
<discovery>2021-09-15</discovery>
<entry>2021-09-16</entry>
<modified>2021-09-18</modified>
</dates>
</vuln>
<vuln vid="47b571f2-157b-11ec-ae98-704d7b472482">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>93.0.4577.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html">
<p>This release includes 11 security fixes, including:</p>
<ul>
<li>[1237533] High CVE-2021-30625: Use after free in Selection API.
Reported by Marcin Towalski of Cisco Talos on 2021-08-06</li>
<li>[1241036] High CVE-2021-30626: Out of bounds memory access in
ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18</li>
<li>[1245786] High CVE-2021-30627: Type Confusion in Blink layout.
Reported by Aki Helin of OUSPG on 2021-09-01</li>
<li>[1241123] High CVE-2021-30628: Stack buffer overflow in ANGLE.
Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18</li>
<li>[1243646] High CVE-2021-30629: Use after free in Permissions.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
at Qi'anxin Group on 2021-08-26</li>
<li>[1244568] High CVE-2021-30630: Inappropriate implementation in
Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
2021-08-30</li>
<li>[1246932] High CVE-2021-30631: Type Confusion in Blink layout.
Reported by Atte Kettunen of OUSPG on 2021-09-06</li>
<li>[1247763] High CVE-2021-30632: Out of bounds write in V8.
Reported by Anonymous on 2021-09-08</li>
<li>[1247766] High CVE-2021-30633: Use after free in Indexed DB API.
Reported by Anonymous on 2021-09-08</li>
</ul>
<p>Google is aware that exploits for CVE-2021-30632 and CVE-2021-30633
exist in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30625</cvename>
<cvename>CVE-2021-30626</cvename>
<cvename>CVE-2021-30627</cvename>
<cvename>CVE-2021-30628</cvename>
<cvename>CVE-2021-30629</cvename>
<cvename>CVE-2021-30630</cvename>
<cvename>CVE-2021-30631</cvename>
<cvename>CVE-2021-30632</cvename>
<cvename>CVE-2021-30633</cvename>
<url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-09-13</discovery>
<entry>2021-09-14</entry>
</dates>
</vuln>
<vuln vid="93eb0e48-14ba-11ec-875e-901b0e9408dc">
<topic>Matrix clients -- several vulnerabilities</topic>
<affects>
<package>
<name>cinny</name>
<range><lt>1.2.1</lt></range>
</package>
<package>
<name>element-web</name>
<range><lt>1.8.3</lt></range>
</package>
<package>
<name>nheko</name>
<range><le>0.8.2_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing">
<p>Today we are disclosing a critical security issue affecting
multiple Matrix clients and libraries including Element
(Web/Desktop/Android), FluffyChat, Nheko, Cinny, and SchildiChat.</p>
<p>Specifically, in certain circumstances it may be possible to
trick vulnerable clients into disclosing encryption keys for
messages previously sent by that client to user accounts later
compromised by an attacker.</p>
<p>Exploiting this vulnerability to read encrypted messages requires
gaining control over the recipient’s account. This requires either
compromising their credentials directly or compromising their homeserver.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-40823</cvename>
<cvename>CVE-2021-40824</cvename>
<url>https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing</url>
</references>
<dates>
<discovery>2021-08-23</discovery>
<entry>2021-09-13</entry>
</dates>
</vuln>
<vuln vid="376df2f1-1295-11ec-859e-000c292ee6b8">
<topic>consul -- rpc: authorize raft requests</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.10.2</lt></range>
<range><lt>1.9.9</lt></range>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hashicorp reports:</p>
<blockquote cite="https://github.com/hashicorp/consul/releases/tag/v1.9.9">
<p>HashiCorp Consul Raft RPC layer allows non-server agents with a
valid certificate signed by the same CA to access server-only
functionality, enabling privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37219</cvename>
<url>https://github.com/hashicorp/consul/releases/tag/v1.9.9</url>
</references>
<dates>
<discovery>2021-08-27</discovery>
<entry>2021-09-11</entry>
</dates>
</vuln>
<vuln vid="4ea1082a-1259-11ec-b4fa-dd5a552bdd17">
<topic>go -- archive/zip: overflow in preallocation check can cause OOM panic</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.17.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/47801">
<p>An oversight in the previous fix still allows for an OOM
panic when the indicated directory size in the archive
header is so large that subtracting it from the archive
size overflows a uint64, effectively bypassing the check
that the number of files in the archive is reasonable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39293</cvename>
<url>https://github.com/golang/go/issues/47801</url>
</references>
<dates>
<discovery>2021-08-18</discovery>
<entry>2021-09-10</entry>
</dates>
</vuln>
<vuln vid="145ce848-1165-11ec-ac7e-08002789875b">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3.8/whatsnew/changelog.html#changelog">
<p>bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid
a potential race condition.</p>
<p>bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
on Windows and macOS.</p>
<p>bpo-43124: Made the internal putcmd function in smtplib sanitize input for
presence of \r and \n characters to avoid (unlikely) command injection.</p>
<p>bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address
strings. Leading zeros are ambiguous and interpreted as octal notation by some
libraries. For example the legacy function socket.inet_aton() treats leading
zeros as octal notation. glibc implementation of modern inet_pton() does not
accept any leading zeros. For a while the ipaddress module used to accept ambiguous
leading zeros.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.8/whatsnew/changelog.html#changelog</url>
</references>
<dates>
<discovery>2021-08-30</discovery>
<entry>2021-09-09</entry>
</dates>
</vuln>
<vuln vid="f55921aa-10c9-11ec-8647-00e0670f2660">
<topic>MPD5 PPPoE Server remotely exploitable crash</topic>
<affects>
<package>
<name>mpd5</name>
<range><ge>5.0</ge><lt>5.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Version 5.9_2 contains security fix for PPPoE servers.
Insufficient validation of incoming PPPoE Discovery request
specially crafted by unauthenticated user might lead to unexpected
termination of the process. The problem affects mpd versions
since 5.0. Installations not using PPPoE server configuration
were not affected.</p>
</body>
</description>
<references>
<url>http://mpd.sourceforge.net/doc5/mpd4.html#4</url>
</references>
<dates>
<discovery>2021-09-04</discovery>
<entry>2021-09-09</entry>
</dates>
</vuln>
<vuln vid="0e561173-0fa9-11ec-a2fa-080027948c12">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python36</name>
<range><lt>3.6.15</lt></range>
</package>
<package>
<name>python37</name>
<range><lt>3.7.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3.6/whatsnew/changelog.html#changelog">
<p>bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
on Windows and macOS.</p>
<p>bpo-43124: Made the internal putcmd function in smtplib sanitize input for
presence of \r and \n characters to avoid (unlikely) command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.6/whatsnew/changelog.html#changelog</url>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url>
</references>
<dates>
<discovery>2021-08-30</discovery>
<entry>2021-09-07</entry>
</dates>
</vuln>
<vuln vid="65f05b71-0e3c-11ec-b335-d4c9ef517024">
<topic>WeeChat -- Crash when decoding a malformed websocket frame in relay plugin.</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WeeChat project reports:</p>
<blockquote cite="https://weechat.org/doc/security/">
<p>Crash when decoding a malformed websocket frame in relay plugin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/doc/security/</url>
<url>https://github.com/weechat/weechat/commit/8b1331f98de1714bae15a9ca2e2b393ba49d735b</url>
</references>
<dates>
<discovery>2021-09-04</discovery>
<entry>2021-09-05</entry>
</dates>
</vuln>
<vuln vid="a67e358c-0bf6-11ec-875e-901b0e9408dc">
<topic>py-matrix-synapse -- several vulnerabilities</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<range><lt>1.41.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2021/08/31/synapse-1-41-1-released">
<p>This release patches two moderate severity issues which
could reveal metadata about private rooms:</p>
<ul>
<li>CVE-2021-39164: Enumerating a private room's list of
members and their display names.</li>
<li>CVE-2021-39163: Disclosing a private room's name,
avatar, topic, and number of members.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/258187</freebsdpr>
<cvename>CVE-2021-39164</cvename>
<cvename>CVE-2021-39163</cvename>
<url>https://matrix.org/blog/2021/08/31/synapse-1-41-1-released</url>
</references>
<dates>
<discovery>2021-08-31</discovery>
<entry>2021-09-02</entry>
</dates>
</vuln>
<vuln vid="032643d7-0ba7-11ec-a689-080027e50e6d">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python39</name>
<range><lt>3.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/release/3.9.7/whatsnew/changelog.html">
<p>bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid
a potential race condition.</p>
<p>bpo-41180: Add auditing events to the marshal module, and stop raising
code.__init__ events for every unmarshalled code object. Directly instantiated
code objects will continue to raise an event, and audit event handlers should
inspect or collect the raw marshal data. This reduces a significant performance
overhead when loading from .pyc files.</p>
<p>bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
on Windows and macOS.</p>
<p>bpo-43124: Made the internal putcmd function in smtplib sanitize input for
presence of \r and \n characters to avoid (unlikely) command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/release/3.9.7/whatsnew/changelog.html</url>
</references>
<dates>
<discovery>2021-08-30</discovery>
<entry>2021-09-02</entry>
</dates>
</vuln>
<vuln vid="a7732806-0b2a-11ec-836b-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>93.0.4577.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop_31.html">
<p>This release contains 27 security fixes, including:</p>
<ul>
<li>[1233975] High CVE-2021-30606: Use after free in Blink. Reported
by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of 360
Alpha Lab on 2021-07-28</li>
<li>[1235949] High CVE-2021-30607: Use after free in Permissions.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2021-08-03</li>
<li>[1219870] High CVE-2021-30608: Use after free in Web Share.
Reported by Huyna at Viettel Cyber Security on 2021-06-15</li>
<li>[1239595] High CVE-2021-30609: Use after free in Sign-In.
Reported by raven (@raid_akame) on 2021-08-13</li>
<li>[1200440] High CVE-2021-30610: Use after free in Extensions API.
Reported by Igor Bukanov from Vivaldi on 2021-04-19</li>
<li>[1233942] Medium CVE-2021-30611: Use after free in WebRTC.
Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of
360 Alpha Lab on 2021-07-28</li>
<li>[1234284] Medium CVE-2021-30612: Use after free in WebRTC.
Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of
360 Alpha Lab on 2021-07-29</li>
<li>[1209622] Medium CVE-2021-30613: Use after free in Base
internals. Reported by Yangkang (@dnpushme) of 360 ATA on
2021-05-16</li>
<li>[1207315] Medium CVE-2021-30614: Heap buffer overflow in
TabStrip. Reported by Huinian Yang (@vmth6) of Amber Security Lab,
OPPO Mobile Telecommunications Corp. Ltd. on 2021-05-10</li>
<li>[1208614] Medium CVE-2021-30615: Cross-origin data leak in
Navigation. Reported by NDevTK on 2021-05-12</li>
<li>[1231432] Medium CVE-2021-30616: Use after free in Media.
Reported by Anonymous on 2021-07-21</li>
<li>[1226909] Medium CVE-2021-30617: Policy bypass in Blink.
Reported by NDevTK on 2021-07-07</li>
<li>[1232279] Medium CVE-2021-30618: Inappropriate implementation in
DevTools. Reported by @DanAmodio and @mattaustin from Contrast
Security on 2021-07-23</li>
<li>[1235222] Medium CVE-2021-30619: UI Spoofing in Autofill.
Reported by Alesandro Ortiz on 2021-08-02</li>
<li>[1063518] Medium CVE-2021-30620: Insufficient policy enforcement
in Blink. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
Research on 2020-03-20</li>
<li>[1204722] Medium CVE-2021-30621: UI Spoofing in Autofill.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2021-04-30</li>
<li>[1224419] Medium CVE-2021-30622: Use after free in WebApp
Installs. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
Research on 2021-06-28</li>
<li>[1223667] Low CVE-2021-30623: Use after free in Bookmarks.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-06-25</li>
<li>[1230513] Low CVE-2021-30624: Use after free in Autofill.
Reported by Wei Yuan of MoyunSec VLab on 2021-07-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30606</cvename>
<cvename>CVE-2021-30607</cvename>
<cvename>CVE-2021-30608</cvename>
<cvename>CVE-2021-30609</cvename>
<cvename>CVE-2021-30610</cvename>
<cvename>CVE-2021-30611</cvename>
<cvename>CVE-2021-30612</cvename>
<cvename>CVE-2021-30613</cvename>
<cvename>CVE-2021-30614</cvename>
<cvename>CVE-2021-30615</cvename>
<cvename>CVE-2021-30616</cvename>
<cvename>CVE-2021-30617</cvename>
<cvename>CVE-2021-30618</cvename>
<cvename>CVE-2021-30619</cvename>
<cvename>CVE-2021-30620</cvename>
<cvename>CVE-2021-30621</cvename>
<cvename>CVE-2021-30622</cvename>
<cvename>CVE-2021-30623</cvename>
<cvename>CVE-2021-30624</cvename>
<url>https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop_31.html</url>
</references>
<dates>
<discovery>2021-08-31</discovery>
<entry>2021-09-01</entry>
</dates>
</vuln>
<vuln vid="3d915d96-0b1f-11ec-8d9f-080027415d17">
<topic>cyrus-imapd -- multiple-minute daemon hang via input that is mishandled during hash-table interaction</topic>
<affects>
<package>
<name>cyrus-imapd34</name>
<range><lt>3.4.2</lt></range>
</package>
<package>
<name>cyrus-imapd32</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>cyrus-imapd30</name>
<range><lt>3.0.16</lt></range>
</package>
<package>
<name>cyrus-imapd25</name>
<name>cyrus-imapd24</name>
<name>cyrus-imapd23</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.4.2 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html">
<p>Fixed CVE-2021-33582: Certain user inputs are used as hash table keys during processing. A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a single bucket. Each subsequent insertion to the same bucket requires a strcmp of every other entry in it. At tens of thousands of entries, each new insertion could keep the CPU busy in a strcmp loop for minutes.
The string hashing algorithm has been replaced with a better one, and now also uses a random seed per hash table, so malicious inputs cannot be precomputed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33582</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33582</url>
</references>
<dates>
<discovery>2021-05-26</discovery>
<entry>2021-09-01</entry>
</dates>
</vuln>
<vuln vid="6c22bb39-0a9a-11ec-a265-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.2.0</ge><lt>14.2.2</lt></range>
<range><ge>14.1.0</ge><lt>14.1.4</lt></range>
<range><ge>0</ge><lt>14.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/">
<p>Stored XSS in DataDog Integration</p>
<p>Invited group members continue to have project access even after invited group is deleted</p>
<p>Specially crafted requests to apollo_upload_server middleware leads to denial of service</p>
<p>Privilege escalation of an external user through project token</p>
<p>Missing access control allows non-admin users to add/remove Jira Connect Namespaces</p>
<p>User enumeration on private instances</p>
<p>Member e-mails can be revealed via project import/export feature</p>
<p>Stored XSS in Jira integration</p>
<p>Stored XSS in markdown via the Design reference</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22257</cvename>
<cvename>CVE-2021-22258</cvename>
<cvename>CVE-2021-22238</cvename>
<url>https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/</url>
</references>
<dates>
<discovery>2021-08-31</discovery>
<entry>2021-08-31</entry>
</dates>
</vuln>
<vuln vid="1d6410e8-06c1-11ec-a35d-03ca114d16d6">
<topic>fetchmail -- STARTTLS bypass vulnerabilities</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.4.22.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem:</p>
<blockquote cite="https://www.fetchmail.info/fetchmail-SA-2021-02.txt">
<p>In certain circumstances, fetchmail 6.4.21 and older would
not encrypt the session using STARTTLS/STLS, and might not have
cleared session state across the TLS negotiation.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-39272</cvename>
<url>https://www.fetchmail.info/fetchmail-SA-2021-02.txt</url>
</references>
<dates>
<discovery>2021-08-10</discovery>
<entry>2021-08-26</entry>
</dates>
</vuln>
<vuln vid="d22b336d-0567-11ec-b69d-4062311215d5">
<topic>FreeBSD -- libfetch out of bounds read</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_4</lt></range>
<range><ge>12.2</ge><lt>12.2_10</lt></range>
<range><ge>11.4</ge><lt>11.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The passive mode in FTP communication allows an out of boundary read while
libfetch uses strtol to parse the relevant numbers into address bytes. It
does not check if the line ends prematurely. If it does, the for-loop
condition checks for *p == '\0' one byte too late because p++ was already
performed.</p>
<h1>Impact:</h1>
<p>The connection buffer size can be controlled by a malicious FTP server
because the size is increased until a newline is encountered (or no more
characters are read). This also allows to move the buffer into more
interesting areas within the address space, potentially parsing relevant
numbers for the attacker. Since these bytes become available to the server
in form of a new TCP connection to a constructed port number or even part of
the IPv6 address this is a potential information leak.</p>
</body>
</description>
<references>
<cvename>CVE-2021-36159</cvename>
<freebsdsa>SA-21:15.libfetch</freebsdsa>
</references>
<dates>
<discovery>2021-08-24</discovery>
<entry>2021-08-25</entry>
</dates>
</vuln>
<vuln vid="3e9d2fde-0567-11ec-b69d-4062311215d5">
<topic>FreeBSD -- Remote code execution in ggatec(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_4</lt></range>
<range><ge>12.2</ge><lt>12.2_10</lt></range>
<range><ge>11.4</ge><lt>11.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ggatec(8) daemon does not validate the size of a response before writing
it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).</p>
<h1>Impact:</h1>
<p>A malicious ggated(8) or an attacker in a priviledged network position can
overwrite the stack with crafted content and potentially execute arbitrary
code.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29630</cvename>
<freebsdsa>SA-21:14.ggatec</freebsdsa>
</references>
<dates>
<discovery>2021-08-24</discovery>
<entry>2021-08-25</entry>
</dates>
</vuln>
<vuln vid="a6d5d4c1-0564-11ec-b69d-4062311215d5">
<topic>FreeBSD -- Missing error handling in bhyve(8) device models</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_4</lt></range>
<range><ge>12.2</ge><lt>12.2_10</lt></range>
<range><ge>11.4</ge><lt>11.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Certain VirtIO-based device models failed to handle errors when fetching
I/O descriptors. Such errors could be triggered by a malicious guest.
As a result, the device model code could be tricked into operating on
uninitialized I/O vectors, leading to memory corruption.</p>
<h1>Impact:</h1>
<p>A malicious guest may be able to crash the bhyve process. It may be
possible to exploit the memory corruption bugs to achieve arbitrary code
execution in the bhyve process.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29631</cvename>
<freebsdsa>SA-21:13.bhyve</freebsdsa>
</references>
<dates>
<discovery>2021-08-24</discovery>
<entry>2021-08-25</entry>
</dates>
</vuln>
<vuln vid="96811d4a-04ec-11ec-9b84-d4c9ef517024">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1l,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.0.b3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_4</lt></range>
<range><ge>12.2</ge><lt>12.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20210824.txt">
<p>SM2 Decryption Buffer Overflow (CVE-2021-3711: High)</p>
<p>Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
Moderate)
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3711</cvename>
<cvename>CVE-2021-3712</cvename>
<url>https://www.openssl.org/news/secadv/20210824.txt</url>
<freebsdsa>SA-21:16.openssl</freebsdsa>
</references>
<dates>
<discovery>2021-08-24</discovery>
<entry>2021-08-24</entry>
<modified>2021-08-25</modified>
</dates>
</vuln>
<vuln vid="d3180f02-031e-11ec-875f-0800273f11ea">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.15.0:</p>
<blockquote cite="https://blog.gitea.io/2021/08/gitea-1.15.0-is-released/">
<ul>
<li>Encrypt LDAP bind password in db with SECRET_KEY (#15547)</li>
<li>Remove random password in Dockerfiles (#15362)</li>
<li>Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 (#16590) (#16606)</li>
<li>Correctly create of git-daemon-export-ok files (#16508) (#16514)</li>
<li>Don't show private user's repo in explore view (#16550) (#16554)</li>
<li>Update node tar dependency to 6.1.6 (#16622) (#16623)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.15.0</url>
<freebsdpr>ports/257994</freebsdpr>
</references>
<dates>
<discovery>2021-04-29</discovery>
<entry>2021-08-22</entry>
</dates>
</vuln>
<vuln vid="733afd81-01cf-11ec-aec9-0800273f11ea">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.14.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.14.6:</p>
<blockquote cite="https://blog.gitea.io/2021/08/gitea-1.14.6-is-released/">
<ul>
<li>Bump github.com/markbates/goth from v1.67.1 to v1.68.0 (#16538) (#16540)</li>
<li>Switch to maintained JWT lib (#16532) (#16535)</li>
<li>Upgrade to latest version of golang-jwt (as forked for 1.14) (#16590) (#16607)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.14.6</url>
<freebsdpr>ports/257973</freebsdpr>
</references>
<dates>
<discovery>2021-07-24</discovery>
<entry>2021-08-20</entry>
</dates>
</vuln>
<vuln vid="70e71a24-0151-11ec-bf0c-080027eedc6a">
<topic>bouncycastle15 -- bcrypt password checking vulnerability</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><ge>1.65</ge><lt>1.67</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Bouncy Castle team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28052">
<p>
The OpenBSDBCrypt.checkPassword utility method compared incorrect
data when checking the password, allowing incorrect passwords to
indicate they were matching with previously hashed ones that were
different.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-28052</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28052</url>
</references>
<dates>
<discovery>2020-11-02</discovery>
<entry>2021-08-20</entry>
</dates>
</vuln>
<vuln vid="89d5bca6-0150-11ec-bf0c-080027eedc6a">
<topic>The Bouncy Castle Crypto APIs -- EC math vulnerability</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><lt>1.66</lt></range>
</package>
<package>
<name>bouncycastle</name>
<range><lt>1.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Bouncy Castle team reports::</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522">
<p>
Bouncy Castle BC Java before 1.66 has a timing issue within the EC
math library that can expose information about the private key when
an attacker is able to observe timing information for the generation
of multiple deterministic ECDSA signatures.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15522</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522</url>
</references>
<dates>
<discovery>2020-07-04</discovery>
<entry>2021-08-20</entry>
</dates>
</vuln>
<vuln vid="f4c54b81-bcc8-11eb-a7a6-080027f515ea">
<topic>binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()</topic>
<affects>
<package>
<name>binutils</name>
<range><lt>2.33.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hao Wang reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3487">
<p>
There's a flaw in the BFD library of binutils in versions before 2.36.
An attacker who supplies a crafted file to an application linked with BFD,
and using the DWARF functionality, could cause an impact to system
availability by way of excessive memory consumption.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3487</cvename>
<url>https://sourceware.org/bugzilla/show_bug.cgi?id=26946</url>
</references>
<dates>
<discovery>2020-11-25</discovery>
<entry>2021-08-13</entry>
</dates>
</vuln>
<vuln vid="128deba6-ff56-11eb-8514-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>92.0.4515.159</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html">
<p>This release contains 9 security fixes, including:</p>
<ul>
<li>[1234764] High CVE-2021-30598: Type Confusion in V8. Reported by
Manfred Paul on 2021-07-30</li>
<li>[1234770] High CVE-2021-30599: Type Confusion in V8. Reported by
Manfred Paul on 2021-07-30</li>
<li>[1231134] High CVE-2021-30600: Use after free in Printing.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-07-20</li>
<li>[1234009] High CVE-2021-30601: Use after free in Extensions API.
Reported by koocola(@alo_cook) and Nan Wang(@eternalsakura13) of
360 Alpha Lab on 2021-07-28</li>
<li>[1230767] High CVE-2021-30602: Use after free in WebRTC.
Reported by Marcin Towalski of Cisco Talos on 2021-07-19</li>
<li>[1233564] High CVE-2021-30603: Race in WebAudio. Reported by
Sergei Glazunov of Google Project Zero on 2021-07-27</li>
<li>[1234829] High CVE-2021-30604: Use after free in ANGLE. Reported
by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-07-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30598</cvename>
<cvename>CVE-2021-30599</cvename>
<cvename>CVE-2021-30600</cvename>
<cvename>CVE-2021-30601</cvename>
<cvename>CVE-2021-30602</cvename>
<cvename>CVE-2021-30603</cvename>
<cvename>CVE-2021-30604</cvename>
<url>https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-08-16</discovery>
<entry>2021-08-17</entry>
</dates>
</vuln>
<vuln vid="e9200f8e-fd34-11eb-afb1-c85b76ce9b5a">
<topic>lynx -- SSL certificate validation error</topic>
<affects>
<package>
<name>ja-lynx</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>ja-lynx-current</name>
<range><lt>2.9.0d9</lt></range>
</package>
<package>
<name>lynx</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>lynx-current</name>
<range><lt>2.9.0d9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Axel Beckert reports:</p>
<blockquote cite="https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html">
<p>[...] I was able to capture the password given on the commandline in traffic
of an TLS handshake using tcpdump and analysing it with Wireshark: [...]</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html</url>
</references>
<dates>
<discovery>2021-08-07</discovery>
<entry>2021-08-14</entry>
<modified>2021-08-15</modified>
</dates>
</vuln>
<vuln vid="b471130b-fb86-11eb-87db-6cc21735f730">
<topic>PostgreSQL server -- Memory disclosure in certain queries</topic>
<affects>
<package>
<name>postgresql13-server</name>
<range><lt>13.4</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.8</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-3677/">
<p>
A purpose-crafted query can read arbitrary bytes of
server memory. In the default configuration, any
authenticated database user can complete this attack at
will. The attack does not require the ability to create
objects. If server settings include
max_worker_processes=0, the known versions of this
attack are infeasible. However, undiscovered variants of
the attack may be independent of that setting.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3677</cvename>
<url>https://www.postgresql.org/support/security/CVE-2021-3677/</url>
</references>
<dates>
<discovery>2021-08-12</discovery>
<entry>2021-08-12</entry>
</dates>
</vuln>
<vuln vid="e80073d7-f8ba-11eb-b141-589cfc007716">
<topic>xtrlock -- xtrlock does not block multitouch events</topic>
<affects>
<package>
<name>xtrlock</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html">
<p>xtrlock did not block multitouch events so an attacker could still
input and thus control various programs such as Chromium, etc. via
so-called "multitouch" events including pan scrolling, "pinch and
zoom" or even being able to provide regular mouse clicks by
depressing the touchpad once and then clicking with a secondary
finger.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10894</cvename>
<url>https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html</url>
</references>
<dates>
<discovery>2016-07-10</discovery>
<entry>2021-08-09</entry>
</dates>
</vuln>
<vuln vid="848bdd06-f93a-11eb-9f7d-206a8a720317">
<topic>x11/cde -- Local privilege escalation via CDE dtsession</topic>
<affects>
<package>
<name>cde</name>
<range><lt>2.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marco Ivaldi (marco.ivaldi () mediaservice net) reports:</p>
<blockquote cite="https://seclists.org/bugtraq/2020/Jan/22">
<p>A buffer overflow in the CheckMonitor() function in the Common
Desktop Environment 2.3.1 and earlier and 1.6 and earlier,
as distributed with Oracle Solaris 10 1/13 (Update 11) and
earlier, allows local users to gain root privileges via a long
palette name passed to dtsession in a malicious .Xdefaults
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2696</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2696</url>
</references>
<dates>
<discovery>2020-01-15</discovery>
<entry>2021-08-09</entry>
</dates>
</vuln>
<vuln vid="880552c4-f63f-11eb-9d56-7186043316e9">
<topic>go -- net/http: panic due to racy read of persistConn after handler panic</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.16.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/46866">
<p>A net/http/httputil ReverseProxy can panic due to a race
condition if its Handler aborts with ErrAbortHandler, for
example due to an error in copying the response body. An
attacker might be able to force the conditions leading to
the race condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-36221</cvename>
<url>https://github.com/golang/go/issues/46866</url>
</references>
<dates>
<discovery>2021-06-21</discovery>
<entry>2021-08-05</entry>
</dates>
</vuln>
<vuln vid="1d651770-f4f5-11eb-ba49-001b217b3468">
<topic>Gitlab -- Gitlab</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.1.0</ge><lt>14.1.2</lt></range>
<range><ge>14.0.0</ge><lt>14.0.7</lt></range>
<range><ge>0</ge><lt>13.12.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/">
<p>Stored XSS in Mermaid when viewing Markdown files</p>
<p>Stored XSS in default branch name</p>
<p>Perform Git actions with an impersonation token even if impersonation is disabled</p>
<p>Tag and branch name confusion allows Developer to access protected CI variables</p>
<p>New subscriptions generate OAuth tokens on an incorrect OAuth client application</p>
<p>Ability to list and delete impersonation tokens for your own user</p>
<p>Pipelines page is partially visible for users that have no right to see CI/CD</p>
<p>Improper email validation on an invite URL</p>
<p>Unauthorised user was able to add meta data upon issue creation</p>
<p>Unauthorized user can trigger deployment to a protected environment</p>
<p>Guest in private project can see CI/CD Analytics</p>
<p>Guest users can create issues for Sentry errors and track their status</p>
<p>Private user email disclosure via group invitation</p>
<p>Projects are allowed to add members with email address domain that should be blocked by group settings</p>
<p>Misleading username could lead to impersonation in using SSH Certificates</p>
<p>Unauthorized user is able to access and view project vulnerability reports</p>
<p>Denial of service in repository caused by malformed commit author</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22237</cvename>
<cvename>CVE-2021-22236</cvename>
<cvename>CVE-2021-22239</cvename>
<url>https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/</url>
</references>
<dates>
<discovery>2021-08-03</discovery>
<entry>2021-08-04</entry>
</dates>
</vuln>
<vuln vid="5ef14250-f47c-11eb-8f13-5b4de959822e">
<topic>Prosody -- Remote Information Disclosure</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.11.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Prosody XMPP server advisory reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20210722/">
<p>It was discovered that Prosody allows any entity to access the list of
admins, members, owners and banned entities of any federated XMPP group chat
of which they know the address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-37601</cvename>
<url>https://prosody.im/security/advisory_20210722/</url>
</references>
<dates>
<discovery>2021-07-22</discovery>
<entry>2021-08-03</entry>
</dates>
</vuln>
<vuln vid="c3c6c4a3-f47d-11eb-b632-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>92.0.4515.131</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/search/label/Stable%20updates">
<p>This release contains 10 security fixes, including:</p>
<ul>
<li>[1227777] High CVE-2021-30590: Heap buffer overflow in
Bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-07-09</li>
<li>[1229298] High CVE-2021-30591: Use after free in File System
API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
2021-07-14</li>
<li>[1209469] High CVE-2021-30592: Out of bounds write in Tab
Groups. Reported by David Erceg on 2021-05-15</li>
<li>[1209616] High CVE-2021-30593: Out of bounds read in Tab Strip.
Reported by David Erceg on 2021-05-16</li>
<li>[1218468] High CVE-2021-30594: Use after free in Page Info UI.
Reported by raven (@raid_akame) on 2021-06-10</li>
<li>[1214481] Medium CVE-2021-30596: Incorrect security UI in
Navigation. Reported by Mohit Raj (shadow2639) on 2021-05-29</li>
<li>[1232617] Medium CVE-2021-30597: Use after free in Browser UI.
Reported by raven (@raid_akame) on 2021-07-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30590</cvename>
<cvename>CVE-2021-30591</cvename>
<cvename>CVE-2021-30592</cvename>
<cvename>CVE-2021-30593</cvename>
<cvename>CVE-2021-30594</cvename>
<cvename>CVE-2021-30596</cvename>
<cvename>CVE-2021-30597</cvename>
<url>https://chromereleases.googleblog.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2021-08-02</discovery>
<entry>2021-08-03</entry>
</dates>
</vuln>
<vuln vid="b1aa54ae-74cb-42a0-b462-cbb6831c5c50">
<topic>RabbitMQ -- Denial of Service in AMQP1.0 plugin</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><lt>3.8.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotal.io reports:</p>
<blockquote cite="https://tanzu.vmware.com/security/cve-2021-22116">
<p>All versions prior to 3.8.16 are prone to a denial of
service vulnerability due to improper input validation
in AMQP 1.0 client connection endpoint.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9877</cvename>
<url>https://tanzu.vmware.com/security/cve-2021-22116</url>
<url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.19</url>
</references>
<dates>
<discovery>2021-05-10</discovery>
<entry>2021-05-10</entry>
</dates>
</vuln>
<vuln vid="d34bef0b-f312-11eb-b12b-fc4dd43e2b6a">
<topic>tomcat -- HTTP request smuggling in multiple versions</topic>
<affects>
<package>
<name>tomcat85</name>
<range><ge>8.5.0</ge><le>8.5.66</le></range>
</package>
<package>
<name>tomcat9</name>
<range><ge>9.0.0</ge><le>9.0.46</le></range>
</package>
<package>
<name>tomcat10</name>
<range><ge>10.0.0</ge><le>10.0.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab reports:</p>
<blockquote cite="https://tomcat.apache.org/security.html">
<p>Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignored the transfer-encoding header if the client declared it would only accept an HTTP/1.0 response; Tomcat honoured the identify encoding; and Tomcat did not ensure that, if present, the chunked encoding was the final encoding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33037</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33037</url>
</references>
<dates>
<discovery>2021-05-07</discovery>
<entry>2021-08-01</entry>
</dates>
</vuln>
<vuln vid="8b571fb2-f311-11eb-b12b-fc4dd43e2b6a">
<topic>tomcat -- JNDI Realm Authentication Weakness in multiple versions</topic>
<affects>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.108</le></range>
</package>
<package>
<name>tomcat85</name>
<range><ge>8.5.0</ge><le>8.5.65</le></range>
</package>
<package>
<name>tomcat9</name>
<range><ge>9.0.0</ge><le>9.0.45</le></range>
</package>
<package>
<name>tomcat10</name>
<range><ge>10.0.0</ge><le>10.0.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ilja.farber reports:</p>
<blockquote cite="https://tomcat.apache.org/security.html">
<p>Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator.
In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30640</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30640</url>
</references>
<dates>
<discovery>2021-04-08</discovery>
<entry>2021-08-01</entry>
</dates>
</vuln>
<vuln vid="cc7c85d9-f30a-11eb-b12b-fc4dd43e2b6a">
<topic>tomcat -- Remote Denial of Service in multiple versions</topic>
<affects>
<package>
<name>tomcat85</name>
<range><eq>8.5.64</eq></range>
</package>
<package>
<name>tomcat9</name>
<range><eq>9.0.44</eq></range>
</package>
<package>
<name>tomcat10</name>
<range><ge>10.0.3</ge><le>10.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rbeaudry reports:</p>
<blockquote cite="https://tomcat.apache.org/security.html">
<p>A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS.</p>
<p>Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30639</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30639</url>
</references>
<dates>
<discovery>2021-03-24</discovery>
<entry>2021-08-01</entry>
</dates>
</vuln>
<vuln vid="cbfd1874-efea-11eb-8fe9-036bd763ff35">
<topic>fetchmail -- 6.4.19 and older denial of service or information disclosure</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.9</lt></range>
<range><ge>6.3.17</ge><lt>6.4.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="https://sourceforge.net/p/fetchmail/mailman/message/37327392/">
<p>When a log message exceeds c. 2 kByte in size, for instance, with very long
header contents, and depending on verbosity option, fetchmail can crash or
misreport each first log message that requires a buffer reallocation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-36386</cvename>
<cvename>CVE-2008-2711</cvename>
<url>https://sourceforge.net/p/fetchmail/mailman/message/37327392/</url>
</references>
<dates>
<discovery>2021-07-07</discovery>
<entry>2021-07-28</entry>
<modified>2021-08-03</modified>
</dates>
</vuln>
<vuln vid="c561ce49-eabc-11eb-9c3f-0800270512f4">
<topic>redis -- Integer overflow issues with BITFIELD command on 32-bit systems</topic>
<affects>
<package>
<name>redis</name>
<range><lt>6.0.15</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><lt>6.2.5</lt></range>
</package>
<package>
<name>redis5</name>
<range><lt>5.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Huang Zhw reports:</p>
<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj">
<p>
On 32-bit versions, Redis BITFIELD command is vulnerable to integer
overflow that can potentially be exploited to corrupt the heap,
leak arbitrary heap contents or trigger remote code execution.
The vulnerability involves constructing specially crafted bit
commands which overflow the bit offset.
</p>
<p>
This problem only affects 32-bit versions of Redis.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32761</cvename>
<url>https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj</url>
</references>
<dates>
<discovery>2021-07-04</discovery>
<entry>2021-07-27</entry>
</dates>
</vuln>
<vuln vid="ce79167f-ee1c-11eb-9785-b42e99a1b9c3">
<topic>powerdns -- remotely triggered crash</topic>
<affects>
<package>
<name>powerdns</name>
<range><eq>4.5.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns reports:</p>
<blockquote cite="https://www.powerdns.com/news.html#20210726">
<p>PowerDNS Security Advisory 2021-01: Specific query crashes Authoritative Server</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-36754</cvename>
<url>https://blog.powerdns.com/2021/07/26/security-advisory-2021-01-for-powerdns-authoritative-server-4-5-0/</url>
</references>
<dates>
<discovery>2021-07-26</discovery>
<entry>2021-07-27</entry>
</dates>
</vuln>
<vuln vid="cc553d79-e1f0-4b94-89f2-bacad42ee826">
<topic>mosquitto -- NULL pointer dereference</topic>
<affects>
<package>
<name>mosquitto</name>
<range><ge>2.0.0</ge><lt>2.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roger Light reports:</p>
<blockquote cite="https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt">
<p>If an authenticated client connected with MQTT v5 sent
a malformed CONNACK message to the broker a NULL pointer
dereference occurred, most likely resulting in a
segfault.</p>
<p>(Note: a CVE is referenced in the github commit but it
appears to be for a python-bleach vulnerability so it is
not included here.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt</url>
</references>
<dates>
<discovery>2021-04-10</discovery>
<entry>2021-07-24</entry>
</dates>
</vuln>
<vuln vid="92ad12b8-ec09-11eb-aef1-0897988a1c07">
<topic>pjsip -- Race condition in SSL socket server</topic>
<affects>
<package>
<name>pjsip</name>
<range><lt>2.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pjsip reports:</p>
<blockquote cite="https://github.com/pjsip/pjproject/security/advisories">
<p>There are a couple of issues found in the SSL socket:</p>
<ul>
<li>A race condition between callback and destroy, due to the accepted socket having no group lock.</li>
<li>SSL socket parent/listener may get destroyed during handshake.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32686</cvename>
<url>https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr</url>
</references>
<dates>
<discovery>2021-07-23</discovery>
<entry>2021-07-23</entry>
</dates>
</vuln>
<vuln vid="53fbffe6-ebf7-11eb-aef1-0897988a1c07">
<topic>asterisk -- pjproject/pjsip: crash when SSL socket destroyed during handshake</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.38.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.19.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>Depending on the timing, it's possible for Asterisk to
crash when using a TLS connection if the underlying socket
parent/listener gets destroyed during the handshake.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32686</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-009.html</url>
</references>
<dates>
<discovery>2021-05-05</discovery>
<entry>2021-07-23</entry>
</dates>
</vuln>
<vuln vid="fb3455be-ebf6-11eb-aef1-0897988a1c07">
<topic>asterisk -- Remote crash when using IAX2 channel driver</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.38.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.19.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If the IAX2 channel driver receives a packet that
contains an unsupported media format it can cause a crash
to occur in Asterisk.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32558</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-008.html</url>
</references>
<dates>
<discovery>2021-04-13</discovery>
<entry>2021-07-23</entry>
</dates>
</vuln>
<vuln vid="ffa364e1-ebf5-11eb-aef1-0897988a1c07">
<topic>asterisk -- Remote Crash Vulnerability in PJSIP channel driver</topic>
<affects>
<package>
<name>asterisk16</name>
<range><ge>16.17.0</ge><lt>16.19.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><ge>18.3.0</ge><lt>18.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk receives a re-INVITE without SDP after
having sent a BYE request a crash will occur. This occurs
due to the Asterisk channel no longer being present while
code assumes it is.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31878</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-007.html</url>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-07-23</entry>
</dates>
</vuln>
<vuln vid="76487640-ea29-11eb-a686-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>92.0.4515.107</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html">
<p>This release contains 35 security fixes, including:</p>
<ul>
<li>][1210985] High CVE-2021-30565: Out of bounds write in Tab
Groups. Reported by David Erceg on 2021-05-19</li>
<li>[1202661] High CVE-2021-30566: Stack buffer overflow in
Printing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-04-26</li>
<li>[1211326] High CVE-2021-30567: Use after free in DevTools.
Reported by DDV_UA on 2021-05-20</li>
<li>[1219886] High CVE-2021-30568: Heap buffer overflow in WebGL.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-06-15</li>
<li>[1218707] High CVE-2021-30569: Use after free in sqlite.
Reported by Chris Salls (@salls) of Makai Security on
2021-06-11</li>
<li>[1101897] High CVE-2021-30571: Insufficient policy enforcement
in DevTools. Reported by David Erceg on 2020-07-03</li>
<li>[1214234] High CVE-2021-30572: Use after free in Autofill.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2021-05-28</li>
<li>[1216822] High CVE-2021-30573: Use after free in GPU. Reported
by Security For Everyone Team - https://securityforeveryone.com on
2021-06-06</li>
<li>[1227315] High CVE-2021-30574: Use after free in protocol
handling. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-07-08</li>
<li>[1213313] Medium CVE-2021-30575: Out of bounds read in Autofill.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-05-26</li>
<li>[1194896] Medium CVE-2021-30576: Use after free in DevTools.
Reported by David Erceg on 2021-04-01</li>
<li>[1204811] Medium CVE-2021-30577: Insufficient policy enforcement
in Installer. Reported by Jan van der Put (REQON B.V) on
2021-05-01</li>
<li>[1201074] Medium CVE-2021-30578: Uninitialized Use in Media.
Reported by Chaoyuan Peng on 2021-04-21</li>
<li>[1207277] Medium CVE-2021-30579: Use after free in UI framework.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2021-05-10</li>
<li>[1189092] Medium CVE-2021-30580: Insufficient policy enforcement
in Android intents. Reported by @retsew0x01 on 2021-03-17</li>
<li>[1194431] Medium CVE-2021-30581: Use after free in DevTools.
Reported by David Erceg on 2021-03-31</li>
<li>[1205981] Medium CVE-2021-30582: Inappropriate implementation in
Animation. Reported by George Liu on 2021-05-05</li>
<li>[1179290] Medium CVE-2021-30583: Insufficient policy enforcement
in image handling on Windows. Reported by Muneaki Nishimura
(nishimunea) on 2021-02-17</li>
<li>[1213350] Medium CVE-2021-30584: Incorrect security UI in
Downloads. Reported by @retsew0x01 on 2021-05-26</li>
<li>[1023503] Medium CVE-2021-30585: Use after free in sensor
handling. Reported by niarci on 2019-11-11</li>
<li>[1201032] Medium CVE-2021-30586: Use after free in dialog box
handling on Windows. Reported by kkomdal with kkwon and neodal on
2021-04-21</li>
<li>[1204347] Medium CVE-2021-30587: Inappropriate implementation in
Compositing on Windows. Reported by Abdulrahman Alqabandi,
Microsoft Browser Vulnerability Research on 2021-04-30</li>
<li>[1195650] Low CVE-2021-30588: Type Confusion in V8. Reported by
Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-04</li>
<li>[1180510] Low CVE-2021-30589: Insufficient validation of
untrusted input in Sharing. Reported by Kirtikumar Anandrao
Ramchandani (@Kirtikumar_A_R) and Patrick Walker (@homesen) on
2021-02-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30565</cvename>
<cvename>CVE-2021-30566</cvename>
<cvename>CVE-2021-30567</cvename>
<cvename>CVE-2021-30568</cvename>
<cvename>CVE-2021-30569</cvename>
<cvename>CVE-2021-30571</cvename>
<cvename>CVE-2021-30572</cvename>
<cvename>CVE-2021-30573</cvename>
<cvename>CVE-2021-30574</cvename>
<cvename>CVE-2021-30575</cvename>
<cvename>CVE-2021-30576</cvename>
<cvename>CVE-2021-30577</cvename>
<cvename>CVE-2021-30578</cvename>
<cvename>CVE-2021-30579</cvename>
<cvename>CVE-2021-30580</cvename>
<cvename>CVE-2021-30581</cvename>
<cvename>CVE-2021-30582</cvename>
<cvename>CVE-2021-30583</cvename>
<cvename>CVE-2021-30584</cvename>
<cvename>CVE-2021-30585</cvename>
<cvename>CVE-2021-30586</cvename>
<cvename>CVE-2021-30587</cvename>
<cvename>CVE-2021-30588</cvename>
<cvename>CVE-2021-30589</cvename>
<url>https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2021-07-20</discovery>
<entry>2021-07-21</entry>
</dates>
</vuln>
<vuln vid="aa646c01-ea0d-11eb-9b84-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.78.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.se/docs/vuln-7.77.0.html">
<p>CURLOPT_SSLCERT mixup with Secure Transport (CVE-2021-22926)</p>
<p>TELNET stack contents disclosure again (CVE-2021-22925)</p>
<p>Bad connection reuse due to flawed path name checks (CVE-2021-92254)</p>
<p>Metalink download sends credentials (CVE-2021-92253)</p>
<p>Wrong content via metalink not discarded (CVE-2021-92252)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22922</cvename>
<cvename>CVE-2021-22923</cvename>
<cvename>CVE-2021-22924</cvename>
<cvename>CVE-2021-22925</cvename>
<cvename>CVE-2021-22926</cvename>
<url>https://curl.se/docs/vuln-7.77.0.html</url>
</references>
<dates>
<discovery>2021-07-21</discovery>
<entry>2021-07-21</entry>
</dates>
</vuln>
<vuln vid="38a4a043-e937-11eb-9b84-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-server</name>
<range><lt>5.7.35</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.26</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.31</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.21</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2021.html">
<p>This Critical Patch Update contains 41 new security patches for
Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.<br/>
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 8.8.</p>
<p>MariaDB is affected by CVE-2021-2372 and CVE-2021-2389 only.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujul2021.html</url>
<cvename>CVE-2019-17543</cvename>
<cvename>CVE-2021-2339</cvename>
<cvename>CVE-2021-2340</cvename>
<cvename>CVE-2021-2342</cvename>
<cvename>CVE-2021-2352</cvename>
<cvename>CVE-2021-2354</cvename>
<cvename>CVE-2021-2356</cvename>
<cvename>CVE-2021-2357</cvename>
<cvename>CVE-2021-2367</cvename>
<cvename>CVE-2021-2370</cvename>
<cvename>CVE-2021-2372</cvename>
<cvename>CVE-2021-2374</cvename>
<cvename>CVE-2021-2383</cvename>
<cvename>CVE-2021-2384</cvename>
<cvename>CVE-2021-2385</cvename>
<cvename>CVE-2021-2387</cvename>
<cvename>CVE-2021-2389</cvename>
<cvename>CVE-2021-2390</cvename>
<cvename>CVE-2021-2399</cvename>
<cvename>CVE-2021-2402</cvename>
<cvename>CVE-2021-2410</cvename>
<cvename>CVE-2021-2411</cvename>
<cvename>CVE-2021-2412</cvename>
<cvename>CVE-2021-2417</cvename>
<cvename>CVE-2021-2418</cvename>
<cvename>CVE-2021-2422</cvename>
<cvename>CVE-2021-2424</cvename>
<cvename>CVE-2021-2425</cvename>
<cvename>CVE-2021-2426</cvename>
<cvename>CVE-2021-2427</cvename>
<cvename>CVE-2021-2429</cvename>
<cvename>CVE-2021-2437</cvename>
<cvename>CVE-2021-2440</cvename>
<cvename>CVE-2021-2441</cvename>
<cvename>CVE-2021-2444</cvename>
<cvename>CVE-2021-3450</cvename>
<cvename>CVE-2021-22884</cvename>
<cvename>CVE-2021-22901</cvename>
</references>
<dates>
<discovery>2021-07-20</discovery>
<entry>2021-07-20</entry>
<modified>2021-08-04</modified>
</dates>
</vuln>
<vuln vid="943d23b6-e65e-11eb-ad30-0800273f11ea">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.14.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.14.5:</p>
<blockquote cite="https://blog.gitea.io/2021/07/gitea-1.14.5-is-released/">
<ul>
<li>Hide mirror passwords on repo settings page (#16022) (#16355)</li>
<li>Update bluemonday to v1.0.15 (#16379) (#16380)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.14.5</url>
<freebsdpr>ports/257221</freebsdpr>
</references>
<dates>
<discovery>2021-05-16</discovery>
<entry>2021-07-18</entry>
</dates>
</vuln>
<vuln vid="1ba21ff1-e672-11eb-a686-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>91.0.4472.164</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html">
<p>This release contains 8 security fixes, including:</p>
<ul>
<li>[1219082] High CVE-2021-30559: Out of bounds write in ANGLE.
Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
2021-06-11</li>
<li>[1214842] High CVE-2021-30541: Use after free in V8. Reported by
Richard Wheeldon on 2021-05-31</li>
<li>[1219209] High CVE-2021-30560: Use after free in Blink XSLT.
Reported by Nick Wellnhofer on 2021-06-12</li>
<li>[1219630] High CVE-2021-30561: Type Confusion in V8. Reported by
Sergei Glazunov of Google Project Zero on 2021-06-14</li>
<li>[1220078] High CVE-2021-30562: Use after free in WebSerial.
Reported by Anonymous on 2021-06-15</li>
<li>[1228407] High CVE-2021-30563: Type Confusion in V8. Reported by
Anonymous on 2021-07-12</li>
<li>[1221309] Medium CVE-2021-30564: Heap buffer overflow in WebXR.
Reported by Ali Merchant, iQ3Connect VR Platform on
2021-06-17</li>
</ul>
<p>Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30541</cvename>
<cvename>CVE-2021-30559</cvename>
<cvename>CVE-2021-30560</cvename>
<cvename>CVE-2021-30561</cvename>
<cvename>CVE-2021-30562</cvename>
<cvename>CVE-2021-30563</cvename>
<cvename>CVE-2021-30564</cvename>
<url>https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-07-15</discovery>
<entry>2021-07-16</entry>
</dates>
</vuln>
<vuln vid="7ed5779c-e4c7-11eb-91d7-08002728f74c">
<topic>Ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby26</name>
<range><lt>2.6.8,1</lt></range>
</package>
<package>
<name>ruby</name>
<range><lt>2.7.4,1</lt></range>
</package>
<package>
<name>ruby30</name>
<range><lt>3.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released/">
<p>This release includes security fixes. Please check the topics below for details.</p>
<p>CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP</p>
<p>CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP</p>
<p>CVE-2021-31799: A command injection vulnerability in RDoc</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31799</cvename>
<cvename>CVE-2021-31810</cvename>
<cvename>CVE-2021-32066</cvename>
<url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-6-8-released/</url>
<url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-7-4-released/</url>
<url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released/</url>
<url>https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/</url>
<url>https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/</url>
<url>https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/</url>
</references>
<dates>
<discovery>2021-07-07</discovery>
<entry>2021-07-14</entry>
</dates>
</vuln>
<vuln vid="c365536d-e3cf-11eb-9d8d-b37b683944c2">
<topic>go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.16.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/47143">
<p>crypto/tls clients can panic when provided a certificate of
the wrong type for the negotiated parameters. net/http clients
performing HTTPS requests are also affected. The panic can be
triggered by an attacker in a privileged network position
without access to the server certificate's private key, as
long as a trusted ECDSA or Ed25519 certificate for the server
exists (or can be issued), or the client is configured with
Config.InsecureSkipVerify. Clients that disable all TLS_RSA
cipher suites (that is, TLS 1.0–1.2 cipher suites without
ECDHE), as well as TLS 1.3-only clients, are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-34558</cvename>
<url>https://github.com/golang/go/issues/47143</url>
</references>
<dates>
<discovery>2021-07-07</discovery>
<entry>2021-07-12</entry>
</dates>
</vuln>
<vuln vid="9b1699ff-d84c-11eb-92d6-1b6ff3dfe4d3">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php73</name>
<name>mantis-php74</name>
<name>mantis-php80</name>
<range><lt>2.25.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis 2.25.1 and 2.25.2 releases report:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?version_id=362">
<p>Security and maintenance release, PHPMailer update to 6.5.0</p>
<ul>
<li>0028552: XSS in manage_custom_field_edit_page.php (CVE-2021-33557)</li>
<li>0028821: Update PHPMailer to 6.5.0 (CVE-2021-3603, CVE-2020-36326)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33557</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-33557</url>
<cvename>CVE-2021-3603</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3603</url>
<cvename>CVE-2020-36326</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-36326</url>
</references>
<dates>
<discovery>2021-04-28</discovery>
<entry>2021-07-09</entry>
</dates>
</vuln>
<vuln vid="01974420-dfaf-11eb-ba49-001b217b3468">
<topic>Gitlab -- vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.0.0</ge><lt>14.0.4</lt></range>
<range><ge>13.12.0</ge><lt>13.12.8</lt></range>
<range><ge>13.11.0</ge><lt>13.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/">
<p>Arbitrary file read via design feature</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/</url>
</references>
<dates>
<discovery>2021-07-07</discovery>
<entry>2021-07-08</entry>
</dates>
</vuln>
<vuln vid="d49f86ab-d9c7-11eb-a200-00155d01f201">
<topic>Exiv2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>exiv2</name>
<range><lt>0.27.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exiv2 teams reports:</p>
<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories">
<p>Multiple vulnerabilities covering buffer overflows, out-of-bounds,
read of uninitialized memory and denial of serivce. The heap
overflow is triggered when Exiv2 is used to read the metadata of
a crafted image file. An attacker could potentially exploit the
vulnerability to gain code execution, if they can trick the victim
into running Exiv2 on a crafted image file. The out-of-bounds read
is triggered when Exiv2 is used to write metadata into a crafted
image file. An attacker could potentially exploit the vulnerability
to cause a denial of service by crashing Exiv2, if they can trick
the victim into running Exiv2 on a crafted image file. The read of
uninitialized memory is triggered when Exiv2 is used to read the
metadata of a crafted image file. An attacker could potentially
exploit the vulnerability to leak a few bytes of stack memory, if
they can trick the victim into running Exiv2 on a crafted image
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29457</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm</url>
<cvename>CVE-2021-29458</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-57jj-75fm-9rq5</url>
<cvename>CVE-2021-29463</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr</url>
<cvename>CVE-2021-29464</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p</url>
<cvename>CVE-2021-29470</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj</url>
<cvename>CVE-2021-29473</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2</url>
<cvename>CVE-2021-29623</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v</url>
<cvename>CVE-2021-32617</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj</url>
<cvename>CVE-2021-3482</cvename>
<url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jp9-m3fv-2vg9</url>
</references>
<dates>
<discovery>2021-04-25</discovery>
<entry>2021-06-30</entry>
</dates>
</vuln>
<vuln vid="f2596f27-db4c-11eb-8bc6-c556d71493c9">
<topic>openexr v3.0.5 -- fixes miscellaneous security issues</topic>
<affects>
<package>
<name>openexr</name>
<range><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5">
<ul>
<li>1038 fix/extend part number validation in MultiPart methods</li>
<li>1037 verify data size in deepscanlines with NO_COMPRESSION</li>
<li>1036 detect buffer overflows in RleUncompress</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5</url>
</references>
<dates>
<discovery>2021-06-03</discovery>
<entry>2021-07-02</entry>
</dates>
</vuln>
<vuln vid="8ba8278d-db06-11eb-ba49-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>14.0.0</ge><lt>14.0.2</lt></range>
<range><ge>13.12.0</ge><lt>13.12.6</lt></range>
<range><ge>8.0.0</ge><lt>13.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/">
<p>DoS using Webhook connections</p>
<p>CSRF on GraphQL API allows executing mutations through GET requests</p>
<p>Private projects information disclosure</p>
<p>Denial of service of user profile page</p>
<p>Single sign-on users not getting blocked</p>
<p>Some users can push to Protected Branch with Deploy keys</p>
<p>A deactivated user can access data through GraphQL</p>
<p>Reflected XSS in release edit page</p>
<p>Clipboard DOM-based XSS</p>
<p>Stored XSS on Audit Log</p>
<p>Forks of public projects by project members could leak codebase</p>
<p>Improper text rendering</p>
<p>HTML Injection in full name field</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/</url>
</references>
<dates>
<discovery>2021-07-01</discovery>
<entry>2021-07-02</entry>
</dates>
</vuln>
<vuln vid="9d271bab-da22-11eb-86f0-94c691a700a6">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.300</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.289.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-06-30/">
<h1>Description</h1>
<h5>(Medium) SECURITY-2278 / CVE-2021-21670</h5>
<p>Improper permission checks allow canceling queue items and aborting builds</p>
<h5>(High) SECURITY-2371 / CVE-2021-21671</h5>
<p>Session fixation vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21670</cvename>
<cvename>CVE-2021-21671</cvename>
<url>https://www.jenkins.io/security/advisory/2021-06-30/</url>
</references>
<dates>
<discovery>2021-06-30</discovery>
<entry>2021-07-01</entry>
</dates>
</vuln>
<vuln vid="7003b62d-7252-46ff-a9df-1b1900f1e65b">
<topic>RabbitMQ -- Denial of Service via improper input validation</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><lt>3.8.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathon Knudsen of Synopsys Cybersecurity Research Center reports:</p>
<blockquote cite="https://tanzu.vmware.com/security/cve-2021-22116">
<p>All versions prior to 3.8.16 are prone to a denial of service
vulnerability due to improper input validation in AMQP 1.0 client
connection endpoint. A malicious client can exploit the vulnerability
by sending malicious AMQP messages to the target RabbitMQ instance
having the AMQP 1.0 plugin enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22116</cvename>
<url>https://tanzu.vmware.com/security/cve-2021-22116</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22116</url>
</references>
<dates>
<discovery>2021-05-10</discovery>
<entry>2021-06-28</entry>
</dates>
</vuln>
<vuln vid="7c555ce3-658d-4589-83dd-4b6a31c5d610">
<topic>RabbitMQ-C -- integer overflow leads to heap corruption</topic>
<affects>
<package>
<name>rabbitmq-c</name>
<name>rabbitmq-c-devel</name>
<range><lt>0.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>alanxz reports:</p>
<blockquote cite="https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a">
<p>When parsing a frame header, validate that the frame_size is less than
or equal to INT32_MAX. Given frame_max is limited between 0 and
INT32_MAX in amqp_login and friends, this does not change the API.
This prevents a potential buffer overflow when a malicious client sends
a frame_size that is close to UINT32_MAX, in which causes an overflow
when computing state->target_size resulting in a small value there. A
buffer is then allocated with the small amount, then memcopy copies the
frame_size writing to memory beyond the end of the buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-18609</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18609</url>
</references>
<dates>
<discovery>2019-10-29</discovery>
<entry>2021-06-25</entry>
</dates>
</vuln>
<vuln vid="41bc849f-d5ef-11eb-ae37-589cfc007716">
<topic>PuppetDB -- SQL Injection</topic>
<affects>
<package>
<name>puppetdb6</name>
<range><lt>6.17.0</lt></range>
</package>
<package>
<name>puppetdb7</name>
<range><lt>7.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/docs/puppetdb/latest/release_notes.html#security-fixes">
<p>Fixed an issue where someone with the ability to query PuppetDB
could arbitrarily write, update, or delete data CVE-2021-27021
PDB-5138.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-27021</cvename>
<url>https://puppet.com/security/cve/cve-2021-27021/</url>
<url>https://tickets.puppetlabs.com/browse/PDB-5138</url>
</references>
<dates>
<discovery>2021-06-24</discovery>
<entry>2021-06-25</entry>
</dates>
</vuln>
<vuln vid="4c9159ea-d4c9-11eb-aeee-8c164582fbac">
<topic>Ansible -- Templating engine bug</topic>
<affects>
<package>
<name>py36-ansible-core</name>
<name>py37-ansible-core</name>
<name>py38-ansible-core</name>
<name>py39-ansible-core</name>
<range><lt>2.11.2</lt></range>
</package>
<package>
<name>py36-ansible-base</name>
<name>py37-ansible-base</name>
<name>py38-ansible-base</name>
<name>py39-ansible-base</name>
<range><lt>2.10.11</lt></range>
</package>
<package>
<name>py36-ansible2</name>
<name>py37-ansible2</name>
<name>py38-ansible2</name>
<name>py39-ansible2</name>
<range><lt>2.9.23</lt></range>
</package>
<package>
<name>py36-ansible</name>
<name>py37-ansible</name>
<name>py38-ansible</name>
<name>py39-ansible</name>
<range><lt>2.9.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#security-fixes">
<p>Templating engine fix for not preserving usnafe status
when trying to preserve newlines.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3583</cvename>
<url>https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#security-fixes</url>
<url>https://github.com/ansible/ansible/blob/stable-2.10/changelogs/CHANGELOG-v2.10.rst#security-fixes</url>
<url>https://github.com/ansible/ansible/pull/74960</url>
<url>https://groups.google.com/g/ansible-announce/c/tmIgD1DpZJg</url>
</references>
<dates>
<discovery>2021-06-10</discovery>
<entry>2021-06-24</entry>
<modified>2021-06-25</modified>
</dates>
</vuln>
<vuln vid="f3fc2b50-d36a-11eb-a32c-00a0989e4ec1">
<topic>dovecot-pigeonhole -- Sieve excessive resource usage</topic>
<affects>
<package>
<name>dovecot-pigeonhole</name>
<range><lt>0.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot team reports reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html">
<p>Sieve interpreter is not protected against abusive
scripts that claim excessive resource usage. Fixed by limiting the
user CPU time per single script execution and cumulatively over
several script runs within a configurable timeout period. Sufficiently
large CPU time usage is summed in the Sieve script binary and execution
is blocked when the sum exceeds the limit within that time. The block
is lifted when the script is updated after the resource usage times out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-28200</cvename>
<url>https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html</url>
</references>
<dates>
<discovery>2020-09-23</discovery>
<entry>2021-06-22</entry>
</dates>
</vuln>
<vuln vid="d18f431d-d360-11eb-a32c-00a0989e4ec1">
<topic>dovecot -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.11</ge><lt>2.3.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot team reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html">
<p>CVE-2021-29157: Dovecot does not correctly escape kid and azp
fields in JWT tokens.
This may be used to supply attacker controlled keys to validate
tokens in some configurations. This requires attacker
to be able to write files to
local disk.</p>
</blockquote>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html">
<p>CVE-2021-33515: On-path attacker could inject plaintext commands
before STARTTLS negotiation that would be executed after STARTTLS
finished with the client. Only the SMTP submission service is
affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29157</cvename>
<url>https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html</url>
<cvename>CVE-2021-33515</cvename>
<url>https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html</url>
</references>
<dates>
<discovery>2021-03-22</discovery>
<entry>2021-06-22</entry>
</dates>
</vuln>
<vuln vid="0e561c06-d13a-11eb-92be-0800273f11ea">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.14.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.14.3:</p>
<blockquote cite="https://blog.gitea.io/2021/06/gitea-1.14.3-is-released/">
<ul>
<li>Encrypt migration credentials at rest (#15895) (#16187)</li>
<li>Only check access tokens if they are likely to be tokens
(#16164) (#16171)</li>
<li>Add missing SameSite settings for the i_like_gitea cookie
(#16037) (#16039)</li>
<li>Fix setting of SameSite on cookies (#15989) (#15991)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.14.3</url>
<freebsdpr>ports/256720</freebsdpr>
</references>
<dates>
<discovery>2021-05-16</discovery>
<entry>2021-06-19</entry>
</dates>
</vuln>
<vuln vid="afdc7579-d023-11eb-bcad-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>91.0.4472.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html">
<p>This release includes 4 security fixes, including:</p>
<ul>
<li>[1219857] High CVE-2021-30554: Use after free in WebGL. Reported
by anonymous on 2021-06-15</li>
<li>[1215029] High CVE-2021-30555: Use after free in Sharing.
Reported by David Erceg on 2021-06-01</li>
<li>[1212599] High CVE-2021-30556: Use after free in WebAudio.
Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-24</li>
<li>[1202102] High CVE-2021-30557: Use after free in TabGroups.
Reported by David Erceg on 2021-04-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30554</cvename>
<cvename>CVE-2021-30555</cvename>
<cvename>CVE-2021-30556</cvename>
<cvename>CVE-2021-30557</cvename>
<url>https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html</url>
</references>
<dates>
<discovery>2021-06-17</discovery>
<entry>2021-06-18</entry>
</dates>
</vuln>
<vuln vid="9f27ac74-cdee-11eb-930d-fc4dd43e2b6a">
<topic>ircII -- denial of service</topic>
<affects>
<package>
<name>ircii</name>
<range><lt>20210314</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Ortmann reports:</p>
<blockquote cite="https://www.openwall.com/lists/oss-security/2021/03/24/2">
<p>ircii has a bug in parsing CTCP UTC messages.</p>
<p>Its unknown if this could also be used for arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29376</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29376</url>
</references>
<dates>
<discovery>2021-03-02</discovery>
<entry>2021-03-30</entry>
</dates>
</vuln>
<vuln vid="cce76eca-ca16-11eb-9b84-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>moderate: mod_proxy_wstunnel tunneling of non Upgraded
connections (CVE-2019-17567)</li>
<li>moderate: Improper Handling of Insufficient Privileges
(CVE-2020-13938)</li>
<li>low: mod_proxy_http NULL pointer dereference
(CVE-2020-13950)</li>
<li>low: mod_auth_digest possible stack overflow by one nul byte
(CVE-2020-35452)</li>
<li>low: mod_session NULL pointer dereference (CVE-2021-26690)</li>
<li>low: mod_session response handling heap overflow (CVE-2021-26691)</li>
<li>moderate: Unexpected URL matching with 'MergeSlashes OFF'
(CVE-2021-30641)</li>
<li>important: NULL pointer dereference on specially crafted HTTP/2
request (CVE-2021-31618)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-17567</cvename>
<cvename>CVE-2020-13938</cvename>
<cvename>CVE-2020-13950</cvename>
<cvename>CVE-2020-35452</cvename>
<cvename>CVE-2021-26690</cvename>
<cvename>CVE-2021-26691</cvename>
<cvename>CVE-2021-30641</cvename>
<cvename>CVE-2021-31618</cvename>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
</references>
<dates>
<discovery>2021-06-09</discovery>
<entry>2021-06-10</entry>
</dates>
</vuln>
<vuln vid="c9e2a1a7-caa1-11eb-904f-14dae9d5a9d2">
<topic>dragonfly -- argument injection</topic>
<affects>
<package>
<name>rubygem-dragonfly</name>
<range><lt>2.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-33564">
<p>An argument injection vulnerability in the Dragonfly
gem before 1.4.0 for Ruby allows remote attackers to read
and write to arbitrary files via a crafted URL when the
verify_url option is disabled. This may lead to code
execution. The problem occurs because the generate and
process features mishandle use of the ImageMagick convert
utility.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33564</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-33564</url>
<url>https://github.com/mlr0p/CVE-2021-33564</url>
<url>https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33564</url>
</references>
<dates>
<discovery>2021-05-24</discovery>
<entry>2021-06-11</entry>
</dates>
</vuln>
<vuln vid="e4cd0b38-c9f9-11eb-87e1-08002750c711">
<topic>cacti -- SQL Injection was possible due to incorrect validation order</topic>
<affects>
<package>
<name>cacti</name>
<range><ge>1.2</ge><lt>1.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cati team reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/4022">
<p>Due to a lack of validation, data_debug.php can be the source of a SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35701</cvename>
<url>https://github.com/Cacti/cacti/issues/4022</url>
</references>
<dates>
<discovery>2020-12-24</discovery>
<entry>2021-06-10</entry>
<modified>2021-06-24</modified>
</dates>
</vuln>
<vuln vid="20b3ab21-c9df-11eb-8558-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>91.0.4472.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html">
<p>This release contains 14 security fixes, including:</p>
<ul>
<li>[1212618] Critical CVE-2021-30544: Use after free in BFCache.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
2021-05-24</li>
<li>[1201031] High CVE-2021-30545: Use after free in Extensions.
Reported by kkwon with everpall and kkomdal on 2021-04-21</li>
<li>[1206911] High CVE-2021-30546: Use after free in Autofill.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2021-05-08</li>
<li>[1210414] High CVE-2021-30547: Out of bounds write in ANGLE.
Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
2021-05-18</li>
<li>[1210487] High CVE-2021-30548: Use after free in Loader.
Reported by Yangkang(@dnpushme) & Wanglu of Qihoo360 Qex Team
on 2021-05-18</li>
<li>[1212498] High CVE-2021-30549: Use after free in Spell check.
Reported by David Erceg on 2021-05-23</li>
<li>[1212500] High CVE-2021-30550: Use after free in Accessibility.
Reported by David Erceg on 2021-05-23</li>
<li>[1216437] High CVE-2021-30551: Type Confusion in V8. Reported by
Sergei Glazunov of Google Project Zero on 2021-06-04</li>
<li>[1200679] Medium CVE-2021-30552: Use after free in Extensions.
Reported by David Erceg on 2021-04-20</li>
<li>[1209769] Medium CVE-2021-30553: Use after free in Network
service. Reported by Anonymous on 2021-05-17</li>
</ul>
<p>Google is aware that an exploit for CVE-2021-30551 exists in the
wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30544</cvename>
<cvename>CVE-2021-30545</cvename>
<cvename>CVE-2021-30546</cvename>
<cvename>CVE-2021-30547</cvename>
<cvename>CVE-2021-30548</cvename>
<cvename>CVE-2021-30549</cvename>
<cvename>CVE-2021-30550</cvename>
<cvename>CVE-2021-30551</cvename>
<cvename>CVE-2021-30552</cvename>
<cvename>CVE-2021-30553</cvename>
<url>https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-06-10</discovery>
<entry>2021-06-10</entry>
</dates>
</vuln>
<vuln vid="fc1bcbca-c88b-11eb-9120-f02f74d0e4bd">
<topic>dino -- Path traversal in Dino file transfers</topic>
<affects>
<package>
<name>dino</name>
<range><lt>0.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dino team reports:</p>
<blockquote cite="https://dino.im/security/cve-2021-33896/">
<p>It was discovered that when a user receives and downloads
a file in Dino, URI-encoded path separators in the file name
will be decoded, allowing an attacker to traverse
directories and create arbitrary files in the context of the
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33896</cvename>
<mlist msgid="392f934a-f937-7b29-5f7f-5df3ee60d8a8@.larma.de">https://marc.info/?l=oss-security&m=162308719412719</mlist>
<url>https://dino.im/security/cve-2021-33896/</url>
</references>
<dates>
<discovery>2021-06-07</discovery>
<entry>2021-06-08</entry>
</dates>
</vuln>
<vuln vid="45b8716b-c707-11eb-b9a0-6805ca0b3d42">
<topic>pglogical -- shell command injection in pglogical.create_subscription()</topic>
<affects>
<package>
<name>pglogical</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>2ndQuadrant reports:</p>
<blockquote cite="https://github.com/2ndQuadrant/pglogical/releases/tag/REL2_3_4">
<ul>
<li>
Fix pg_dump/pg_restore execution (CVE-2021-3515)<br/>
<br/>
Correctly escape the connection string for both pg_dump
and pg_restore so that exotic database and user names are
handled correctly.<br/>
<br/>
Reported by Pedro Gallegos
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3515</cvename>
<url>https://github.com/2ndQuadrant/pglogical/releases/tag/REL2_3_4</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1954112</url>
</references>
<dates>
<discovery>2021-06-01</discovery>
<entry>2021-06-06</entry>
</dates>
</vuln>
<vuln vid="f70ab05e-be06-11eb-b983-000c294bb613">
<topic>drupal7 -- fix possible CSS</topic>
<affects>
<package>
<name>drupal7</name>
<range><gt>7.0</gt><lt>7.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2021-002">
<p>Drupal core's sanitization API fails to properly filter
cross-site scripting under certain circumstances.
Not all sites and users are affected, but configuration
changes to prevent the exploit might be impractical
and will vary between sites. Therefore, we recommend
all sites update to this release as soon as
possible.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-13672</cvename>
</references>
<dates>
<discovery>2021-04-21</discovery>
<entry>2021-06-06</entry>
</dates>
</vuln>
<vuln vid="36a35d83-c560-11eb-84ab-e0d55e2a8bf9">
<topic>polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cedric Buissart reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2021/q2/180">
<p>The function <code>polkit_system_bus_name_get_creds_sync</code> is used to get the
uid and pid of the process requesting the action. It does this by
sending the unique bus name of the requesting process, which is
typically something like ":1.96", to <code>dbus-daemon</code>. These unique names
are assigned and managed by <code>dbus-daemon</code> and cannot be forged, so this
is a good way to check the privileges of the requesting process.</p>
<p>The vulnerability happens when the requesting process disconnects from
<code>dbus-daemon</code> just before the call to
<code>polkit_system_bus_name_get_creds_sync</code> starts. In this scenario, the
unique bus name is no longer valid, so <code>dbus-daemon</code> sends back an error
reply. This error case is handled in
<code>polkit_system_bus_name_get_creds_sync</code> by setting the value of the
<code>error</code> parameter, but it still returns <code>TRUE</code>, rather than <code>FALSE</code>.
This behavior means that all callers of
<code>polkit_system_bus_name_get_creds_sync</code> need to carefully check whether
an error was set. If the calling function forgets to check for errors
then it will think that the uid of the requesting process is 0 (because
the <code>AsyncGetBusNameCredsData</code> struct is zero initialized). In other
words, it will think that the action was requested by a root process,
and will therefore allow it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3560</cvename>
<url>https://seclists.org/oss-sec/2021/q2/180</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3560</url>
<url>https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a</url>
</references>
<dates>
<discovery>2021-06-03</discovery>
<entry>2021-06-04</entry>
</dates>
</vuln>
<vuln vid="69815a1d-c31d-11eb-9633-b42e99a1b9c3">
<topic>SOGo -- SAML user authentication impersonation</topic>
<affects>
<package>
<name>sogo</name>
<range><lt>5.1.1</lt></range>
</package>
<package>
<name>sogo-activesync</name>
<range><lt>5.1.1</lt></range>
</package>
<package>
<name>sogo2</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>sogo2-activesync</name>
<range><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sogo.nu reports:</p>
<blockquote cite="https://www.sogo.nu/news/2021/saml-vulnerability.html">
<p>SOGo was not validating the signatures of any SAML assertions it received.</p>
<p>This means any actor with network access to the deployment could impersonate</p>
<p>users when SAML was the authentication method.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33054</cvename>
<url>https://www.sogo.nu/news/2021/saml-vulnerability.html</url>
<url>https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html</url>
</references>
<dates>
<discovery>2021-06-01</discovery>
<entry>2021-06-02</entry>
</dates>
</vuln>
<vuln vid="c7855866-c511-11eb-ae1d-b42e991fc52e">
<topic>tauthon -- Regular Expression Denial of Service</topic>
<affects>
<package>
<name>tauthon</name>
<range><lt>2.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p/>
<blockquote cite="https://github.com/naftaliharris/tauthon/blob/master/Misc/NEWS.d/2.8.3.rst">
<p>The :class:`~urllib.request.AbstractBasicAuthHandler` class
of the :mod:`urllib.request` module uses an inefficient
regular expression which can be exploited by an
attacker to cause a denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-8492</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492</url>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2021-06-04</entry>
</dates>
</vuln>
<vuln vid="417de1e6-c31b-11eb-9633-b42e99a1b9c3">
<topic>lasso -- signature checking failure</topic>
<affects>
<package>
<name>lasso</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>entrouvert reports:</p>
<blockquote cite="https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0">
<p>When AuthnResponse messages are not signed (which is
permitted by the specifiation), all assertion's signatures should be
checked, but currently after the first signed assertion is checked all
following assertions are accepted without checking their signature, and
the last one is considered the main assertion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-28091</cvename>
<url>https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0</url>
</references>
<dates>
<discovery>2021-06-01</discovery>
<entry>2021-06-01</entry>
</dates>
</vuln>
<vuln vid="079b3641-c4bd-11eb-a22a-693f0544ae52">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.16.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/45910">
<p>The SetString and UnmarshalText methods of math/big.Rat may cause a
panic or an unrecoverable fatal error if passed inputs with very
large exponents.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/46313">
<p>ReverseProxy in net/http/httputil could be made to forward certain
hop-by-hop headers, including Connection. In case the target of the
ReverseProxy was itself a reverse proxy, this would let an attacker
drop arbitrary headers, including those set by the
ReverseProxy.Director.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/46241">
<p>The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr
functions in net, and their respective methods on the Resolver type
may return arbitrary values retrieved from DNS which do not follow
the established RFC 1035 rules for domain names. If these names are
used without further sanitization, for instance unsafely included in
HTML, they may allow for injection of unexpected content. Note that
LookupTXT may still return arbitrary values that could require
sanitization before further use.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/46242">
<p>The NewReader and OpenReader functions in archive/zip can cause a
panic or an unrecoverable fatal error when reading an archive that
claims to contain a large number of files, regardless of its actual
size.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33198</cvename>
<url>https://github.com/golang/go/issues/45910</url>
<cvename>CVE-2021-33197</cvename>
<url>https://github.com/golang/go/issues/46313</url>
<cvename>CVE-2021-33195</cvename>
<url>https://github.com/golang/go/issues/46241</url>
<cvename>CVE-2021-33196</cvename>
<url>https://github.com/golang/go/issues/46242</url>
</references>
<dates>
<discovery>2021-05-01</discovery>
<entry>2021-06-03</entry>
</dates>
</vuln>
<vuln vid="3000acee-c45d-11eb-904f-14dae9d5a9d2">
<topic>aiohttp -- open redirect vulnerability</topic>
<affects>
<package>
<name>py36-aiohttp</name>
<name>py37-aiohttp</name>
<name>py38-aiohttp</name>
<name>py39-aiohttp</name>
<range><le>3.7.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sviatoslav Sydorenko reports:</p>
<blockquote cite="https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg">
<p>Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.</p>
<p>It is caused by a bug in the <code>aiohttp.web_middlewares.normalize_path_middleware</code> middleware.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21330</cvename>
<url>https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-21330</url>
</references>
<dates>
<discovery>2021-02-25</discovery>
<entry>2021-06-03</entry>
<modified>2021-06-23</modified>
</dates>
</vuln>
<vuln vid="a550d62c-f78d-4407-97d9-93876b6741b9">
<topic>zeek -- several potential DoS vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.2">
<p> Fix potential Undefined Behavior in decode_netbios_name()
and decode_netbios_name_type() BIFs. The latter has a
possibility of a remote heap-buffer-overread, making this
a potential DoS vulnerability.</p>
<p> Add some extra length checking when parsing mobile
ipv6 packets. Due to the possibility of reading invalid
headers from remote sources, this is a potential DoS
vulnerability. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.2</url>
</references>
<dates>
<discovery>2021-04-30</discovery>
<entry>2021-06-02</entry>
</dates>
</vuln>
<vuln vid="c7ec6375-c3cf-11eb-904f-14dae9d5a9d2">
<topic>PyYAML -- arbitrary code execution</topic>
<affects>
<package>
<name>py36-yaml</name>
<name>py37-yaml</name>
<name>py38-yaml</name>
<name>py39-yaml</name>
<range><lt>5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability was discovered in the PyYAML library
in versions before 5.4, where it is susceptible to arbitrary
code execution when it processes untrusted YAML files
through the full_load method or with the FullLoader loader.
Applications that use the library to process untrusted
input may be vulnerable to this flaw. This flaw allows
an attacker to execute arbitrary code on the system by
abusing the python/object/new constructor. This flaw is
due to an incomplete fix for CVE-2020-1747.</p>
</body>
</description>
<references>
<cvename>CVE-2020-14343</cvename>
<url>https://github.com/yaml/pyyaml/issues/420</url>
<url>https://access.redhat.com/security/cve/CVE-2020-14343</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1860466</url>
</references>
<dates>
<discovery>2020-07-22</discovery>
<entry>2021-06-02</entry>
</dates>
</vuln>
<vuln vid="e24fb8f8-c39a-11eb-9370-b42e99a1b9c3">
<topic>isc-dhcp -- remotely exploitable vulnerability</topic>
<affects>
<package>
<name>isc-dhcp44-relay</name>
<range><lt>4.4.2-P1</lt></range>
</package>
<package>
<name>isc-dhcp44-server</name>
<range><lt>4.4.2-P1</lt></range>
</package>
<package>
<name>isc-dhcp44-client</name>
<range><lt>4.4.2-P1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael McNally reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2021/q2/170">
<p>Program code used by the ISC DHCP package to read and parse stored leases</p>
<p>has a defect that can be exploited by an attacker to cause one of several
undesirable outcomes</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-25217</cvename>
<url>https://kb.isc.org/docs/cve-2021-25217</url>
</references>
<dates>
<discovery>2021-05-26</discovery>
<entry>2021-06-02</entry>
</dates>
</vuln>
<vuln vid="5f52d646-c31f-11eb-8dcf-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.12.0</ge><lt>13.12.2</lt></range>
<range><ge>13.11.0</ge><lt>13.11.5</lt></range>
<range><ge>7.10.0</ge><lt>13.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/">
<p>Stealing GitLab OAuth access tokens using XSLeaks in Safari</p>
<p>Denial of service through recursive triggered pipelines</p>
<p>Unauthenticated CI lint API may lead to information disclosure and SSRF</p>
<p>Server-side DoS through rendering crafted Markdown documents</p>
<p>Issue and merge request length limit is not being enforced</p>
<p>Insufficient Expired Password Validation</p>
<p>XSS in blob viewer of notebooks</p>
<p>Logging of Sensitive Information</p>
<p>On-call rotation information exposed when removing a member</p>
<p>Spoofing commit author for signed commits</p>
<p>Enable qsh verification for Atlassian Connect</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22181</cvename>
<url>https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/</url>
</references>
<dates>
<discovery>2021-06-01</discovery>
<entry>2021-06-01</entry>
</dates>
</vuln>
<vuln vid="8eb69cd0-c2ec-11eb-b6e7-8c164567ca3c">
<topic>redis -- integer overflow</topic>
<affects>
<package>
<name>redis</name>
<range><ge>6.0.0</ge><lt>6.0.14</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><ge>6.2.0</ge><lt>6.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis development team reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/RLTwi1kKsCI">
<p>An integer overflow bug in Redis version 6.0 or newer can be
exploited using the STRALGO LCS command to corrupt the heap and
potentially result with remote code execution. This is a result
of an incomplete fix by CVE-2021-29477.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32625</cvename>
<url>https://groups.google.com/g/redis-db/c/RLTwi1kKsCI</url>
</references>
<dates>
<discovery>2021-06-01</discovery>
<entry>2021-06-01</entry>
</dates>
</vuln>
<vuln vid="58d6ed66-c2e8-11eb-9fb0-6451062f0f7a">
<topic>libX11 -- Arbitrary code execution</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.7.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.freedesktop.org/archives/xorg/2021-May/060699.html">
<p>XLookupColor() and other X libraries function lack proper validation
of the length of their string parameters. If those parameters can be
controlled by an external application (for instance a color name that
can be emitted via a terminal control sequence) it can lead to the
emission of extra X protocol requests to the X server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31535</cvename>
<url>https://lists.freedesktop.org/archives/xorg/2021-May/060699.html</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-31535</url>
</references>
<dates>
<discovery>2021-05-11</discovery>
<entry>2021-06-01</entry>
<modified>2022-02-08</modified>
</dates>
</vuln>
<vuln vid="59ab72fb-bccf-11eb-a38d-6805ca1caf5c">
<topic>Prometheus -- arbitrary redirects</topic>
<affects>
<package>
<name>prometheus2</name>
<range><ge>2.23.0</ge><lt>2.26.1</lt></range>
<range><eq>2.27.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prometheus reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-29622">
<p>
Prometheus is an open-source monitoring system and time series
database. In 2.23.0, Prometheus changed its default UI to the New
ui. To ensure a seamless transition, the URL's prefixed by /new
redirect to /. Due to a bug in the code, it is possible for an
attacker to craft an URL that can redirect to any other URL, in the
/new endpoint. If a user visits a prometheus server with a
specially crafted address, they can be redirected to an arbitrary
URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In
2.28.0, the /new endpoint will be removed completely. The
workaround is to disable access to /new via a reverse proxy in
front of Prometheus.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29622</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-29622</url>
</references>
<dates>
<discovery>2021-05-18</discovery>
<entry>2021-06-01</entry>
</dates>
</vuln>
<vuln vid="fd24a530-c202-11eb-b217-b42e99639323">
<topic>wayland -- integer overflow</topic>
<affects>
<package>
<name>wayland</name>
<range><lt>1.19.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Stoeckmann reports:</p>
<blockquote cite="https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/133">
<p>The libXcursor fix for CVE-2013-2003 has never been imported into wayland, leaving it vulnerable to it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2003</cvename>
<url>https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/133</url>
<freebsdpr>ports/256273</freebsdpr>
</references>
<dates>
<discovery>2021-05-02</discovery>
<entry>2021-05-31</entry>
</dates>
</vuln>
<vuln vid="107c7a76-beaa-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Missing message validation in libradius(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>13.0</ge><lt>13.0_1</lt></range>
<range><ge>12.2</ge><lt>12.2_7</lt></range>
<range><ge>11.4</ge><lt>11.4_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>libradius did not perform sufficient validation of received messages.</p>
<p>rad_get_attr(3) did not verify that the attribute length is valid before
subtracting the length of the Type and Length fields. As a result, it
could return success while also providing a bogus length of SIZE_T_MAX -
2 for the Value field.</p>
<p>When processing attributes to find an optional authenticator,
is_valid_response() failed to verify that each attribute length is
non-zero and could thus enter an infinite loop.</p>
<h1>Impact:</h1>
<p>A server may use libradius(3) to process messages from RADIUS clients.
In this case, a malicious client could trigger a denial-of-service in
the server. A client using libradius(3) to process messages from a
server is susceptible to the same problem.</p>
<p>The impact of the rad_get_attr(3) bug depends on how the returned length
is validated and used by the consumer. It is possible that libradius(3)
applications will crash or enter an infinite loop when calling
rad_get_attr(3) on untrusted RADIUS messages.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29629</cvename>
<freebsdsa>SA-21:12.libradius</freebsdsa>
</references>
<dates>
<discovery>2021-05-27</discovery>
<entry>2021-05-27</entry>
</dates>
</vuln>
<vuln vid="d1ac6a6a-bea8-11eb-b87a-901b0ef719ab">
<topic>FreeBSD-kernel -- SMAP bypass</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>13.0</ge><lt>13.0_1</lt></range>
<range><ge>12.2</ge><lt>12.2_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The FreeBSD kernel enables SMAP during boot when the CPU reports that
the SMAP capability is present. Subroutines such as copyin() and
copyout() are responsible for disabling SMAP around the sections of code
that perform user memory accesses.</p>
<p>Such subroutines must handle page faults triggered when user memory is
not mapped. The kernel's page fault handler checks the validity of the
fault, and if it is indeed valid it will map a page and resume copying.
If the fault is invalid, the fault handler returns control to a
trampoline which aborts the operation and causes an error to be
returned. In this second scenario, a bug in the implementation of SMAP
support meant that SMAP would remain disabled until the thread returns
to user mode.</p>
<h1>Impact:</h1>
<p>This bug may be used to bypass the protections provided by SMAP for the
duration of a system call. It could thus be combined with other kernel
bugs to craft an exploit.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29628</cvename>
<freebsdsa>SA-21:11.smap</freebsdsa>
</references>
<dates>
<discovery>2021-05-27</discovery>
<entry>2021-05-27</entry>
</dates>
</vuln>
<vuln vid="674ed047-be0a-11eb-b927-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>91.0.4472.77</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html">
<p>This release contains 32 security fixes, including:</p>
<ul>
<li>[1208721] High CVE-2021-30521: Heap buffer overflow in Autofill.
Reported by ZhanJia Song on 2021-05-13</li>
<li>[1176218] High CVE-2021-30522: Use after free in WebAudio.
Reported by Piotr Bania of Cisco Talos on 2021-02-09</li>
<li>[1187797] High CVE-2021-30523: Use after free in WebRTC.
Reported by Tolyan Korniltsev on 2021-03-13</li>
<li>[1197146] High CVE-2021-30524: Use after free in TabStrip.
Reported by David Erceg on 2021-04-08</li>
<li>[1197888] High CVE-2021-30525: Use after free in TabGroups.
Reported by David Erceg on 2021-04-11</li>
<li>[1198717] High CVE-2021-30526: Out of bounds write in
TabStrip. Reported by David Erceg on 2021-04-13</li>
<li>[1199198] High CVE-2021-30527: Use after free in WebUI.
Reported by David Erceg on 2021-04-15</li>
<li>[1206329] High CVE-2021-30528: Use after free in
WebAuthentication. Reported by Man Yue Mo of GitHub Security Lab on
2021-05-06</li>
<li>[1195278] Medium CVE-2021-30529: Use after free in Bookmarks.
Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of
360 Alpha Lab on 2021-04-02</li>
<li>[1201033] Medium CVE-2021-30530: Out of bounds memory access
in WebAudio. Reported by kkwon on 2021-04-21</li>
<li>[1115628] Medium CVE-2021-30531: Insufficient policy
enforcement in Content Security Policy. Reported by Philip Papurt on
2020-08-12</li>
<li>[1117687] Medium CVE-2021-30532: Insufficient policy
enforcement in Content Security Policy. Reported by Philip Papurt on
2020-08-18</li>
<li>[1145553] Medium CVE-2021-30533: Insufficient policy
enforcement in PopupBlocker. Reported by Eliya Stein on
2020-11-04</li>
<li>[1151507] Medium CVE-2021-30534: Insufficient policy
enforcement in iFrameSandbox. Reported by Alesandro Ortiz on
2020-11-20</li>
<li>[1194899] Medium CVE-2021-30535: Double free in ICU. Reported
by nocma, leogan, cheneyxu of WeChat Open Platform Security Team on
2021-04-01</li>
<li>[1145024] Medium CVE-2021-21212: Insufficient data validation
in networking. Reported by Hugo Hue and Sze Yiu Chau of the Chinese
University of Hong Kong on 2020-11-03</li>
<li>[1194358] Low CVE-2021-30536: Out of bounds read in V8.
Reported by Chris Salls (@salls) on 2021-03-31</li>
<li>[830101] Low CVE-2021-30537: Insufficient policy enforcement
in cookies. Reported by Jun Kokatsu (@shhnjk) on 2018-04-06</li>
<li>[1115045] Low CVE-2021-30538: Insufficient policy enforcement
in content security policy. Reported by Tianze Ding (@D1iv3) of
Tencent Security Xuanwu Lab on 2020-08-11</li>
<li>[971231] Low CVE-2021-30539: Insufficient policy enforcement
in content security policy. Reported by unnamed researcher on
2019-06-05</li>
<li>[1184147] Low CVE-2021-30540: Incorrect security UI in
payments. Reported by @retsew0x01 on 2021-03-03</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30521</cvename>
<cvename>CVE-2021-30522</cvename>
<cvename>CVE-2021-30523</cvename>
<cvename>CVE-2021-30524</cvename>
<cvename>CVE-2021-30525</cvename>
<cvename>CVE-2021-30526</cvename>
<cvename>CVE-2021-30527</cvename>
<cvename>CVE-2021-30528</cvename>
<cvename>CVE-2021-30529</cvename>
<cvename>CVE-2021-30530</cvename>
<cvename>CVE-2021-30531</cvename>
<cvename>CVE-2021-30532</cvename>
<cvename>CVE-2021-30533</cvename>
<cvename>CVE-2021-30534</cvename>
<cvename>CVE-2021-30535</cvename>
<cvename>CVE-2021-21212</cvename>
<cvename>CVE-2021-30536</cvename>
<cvename>CVE-2021-30537</cvename>
<cvename>CVE-2021-30538</cvename>
<cvename>CVE-2021-30539</cvename>
<cvename>CVE-2021-30540</cvename>
<url>https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html</url>
</references>
<dates>
<discovery>2021-05-25</discovery>
<entry>2021-05-26</entry>
</dates>
</vuln>
<vuln vid="21ec4428-bdaa-11eb-a04e-641c67a117d8">
<topic>libzmq4 -- Denial of Service</topic>
<affects>
<package>
<name>libzmq4</name>
<range><lt>4.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google's oss-fuzz project reports:</p>
<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.3">
<p>Denial-of-Service on CURVE/ZAP-protected servers by
unauthenticated clients.
If a raw TCP socket is opened and connected to an endpoint that is fully
configured with CURVE/ZAP, legitimate clients will not be able to exchange
any message. Handshakes complete successfully, and messages are delivered to
the library, but the server application never receives them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15166</cvename>
<url>https://github.com/zeromq/libzmq/releases/tag/v4.3.3</url>
<url>https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m</url>
<freebsdpr>ports/255102</freebsdpr>
</references>
<dates>
<discovery>2020-09-07</discovery>
<entry>2021-05-25</entry>
</dates>
</vuln>
<vuln vid="6954a2b0-bda8-11eb-a04e-641c67a117d8">
<topic>libzmq4 -- Stack overflow</topic>
<affects>
<package>
<name>libzmq4</name>
<range><lt>4.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fang-Pen Lin reports:</p>
<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.2">
<p>A remote, unauthenticated client connecting to a
libzmq application, running with a socket listening with CURVE
encryption/authentication enabled, may cause a stack overflow and
overwrite the stack with arbitrary data, due to a buffer overflow in
the library. Users running public servers with the above configuration
are highly encouraged to upgrade as soon as possible, as there are no
known mitigations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13132</cvename>
<url>https://github.com/zeromq/libzmq/releases/tag/v4.3.2</url>
<url>https://github.com/zeromq/libzmq/issues/3558</url>
<freebsdpr>ports/255102</freebsdpr>
</references>
<dates>
<discovery>2019-06-27</discovery>
<entry>2021-05-25</entry>
</dates>
</vuln>
<vuln vid="0882f019-bd60-11eb-9bdd-8c164567ca3c">
<topic>NGINX -- 1-byte memory overwrite in resolver</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.20.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.21.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017">
<p>1-byte memory overwrite might occur during DNS server response
processing if the "resolver" directive was used, allowing an
attacker who is able to forge UDP packets from the DNS server
to cause worker process crash or, potentially, arbitrary code
execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-23017</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017</url>
</references>
<dates>
<discovery>2021-05-25</discovery>
<entry>2021-05-25</entry>
</dates>
</vuln>
<vuln vid="58b22f3a-bc71-11eb-b9c9-6cc21735f730">
<topic>PG Partition Manager -- arbitrary code execution</topic>
<affects>
<package>
<name>pg_partman</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PG Partition Manager reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-33204">
<p>
In the pg_partman (aka PG Partition Manager) extension before 4.5.1
for PostgreSQL, arbitrary code execution can be achieved via
SECURITY DEFINER functions because an explicit search_path is not
set.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-33204</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-33204</url>
</references>
<dates>
<discovery>2021-05-21</discovery>
<entry>2021-05-24</entry>
</dates>
</vuln>
<vuln vid="5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9">
<topic>texproc/expat2 -- billion laugh attack</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Seifried reports:</p>
<blockquote cite="https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/">
<p>So here are the CVE's for the two big ones, libxml2 and expat.
Both are affected by the expansion of internal entities
(which can be used to consume resources) and external entities
(which can cause a denial of service against other services, be
used to port scan, etc.).</p>
<p>A billion laughs attack is a type of denial-of-service attack
which is aimed at parsers of XML documents.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0340</cvename>
<url>https://www.openwall.com/lists/oss-security/2013/02/22/3</url>
<url>https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2013-0340</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2021-05-24</entry>
</dates>
</vuln>
<vuln vid="524bd03a-bb75-11eb-bf35-080027f515ea">
<topic>libxml2 -- Possible denial of service</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.10_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veillard reports:</p>
<blockquote cite="https://ubuntu.com/security/CVE-2021-3541">
<p>
A flaw was found in libxml2. Exponential entity expansion attack
its possible bypassing all existing protection mechanisms and
leading to denial of service.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3541</cvename>
<url>https://ubuntu.com/security/CVE-2021-3541</url>
<url>https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e</url>
</references>
<dates>
<discovery>2021-05-18</discovery>
<entry>2021-05-23</entry>
</dates>
</vuln>
<vuln vid="62da9702-b4cc-11eb-b9c9-6cc21735f730">
<topic>PostgreSQL server -- two security issues</topic>
<affects>
<package>
<name>postgresql13-server</name>
<range><lt>13.3</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.7</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.12</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.17</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32028/">
<p>Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE</p>
<p>
Using an INSERT ... ON CONFLICT ... DO UPDATE command on a
purpose-crafted table, an attacker can read arbitrary bytes of
server memory. In the default configuration, any authenticated
database user can create prerequisite objects and complete this
attack at will. A user lacking the CREATE and TEMPORARY privileges
on all databases and the CREATE privilege on all schemas cannot use
this attack at will..
</p>
</blockquote>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32027/">
<p>
Buffer overrun from integer overflow in array subscripting
calculations
</p>
<p>
While modifying certain SQL array values, missing bounds checks let
authenticated database users write arbitrary bytes to a wide area of
server memory.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/support/security/CVE-2021-32027/</url>
<url>https://www.postgresql.org/support/security/CVE-2021-32028/</url>
</references>
<dates>
<discovery>2021-05-13</discovery>
<entry>2021-05-14</entry>
</dates>
</vuln>
<vuln vid="76e0bb86-b4cb-11eb-b9c9-6cc21735f730">
<topic>PostgreSQL -- Memory disclosure in partitioned-table UPDATE ... RETURNING</topic>
<affects>
<package>
<name>postgresql13-server</name>
<range><lt>13.3</lt></range>
</package>
<package>
<name>postgresql12-server</name>
<range><lt>12.7</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32029/">
<p>
Using an UPDATE ... RETURNING on a purpose-crafted partitioned
table, an attacker can read arbitrary bytes of server memory. In the
default configuration, any authenticated database user can create
prerequisite objects and complete this attack at will. A user
lacking the CREATE and TEMPORARY privileges on all databases and the
CREATE privilege on all schemas typically cannot use this attack at
will.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/support/security/CVE-2021-32029/</url>
</references>
<dates>
<discovery>2021-05-13</discovery>
<entry>2021-05-14</entry>
</dates>
</vuln>
<vuln vid="fc75570a-b417-11eb-a23d-c7ab331fd711">
<topic>Prosody -- multiple vulnerabilities</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.11.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody security advisory 2021-05-12 reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20210512/">
<p>
This advisory details 5 new security vulnerabilities discovered in the
Prosody.im XMPP server software. All issues are fixed in the 0.11.9
release default configuration.
</p>
<ul>
<li>CVE-2021-32918: DoS via insufficient memory consumption controls</li>
<li>CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU consumption</li>
<li>CVE-2021-32921: Use of timing-dependent string comparison with sensitive values</li>
<li>CVE-2021-32917: Use of mod_proxy65 is unrestricted in default configuration</li>
<li>CVE-2021-32919: Undocumented dialback-without-dialback option insecure</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32918</cvename>
<cvename>CVE-2021-32920</cvename>
<cvename>CVE-2021-32921</cvename>
<cvename>CVE-2021-32917</cvename>
<cvename>CVE-2021-32919</cvename>
</references>
<dates>
<discovery>2021-05-12</discovery>
<entry>2021-05-13</entry>
</dates>
</vuln>
<vuln vid="3e0ca488-b3f6-11eb-a5f7-a0f3c100ae18">
<topic>ImageMagick6 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick6</name>
<name>ImageMagick6-nox11</name>
<range><lt>6.9.12.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ImageMagick">
<p>Several vulnerabilities have been discovered in ImageMagick:</p>
<ul>
<li>CVE-2021-20309: A flaw was found in ImageMagick in versions before 6.9.12,
where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger
undefined behavior via a crafted image file submitted to an application using ImageMagick.</li>
<li>CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 in gem.c.
This flaw allows an attacker who submits a crafted file that is processed by ImageMagick
to trigger undefined behavior through a division by zero.</li>
<li>CVE-2020-29599: ImageMagick before 6.9.11-40 mishandles the -authenticate option,
which allows setting a password for password-protected PDF files.</li>
<li>And maybe some others…</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-29599</cvename>
<cvename>CVE-2021-20176</cvename>
<cvename>CVE-2021-20309</cvename>
</references>
<dates>
<discovery>2020-12-17</discovery>
<entry>2021-05-13</entry>
</dates>
</vuln>
<vuln vid="a7c60af1-b3f1-11eb-a5f7-a0f3c100ae18">
<topic>ImageMagick7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.11.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ImageMagick">
<p>Several vulnerabilities have been discovered in ImageMagick:</p>
<ul>
<li>CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11.
A potential cipher leak when the calculate signatures in TransformSignature is possible.</li>
<li>CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11,
where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger
undefined behavior via a crafted image file that is submitted by an attacker and
processed by an application using ImageMagick.</li>
<li>CVE-2021-20311: A flaw was found in ImageMagick in versions before 7.0.11,
where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c
may trigger undefined behavior via a crafted image file that is submitted by an
attacker processed by an application using ImageMagick.</li>
<li>CVE-2021-20310: A flaw was found in ImageMagick in versions before 7.0.11,
where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger
undefined behavior via a crafted image file that is submitted by an attacker
and processed by an application using ImageMagick.</li>
<li>CVE-2021-20309: A flaw was found in ImageMagick in versions before 7.0.11,
where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger
undefined behavior via a crafted image file submitted to an application using ImageMagick.</li>
<li>And several others…</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-27829</cvename>
<cvename>CVE-2020-29599</cvename>
<cvename>CVE-2021-20176</cvename>
<cvename>CVE-2021-20241</cvename>
<cvename>CVE-2021-20243</cvename>
<cvename>CVE-2021-20244</cvename>
<cvename>CVE-2021-20245</cvename>
<cvename>CVE-2021-20246</cvename>
<cvename>CVE-2021-20309</cvename>
<cvename>CVE-2021-20310</cvename>
<cvename>CVE-2021-20311</cvename>
<cvename>CVE-2021-20312</cvename>
<cvename>CVE-2021-20313</cvename>
</references>
<dates>
<discovery>2020-10-27</discovery>
<entry>2021-05-13</entry>
</dates>
</vuln>
<vuln vid="f947aa26-b2f9-11eb-a5f7-a0f3c100ae18">
<topic>Pillow -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py38-pillow</name>
<range><lt>8.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>python-pillow reports:</p>
<blockquote cite="https://github.com/python-pillow/Pillow/pull/5377/commits/8ec027867f19633d9adfc5c8b7504d9b609fc5f1">
<p>This release fixes several vulnerabilities found with `OSS-Fuzz`.</p>
<ul>
<li>`CVE-2021-25288`: Fix OOB read in Jpeg2KDecode.
This dates to Pillow 2.4.0.</li>
<li>`CVE-2021-28675`: Fix DOS in PsdImagePlugin.
This dates to the PIL fork.</li>
<li>`CVE-2021-28676`: Fix FLI DOS.
This dates to the PIL fork.</li>
<li>`CVE-2021-28677`: Fix EPS DOS on _open.
This dates to the PIL fork.</li>
<li>`CVE-2021-28678`: Fix BLP DOS.
This dates to Pillow 5.1.0.</li>
<li>Fix memory DOS in ImageFont.
This dates to the PIL fork.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-25288</cvename>
<cvename>CVE-2021-28675</cvename>
<cvename>CVE-2021-28676</cvename>
<cvename>CVE-2021-28677</cvename>
<cvename>CVE-2021-28678</cvename>
</references>
<dates>
<discovery>2021-04-01</discovery>
<entry>2021-05-12</entry>
</dates>
</vuln>
<vuln vid="3cac007f-b27e-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>90.0.4430.212</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html">
<p>This release contains 19 security fixes, including:</p>
<ul>
<li>[1180126] High CVE-2021-30506: Incorrect security UI in Web App
Installs. Reported by @retsew0x01 on 2021-02-19</li>
<li>[1178202] High CVE-2021-30507: Inappropriate implementation in
Offline. Reported by Alison Huffman, Microsoft Browser
Vulnerability Research on 2021-02-14</li>
<li>[1195340] High CVE-2021-30508: Heap buffer overflow in Media
Feeds. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-04-02</li>
<li>[1196309] High CVE-2021-30509: Out of bounds write in Tab Strip.
Reported by David Erceg on 2021-04-06</li>
<li>[1197436] High CVE-2021-30510: Race in Aura. Reported by Weipeng
Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group
on 2021-04-09</li>
<li>[1197875] High CVE-2021-30511: Out of bounds read in Tab Groups.
Reported by David Erceg on 2021-04-10</li>
<li>[1200019] High CVE-2021-30512: Use after free in Notifications.
Reported by ZhanJia Song on 2021-04-17</li>
<li>[1200490] High CVE-2021-30513: Type Confusion in V8. Reported by
Man Yue Mo of GitHub Security Lab on 2021-04-19</li>
<li>[1200766] High CVE-2021-30514: Use after free in Autofill.
Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of
360 Alpha Lab on 2021-04-20</li>
<li>[1201073] High CVE-2021-30515: Use after free in File API.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
2021-04-21</li>
<li>[1201446] High CVE-2021-30516: Heap buffer overflow in History.
Reported by ZhanJia Song on 2021-04-22</li>
<li>[1203122] High CVE-2021-30517: Type Confusion in V8. Reported by
laural on 2021-04-27</li>
<li>[1203590] High CVE-2021-30518: Heap buffer overflow in Reader
Mode. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
Research on 2021-04-28</li>
<li>[1194058] Medium CVE-2021-30519: Use after free in Payments.
Reported by asnine on 2021-03-30</li>
<li>[1193362] Medium CVE-2021-30520: Use after free in Tab Strip.
Reported by Khalil Zhani on 2021-04-03</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-30506</cvename>
<cvename>CVE-2021-30507</cvename>
<cvename>CVE-2021-30508</cvename>
<cvename>CVE-2021-30509</cvename>
<cvename>CVE-2021-30510</cvename>
<cvename>CVE-2021-30511</cvename>
<cvename>CVE-2021-30512</cvename>
<cvename>CVE-2021-30513</cvename>
<cvename>CVE-2021-30514</cvename>
<cvename>CVE-2021-30515</cvename>
<cvename>CVE-2021-30516</cvename>
<cvename>CVE-2021-30517</cvename>
<cvename>CVE-2021-30518</cvename>
<cvename>CVE-2021-30519</cvename>
<cvename>CVE-2021-30520</cvename>
<url>https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-05-10</discovery>
<entry>2021-05-11</entry>
</dates>
</vuln>
<vuln vid="278561d7-b261-11eb-b788-901b0e934d69">
<topic>py-matrix-synapse -- malicious push rules may be used for a denial of service attack.</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<range><lt>1.33.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85">
<p>"Push rules" can specify conditions under which they will match,
including event_match, which matches event content against a
pattern including wildcards.
Certain patterns can cause very poor performance in the matching
engine, leading to a denial-of-service when processing moderate
length events.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29471</cvename>
<url>https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85</url>
</references>
<dates>
<discovery>2021-05-11</discovery>
<entry>2021-05-11</entry>
</dates>
</vuln>
<vuln vid="12156786-b18a-11eb-8cba-080027b00c2e">
<topic>cyrus-imapd -- Remote authenticated users could bypass intended access restrictions on certain server annotations.</topic>
<affects>
<package>
<name>cyrus-imapd34</name>
<range><ge>3.4.0</ge><lt>3.4.1</lt></range>
</package>
<package>
<name>cyrus-imapd32</name>
<range><ge>3.2.0</ge><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.4.1 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html">
<p>Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-32056</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32056</url>
</references>
<dates>
<discovery>2021-05-05</discovery>
<entry>2021-05-10</entry>
</dates>
</vuln>
<vuln vid="49346de2-b015-11eb-9bdf-f8b156b6dcc8">
<topic>FLAC -- out-of-bounds read</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oss-Fuzz reports:</p>
<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069">
<p>There is a possible out of bounds read due to a heap
buffer overflow in FLAC__bitreader_read_rice_signed_block
of bitreader.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069</url>
<cvename>CVE-2020-0499</cvename>
</references>
<dates>
<discovery>2019-09-08</discovery>
<entry>2021-05-08</entry>
</dates>
</vuln>
<vuln vid="f7a00ad7-ae75-11eb-8113-08002728f74c">
<topic>Rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack52</name>
<range><lt>5.2.6</lt></range>
</package>
<package>
<name>rubygem-actionpack60</name>
<range><lt>6.0.3.7</lt></range>
</package>
<package>
<name>rubygem-actionpack61</name>
<range><lt>6.1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2021/5/5/Rails-versions-6-1-3-2-6-0-3-7-5-2-4-6-and-5-2-6-have-been-released/">
<p>Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These
releases contain important security fixes. Here is a list of the issues
fixed:</p>
<p>CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack</p>
<p>CVE-2021-22902: Possible Denial of Service vulnerability in Action Dispatch</p>
<p>CVE-2021-22903: Possible Open Redirect Vulnerability in Action Pack</p>
<p>CVE-2021-22904: Possible DoS Vulnerability in Action Controller Token Authentication</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2021/5/5/Rails-versions-6-1-3-2-6-0-3-7-5-2-4-6-and-5-2-6-have-been-released/</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22885-possible-information-disclosure-unintended-method-execution-in-action-pack/77868</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869</url>
<cvename>CVE-2021-22885</cvename>
<cvename>CVE-2021-22902</cvename>
<cvename>CVE-2021-22903</cvename>
<cvename>CVE-2021-22904</cvename>
</references>
<dates>
<discovery>2021-05-05</discovery>
<entry>2021-05-07</entry>
</dates>
</vuln>
<vuln vid="7f242313-aea5-11eb-8151-67f74cf7c704">
<topic>go -- net/http: ReadRequest can stack overflow due to recursion with very large headers</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.16.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/45710">
<p>http.ReadRequest can stack overflow due to recursion when given a
request with a very large header (~8-10MB depending on the
architecture). A http.Server which overrides the default max header
of 1MB by setting Server.MaxHeaderBytes to a much larger value could
also be vulnerable in the same way.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31525</cvename>
<url>https://github.com/golang/go/issues/45710</url>
</references>
<dates>
<discovery>2021-04-22</discovery>
<entry>2021-05-06</entry>
</dates>
</vuln>
<vuln vid="50ec3a01-ad77-11eb-8528-8c164582fbac">
<topic>Ansible -- Insecure Temporary File</topic>
<affects>
<package>
<name>py36-ansible</name>
<name>py37-ansible</name>
<name>py38-ansible</name>
<name>py39-ansible</name>
<name>py36-ansible27</name>
<range><ge>2.9.0</ge><le>2.9.9</le></range>
</package>
<package>
<name>py37-ansible27</name>
<name>py38-ansible27</name>
<name>py39-ansible27</name>
<range><ge>2.7.0</ge><le>2.7.18</le></range>
</package>
<package>
<name>py36-ansible28</name>
<name>py37-ansible28</name>
<name>py38-ansible28</name>
<name>py39-ansible28</name>
<range><ge>2.8.0</ge><le>2.8.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-10744">
<p>
An incomplete fix was found for the fix of the flaw CVE-2020-1733
ansible: insecure temporary directory when running become_user from
become directive. The provided fix is insufficient to prevent the
race condition on systems using ACLs and FUSE filesystems..
</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-10744</url>
<cvename>CVE-2020-10744</cvename>
</references>
<dates>
<discovery>2020-05-15</discovery>
<entry>2021-05-05</entry>
</dates>
</vuln>
<vuln vid="1766359c-ad6e-11eb-b2a4-080027e50e6d">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<name>py39-django22</name>
<range><lt>2.2.21</lt></range>
</package>
<package>
<name>py36-django31</name>
<name>py37-django31</name>
<name>py38-django31</name>
<name>py39-django31</name>
<range><lt>3.1.9</lt></range>
</package>
<package>
<name>py36-django32</name>
<name>py37-django32</name>
<name>py38-django32</name>
<name>py39-django32</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2021/may/04/security-releases/">
<p>CVE-2021-31542:Potential directory-traversal via uploaded files.</p>
<p>MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal
via uploaded files with suitably crafted file names.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2021/may/04/security-releases/</url>
<cvename>CVE-2021-31542</cvename>
</references>
<dates>
<discovery>2021-04-22</discovery>
<entry>2021-05-05</entry>
</dates>
</vuln>
<vuln vid="bffa40db-ad50-11eb-86b8-080027846a02">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.10</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#changelog">
<p>bpo-43434: Creating a sqlite3.Connection object now also produces a
sqlite3.connect auditing event. Previously this event was only produced
by sqlite3.connect() calls. Patch by Erlend E. Aasland.</p>
<p>bpo-43882: The presence of newline or tab characters in parts of a URL
could allow some forms of attacks.Following the controlling specification
for URLs defined by WHATWG urllib.parse() now removes A SCII newlines
and tabs from URLs, preventing such attacks.</p>
<p>bpo-43472: Ensures interpreter-level audit hooks receive the cpython.
PyInterpreterState_New event when called through the _xxsubinterpreters
module.</p>
<p>bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4
address strings. Leading zeros are ambiguous and interpreted as octal
notation by some libraries. For example the legacy function socket.inet_aton()
treats leading zeros as octal notatation. glibc implementation of modern
inet_pton() does not accept any leading zeros. For a while the ipaddress
module used to accept ambiguous leading zeros.</p>
<p>bpo-43075: Fix Regular Expression Denial of Service (ReDoS) vulnerability
in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has
quadratic worst-case complexity and it allows cause a denial of service
when identifying crafted invalid RFCs. This ReDoS issue is on the client
side and needs remote attackers to control the HTTP server.</p>
<p>bpo-42800: Audit hooks are now fired for frame.f_code, traceback.tb_frame,
and generator code/frame attribute access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3/whatsnew/changelog.html#changelog</url>
<url>https://docs.python.org/3.8/whatsnew/changelog.html#changelog</url>
</references>
<dates>
<discovery>2021-03-08</discovery>
<entry>2021-05-05</entry>
</dates>
</vuln>
<vuln vid="1606b03b-ac57-11eb-9bdd-8c164567ca3c">
<topic>redis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redis</name>
<range><ge>6.0.0</ge><lt>6.0.13</lt></range>
</package>
<package>
<name>redis-devel</name>
<range><ge>6.2.0</ge><lt>6.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis project reports:</p>
<blockquote cite="https://groups.google.com/g/redis-db/c/6GSWzTW0PR8">
<dl>
<dt>Vulnerability in the STRALGO LCS command</dt>
<dd>
An integer overflow bug in Redis version 6.0 or newer could be
exploited using the STRALGO LCS command to corrupt the heap and
potentially result with remote code execution.
</dd>
<dt>Vulnerability in the COPY command for large intsets</dt>
<dd>
An integer overflow bug in Redis 6.2 could be exploited to corrupt
the heap and potentially result with remote code execution.
The vulnerability involves changing the default set-max-intset-entries
configuration value, creating a large set key that consists of
integer values and using the COPY command to duplicate it.
The integer overflow bug exists in all versions of Redis starting
with 2.6, where it could result with a corrupted RDB or DUMP payload,
but not exploited through COPY (which did not exist before 6.2).
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-29477</cvename>
<cvename>CVE-2021-29478</cvename>
<url>https://groups.google.com/g/redis-db/c/6GSWzTW0PR8</url>
</references>
<dates>
<discovery>2021-05-03</discovery>
<entry>2021-05-03</entry>
</dates>
</vuln>
<vuln vid="57027417-ab7f-11eb-9596-080027f515ea">
<topic>RDoc -- command injection vulnerability</topic>
<affects>
<package>
<name>rubygem-rdoc</name>
<range><lt>6.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexandr Savca reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/">
<p>
RDoc used to call Kernel#open to open a local file. If a Ruby project
has a file whose name starts with | and ends with tags, the command
following the pipe character is executed. A malicious Ruby project
could exploit it to run an arbitrary command execution against a user
who attempts to run rdoc command.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-31799</cvename>
<url>https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/</url>
</references>
<dates>
<discovery>2021-05-02</discovery>
<entry>2021-05-02</entry>
</dates>
</vuln>
<vuln vid="0add6e6b-6883-11eb-b0cb-f8b156c2bfe9">
<topic>sympa -- Unauthorised full access via SOAP API due to illegal cookie</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.2.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sympa community reports:</p>
<blockquote cite="https://github.com/sympa-community/sympa/issues/1041">
<p>Unauthorised full access via SOAP API due to illegal cookie</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-29668</cvename>
<url>https://sympa-community.github.io/security/2020-003.html</url>
</references>
<dates>
<discovery>2020-11-24</discovery>
<entry>2021-02-06</entry>
</dates>
</vuln>
<vuln vid="6f33d38b-aa18-11eb-b3f1-005056a311d1">
<topic>samba -- negative idmap cache entries vulnerability</topic>
<affects>
<package>
<name>samba412</name>
<range><lt>4.12.15</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.8</lt></range>
</package>
<package>
<name>samba414</name>
<range><lt>4.14.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<ul>
<li>CVE-2021-20254: Negative idmap cache entries can cause incorrect
group entries in the Samba file server process token.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2021-20254.html</url>
<cvename>CVE-2021-20254</cvename>
</references>
<dates>
<discovery>2021-04-29</discovery>
<entry>2021-05-01</entry>
</dates>
</vuln>
<vuln vid="518a119c-a864-11eb-8ddb-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.11.0</ge><lt>13.11.2</lt></range>
<range><ge>13.10.0</ge><lt>13.10.4</lt></range>
<range><ge>11.6.0</ge><lt>13.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/">
<p>Read API scoped tokens can execute mutations</p>
<p>Pull mirror credentials were exposed</p>
<p>Denial of Service when querying repository branches API</p>
<p>Non-owners can set system_note_timestamp when creating / updating issues</p>
<p>DeployToken will impersonate a User with the same ID when using Dependency Proxy</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/</url>
<cvename>CVE-2021-22209</cvename>
<cvename>CVE-2021-22206</cvename>
<cvename>CVE-2021-22210</cvename>
<cvename>CVE-2021-22208</cvename>
<cvename>CVE-2021-22211</cvename>
</references>
<dates>
<discovery>2021-04-28</discovery>
<entry>2021-04-28</entry>
</dates>
</vuln>
<vuln vid="76a07f31-a860-11eb-8ddb-001b217b3468">
<topic>Carrierwave -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-carrierwave</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Community reports:</p>
<blockquote cite="https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08">
<p>Fix Code Injection vulnerability in CarrierWave::RMagick</p>
<p>Fix SSRF vulnerability in the remote file download feature</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08</url>
<cvename>CVE-2021-21288</cvename>
<cvename>CVE-2021-21305</cvename>
</references>
<dates>
<discovery>2021-02-08</discovery>
<entry>2021-04-28</entry>
</dates>
</vuln>
<vuln vid="31a7ffb1-a80a-11eb-b159-f8b156c2bfe9">
<topic>sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security.</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.2.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Earlier versions of Sympa require a parameter named cookie in sympa.conf
configuration file.</p>
<blockquote cite="https://sympa-community.github.io/security/2021-001.html">
<p>This parameter was used to make some identifiers generated by the system
unpredictable. For example, it was used as following:</p>
<ul><li>To be used as a salt to encrypt passwords stored in the database by
the RC4 symmetric key algorithm.
<p>Note that RC4 is no longer considered secure enough and is not supported
in the current version of Sympa.</p></li>
<li>To prevent attackers from sending crafted messages to achieve XSS and
so on in message archives.</li></ul>
<p>There were the following problems with the use of this parameter.</p>
<ol><li>This parameter, for its purpose, should be different for each
installation, and once set, it cannot be changed. As a result, some sites
have been operating without setting this parameter. This completely
invalidates the security measures described above.</li>
<li>Even if this parameter is properly set, it may be considered not being
strong enough against brute force attacks.</li></ol>
</blockquote>
</body>
</description>
<references>
<url>https://sympa-community.github.io/security/2021-001.html</url>
</references>
<dates>
<discovery>2021-04-27</discovery>
<entry>2021-04-27</entry>
</dates>
</vuln>
<vuln vid="9fba80e0-a771-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>90.0.4430.93</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html">
<p>This release contains 9 security fixes, including:</p>
<ul>
<li>[1199345] High CVE-2021-21227: Insufficient data validation in
V8. Reported by Gengming Liu of Singular Security Lab on
2021-04-15</li>
<li>[1175058] High CVE-2021-21232: Use after free in Dev Tools.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
Research on 2021-02-05</li>
<li>[1182937] High CVE-2021-21233: Heap buffer overflow in ANGLE.
Reported by Omair on 2021-02-26</li>
<li>[1139156] Medium CVE-2021-21228: Insufficient policy enforcement
in extensions. Reported by Rob Wu on 2020-10-16</li>
<li>[$TBD][1198165] Medium CVE-2021-21229: Incorrect security UI in
downloads. Reported by Mohit Raj (shadow2639) on 2021-04-12</li>
<li>[1198705] Medium CVE-2021-21230: Type Confusion in V8. Reported
by Manfred Paul on 2021-04-13</li>
<li>[1198696] Low CVE-2021-21231: Insufficient data validation in
V8. Reported by Sergei Glazunov of Google Project Zero on
2021-04-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21227</cvename>
<cvename>CVE-2021-21228</cvename>
<cvename>CVE-2021-21229</cvename>
<cvename>CVE-2021-21230</cvename>
<cvename>CVE-2021-21231</cvename>
<cvename>CVE-2021-21232</cvename>
<cvename>CVE-2021-21233</cvename>
<url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2021-04-26</discovery>
<entry>2021-04-27</entry>
</dates>
</vuln>
<vuln vid="e4403051-a667-11eb-b9c9-6cc21735f730">
<topic>sbibboleth-sp -- denial of service vulnerability</topic>
<affects>
<package>
<name>shibboleth-sp</name>
<range>
<ge>3.0.0</ge>
<lt>3.2.1_1</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth project reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20210426.txt">
<p>Session recovery feature contains a null pointer deference.</p>
<p>
The cookie-based session recovery feature added in V3.0 contains a
flaw that is exploitable on systems *not* using the feature if a
specially crafted cookie is supplied.
</p>
<p>
This manifests as a crash in the shibd daemon/service process.
</p>
<p>
Because it is very simple to trigger this condition remotely, it
results in a potential denial of service condition exploitable by
a remote, unauthenticated attacker.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20210426.txt</url>
</references>
<dates>
<discovery>2021-04-23</discovery>
<entry>2021-04-26</entry>
</dates>
</vuln>
<vuln vid="bc83cfc9-42cf-4b00-97ad-d352ba0c5e2b">
<topic>zeek -- null-pointer dereference vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.1">
<p>Fix null-pointer dereference when encountering an
invalid enum name in a config/input file that tries to
read it into a set[enum]. For those that have such an
input feed whose contents may come from external/remote
sources, this is a potential DoS vulnerability. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.1</url>
</references>
<dates>
<discovery>2021-04-01</discovery>
<entry>2021-04-21</entry>
</dates>
</vuln>
<vuln vid="efb965be-a2c0-11eb-8956-1951a8617e30">
<topic>openvpn -- deferred authentication can be bypassed in specific circumstances</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gert Döring reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2020-15078">
<p>
OpenVPN 2.5.1 and earlier versions allows a remote attackers to
bypass authentication and access control channel data on servers
configured with deferred authentication, which can be used to
potentially trigger further information leaks.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/CVE-2020-15078</url>
<url>https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-252</url>
<cvename>CVE-2020-15078</cvename>
</references>
<dates>
<discovery>2021-03-02</discovery>
<entry>2021-04-21</entry>
</dates>
</vuln>
<vuln vid="cb13a765-a277-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>90.0.4430.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Reelases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html">
<p>This release includes 7 security fixes, including:</p>
<ul>
<li>1194046] High CVE-2021-21222: Heap buffer overflow in V8.
Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30</li>
<li>[1195308] High CVE-2021-21223: Integer overflow in Mojo.
Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02</li>
<li>[1195777] High CVE-2021-21224: Type Confusion in V8. Reported
by Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-05</li>
<li>[1195977] High CVE-2021-21225: Out of bounds memory access in
V8. Reported by Brendon Tiszka (@btiszka) supporting the EFF on
2021-04-05</li>
<li>[1197904] High CVE-2021-21226: Use after free in navigation.
Reported by Brendon Tiszka (@btiszka) supporting the EFF on
2021-04-11</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21222</cvename>
<cvename>CVE-2021-21223</cvename>
<cvename>CVE-2021-21224</cvename>
<cvename>CVE-2021-21225</cvename>
<cvename>CVE-2021-21226</cvename>
<url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2021-04-20</discovery>
<entry>2021-04-21</entry>
</dates>
</vuln>
<vuln vid="e358b470-b37d-4e47-bc8a-2cd9adbeb63c">
<topic>jenkins -- Denial of service vulnerability in bundled Jetty</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.286</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.277.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-04-20/">
<h1>Description</h1>
<h5>(High) JENKINS-65280 / CVE-2021-28165</h5>
<p>Denial of service vulnerability in bundled Jetty</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jenkins.io/security/advisory/2021-04-20/</url>
<cvename>CVE-2021-28165</cvename>
</references>
<dates>
<discovery>2021-04-20</discovery>
<entry>2021-04-20</entry>
</dates>
</vuln>
<vuln vid="56ba4513-a1be-11eb-9072-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.29</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.19</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.10</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.52</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.34</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2021.html">
<p>This Critical Patch Update contains 49 new security patches for
Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.<br/>
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 9.8.</p>
<p>MariaDB is affected by CVE-2021-2166 and CVE-2021-2154 only</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuapr2021.html</url>
<url>https://mariadb.com/kb/en/mariadb-10510-release-notes/</url>
<cvename>CVE-2020-8277</cvename>
<cvename>CVE-2020-1971</cvename>
<cvename>CVE-2021-3449</cvename>
<cvename>CVE-2020-28196</cvename>
<cvename>CVE-2021-23841</cvename>
<cvename>CVE-2021-2144</cvename>
<cvename>CVE-2021-2172</cvename>
<cvename>CVE-2021-2298</cvename>
<cvename>CVE-2021-2178</cvename>
<cvename>CVE-2021-2202</cvename>
<cvename>CVE-2021-2307</cvename>
<cvename>CVE-2021-2304</cvename>
<cvename>CVE-2021-2180</cvename>
<cvename>CVE-2021-2194</cvename>
<cvename>CVE-2021-2154</cvename>
<cvename>CVE-2021-2166</cvename>
<cvename>CVE-2021-2196</cvename>
<cvename>CVE-2021-2300</cvename>
<cvename>CVE-2021-2305</cvename>
<cvename>CVE-2021-2179</cvename>
<cvename>CVE-2021-2226</cvename>
<cvename>CVE-2021-2160</cvename>
<cvename>CVE-2021-2164</cvename>
<cvename>CVE-2021-2169</cvename>
<cvename>CVE-2021-2170</cvename>
<cvename>CVE-2021-2193</cvename>
<cvename>CVE-2021-2203</cvename>
<cvename>CVE-2021-2212</cvename>
<cvename>CVE-2021-2213</cvename>
<cvename>CVE-2021-2278</cvename>
<cvename>CVE-2021-2299</cvename>
<cvename>CVE-2021-2230</cvename>
<cvename>CVE-2021-2146</cvename>
<cvename>CVE-2021-2201</cvename>
<cvename>CVE-2021-2208</cvename>
<cvename>CVE-2021-2215</cvename>
<cvename>CVE-2021-2217</cvename>
<cvename>CVE-2021-2293</cvename>
<cvename>CVE-2021-2174</cvename>
<cvename>CVE-2021-2171</cvename>
<cvename>CVE-2021-2162</cvename>
<cvename>CVE-2021-2301</cvename>
<cvename>CVE-2021-2308</cvename>
<cvename>CVE-2021-2232</cvename>
</references>
<dates>
<discovery>2021-04-20</discovery>
<entry>2021-04-20</entry>
<modified>2021-05-04</modified>
</dates>
</vuln>
<vuln vid="e87c2647-a188-11eb-8806-1c1b0d9ea7e6">
<topic>All versions of Apache OpenOffice through 4.1.9 can open non-http(s) hyperlinks. If the link is specifically crafted this could lead to untrusted code execution.</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.10</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1619649022,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openofffice project reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245">
<p>The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245</url>
<cvename>CVE-2021-30245</cvename>
</references>
<dates>
<discovery>2021-01-25</discovery>
<entry>2021-04-20</entry>
</dates>
</vuln>
<vuln vid="20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a">
<topic>Apache Maven -- multiple vulnerabilities</topic>
<affects>
<package>
<name>maven</name>
<range><lt>3.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Maven project reports:</p>
<blockquote cite="http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291">
<p>We received a report from Jonathan Leitschuh about a vulnerability
of custom repositories in dependency POMs. We've split this up
into three separate issues:</p>
<ul>
<li>Possible Man-In-The-Middle-Attack due to custom repositories
using HTTP.
More and more repositories use HTTPS nowadays, but this
hasn't always been the case. This means that Maven Central contains
POMs with custom repositories that refer to a URL over HTTP. This
makes downloads via such repository a target for a MITM attack. At
the same time, developers are probably not aware that for some
downloads an insecure URL is being used. Because uploaded POMs to
Maven Central are immutable, a change for Maven was required. To
solve this, we extended the mirror configuration with blocked
parameter, and we added a new external:http:* mirror selector (like
existing external:*), meaning "any external URL using HTTP".
The decision was made to block such external HTTP repositories by default:
this is done by providing a mirror in the conf/settings.xml blocking
insecure HTTP external URLs.</li>
<li>Possible Domain Hijacking due to custom repositories using abandoned
domains
Sonatype has analyzed which domains were abandoned and has claimed these
domains.</li>
<li>Possible hijacking of downloads by redirecting to custom repositories
This one was the hardest to analyze and explain. The short story is:
you're safe, dependencies are only downloaded from repositories within
their context. So there are two main questions: what is the context and
what is the order? The order is described on the Repository Order page.
The first group of repositories are defined in the settings.xml (both user
and global). The second group of repositories are based on inheritence,
with ultimately the super POM containing the URL to Maven Central. The
third group is the most complex one but is important to understand the
term context: repositories from the effective POMs from the dependency
path to the artifact. So if a dependency was defined by another dependency
or by a Maven project, it will also include their repositories. In the end
this is not a bug, but a design feature.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291</url>
<cvename>CVE-2021-26291</cvename>
<cvename>CVE-2020-13956</cvename>
</references>
<dates>
<discovery>2021-04-04</discovery>
<entry>2021-04-19</entry>
</dates>
</vuln>
<vuln vid="093a6baf-9f99-11eb-b150-000c292ee6b8">
<topic>Consul -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hashicorp reports:</p>
<blockquote cite="https://github.com/hashicorp/consul/releases/tag/v1.9.5">
<p>Add content-type headers to raw KV responses to prevent XSS attacks
(CVE-2020-25864). audit-logging: Parse endpoint URL to prevent
requests from bypassing the audit log (CVE-2021-28156).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/consul/releases/tag/v1.9.5</url>
<cvename>CVE-2020-25864</cvename>
<cvename>CVE-2021-28156</cvename>
</references>
<dates>
<discovery>2021-04-15</discovery>
<entry>2021-04-17</entry>
</dates>
</vuln>
<vuln vid="75aae50b-9e3c-11eb-9bc3-8c164582fbac">
<topic>AccountsService -- Insufficient path check in user_change_icon_file_authorized_cb()</topic>
<affects>
<package>
<name>accountsservice</name>
<range><lt>0.6.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14036">
<p>
Directory Traversal with ../ sequences occurs in AccountsService
before 0.6.50 because of an insufficient path check in
user_change_icon_file_authorized_cb() in user.c.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/07/02/2</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-14036</url>
<url>https://www.securityfocus.com/bid/104757</url>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=107085</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1099699</url>
<url>https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a</url>
<cvename>CVE-2018-14036</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2021-04-15</entry>
</dates>
</vuln>
<vuln vid="40b481a9-9df7-11eb-9bc3-8c164582fbac">
<topic>mdbook -- XSS in mdBook's search page</topic>
<affects>
<package>
<name>mdbook</name>
<range><lt>0.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rust Security Response Working Group reports:</p>
<blockquote cite="https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436">
<p>
The search feature of mdBook (introduced in version 0.1.4) was
affected by a cross site scripting vulnerability that allowed an
attacker to execute arbitrary JavaScript code on an user's browser
by tricking the user into typing a malicious search query, or
tricking the user into clicking a link to the search page with the
malicious search query prefilled.
mdBook 0.4.5 fixes the vulnerability by properly escaping the search
query.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045</url>
<url>https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b</url>
<url>https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436</url>
<url>https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0?pli=1</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-26297</url>
<cvename>CVE-2020-26297</cvename>
</references>
<dates>
<discovery>2021-04-01</discovery>
<entry>2021-04-15</entry>
</dates>
</vuln>
<vuln vid="fb6e53ae-9df6-11eb-ba8c-001b217b3468">
<topic>Gitlab -- Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.10.0</ge><lt>13.10.3</lt></range>
<range><ge>13.9.0</ge><lt>13.9.6</lt></range>
<range><ge>7.12</ge><lt>13.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/">
<p>Remote code execution when uploading specially crafted image files</p>
<p>Update Rexml</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/</url>
<cvename>CVE-2021-28965</cvename>
</references>
<dates>
<discovery>2021-04-14</discovery>
<entry>2021-04-15</entry>
</dates>
</vuln>
<vuln vid="f3d86439-9def-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>90.0.4430.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html">
<p>This release contains 37 security fixes, including:</p>
<ul>
<li>[1025683] High CVE-2021-21201: Use after free in permissions.
Reported by Gengming Liu, Jianyu Chen at Tencent Keen Security
Lab on 2019-11-18</li>
<li>[1188889] High CVE-2021-21202: Use after free in extensions.
Reported by David Erceg on 2021-03-16</li>
<li>[1192054] High CVE-2021-21203: Use after free in Blink.
Reported by asnine on 2021-03-24</li>
<li>[1189926] High CVE-2021-21204: Use after free in Blink.
Reported by Chelse Tsai-Simek, Jeanette Ulloa, and Emily
Voigtlander of Seesaw on 2021-03-19</li>
<li>[1165654] High CVE-2021-21205: Insufficient policy enforcement
in navigation. Reported by Alison Huffman, Microsoft Browser
Vulnerability Research on 2021-01-12</li>
<li>[1195333] High CVE-2021-21221: Insufficient validation of
untrusted input in Mojo. Reported by Guang Gong of Alpha Lab,
Qihoo 360 on 2021-04-02</li>
<li>[1185732] Medium CVE-2021-21207: Use after free in IndexedDB.
Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13)
of 360 Alpha Lab on 2021-03-08</li>
<li>[1039539] Medium CVE-2021-21208: Insufficient data validation
in QR scanner. Reported by Ahmed Elsobky (@0xsobky) on
2020-01-07</li>
<li>[1143526] Medium CVE-2021-21209: Inappropriate implementation
in storage. Reported by Tom Van Goethem (@tomvangoethem) on
2020-10-29</li>
<li>[1184562] Medium CVE-2021-21210: Inappropriate implementation
in Network. Reported by @bananabr on 2021-03-04</li>
<li>[1103119] Medium CVE-2021-21211: Inappropriate implementation
in Navigation. Reported by Akash Labade (m0ns7er) on
2020-07-08</li>
<li>[1145024] Medium CVE-2021-21212: Incorrect security UI in
Network Config UI. Reported by Hugo Hue and Sze Yiu Chau of the
Chinese University of Hong Kong on 2020-11-03</li>
<li>[1161806] Medium CVE-2021-21213: Use after free in WebMIDI.
Reported by raven (@raid_akame) on 2020-12-25</li>
<li>[1170148] Medium CVE-2021-21214: Use after free in Network API.
Reported by Anonymous on 2021-01-24</li>
<li>[1172533] Medium CVE-2021-21215: Inappropriate implementation
in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2021-01-30</li>
<li>[1173297] Medium CVE-2021-21216: Inappropriate implementation
in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2021-02-02</li>
<li>[1166462] Low CVE-2021-21217: Uninitialized Use in PDFium.
Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
2021-01-14</li>
<li>[1166478] Low CVE-2021-21218: Uninitialized Use in PDFium.
Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
2021-01-14</li>
<li>[1166972] Low CVE-2021-21219: Uninitialized Use in PDFium.
Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
2021-01-15</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21201</cvename>
<cvename>CVE-2021-21202</cvename>
<cvename>CVE-2021-21203</cvename>
<cvename>CVE-2021-21204</cvename>
<cvename>CVE-2021-21205</cvename>
<cvename>CVE-2021-21221</cvename>
<cvename>CVE-2021-21207</cvename>
<cvename>CVE-2021-21208</cvename>
<cvename>CVE-2021-21209</cvename>
<cvename>CVE-2021-21210</cvename>
<cvename>CVE-2021-21211</cvename>
<cvename>CVE-2021-21212</cvename>
<cvename>CVE-2021-21213</cvename>
<cvename>CVE-2021-21214</cvename>
<cvename>CVE-2021-21215</cvename>
<cvename>CVE-2021-21216</cvename>
<cvename>CVE-2021-21217</cvename>
<cvename>CVE-2021-21218</cvename>
<cvename>CVE-2021-21219</cvename>
<url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2021-04-14</discovery>
<entry>2021-04-15</entry>
</dates>
</vuln>
<vuln vid="7c0d71a9-9d48-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>89.0.4389.128</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html">
<p>This release contains two security fixes:</p>
<ul>
<li>[1196781] High CVE-2021-21206: Use after free in Blink. Reported
by Anonymous on 2021-04-07</li>
<li>[1196683] High CVE-2021-21220: Insufficient validation of
untrusted input in V8 for x86_64. Reported by Bruno Keith (@bkth_)
and Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_it)
via ZDI (ZDI-CAN-13569) on 2021-04-07></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21206</cvename>
<cvename>CVE-2021-21220</cvename>
<url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-04-13</discovery>
<entry>2021-04-14</entry>
</dates>
</vuln>
<vuln vid="465db5b6-9c6d-11eb-8e8a-bc542f4bd1dd">
<topic>xorg-server -- Input validation failures in X server XInput extension</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.20.11,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.20.11,1</lt></range>
</package>
<package>
<name>xwayland-devel</name>
<range><le>1.20.0.877</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X.Org server security reports for release 1.20.11:</p>
<blockquote cite="https://lists.x.org/archives/xorg/2021-April/060678.html">
<ul>
<li>Fix XChangeFeedbackControl() request underflow</li>
</ul>
<p>.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.freedesktop.org/xorg/xserver/-/tags/xorg-server-1.20.11</url>
</references>
<dates>
<discovery>2021-04-13</discovery>
<entry>2021-04-13</entry>
</dates>
</vuln>
<vuln vid="094fb2ec-9aa3-11eb-83cb-0800278d94f0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.14.0:</p>
<blockquote cite="https://blog.gitea.io/2021/04/gitea-1.14.0-is-released/">
<ul>
<li>Validate email in external authenticator registration form</li>
<li>Ensure validation occurs on clone addresses too</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.14.0</url>
<freebsdpr>ports/254976</freebsdpr>
</references>
<dates>
<discovery>2021-03-11</discovery>
<entry>2021-04-11</entry>
</dates>
</vuln>
<vuln vid="9ee01e60-6045-43df-98e5-a794007e54ef">
<topic>syncthing -- crash due to malformed relay protocol message</topic>
<affects>
<package>
<name>syncthing</name>
<range><lt>1.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>syncthing developers report:</p>
<blockquote cite="https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h">
<p>syncthing can be caused to crash and exit if sent a malformed relay protocol
message message with a negative length field.</p>
<p>The relay server strelaysrv can be caused to crash and exit if sent a malformed
relay protocol message with a negative length field.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21404</cvename>
<url>https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h</url>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-04-12</entry>
</dates>
</vuln>
<vuln vid="f671c282-95ef-11eb-9c34-080027f515ea">
<topic>python -- Information disclosure via pydoc -p: /getfile?key=path allows to read arbitrary file on the filesystem</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.9</lt></range>
</package>
<package>
<name>python39</name>
<range><lt>3.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Schwörer reports:</p>
<blockquote cite="https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html">
<p>
Remove the getfile feature of the pydoc module which could be
abused to read arbitrary files on the disk (directory traversal
vulnerability). Moreover, even source code of Python modules
can contain sensitive data like passwords.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3426</cvename>
<url>https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html</url>
<url>https://bugs.python.org/issue42988</url>
</references>
<dates>
<discovery>2021-01-21</discovery>
<entry>2021-04-10</entry>
</dates>
</vuln>
<vuln vid="d10fc771-958f-11eb-9c34-080027f515ea">
<topic>curl -- TLS 1.3 session ticket proxy host mixup</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.63.0</ge><lt>7.76.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Stenberg reports:</p>
<blockquote cite="https://curl.se/docs/CVE-2021-22890.html">
<p>
Enabled by default, libcurl supports the use of TLS 1.3 session
tickets to resume previous TLS sessions to speed up subsequent
TLS handshakes.
</p>
<p>
When using a HTTPS proxy and TLS 1.3, libcurl can confuse session
tickets arriving from the HTTPS proxy but work as if they arrived
from the remote server and then wrongly "short-cut" the host
handshake. The reason for this confusion is the modified sequence
from TLS 1.2 when the session ids would provided only during the
TLS handshake, while in TLS 1.3 it happens post hand-shake and
the code was not updated to take that changed behavior into account.
</p>
<p>
When confusing the tickets, a HTTPS proxy can trick libcurl to use
the wrong session ticket resume for the host and thereby circumvent
the server TLS certificate check and make a MITM attack to be
possible to perform unnoticed.
</p>
<p>
This flaw can allow a malicious HTTPS proxy to MITM the traffic.
Such a malicious HTTPS proxy needs to provide a certificate that
curl will accept for the MITMed server for an attack to work -
unless curl has been told to ignore the server certificate check.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22890</cvename>
<url>https://curl.se/docs/CVE-2021-22890.html</url>
</references>
<dates>
<discovery>2021-03-31</discovery>
<entry>2021-04-10</entry>
</dates>
</vuln>
<vuln vid="b1194286-958e-11eb-9c34-080027f515ea">
<topic>curl -- Automatic referer leaks credentials</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1.1</ge><lt>7.76.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Stenberg reports:</p>
<blockquote cite="https://curl.se/docs/CVE-2021-22876.html">
<p>
libcurl does not strip off user credentials from the URL when
automatically populating the Referer: HTTP request header field
in outgoing HTTP requests, and therefore risks leaking sensitive
data to the server that is the target of the second HTTP request.
</p>
<p>
libcurl automatically sets the Referer: HTTP request header field
in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set.
With the curl tool, it is enabled with --referer ";auto".
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-22876</cvename>
<url>https://curl.se/docs/CVE-2021-22876.html</url>
</references>
<dates>
<discovery>2021-03-31</discovery>
<entry>2021-04-10</entry>
</dates>
</vuln>
<vuln vid="8ba23a62-997d-11eb-9f0e-0800278d94f0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.7:</p>
<blockquote cite="https://blog.gitea.io/2021/04/gitea-1.13.7-is-released/">
<ul>
<li>Update to bluemonday-1.0.6</li>
<li>Clusterfuzz found another way</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.7</url>
<freebsdpr>ports/254930</freebsdpr>
</references>
<dates>
<discovery>2021-04-07</discovery>
<entry>2021-04-09</entry>
</dates>
</vuln>
<vuln vid="9ae2c00f-97d0-11eb-8cd6-080027f515ea">
<topic>clamav -- Multiple vulnerabilites</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.103.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html">
<dl>
<dt>CVE-2021-1252</dt>
<dd>Excel XLM parser infinite loop</dd>
<dt>CVE-2021-1404</dt>
<dd>PDF parser buffer over-read; possible crash. </dd>
<dt>CVE-2021-1405</dt>
<dd>Mail parser NULL-dereference crash. </dd>
</dl>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-1252</cvename>
<cvename>CVE-2021-1404</cvename>
<cvename>CVE-2021-1405</cvename>
<url>https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html</url>
</references>
<dates>
<discovery>2021-04-07</discovery>
<entry>2021-04-07</entry>
</dates>
</vuln>
<vuln vid="9595d002-edeb-4602-be2d-791cd654247e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.287</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.277.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-04-07/">
<h1>Description</h1>
<h5>(Low) SECURITY-1721 / CVE-2021-21639</h5>
<p>Lack of type validation in agent related REST API</p>
<h5>(Medium) SECURITY-1871 / CVE-2021-21640</h5>
<p>View name validation bypass</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jenkins.io/security/advisory/2021-04-07/</url>
</references>
<dates>
<discovery>2021-04-07</discovery>
<entry>2021-04-08</entry>
</dates>
</vuln>
<vuln vid="c0c1834c-9761-11eb-acfd-0022489ad614">
<topic>Node.js -- April 2021 Security Releases</topic>
<affects>
<package>
<name>node10</name>
<range><lt>10.24.1</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.22.1</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.16.1</lt></range>
</package>
<package>
<name>node</name>
<range><lt>15.14.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/">
<h1>OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)</h1>
<p>This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt</p>
<h1>OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)</h1>
<p>This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt</p>
<h1>npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)</h1>
<p>This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/</url>
<url>https://www.openssl.org/news/secadv/20210325.txt</url>
<url>https://github.com/advisories/GHSA-c4w7-xm78-47vh</url>
<cvename>CVE-2021-3450</cvename>
<cvename>CVE-2021-3449</cvename>
<cvename>CVE-2020-7774</cvename>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-04-07</entry>
</dates>
</vuln>
<vuln vid="a7b97d26-9792-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- jail escape possible by mounting over jail root</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_6</lt></range>
<range><ge>11.4</ge><lt>11.4_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a race condition between lookup of ".." and remounting a filesystem,
a process running inside a jail might access filesystem hierarchy outside
of jail.</p>
<h1>Impact:</h1>
<p>A process with superuser privileges running inside a jail configured
with the allow.mount permission (not enabled by default) could change the root
directory outside of the jail, and thus gain full read and write access
to all files and directories in the system.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25584</cvename>
<freebsdsa>SA-21:10.jail_mount</freebsdsa>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-04-07</entry>
</dates>
</vuln>
<vuln vid="f8e1e2a6-9791-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- double free in accept_filter(9) socket configuration interface</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unprivileged process can configure an accept filter on a listening
socket. This is done using the setsockopt(2) system call. The process
supplies the name of the accept filter which is to be attached to the
socket, as well as a string containing filter-specific information.</p>
<p>If the filter implements the accf_create callback, the socket option
handler attempts to preserve the process-supplied argument string. A
bug in the socket option handler caused this string to be freed
prematurely, leaving a dangling pointer. Additional operations on the
socket can turn this into a double free or a use-after-free.</p>
<h1>Impact:</h1>
<p>The bug may be exploited to trigger local privilege escalation or
kernel memory disclosure.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29627</cvename>
<freebsdsa>SA-21:09.accept_filter</freebsdsa>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-04-07</entry>
</dates>
</vuln>
<vuln vid="13d37672-9791-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Memory disclosure by stale virtual memory mapping</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_6</lt></range>
<range><ge>11.4</ge><lt>11.4_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A particular case of memory sharing is mishandled in the virtual memory
system. It is possible and legal to establish a relationship where
multiple descendant processes share a mapping which shadows memory of an
ancestor process. In this scenario, when one process modifies memory
through such a mapping, the copy-on-write logic fails to invalidate
other mappings of the source page. These stale mappings may remain even
after the mapped pages have been reused for another purpose.</p>
<h1>Impact:</h1>
<p>An unprivileged local user process can maintain a mapping of a page
after it is freed, allowing that process to read private data belonging
to other processes or the kernel.</p>
</body>
</description>
<references>
<cvename>CVE-2021-29626</cvename>
<freebsdsa>SA-21:08.vm</freebsdsa>
</references>
<dates>
<discovery>2021-04-06</discovery>
<entry>2021-04-07</entry>
</dates>
</vuln>
<vuln vid="79fa9f23-9725-11eb-b530-7085c2fb2c14">
<topic>upnp -- stack overflow vulnerability</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.14.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28302">
<p>
A stack overflow in pupnp 1.16.1 can cause the denial of service through the
Parser_parseDocument() function. ixmlNode_free() will release a child node
recursively, which will consume stack space and lead to a crash.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-28302</cvename>
<url>https://github.com/pupnp/pupnp/issues/249</url>
</references>
<dates>
<discovery>2021-03-12</discovery>
<entry>2021-04-06</entry>
</dates>
</vuln>
<vuln vid="dec7e4b6-961a-11eb-9c34-080027f515ea">
<topic>ruby -- XML round-trip vulnerability in REXML</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.5.0,1</ge><lt>2.5.9,1</lt></range>
<range><ge>2.6.0,1</ge><lt>2.6.7,1</lt></range>
<range><ge>2.7.0,1</ge><lt>2.7.3,1</lt></range>
<range><ge>3.0.0.p1,1</ge><lt>3.0.1,1</lt></range>
</package>
<package>
<name>rubygem-rexml</name>
<range><lt>3.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Juho Nurminen reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/">
<p>
When parsing and serializing a crafted XML document, REXML gem
(including the one bundled with Ruby) can create a wrong XML
document whose structure is different from the original one.
The impact of this issue highly depends on context, but it may
lead to a vulnerability in some programs that are using REXML.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-28965</cvename>
<url>https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/</url>
</references>
<dates>
<discovery>2021-04-05</discovery>
<entry>2021-04-05</entry>
</dates>
</vuln>
<vuln vid="bddadaa4-9227-11eb-99c5-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>89.0.4389.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html">
<p>This update contains 8 security fixes, including:</p>
<ul>
<li>[1181228] High CVE-2021-21194: Use after free in screen capture.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-02-23</li>
<li>[1182647] High CVE-2021-21195: Use after free in V8.
Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent
Security Xuanwu Lab on 2021-02-26</li>
<li>[1175992] High CVE-2021-21196: Heap buffer overflow in
TabStrip. Reported by Khalil Zhani on 2021-02-08</li>
<li>[1173903] High CVE-2021-21197: Heap buffer overflow in
TabStrip. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2021-02-03</li>
<li>[1184399] High CVE-2021-21198: Out of bounds read in IPC.
Reported by Mark Brand of Google Project Zero on 2021-03-03</li>
<li>[1179635] High CVE-2021-21199: Use Use after free in Aura.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group and Evangelos Foutras</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21194</cvename>
<cvename>CVE-2021-21195</cvename>
<cvename>CVE-2021-21196</cvename>
<cvename>CVE-2021-21197</cvename>
<cvename>CVE-2021-21198</cvename>
<cvename>CVE-2021-21199</cvename>
<url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html</url>
</references>
<dates>
<discovery>2021-03-31</discovery>
<entry>2021-03-31</entry>
</dates>
</vuln>
<vuln vid="56abf87b-96ad-11eb-a218-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.10.0</ge><lt>13.10.1</lt></range>
<range><ge>13.9.0</ge><lt>13.9.5</lt></range>
<range><ge>9</ge><lt>13.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/">
<p>Arbitrary File Read During Project Import</p>
<p>Kroki Arbitrary File Read/Write</p>
<p>Stored Cross-Site-Scripting in merge requests</p>
<p>Access data of an internal project through a public project fork as an anonymous user</p>
<p>Incident metric images can be deleted by any user</p>
<p>Infinite Loop When a User Access a Merge Request</p>
<p>Stored XSS in scoped labels</p>
<p>Admin CSRF in System Hooks Execution Through API</p>
<p>Update OpenSSL dependency</p>
<p>Update PostgreSQL dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/</url>
</references>
<dates>
<discovery>2021-03-31</discovery>
<entry>2021-04-06</entry>
</dates>
</vuln>
<vuln vid="1f6d97da-8f72-11eb-b3f1-005056a311d1">
<topic>samba -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>samba411</name>
<range><le>4.11.15</le></range>
</package>
<package>
<name>samba412</name>
<range><lt>4.12.14</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.7</lt></range>
</package>
<package>
<name>samba414</name>
<range><lt>4.14.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<ul>
<li>CVE-2020-27840: An anonymous attacker can crash the Samba AD DC
LDAP server by sending easily crafted DNs as
part of a bind request. More serious heap corruption
is likely also possible.</li>
<li>CVE-2021-20277: User-controlled LDAP filter strings against
the AD DC LDAP server may crash the LDAP server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2020-27840.html</url>
<url>https://www.samba.org/samba/security/CVE-2021-20277.html</url>
<cvename>CVE-2020-27840</cvename>
<cvename>CVE-2021-20277</cvename>
</references>
<dates>
<discovery>2021-03-24</discovery>
<entry>2021-03-28</entry>
</dates>
</vuln>
<vuln vid="80f9dbd3-8eec-11eb-b9e8-3525f51429a0">
<topic>nettle 3.7.2 -- fix serious ECDSA signature verify bug</topic>
<affects>
<package>
<name>nettle</name>
<range><lt>3.7.2</lt></range>
</package>
<package>
<name>linux-c7-nettle</name>
<range><lt>3.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Niels Möller reports:</p>
<blockquote cite="https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html">
<p>
I've prepared a new bug-fix release of Nettle, a low-level
cryptographics library, to fix a serious bug in the function to
verify ECDSA signatures. Implications include an assertion failure,
which could be used for denial-of-service, when verifying signatures
on the secp_224r1 and secp521_r1 curves.
</p>
<p>
Even when no assert is triggered in ecdsa_verify, ECC point
multiplication may get invalid intermediate values as input, and
produce incorrect results. [...] It appears difficult to construct
an alleged signature that makes the function misbehave in such a way
that an invalid signature is accepted as valid, but such attacks
can't be ruled out without further analysis.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html</url>
</references>
<dates>
<discovery>2021-03-21</discovery>
<entry>2021-03-27</entry>
</dates>
</vuln>
<vuln vid="5a668ab3-8d86-11eb-b8d6-d4c9ef517024">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1k,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.2</ge><lt>12.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20210325.txt">
<p>High: CA certificate check bypass with X509_V_FLAG_X509_STRICT
(CVE-2021-3450)<br/>The X509_V_FLAG_X509_STRICT flag enables
additional security checks of the certificates present in a
certificate chain. It is not set by default.</p>
<p>High: NULL pointer deref in signature_algorithms processing
(CVE-2021-3449)<br/>An OpenSSL TLS server may crash if sent a
maliciously crafted renegotiation ClientHello message from a client.
If a TLSv1.2 renegotiation ClientHello omits the
signature_algorithms extension (where it was present in the initial
ClientHello), but includes a signature_algorithms_cert extension
then a NULL pointer dereference will result, leading to a crash and
a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20210325.txt</url>
<cvename>CVE-2021-3449</cvename>
<cvename>CVE-2021-3450</cvename>
<freebsdsa>SA-21:07.openssl</freebsdsa>
</references>
<dates>
<discovery>2021-03-25</discovery>
<entry>2021-03-26</entry>
<modified>2021-04-07</modified>
</dates>
</vuln>
<vuln vid="ec04f3d0-8cd9-11eb-bb9f-206a8a720317">
<topic>spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache SpamAssassin project reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E">
<p>Apache SpamAssassin 3.4.5 was recently released [1], and fixes
an issue of security note where malicious rule configuration (.cf)
files can be configured to run system commands.</p>
<p>In Apache SpamAssassin before 3.4.5, exploits can be injected in
a number of scenarios. In addition to upgrading to SA 3.4.5,
users should only use update channels or 3rd party .cf files from
trusted places.</p>
</blockquote>
</body>
</description>
<references>
<url>https://spamassassin.apache.org/news.html</url>
<url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946</url>
<cvename>CVE-2020-1946</cvename>
</references>
<dates>
<discovery>2021-03-24</discovery>
<entry>2021-03-24</entry>
</dates>
</vuln>
<vuln vid="c4d2f950-8c27-11eb-a3ae-0800278d94f0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.6:</p>
<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.6-is-released/">
<ul>
<li>Fix bug on avatar middleware</li>
<li>Fix another clusterfuzz identified issue</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.5</url>
<freebsdpr>ports/254515</freebsdpr>
</references>
<dates>
<discovery>2021-03-21</discovery>
<entry>2021-03-23</entry>
</dates>
</vuln>
<vuln vid="1431a25c-8a70-11eb-bd16-0800278d94f0">
<topic>gitea -- quoting in markdown text</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.5:</p>
<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.5-is-released/">
<ul>
<li>Update to goldmark 1.3.3</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.5</url>
<freebsdpr>ports/254130</freebsdpr>
</references>
<dates>
<discovery>2021-03-20</discovery>
<entry>2021-03-21</entry>
</dates>
</vuln>
<vuln vid="76b5068c-8436-11eb-9469-080027f515ea">
<topic>OpenSSH -- Double-free memory corruption in ssh-agent</topic>
<affects>
<package>
<name>openssh-portable</name>
<name>openssh-portable-hpn</name>
<name>openssh-portable-gssapi</name>
<range><ge>8.2.p1,1</ge><lt>8.4.p1_4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenBSD Project reports:</p>
<blockquote cite="https://www.openssh.com/txt/release-8.5">
<p>
ssh-agent(1): fixed a double-free memory corruption that was
introduced in OpenSSH 8.2 . We treat all such memory faults as
potentially exploitable. This bug could be reached by an attacker
with access to the agent socket.
</p>
<p>
On modern operating systems where the OS can provide information
about the user identity connected to a socket, OpenSSH ssh-agent
and sshd limit agent socket access only to the originating user
and root. Additional mitigation may be afforded by the system's
malloc(3)/free(3) implementation, if it detects double-free
conditions.
</p>
<p>
The most likely scenario for exploitation is a user forwarding an
agent either to an account shared with a malicious user or to a
host with an attacker holding root access.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-28041</cvename>
<url>https://www.openssh.com/txt/release-8.5</url>
</references>
<dates>
<discovery>2021-03-03</discovery>
<entry>2021-03-13</entry>
<modified>2021-04-20</modified>
</dates>
</vuln>
<vuln vid="50e59056-87f2-11eb-b6a2-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.9.0</ge><lt>13.9.4</lt></range>
<range><ge>13.8.0</ge><lt>13.8.6</lt></range>
<range><ge>13.2.0</ge><lt>13.7.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gigtlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/">
<p>Remote code execution via unsafe user-controlled markdown rendering options</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/</url>
</references>
<dates>
<discovery>2021-03-17</discovery>
<entry>2021-03-18</entry>
</dates>
</vuln>
<vuln vid="5b72b1ff-877c-11eb-bd4f-2f1d57dafe46">
<topic>dnsmasq -- cache poisoning vulnerability in certain configurations</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.85.r1,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.85.r1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html">
<p>
[In configurations where the forwarding server address contains an @
character for specifying a sending interface or source address, the]
random source port behavior was disabled, making cache poisoning
attacks possible.
</p>
</blockquote>
<p>
This only affects configurations of the form server=1.1.1.1@em0 or
server=1.1.1.1@192.0.2.1, i. e. those that specify an interface to
send through, or an IP address to send from, or use together with
NetworkManager.
</p>
</body>
</description>
<references>
<url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html</url>
<cvename>CVE-2021-3448</cvename>
</references>
<dates>
<discovery>2021-03-17</discovery>
<entry>2021-03-18</entry>
</dates>
</vuln>
<vuln vid="b073677f-253a-41f9-bf2b-2d16072a25f6">
<topic>minio -- MITM attack</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2021.03.17.02.33.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>minio developer report:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp">
<p>
This is a security issue because it enables MITM modification of
request bodies that are meant to have integrity guaranteed by chunk
signatures.
</p>
<p>
In a PUT request using aws-chunked encoding, MinIO ordinarily
verifies signatures at the end of a chunk. This check can be skipped
if the client sends a false chunk size that is much greater than the
actual data sent: the server accepts and completes the request
without ever reaching the end of the chunk + thereby without ever
checking the chunk signature.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp</url>
</references>
<dates>
<discovery>2021-03-17</discovery>
<entry>2021-03-17</entry>
</dates>
</vuln>
<vuln vid="eeca52dc-866c-11eb-b8d6-d4c9ef517024">
<topic>LibreSSL -- use-after-free</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>3.2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenBSD reports:</p>
<blockquote cite="https://marc.info/?l=openbsd-announce&m=161582456312832&w=2">
<p>A TLS client using session resumption may cause a use-after-free.</p>
</blockquote>
</body>
</description>
<references>
<url>https://marc.info/?l=openbsd-announce&m=161582456312832&w=2</url>
<url>https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/017_libssl.patch.sig</url>
</references>
<dates>
<discovery>2021-03-15</discovery>
<entry>2021-03-16</entry>
</dates>
</vuln>
<vuln vid="b81ad6d6-8633-11eb-99c5-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>89.0.4389.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html">
<p>This release includes 5 security fixes, including:</p>
<ul>
<li>[1167357] High CVE-2021-21191: Use after free in WebRTC.
Reported by raven (@raid_akame) on 2021-01-15</li>
<li>[1181387] High CVE-2021-21192: Heap buffer overflow in tab
groups. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2021-02-23</li>
<li>[1186287] High CVE-2021-21193: Use after free in Blink.
Reported by Anonymous on 2021-03-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-11191</cvename>
<cvename>CVE-2021-11192</cvename>
<cvename>CVE-2021-11193</cvename>
<url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2021-03-12</discovery>
<entry>2021-03-16</entry>
</dates>
</vuln>
<vuln vid="317487c6-85ca-11eb-80fa-14dae938ec40">
<topic>squashfs-tools -- Integer overflow</topic>
<affects>
<package>
<name>squashfs-tools</name>
<range><lt>4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phillip Lougher reports:</p>
<blockquote cite="https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1">
<p>Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4645</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2015-4645</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2021-03-15</entry>
</dates>
</vuln>
<vuln vid="72709326-81f7-11eb-950a-00155d646401">
<topic>go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.16.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/44913">
<p>The Decode, DecodeElement, and Skip methods of an xml.Decoder
provided by xml.NewTokenDecoder may enter an infinite loop when
operating on a custom xml.TokenReader which returns an EOF in the
middle of an open XML element.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/44916">
<p>The Reader.Open API, new in Go 1.16, will panic when used on a ZIP
archive containing files that start with "../".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-27918</cvename>
<url>http://golang.org/issue/44913</url>
<cvename>CVE-2021-27919</cvename>
<url>http://golang.org/issue/44916</url>
</references>
<dates>
<discovery>2021-03-05</discovery>
<entry>2021-03-10</entry>
</dates>
</vuln>
<vuln vid="502ba001-7ffa-11eb-911c-0800278d94f0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.3:</p>
<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.3-is-released/">
<ul>
<li>Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one </li>
</ul>
</blockquote>
<p>The Gitea Team reports for release 1.13.4:</p>
<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/">
<ul>
<li>Fix issue popups</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.3</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.4</url>
<freebsdpr>ports/254130</freebsdpr>
</references>
<dates>
<discovery>2021-01-07</discovery>
<entry>2021-02-06</entry>
</dates>
</vuln>
<vuln vid="2dc8927b-54e0-11eb-9342-1c697a013f4b">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php72</name>
<name>mantis-php73</name>
<name>mantis-php74</name>
<name>mantis-php80</name>
<range><lt>2.24.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis 2.24.4 release reports:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.24.4">
<p>Security and maintenance release, addressing 6 CVEs:</p>
<ul>
<li>0027726: CVE-2020-29603: disclosure of private project name</li>
<li>0027727: CVE-2020-29605: disclosure of private issue summary</li>
<li>0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and attachments</li>
<li>0027361: Private category can be access/used by a non member of a private project (IDOR)</li>
<li>0027779: CVE-2020-35571: XSS in helper_ensure_confirmed() calls</li>
<li>0026794: User Account - Takeover</li>
<li>0027363: Fixed in version can be changed to a version that doesn't exist</li>
<li>0027350: When updating an issue, a Viewer user can be set as Reporter</li>
<li>0027370: CVE-2020-35849: Revisions allow viewing private bugnotes id and summary</li>
<li>0027495: CVE-2020-28413: SQL injection in the parameter "access" on the mc_project_get_users function throught the API SOAP.</li>
<li>0027444: Printing unsanitized user input in install.php</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-28413</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28413</url>
<cvename>CVE-2020-35849</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35849</url>
</references>
<dates>
<discovery>2020-11-10</discovery>
<entry>2021-03-10</entry>
</dates>
</vuln>
<vuln vid="2f3cd69e-7dee-11eb-b92e-0022489ad614">
<topic>Node.js -- February 2021 Security Releases</topic>
<affects>
<package>
<name>node10</name>
<range><lt>10.24.0</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.21.0</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.16.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>15.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/">
<h1>HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)</h1>
<p>Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.</p>
<h1>DNS rebinding in --inspect (CVE-2021-22884)</h1>
<p>Affected Node.js versions are vulnerable to a DNS rebinding attack when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.</p>
<h1>OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)</h1>
<p>This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/</url>
<cvename>CVE-2021-22883</cvename>
<cvename>CVE-2021-22884</cvename>
<cvename>CVE-2021-23840</cvename>
</references>
<dates>
<discovery>2021-02-23</discovery>
<entry>2021-03-09</entry>
</dates>
</vuln>
<vuln vid="8bf856ea-7df7-11eb-9aad-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.9.0</ge><lt>13.9.2</lt></range>
<range><ge>13.8.0</ge><lt>13.8.5</lt></range>
<range><lt>13.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/">
<p>JWT token leak via Workhorse</p>
<p>Stored XSS in wiki pages</p>
<p>Group Maintainers are able to use the Group CI/CD Variables API</p>
<p>Insecure storage of GitLab session keys</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/</url>
<cvename>CVE-2021-22185</cvename>
<cvename>CVE-2021-22186</cvename>
</references>
<dates>
<discovery>2021-03-04</discovery>
<entry>2021-03-05</entry>
</dates>
</vuln>
<vuln vid="9e8f0766-7d21-11eb-a2be-001999f8d30b">
<topic>asterisk -- Crash when negotiating T.38 with a zero port</topic>
<affects>
<package>
<name>asterisk16</name>
<range><lt>16.16.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk sends a re-invite initiating T.38 faxing
and the endpoint responds with a m=image line and zero
port, a crash will occur in Asterisk. This is a reoccurrence
of AST-2019-004.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-15297</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-006.html</url>
</references>
<dates>
<discovery>2021-02-20</discovery>
<entry>2021-03-04</entry>
</dates>
</vuln>
<vuln vid="f00b65d8-7ccb-11eb-b3be-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>89.0.4389.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html">
<p>This release includes 47 security fixes, including the below.
Google is aware of reports that an exploit for CVE-2021-21166 exists
in the wild. Please see URL for details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21159</cvename>
<cvename>CVE-2021-21160</cvename>
<cvename>CVE-2021-21161</cvename>
<cvename>CVE-2021-21162</cvename>
<cvename>CVE-2021-21163</cvename>
<cvename>CVE-2021-21164</cvename>
<cvename>CVE-2021-21165</cvename>
<cvename>CVE-2021-21166</cvename>
<cvename>CVE-2021-21167</cvename>
<cvename>CVE-2021-21168</cvename>
<cvename>CVE-2021-21169</cvename>
<cvename>CVE-2021-21170</cvename>
<cvename>CVE-2021-21171</cvename>
<cvename>CVE-2021-21172</cvename>
<cvename>CVE-2021-21173</cvename>
<cvename>CVE-2021-21174</cvename>
<cvename>CVE-2021-21175</cvename>
<cvename>CVE-2021-21176</cvename>
<cvename>CVE-2021-21177</cvename>
<cvename>CVE-2021-21178</cvename>
<cvename>CVE-2021-21179</cvename>
<cvename>CVE-2021-21180</cvename>
<cvename>CVE-2021-21181</cvename>
<cvename>CVE-2021-21182</cvename>
<cvename>CVE-2021-21183</cvename>
<cvename>CVE-2021-21184</cvename>
<cvename>CVE-2021-21185</cvename>
<cvename>CVE-2021-21186</cvename>
<cvename>CVE-2021-21187</cvename>
<cvename>CVE-2021-21188</cvename>
<cvename>CVE-2021-21189</cvename>
<cvename>CVE-2021-21190</cvename>
<cvename>CVE-2020-27844</cvename>
<url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-03-02</discovery>
<entry>2021-03-04</entry>
</dates>
</vuln>
<vuln vid="3a469cbc-7a66-11eb-bd3f-08002728f74c">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>2.0.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JasPer Releases:</p>
<blockquote cite="https://github.com/jasper-software/jasper/releases">
<p>- Fix memory-related bugs in the JPEG-2000 codec resulting from
attempting to decode invalid code streams. (#264, #265)</p>
<p> This fix is associated with CVE-2021-26926 and CVE-2021-26927.</p>
<p>- Fix wrong return value under some compilers (#260)</p>
<p>- Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jasper-software/jasper/releases</url>
<cvename>CVE-2021-26926</cvename>
<cvename>CVE-2021-26927</cvename>
<cvename>CVE-2021-3272</cvename>
</references>
<dates>
<discovery>2021-02-07</discovery>
<entry>2021-03-03</entry>
</dates>
</vuln>
<vuln vid="a1e03a3d-7be0-11eb-b392-20cf30e32f6d">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-salt-2019</name>
<name>py37-salt-2019</name>
<name>py38-salt-2019</name>
<name>py36-salt</name>
<name>py37-salt</name>
<name>py38-salt</name>
<name>py39-salt</name>
<range><lt>2019.2.8</lt></range>
<range><ge>3000</ge><lt>3002.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports multiple security vulnerabilities in Salt</p>
<blockquote cite="https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/">
<ul>
<li>CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.</li>
<li>CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.</li>
<li>CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.</li>
<li>CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.</li>
<li>CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion</li>
<li>CVE-2021-3148: command injection in salt.utils.thin.gen_thin()</li>
<li>CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.</li>
<li>CVE-2021-3144: eauth Token can be used once after expiration.</li>
<li>CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack</li>
<li>CVE-2020-28243: Local Privilege Escalation in the Minion.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/"</url>
<cvename>CVE-2021-3197</cvename>
<cvename>CVE-2021-25281</cvename>
<cvename>CVE-2021-25282</cvename>
<cvename>CVE-2021-25283</cvename>
<cvename>CVE-2021-25284</cvename>
<cvename>CVE-2021-3148</cvename>
<cvename>CVE-2020-35662</cvename>
<cvename>CVE-2021-3144</cvename>
<cvename>CVE-2020-28972</cvename>
<cvename>CVE-2020-28243</cvename>
</references>
<dates>
<discovery>2021-02-25</discovery>
<entry>2021-03-03</entry>
</dates>
</vuln>
<vuln vid="52bd2d59-4ab5-4bef-a599-7aac4e92238b">
<topic>vault -- unauthenticated license read</topic>
<affects>
<package>
<name>vault</name>
<range><lt>1.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>vault developers report:</p>
<blockquote cite="https://github.com/hashicorp/vault/releases/tag/v1.6.3">
<p>Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-27668</cvename>
<url>https://github.com/hashicorp/vault/releases/tag/v1.6.3</url>
</references>
<dates>
<discovery>2021-02-26</discovery>
<entry>2021-02-27</entry>
</dates>
</vuln>
<vuln vid="31ad2f10-7711-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- jail_remove(2) fails to kill all jailed processes</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_4</lt></range>
<range><ge>11.4</ge><lt>11.4_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a race condition in the jail_remove(2) implementation, it
may fail to kill some of the processes.</p>
<h1>Impact:</h1>
<p>A process running inside a jail can avoid being killed during jail
termination. If a jail is subsequently started with the same root
path, a lingering jailed process may be able to exploit the window
during which a devfs filesystem is mounted but the jail's devfs
ruleset has not been applied, to access device nodes which are
ordinarily inaccessible. If the process is privileged, it may be able
to escape the jail and gain full access to the system.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25581</cvename>
<freebsdsa>SA-21:04.jail_remove</freebsdsa>
</references>
<dates>
<discovery>2021-02-24</discovery>
<entry>2021-02-25</entry>
</dates>
</vuln>
<vuln vid="5b8c6e1e-770f-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Xen grant mapping error handling issues</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_4</lt></range>
<range><ge>11.4</ge><lt>11.4_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Grant mapping operations often occur in batch hypercalls, where a
number of operations are done in a single hypercall, the success or
failure of each one reported to the backend driver, and the backend
driver then loops over the results, performing follow-up actions
based on the success or failure of each operation.</p>
<p>Unfortunately, when running in HVM/PVH mode, the FreeBSD backend
drivers mishandle this: Some errors are ignored, effectively implying
their success from the success of related batch elements. In other
cases, errors resulting from one batch element lead to further batch
elements not being inspected, and hence successful ones to not be
possible to properly unmap upon error recovery.</p>
<h1>Impact:</h1>
<p>A malicious or buggy frontend driver may be able to cause resource
leaks in the domain running the corresponding backend driver.</p>
</body>
</description>
<references>
<cvename>CVE-2021-26932</cvename>
<freebsdsa>SA-21:06.xen</freebsdsa>
</references>
<dates>
<discovery>2021-02-24</discovery>
<entry>2021-02-25</entry>
</dates>
</vuln>
<vuln vid="bba850fd-770e-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- jail_attach(2) relies on the caller to change the cwd</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_4</lt></range>
<range><ge>11.4</ge><lt>11.4_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When a process, such as jexec(8) or killall(1), calls jail_attach(2)
to enter a jail, the jailed root can attach to it using ptrace(2) before
the current working directory is changed.</p>
<h1>Impact:</h1>
<p>A process with superuser privileges running inside a jail could change
the root directory outside of the jail, thereby gaining full read and
writing access to all files and directories in the system.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25582</cvename>
<freebsdsa>SA-21:05.jail_chdir</freebsdsa>
</references>
<dates>
<discovery>2021-02-24</discovery>
<entry>2021-02-25</entry>
</dates>
</vuln>
<vuln vid="a8654f1d-770d-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- login.access fails to apply rules</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.2</ge><lt>12.2_4</lt></range>
<range><ge>11.4</ge><lt>11.4_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A regression in the login.access(5) rule processor has the effect
of causing rules to fail to match even when they should not. This
means that rules denying access may be ignored.</p>
<h1>Impact:</h1>
<p>The configuration in login.access(5) may not be applied, permitting
login access to users even when the system is configured to deny it.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25580</cvename>
<freebsdsa>SA-21:03.pam_login_access</freebsdsa>
</references>
<dates>
<discovery>2021-02-24</discovery>
<entry>2021-02-25</entry>
</dates>
</vuln>
<vuln vid="0e38b8f8-75dd-11eb-83f2-8c164567ca3c">
<topic>redis -- Integer overflow on 32-bit systems</topic>
<affects>
<package>
<name>redis-devel</name>
<range><lt>6.2.0</lt></range>
</package>
<package>
<name>redis</name>
<range><lt>6.0.11</lt></range>
</package>
<package>
<name>redis5</name>
<range><lt>5.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis Development team reports:</p>
<blockquote cite="https://github.com/redis/redis/releases/tag/6.2.0">
<p>Redis 4.0 or newer uses a configurable limit for
the maximum supported bulk input size. By default,
it is 512MB which is a safe value for all platforms.
If the limit is significantly increased, receiving a
large request from a client may trigger several
integer overflow scenarios, which would result with
buffer overflow and heap corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21309</cvename>
</references>
<dates>
<discovery>2021-02-22</discovery>
<entry>2021-02-23</entry>
</dates>
</vuln>
<vuln vid="3e9624b3-e92b-4460-8a5a-93247c52c5a1">
<topic>zeek -- Remote crash vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.13">
<p>Fix ASCII Input reader's treatment of input files
containing null-bytes. An input file containing null-bytes
could lead to a buffer-over-read, crash Zeek, and be
exploited to cause Denial of Service. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v3.0.13</url>
</references>
<dates>
<discovery>2021-02-10</discovery>
<entry>2021-02-22</entry>
</dates>
</vuln>
<vuln vid="9c03845c-7398-11eb-bc0e-2cf05d620ecc">
<topic>raptor2 -- malformed input file can lead to a segfault</topic>
<affects>
<package>
<name>raptor2</name>
<range><lt>2.0.15_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redland Issue Tracker reports:</p>
<blockquote cite="https://bugs.librdf.org/mantis/view.php?id=650">
<p>due to an out of bounds array access in
raptor_xml_writer_start_element_common.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.librdf.org/mantis/view.php?id=650</url>
</references>
<dates>
<discovery>2020-11-24</discovery>
<entry>2021-02-20</entry>
</dates>
</vuln>
<vuln vid="a45d945a-cc2c-4cd7-a941-fb58fdb1b01e">
<topic>jenkins -- Privilege escalation vulnerability in bundled Spring Security library</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.280</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-02-19/">
<h1>Description</h1>
<h5>(high) SECURITY-2195 / CVE-2021-22112</h5>
<p>Privilege escalation vulnerability in bundled Spring Security library</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jenkins.io/security/advisory/2021-02-19/</url>
</references>
<dates>
<discovery>2021-02-19</discovery>
<entry>2021-02-20</entry>
</dates>
</vuln>
<vuln vid="1bb2826b-7229-11eb-8386-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in PJSIP channel driver</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.38.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>Given a scenario where an outgoing call is placed from
Asterisk to a remote SIP server it is possible for a crash
to occur.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26906</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-005.html</url>
</references>
<dates>
<discovery>2021-02-08</discovery>
<entry>2021-02-18</entry>
</dates>
</vuln>
<vuln vid="ca21f5e7-7228-11eb-8386-001999f8d30b">
<topic>asterisk -- An unsuspecting user could crash Asterisk with multiple hold/unhold requests</topic>
<affects>
<package>
<name>asterisk16</name>
<range><ge>16.16.0</ge><lt>16.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>Due to a signedness comparison mismatch, an authenticated
WebRTC client could cause a stack overflow and Asterisk
crash by sending multiple hold/unhold requests in quick
succession.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26714</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-004.html</url>
</references>
<dates>
<discovery>2021-02-11</discovery>
<entry>2021-02-18</entry>
</dates>
</vuln>
<vuln vid="5d8ef725-7228-11eb-8386-001999f8d30b">
<topic>asterisk -- Remote attacker could prematurely tear down SRTP calls</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.38.1</ge><lt>13.38.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><ge>16.16.0</ge><lt>16.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>An unauthenticated remote attacker could replay SRTP
packets which could cause an Asterisk instance configured
without strict RTP validation to tear down calls
prematurely.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26712</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-003.html</url>
</references>
<dates>
<discovery>2021-02-18</discovery>
<entry>2021-02-18</entry>
</dates>
</vuln>
<vuln vid="e3894955-7227-11eb-8386-001999f8d30b">
<topic>asterisk -- Remote crash possible when negotiating T.38</topic>
<affects>
<package>
<name>asterisk16</name>
<range><ge>16.15.0</ge><lt>16.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><ge>18.1.0</ge><lt>18.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>When re-negotiating for T.38 if the initial remote
response was delayed just enough Asterisk would send both
audio and T.38 in the SDP. If this happened, and the
remote responded with a declined T.38 stream then Asterisk
would crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-26717</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-002.html</url>
</references>
<dates>
<discovery>2021-02-05</discovery>
<entry>2021-02-18</entry>
</dates>
</vuln>
<vuln vid="b330db5f-7225-11eb-8386-001999f8d30b">
<topic>asterisk -- Remote crash in res_pjsip_diversion</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.38.1</ge><lt>13.38.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><ge>16.15.1</ge><lt>16.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><ge>18.1.1</ge><lt>18.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If a registered user is tricked into dialing a malicious
number that sends lots of 181 responses to Asterisk, each
one will cause a 181 to be sent back to the original
caller with an increasing number of entries in the
"Supported" header. Eventually the number of entries in
the header exceeds the size of the entry array and causes
a crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35776</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2021-001.html</url>
</references>
<dates>
<discovery>2021-01-04</discovery>
<entry>2021-02-18</entry>
</dates>
</vuln>
<vuln vid="8e670b85-706e-11eb-abb2-08002728f74c">
<topic>Rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activerecord52</name>
<range><lt>5.2.4.5</lt></range>
</package>
<package>
<name>rubygem-actionpack60</name>
<name>rubygem-activerecord60</name>
<range><lt>6.0.3.5</lt></range>
</package>
<package>
<name>rubygem-actionpack61</name>
<name>rubygem-activerecord61</name>
<range><lt>6.1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/">
<p>Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those
version are security releases and addresses two issues:</p>
<p>CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.</p>
<p>CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.</p>
<p/>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129</url>
<url>https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130</url>
<cvename>CVE-2021-22880</cvename>
<cvename>CVE-2021-22881</cvename>
</references>
<dates>
<discovery>2021-02-10</discovery>
<entry>2021-02-17</entry>
</dates>
</vuln>
<vuln vid="48514901-711d-11eb-9846-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>88.0.4324.182</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html">
<p>This release contains 10 security fixes, including:</p>
<ul>
<li>[1138143] High CVE-2021-21149: Stack overflow in Data Transfer.
Reported by Ryoya Tsukasaki on 2020-10-14</li>
<li>[1172192] High CVE-2021-21150: Use after free in Downloads.
Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29</li>
<li>[1165624] High CVE-2021-21151: Use after free in Payments.
Reported by Khalil Zhani on 2021-01-12</li>
<li>[1166504] High CVE-2021-21152: Heap buffer overflow in Media.
Reported by Anonymous on 2021-01-14</li>
<li>[1155974] High CVE-2021-21153: Stack overflow in GPU Process.
Reported by Jan Ruge of ERNW GmbH on 2020-12-06</li>
<li>[1173269] High CVE-2021-21154: Heap buffer overflow in Tab
Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2021-02-01</li>
<li>[1175500] High CVE-2021-21155: Heap buffer overflow in Tab
Strip. Reported by Khalil Zhani on 2021-02-07</li>
<li>[1177341] High CVE-2021-21156: Heap buffer overflow in V8.
Reported by Sergei Glazunov of Google Project Zero on
2021-02-11</li>
<li>[1170657] Medium CVE-2021-21157: Use after free in Web
Sockets. Reported by Anonymous on 2021-01-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21149</cvename>
<cvename>CVE-2021-21150</cvename>
<cvename>CVE-2021-21151</cvename>
<cvename>CVE-2021-21152</cvename>
<cvename>CVE-2021-21153</cvename>
<cvename>CVE-2021-21154</cvename>
<cvename>CVE-2021-21155</cvename>
<cvename>CVE-2021-21156</cvename>
<cvename>CVE-2021-21157</cvename>
<url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html</url>
</references>
<dates>
<discovery>2021-02-16</discovery>
<entry>2021-02-17</entry>
</dates>
</vuln>
<vuln vid="96a21236-707b-11eb-96d8-d4c9ef517024">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.1.1j,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>3.0.0.a12</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.2</ge><lt>12.2_10</lt></range>
<range><ge>11.4</ge><lt>11.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20210216.txt">
<p>Null pointer deref in X509_issuer_and_serial_hash()
CVE-2021-23841<br/>(Moderate) The OpenSSL public API function
X509_issuer_and_serial_hash() attempts to create a unique hash
value based on the issuer and serial number data contained within
an X509 certificate. However it fails to correctly handle any errors
that may occur while parsing the issuer field (which might occur if
the issuer field is maliciously constructed). This may subsequently
result in a NULL pointer deref and a crash leading to a potential
denial of service attack.</p>
<p>Integer overflow in CipherUpdate CVE-2021-23840<br/>(Low)
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
may overflow the output length argument in some cases where the
input length is close to the maximum permissable length for an
integer on the platform. In such cases the return value from the
function call will be 1 (indicating success), but the output length
value will be negative. This could cause applications to behave
incorrectly or crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20210216.txt</url>
<cvename>CVE-2021-23841</cvename>
<cvename>CVE-2021-23840</cvename>
<cvename>CVE-2021-23839</cvename>
<freebsdsa>SA-21:17.openssl</freebsdsa>
</references>
<dates>
<discovery>2021-02-16</discovery>
<entry>2021-02-16</entry>
<modified>2021-08-25</modified>
</dates>
</vuln>
<vuln vid="98044aba-6d72-11eb-aed7-1b1b8a70cc8b">
<topic>openexr, ilmbase -- security fixes related to reading corrupted input files</topic>
<affects>
<package>
<name>ilmbase</name>
<range><lt>2.5.5</lt></range>
</package>
<package>
<name>openexr</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5">
<p>Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files[...].</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5</url>
<!-- updated 2021-05-08 from https://github.com/AcademySoftwareFoundation/openexr/commit/744cdecc87ff3489cc47204411d7903ceeb80be4 -->
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4</url>
<cvename>CVE-2021-20296</cvename>
<cvename>CVE-2021-3479</cvename>
<cvename>CVE-2021-3478</cvename>
<cvename>CVE-2021-3477</cvename>
<cvename>CVE-2021-3476</cvename>
<cvename>CVE-2021-3475</cvename>
<cvename>CVE-2021-3474</cvename>
</references>
<dates>
<discovery>2021-02-12</discovery>
<entry>2021-02-12</entry>
</dates>
</vuln>
<vuln vid="1020d401-6d2d-11eb-ab0b-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.8.0</ge><lt>13.8.4</lt></range>
<range><ge>13.7.0</ge><lt>13.7.7</lt></range>
<range><ge>10.5</ge><lt>13.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/">
<p>Improper Certificate Validation for Fortinet OTP</p>
<p>Denial of Service Attack on gitlab-shell</p>
<p>Resource exhaustion due to pending jobs</p>
<p>Confidential issue titles were exposed</p>
<p>Improper access control allowed demoted project members to access authored merge requests</p>
<p>Improper access control allowed unauthorized users to access analytic pages</p>
<p>Unauthenticated CI lint API may lead to information disclosure and SSRF</p>
<p>Prometheus integration in Gitlab may lead to SSRF</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/</url>
</references>
<dates>
<discovery>2021-02-11</discovery>
<entry>2021-02-12</entry>
</dates>
</vuln>
<vuln vid="3003ba60-6cec-11eb-8815-040e3c1b8a02">
<topic>oauth2-proxy -- domain whitelist could be used as redirect</topic>
<affects>
<package>
<name>oauth2-proxy</name>
<range><lt>7.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-21291">
<p>In OAuth2 Proxy before version 7.0.0, for users that use the
whitelist domain feature, a domain that ended in a similar way to
the intended domain could have been allowed as a redirect.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2021-21291</url>
</references>
<dates>
<discovery>2021-02-02</discovery>
<entry>2021-02-12</entry>
</dates>
</vuln>
<vuln vid="06a5abd4-6bc2-11eb-b292-90e2baa3bafc">
<topic>mod_dav_svn -- server crash</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.9.0</ge><le>1.10.6</le></range>
<range><ge>1.11.0</ge><le>1.14.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="https://subversion.apache.org/security/CVE-2020-17525-advisory.txt">
<p>Subversion's mod_authz_svn module will crash if the server is using
in-repository authz rules with the AuthzSVNReposRelativeAccessFile
option and a client sends a request for a non-existing repository URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://subversion.apache.org/security/CVE-2020-17525-advisory.txt</url>
</references>
<dates>
<discovery>2021-01-29</discovery>
<entry>2021-02-10</entry>
</dates>
</vuln>
<vuln vid="cdb10765-6879-11eb-a7d8-08002734b9ed">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.2:</p>
<blockquote cite="https://blog.gitea.io/2021/02/gitea-1.13.2-is-released/">
<ul>
<li>Prevent panic on fuzzer provided string</li>
<li>Add secure/httpOnly attributes to the lang cookie</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.2</url>
<freebsdpr>ports/253295</freebsdpr>
</references>
<dates>
<discovery>2021-01-07</discovery>
<entry>2021-02-06</entry>
</dates>
</vuln>
<vuln vid="3e01aad2-680e-11eb-83e2-e09467587c17">
<topic>chromium -- heap buffer overflow in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>88.0.4324.150</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html">
<p>[1170176] High CVE-2021-21148: Heap buffer overflow in V8.
Reported by Mattias Buelens on 2021-01-24. Google is aware of
reports that an exploit for CVE-2021-21148 exists in the wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21148</cvename>
<url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html</url>
</references>
<dates>
<discovery>2021-02-04</discovery>
<entry>2021-02-05</entry>
</dates>
</vuln>
<vuln vid="479fdfda-6659-11eb-83e2-e09467587c17">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>88.0.4324.146</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html">
<p>This update include 6 security fixes:</p>
<ul>
<li>1169317] Critical CVE-2021-21142: Use after free in Payments.
Reported by Khalil Zhani on 2021-01-21</li>
<li>[1163504] High CVE-2021-21143: Heap buffer overflow in
Extensions. Reported by Allen Parker and Alex Morgan of MU on
2021-01-06</li>
<li>[1163845] High CVE-2021-21144: Heap buffer overflow in Tab
Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2021-01-07</li>
<li>[1154965] High CVE-2021-21145: Use after free in Fonts. Reported
by Anonymous on 2020-12-03</li>
<li>[1161705] High CVE-2021-21146: Use after free in Navigation.
Reported by Alison Huffman and Choongwoo Han of Microsoft Browser
Vulnerability Research on 2020-12-24</li>
<li>[1162942] Medium CVE-2021-21147: Inappropriate implementation in
Skia. Reported by Roman Starkov on 2021-01-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-21142</cvename>
<cvename>CVE-2021-21143</cvename>
<cvename>CVE-2021-21144</cvename>
<cvename>CVE-2021-21145</cvename>
<cvename>CVE-2021-21146</cvename>
<cvename>CVE-2021-21147</cvename>
<url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-02-02</discovery>
<entry>2021-02-03</entry>
</dates>
</vuln>
<vuln vid="66d1c277-652a-11eb-bb3f-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.8.0</ge><lt>13.8.2</lt></range>
<range><ge>13.7.0</ge><lt>13.7.6</lt></range>
<range><ge>11.8</ge><lt>13.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/">
<p>Stored XSS in merge request</p>
<p>Stored XSS in epic's pages</p>
<p>Sensitive GraphQL variables exposed in structured log</p>
<p>Guest user can see tag names in private projects</p>
<p>Information disclosure via error message</p>
<p>DNS rebinding protection bypass</p>
<p>Validate existence of private project</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/</url>
<cvename>CVE-2021-22172</cvename>
<cvename>CVE-2021-22169</cvename>
</references>
<dates>
<discovery>2021-02-01</discovery>
<entry>2021-02-02</entry>
</dates>
</vuln>
<vuln vid="8ec7d426-055d-46bc-8f5a-a9d73a5a71ab">
<topic>minio -- Server Side Request Forgery</topic>
<affects>
<package>
<name>minio</name>
<range><lt>2021.01.30.00.20.58</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Minio developers report:</p>
<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q">
<p>Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.</p>
<p>All users are advised to upgrade ASAP.</p>
<p>The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).</p>
<p>In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q</url>
</references>
<dates>
<discovery>2021-01-29</discovery>
<entry>2021-01-31</entry>
</dates>
</vuln>
<vuln vid="5d91370b-61fd-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Xen guests can triger backend Out Of Memory</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_3</lt></range>
<range><ge>12.1</ge><lt>12.1_13</lt></range>
<range><ge>11.4</ge><lt>11.4_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Some OSes (including Linux, FreeBSD, and NetBSD) are processing watch
events using a single thread. If the events are received faster than
the thread is able to handle, they will get queued.</p>
<p>As the queue is unbound, a guest may be able to trigger a OOM in
the backend.</p>
</body>
</description>
<references>
<cvename>CVE-2020-29568</cvename>
<freebsdsa>SA-21:02.xenoom</freebsdsa>
</references>
<dates>
<discovery>2021-01-29</discovery>
<entry>2021-01-29</entry>
</dates>
</vuln>
<vuln vid="a9c6e9be-61fb-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Uninitialized kernel stack leaks in several file systems</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_3</lt></range>
<range><ge>12.1</ge><lt>12.1_13</lt></range>
<range><ge>11.4</ge><lt>11.4_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Several file systems were not properly initializing the d_off field
of the dirent structures returned by VOP_READDIR. In particular,
tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so.
As a result, eight uninitialized kernel stack bytes may be leaked to
userspace by these file systems. This problem is not present in
FreeBSD 11.</p>
<p>Additionally, msdosfs(5) was failing to zero-fill a pair of padding
fields in the dirent structure, resulting in a leak of three
uninitialized bytes.</p>
<h1>Impact:</h1>
<p>Kernel stack disclosures may leak sensitive information which could
be used to compromise the security of the system.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25578</cvename>
<cvename>CVE-2020-25579</cvename>
<freebsdsa>SA-21:01.fsdisclosure</freebsdsa>
</references>
<dates>
<discovery>2021-01-29</discovery>
<entry>2021-01-29</entry>
</dates>
</vuln>
<vuln vid="13ca36b8-6141-11eb-8a36-7085c2fb2c14">
<topic>pngcheck -- Buffer-overrun vulnerability</topic>
<affects>
<package>
<name>pngcheck</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libpng project reports:</p>
<blockquote cite="http://www.libpng.org/pub/png/apps/pngcheck.html">
<p>pngcheck versions 3.0.0 and earlier have a pair of buffer-overrun
bugs related to the sPLT and PPLT chunks (the latter is a MNG-only
chunk, but it gets noticed even in PNG files if the -s option is used).
Both bugs are fixed in version 3.0.1, released on 24 January 2021.
Again, while all known vulnerabilities are fixed in this version,
the code is quite crufty, so it would be safest to assume there are
still some problems hidden in there. As always, use at your own risk.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libpng.org/pub/png/apps/pngcheck.html</url>
</references>
<dates>
<discovery>2021-01-24</discovery>
<entry>2021-01-28</entry>
</dates>
</vuln>
<vuln vid="f3cf4b33-6013-11eb-9a0e-206a8a720317">
<topic>sudo -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.9.5p2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/stable.html#1.9.5p2">
<p>When invoked as sudoedit, the same set of command line options
are now accepted as for sudo -e. The -H and -P options are now
rejected for sudoedit and sudo -e which matches the sudo 1.7
behavior. This is part of the fix for CVE-2021-3156.</p>
<p>Fixed a potential buffer overflow when unescaping backslashes in
the command's arguments. Normally, sudo escapes special characters
when running a command via a shell (sudo -s or sudo -i). However,
it was also possible to run sudoedit with the -s or -i flags in
which case no escaping had actually been done, making a buffer
overflow possible. This fixes CVE-2021-3156.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/stable.html#1.9.5p2</url>
<cvename>CVE-2021-3156</cvename>
</references>
<dates>
<discovery>2021-01-26</discovery>
<entry>2021-01-26</entry>
</dates>
</vuln>
<vuln vid="fb67567a-5d95-11eb-a955-08002728f74c">
<topic>pysaml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-pysaml2</name>
<name>py37-pysaml2</name>
<name>py38-pysaml2</name>
<name>py39-pysaml2</name>
<range><lt>6.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pysaml2 Releases:</p>
<blockquote cite="https://github.com/IdentityPython/pysaml2/releases">
<p>Fix processing of invalid SAML XML documents - CVE-2021-21238</p>
<p>Fix unspecified xmlsec1 key-type preference - CVE-2021-21239</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/IdentityPython/pysaml2/releases</url>
<url>https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9</url>
<url>https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62</url>
<cvename>CVE-2021-21238</cvename>
<cvename>CVE-2021-21239</cvename>
</references>
<dates>
<discovery>2021-01-20</discovery>
<entry>2021-01-26</entry>
</dates>
</vuln>
<vuln vid="425f2143-8876-4b0a-af84-e0238c5c2062">
<topic>jenkins -- Arbitrary file read vulnerability in workspace browsers</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.276</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.263.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-01-26/">
<h1>Description</h1>
<h5>(Medium) SECURITY-2197 / CVE-2021-21615</h5>
<p>Arbitrary file read vulnerability in workspace browsers</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jenkins.io/security/advisory/2021-01-26/</url>
</references>
<dates>
<discovery>2021-01-26</discovery>
<entry>2021-01-26</entry>
</dates>
</vuln>
<vuln vid="387bbade-5d1d-11eb-bf20-4437e6ad11c4">
<topic>mutt -- denial of service</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy reports:</p>
<blockquote cite="https://gitlab.com/muttmua/mutt/-/issues/323">
<p>
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a
denial of service (mailbox unavailability) by sending email messages
with sequences of semicolon characters in RFC822 address fields
(aka terminators of empty groups). A small email message from the
attacker can cause large memory consumption, and the victim
may then be unable to see email messages from other persons.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/muttmua/mutt/-/issues/323</url>
<cvename>CVE-2021-3181</cvename>
</references>
<dates>
<discovery>2021-01-17</discovery>
<entry>2021-01-23</entry>
</dates>
</vuln>
<vuln vid="31344707-5d87-11eb-929d-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql56-client</name>
<range><lt>5.6.51</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.33</lt></range>
</package>
<package>
<name>mysql80-client</name>
<range><lt>8.0.23</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.51</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.33</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL">
<p>This Critical Patch Update contains 34 new security patches for
Oracle MySQL Server and 4 for MySQL Client. </p>
<p>The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 6.8.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL</url>
<url>CVE-2021-2046</url>
<url>CVE-2021-2020</url>
<url>CVE-2021-2024</url>
<url>CVE-2021-2011</url>
<url>CVE-2021-2006</url>
<url>CVE-2021-2048</url>
<url>CVE-2021-2028</url>
<url>CVE-2021-2122</url>
<url>CVE-2021-2058</url>
<url>CVE-2021-2001</url>
<url>CVE-2021-2016</url>
<url>CVE-2021-2021</url>
<url>CVE-2021-2030</url>
<url>CVE-2021-2031</url>
<url>CVE-2021-2036</url>
<url>CVE-2021-2055</url>
<url>CVE-2021-2060</url>
<url>CVE-2021-2070</url>
<url>CVE-2021-2076</url>
<url>CVE-2021-2065</url>
<url>CVE-2021-2014</url>
<url>CVE-2021-2002</url>
<url>CVE-2021-2012</url>
<url>CVE-2021-2009</url>
<url>CVE-2021-2072</url>
<url>CVE-2021-2081</url>
<url>CVE-2021-2022</url>
<url>CVE-2021-2038</url>
<url>CVE-2021-2061</url>
<url>CVE-2021-2056</url>
<url>CVE-2021-2087</url>
<url>CVE-2021-2088</url>
<url>CVE-2021-2032</url>
<url>CVE-2021-2010</url>
<url>CVE-2021-1998</url>
<url>CVE-2021-2007</url>
<url>CVE-2021-2019</url>
<url>CVE-2021-2042</url>
</references>
<dates>
<discovery>2021-01-23</discovery>
<entry>2021-01-23</entry>
</dates>
</vuln>
<vuln vid="4ed0e43c-5cef-11eb-bafd-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>88.0.4324.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html">
<p>This release contains 36 security fixes, including:</p>
<ul>
<li>[1137179] Critical CVE-2021-21117: Insufficient policy
enforcement in Cryptohome. Reported by Rory McNamara on
2020-10-10</li>
<li>[1161357] High CVE-2021-21118: Insufficient data validation in
V8. Reported by Tyler Nighswander (@tylerni7) of Theori on
2020-12-23</li>
<li>[1160534] High CVE-2021-21119: Use after free in Media. Reported
by Anonymous on 2020-12-20</li>
<li>[1160602] High CVE-2021-21120: Use after free in WebSQL.
Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha
Lab on 2020-12-21</li>
<li>[1161143] High CVE-2021-21121: Use after free in Omnibox.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2020-12-22</li>
<li>[1162131] High CVE-2021-21122: Use after free in Blink. Reported
by Renata Hodovan on 2020-12-28</li>
<li>[1137247] High CVE-2021-21123: Insufficient data validation in
File System API. Reported by Maciej Pulikowski on 2020-10-11</li>
<li>[1131346] High CVE-2021-21124: Potential user after free in
Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from
Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23</li>
<li>[1152327] High CVE-2021-21125: Insufficient policy enforcement
in File System API. Reported by Ron Masas (Imperva) on
2020-11-24</li>
<li>[1163228] High CVE-2020-16044: Use after free in WebRTC.
Reported by Ned Williamson of Project Zero on 2021-01-05</li>
<li>[1108126] Medium CVE-2021-21126: Insufficient policy enforcement
in extensions. Reported by David Erceg on 2020-07-22</li>
<li>[1115590] Medium CVE-2021-21127: Insufficient policy enforcement
in extensions. Reported by Jasminder Pal Singh, Web Services Point
WSP, Kotkapura on 2020-08-12</li>
<li>[1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink.
Reported by Liang Dong on 2020-10-15</li>
<li>[1140403] Medium CVE-2021-21129: Insufficient policy enforcement
in File System API. Reported by Maciej Pulikowski on
2020-10-20</li>
<li>[1140410] Medium CVE-2021-21130: Insufficient policy enforcement
in File System API. Reported by Maciej Pulikowski on
2020-10-20</li>
<li>[1140417] Medium CVE-2021-21131: Insufficient policy enforcement
in File System API. Reported by Maciej Pulikowski on
2020-10-20</li>
<li>[1128206] Medium CVE-2021-21132: Inappropriate implementation in
DevTools. Reported by David Erceg on 2020-09-15</li>
<li>[1157743] Medium CVE-2021-21133: Insufficient policy enforcement
in Downloads. Reported by wester0x01
(https://twitter.com/wester0x01) on 2020-12-11</li>
<li>[1157800] Medium CVE-2021-21134: Incorrect security UI in Page
Info. Reported by wester0x01 (https://twitter.com/wester0x01) on
2020-12-11</li>
<li>[1157818] Medium CVE-2021-21135: Inappropriate implementation in
Performance API. Reported by ndevtk on 2020-12-11</li>
<li>[1038002] Low CVE-2021-21136: Insufficient policy enforcement in
WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad
Mohammed on 2019-12-27</li>
<li>[1093791] Low CVE-2021-21137: Inappropriate implementation in
DevTools. Reported by bobblybear on 2020-06-11</li>
<li>[1122487] Low CVE-2021-21138: Use after free in DevTools.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
at Qi'anxin Group on 2020-08-27</li>
<li>[1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported
by David Manouchehri on 2020-10-08</li>
<li>[1140435] Low CVE-2021-21141: Insufficient policy enforcement in
File System API. Reported by Maciej Pulikowski on 2020-10-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-16044</cvename>
<cvename>CVE-2021-21117</cvename>
<cvename>CVE-2021-21118</cvename>
<cvename>CVE-2021-21119</cvename>
<cvename>CVE-2021-21120</cvename>
<cvename>CVE-2021-21121</cvename>
<cvename>CVE-2021-21122</cvename>
<cvename>CVE-2021-21123</cvename>
<cvename>CVE-2021-21124</cvename>
<cvename>CVE-2021-21125</cvename>
<cvename>CVE-2021-21126</cvename>
<cvename>CVE-2021-21127</cvename>
<cvename>CVE-2021-21128</cvename>
<cvename>CVE-2021-21129</cvename>
<cvename>CVE-2021-21130</cvename>
<cvename>CVE-2021-21131</cvename>
<cvename>CVE-2021-21132</cvename>
<cvename>CVE-2021-21133</cvename>
<cvename>CVE-2021-21134</cvename>
<cvename>CVE-2021-21135</cvename>
<cvename>CVE-2021-21136</cvename>
<cvename>CVE-2021-21137</cvename>
<cvename>CVE-2021-21138</cvename>
<cvename>CVE-2021-21139</cvename>
<cvename>CVE-2021-21140</cvename>
<cvename>CVE-2021-21141</cvename>
<url>https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2021-01-19</discovery>
<entry>2021-01-22</entry>
</dates>
</vuln>
<vuln vid="35aef72c-5c8e-11eb-8309-4ccc6adda413">
<topic>chocolate-doom -- Arbitrary code execution</topic>
<affects>
<package>
<name>chocolate-doom</name>
<range><lt>3.0.1</lt></range>
</package>
<package>
<name>crispy-doom</name>
<range><lt>5.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Dardas from LogicalTrust reports:</p>
<blockquote cite="https://github.com/chocolate-doom/chocolate-doom/issues/1293">
<p>
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate
the user-controlled num_players value, leading to a buffer overflow. A
malicious user can overwrite the server's stack.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/chocolate-doom/chocolate-doom/issues/1293</url>
<cvename>CVE-2020-14983</cvename>
</references>
<dates>
<discovery>2020-06-22</discovery>
<entry>2021-01-22</entry>
</dates>
</vuln>
<vuln vid="13c54e6d-5c45-11eb-b4e2-001b217b3468">
<topic>nokogiri -- Security vulnerability</topic>
<affects>
<package>
<name>rubygem-nokogiri</name>
<name>rubygem-nokogiri18</name>
<range><lt>1.11.0.rc3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nokogiri reports:</p>
<blockquote cite="https://nokogiri.org/CHANGELOG.html">
<p>In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nokogiri.org/CHANGELOG.html</url>
<cvename>CVE-2020-26247</cvename>
</references>
<dates>
<discovery>2021-01-22</discovery>
<entry>2021-01-22</entry>
</dates>
</vuln>
<vuln vid="5b5cf6e5-5b51-11eb-95ac-7f9491278677">
<topic>dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.83</lt></range>
</package>
<package> <!-- not currently active, but in case that someone had a stale package -->
<name>dnsmasq-devel</name>
<range><lt>2.83</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html">
<p>
There are broadly two sets of problems. The first is subtle errors
in dnsmasq's protections against the chronic weakness of the DNS
protocol to cache-poisoning attacks; the Birthday attack, Kaminsky,
etc.[...]
</p>
<p>
the second set of errors is a good old fashioned buffer overflow in
dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an
installation is at risk.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html</url>
<url>https://www.jsof-tech.com/disclosures/dnspooq/</url>
<cvename>CVE-2020-25684</cvename>
<cvename>CVE-2020-25685</cvename>
<cvename>CVE-2020-25686</cvename>
<cvename>CVE-2020-25681</cvename>
<cvename>CVE-2020-25682</cvename>
<cvename>CVE-2020-25683</cvename>
<cvename>CVE-2020-25687</cvename>
</references>
<dates>
<discovery>2020-09-16</discovery> <!-- CVE creation date, vuln apparently known since August to JSOF? -->
<entry>2021-01-20</entry>
</dates>
</vuln>
<vuln vid="6a4805d5-5aaf-11eb-a21d-79f5bc5ef6a9">
<topic>go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.15.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/43783">
<p>The go command may execute arbitrary code at build time when cgo is
in use on Windows. This may occur when running "go get", or
any other command that builds code. Only users who build untrusted
code (and don't execute it) are affected. In addition to Windows
users, this can also affect Unix users who have "." listed
explicitly in their PATH and are running "go get" or build
commands outside of a module or with module mode disabled.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/43786">
<p>The P224() Curve implementation can in rare circumstances generate
incorrect outputs, including returning invalid points from
ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not
crypto/tls) packages support P-224 ECDSA keys, but they are not
supported by publicly trusted certificate authorities. No other
standard library or golang.org/x/crypto package supports or uses the
P-224 curve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2021-3115</cvename>
<url>http://golang.org/issue/43783</url>
<cvename>CVE-2021-3114</cvename>
<url>http://golang.org/issue/43786</url>
</references>
<dates>
<discovery>2021-01-13</discovery>
<entry>2021-01-19</entry>
</dates>
</vuln>
<vuln vid="8899298f-5a92-11eb-8558-3085a9a47796">
<topic>cloud-init -- Wrong access permissions of authorized keys</topic>
<affects>
<package>
<name>cloud-init</name>
<range><ge>20.4</ge><lt>20.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cloud-init reports:</p>
<blockquote cite="https://bugs.launchpad.net/cloud-init/+bug/1911680">
<p>cloud-init release 20.4.1 is now available. This is a hotfix
release, that contains a single patch to address a security issue in
cloud-init 20.4.</p>
<p>Briefly, for users who provide more than one unique SSH key to
cloud-init and have a shared AuthorizedKeysFile configured in
sshd_config, cloud-init 20.4 started writing all of these keys to such a
file, granting all such keys SSH access as root.</p>
<p>It's worth restating this implication: if you are using the default
AuthorizedKeysFile setting in /etc/ssh/sshd_config, as most will be,
then you are _not_ affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/cloud-init/+bug/1911680</url>
</references>
<dates>
<discovery>2021-01-14</discovery>
<entry>2021-01-19</entry>
</dates>
</vuln>
<vuln vid="abed4ff0-7da1-4236-880d-de33e4895315">
<topic>moinmoin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin reports:</p>
<blockquote cite="https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13">
<ul>
<li><p>Security fix for CVE-2020-25074: fix remote code execution via cache action</p></li>
<li><p>Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13</url>
<cvename>CVE-2020-25074</cvename>
<cvename>CVE-2020-15275</cvename>
</references>
<dates>
<discovery>2020-11-08</discovery>
<entry>2021-01-18</entry>
</dates>
</vuln>
<vuln vid="62642942-590f-11eb-a0dc-8c164582fbac">
<topic>Ghostscript -- SAFER Sandbox Breakout</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<range><ge>9.50</ge><lt>9.52_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-15900">
<p>A memory corruption issue was found in Artifex
Ghostscript 9.50 and 9.52. Use of a non-standard
PostScript operator can allow overriding of file access
controls. The 'rsearch' calculation for the 'post' size
resulted in a size that was too large, and could underflow
to max uint32_t. This was fixed in commit
5d499272b95a6b890a1397e11d20937de000d31b.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-15900</url>
</references>
<dates>
<discovery>2020-07-28</discovery>
<entry>2021-01-17</entry>
</dates>
</vuln>
<vuln vid="08b553ed-537a-11eb-be6e-0022489ad614">
<topic>Node.js -- January 2021 Security Releases</topic>
<affects>
<package>
<name>node10</name>
<range><lt>10.23.1</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.20.1</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.15.4</lt></range>
</package>
<package>
<name>node</name>
<range><lt>15.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/">
<h1>use-after-free in TLSWrap (High) (CVE-2020-8265)</h1>
<p>Affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.</p>
<h1>HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)</h1>
<p>Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.</p>
<h1>OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)</h1>
<p>iThis is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/</url>
<url>https://www.openssl.org/news/secadv/20201208.txt</url>
<cvename>CVE-2020-8265</cvename>
<cvename>CVE-2020-8287</cvename>
<cvename>CVE-2020-1971</cvename>
</references>
<dates>
<discovery>2021-01-04</discovery>
<entry>2021-01-14</entry>
</dates>
</vuln>
<vuln vid="0a8ebf4a-5660-11eb-b4e2-001b217b3468">
<topic>Gitlab -- vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.7.0</ge><lt>13.7.4</lt></range>
<range><ge>13.6.0</ge><lt>13.6.5</lt></range>
<range><ge>12.2</ge><lt>13.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/">
<p>Ability to steal a user's API access token through GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/</url>
</references>
<dates>
<discovery>2021-01-14</discovery>
<entry>2021-01-14</entry>
</dates>
</vuln>
<vuln vid="6d554d6e-5638-11eb-9d36-5404a68ad561">
<topic>wavpack -- integer overflow in pack_utils.c</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The wavpack project reports:</p>
<blockquote cite="https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog">
<p>src/pack_utils.c
- issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738)
- sanitize configuration parameters better (improves clarity and aids debugging)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog</url>
<cvename>CVE-2020-35738</cvename>
</references>
<dates>
<discovery>2020-12-29</discovery>
<entry>2021-01-14</entry>
</dates>
</vuln>
<vuln vid="d6f76976-e86d-4f9a-9362-76c849b10db2">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.275</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.263.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2021-01-13/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1452 / CVE-2021-21602</h5>
<p>Arbitrary file read vulnerability in workspace browsers</p>
<h5>(High) SECURITY-1889 / CVE-2021-21603</h5>
<p>XSS vulnerability in notification bar</p>
<h5>(High) SECURITY-1923 / CVE-2021-21604</h5>
<p>Improper handling of REST API XML deserialization errors</p>
<h5>(High) SECURITY-2021 / CVE-2021-21605</h5>
<p>Path traversal vulnerability in agent names</p>
<h5>(Medium) SECURITY-2023 / CVE-2021-21606</h5>
<p>Arbitrary file existence check in file fingerprints</p>
<h5>(Medium) SECURITY-2025 / CVE-2021-21607</h5>
<p>Excessive memory allocation in graph URLs leads to denial of service</p>
<h5>(High) SECURITY-2035 / CVE-2021-21608</h5>
<p>Stored XSS vulnerability in button labels</p>
<h5>(Low) SECURITY-2047 / CVE-2021-21609</h5>
<p>Missing permission check for paths with specific prefix</p>
<h5>(High) SECURITY-2153 / CVE-2021-21610</h5>
<p>Reflected XSS vulnerability in markup formatter preview</p>
<h5>(High) SECURITY-2171 / CVE-2021-21611</h5>
<p>Stored XSS vulnerability on new item page</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jenkins.io/security/advisory/2021-01-13/</url>
</references>
<dates>
<discovery>2021-01-13</discovery>
<entry>2021-01-13</entry>
</dates>
</vuln>
<vuln vid="1f655433-551b-11eb-9cda-589cfc0f81b0">
<topic>phpmyfaq -- XSS vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><le>3.0.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.phpmyfaq.de/security/advisory-2020-12-23">
<p> phpMyFAQ does not implement sufficient checks to avoid XSS
injection for displaying tags. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyfaq.de/security/advisory-2020-12-23</url>
</references>
<dates>
<discovery>2020-12-23</discovery>
<entry>2021-01-12</entry>
</dates>
</vuln>
<vuln vid="6193b3f6-548c-11eb-ba01-206a8a720317">
<topic>sudo -- Potential information leak in sudoedit</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/stable.html#1.9.5">
<p>A potential information leak in sudoedit that could be used to
test for the existence of directories not normally accessible to
the user in certain circumstances. When creating a new file,
sudoedit checks to make sure the parent directory of the new file
exists before running the editor. However, a race condition exists
if the invoking user can replace (or create) the parent directory.
If a symbolic link is created in place of the parent directory,
sudoedit will run the editor as long as the target of the link
exists.If the target of the link does not exist, an error message
will be displayed. The race condition can be used to test for the
existence of an arbitrary directory. However, it _cannot_ be used
to write to an arbitrary location.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/stable.html#1.9.5</url>
<cvename>CVE-2021-23239</cvename>
</references>
<dates>
<discovery>2021-01-11</discovery>
<entry>2021-01-11</entry>
</dates>
</vuln>
<vuln vid="a3cef1e6-51d8-11eb-9b8d-08002728f74c">
<topic>CairoSVG -- Regular Expression Denial of Service vulnerability</topic>
<affects>
<package>
<name>py36-cairosvg</name>
<name>py37-cairosvg</name>
<name>py38-cairosvg</name>
<name>py39-cairosvg</name>
<range><ge>2.0.0</ge><lt>2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CairoSVG security advisories:</p>
<blockquote cite="https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf">
<p>When processing SVG files, the python package CairoSVG uses two regular
expressions which are vulnerable to Regular Expression Denial of Service
(REDoS).</p>
<p>If an attacker provides a malicious SVG, it can make cairosvg get stuck
processing the file for a very long time.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf</url>
</references>
<dates>
<discovery>2020-12-30</discovery>
<entry>2021-01-10</entry>
</dates>
</vuln>
<vuln vid="a2a2b34d-52b4-11eb-87cb-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.7.0</ge><lt>13.7.2</lt></range>
<range><ge>13.6.0</ge><lt>13.6.4</lt></range>
<range><ge>12.2</ge><lt>13.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/">
<p>Ability to steal a user's API access token through GitLab Pages</p>
<p>Prometheus denial of service via HTTP request with custom method</p>
<p>Unauthorized user is able to access private repository information under specific conditions</p>
<p>Regular expression denial of service in NuGet API</p>
<p>Regular expression denial of service in package uploads</p>
<p>Update curl dependency</p>
<p>CVE-2019-3881 mitigation</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/</url>
<cvename>CVE-2021-22166</cvename>
<cvename>CVE-2020-26414</cvename>
<cvename>CVE-2019-3881</cvename>
</references>
<dates>
<discovery>2021-01-07</discovery>
<entry>2021-01-09</entry>
</dates>
</vuln>
<vuln vid="d153c4d2-50f8-11eb-8046-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>87.0.4280.141</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html">
<p>This release includes 16 security fixes, including:</p>
<ul>
<li>[1148749] High CVE-2021-21106: Use after free in autofill.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of
Legendsec at Qi'anxin Group on 2020-11-13</li>
<li>[1153595] High CVE-2021-21107: Use after free in drag and
drop. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2020-11-30</li>
<li>[1155426] High CVE-2021-21108: Use after free in media.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2020-12-04</li>
<li>[1152334] High CVE-2021-21109: Use after free in payments.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
2020-11-24</li>
<li>[1152451] High CVE-2021-21110: Use after free in safe
browsing. Reported by Anonymous on 2020-11-24</li>
<li>[1149125] High CVE-2021-21111: Insufficient policy enforcement
in WebUI. Reported by Alesandro Ortiz on 2020-11-15</li>
<li>[1151298] High CVE-2021-21112: Use after free in Blink.
Reported by YoungJoo Lee(@ashuu_lee) of Raon Whitehat on
2020-11-20</li>
<li>[1155178] High CVE-2021-21113: Heap buffer overflow in Skia.
Reported by tsubmunu on 2020-12-03</li>
<li>[1148309] High CVE-2020-16043: Insufficient data validation in
networking. Reported by Samy Kamkar, Ben Seri at Armis, Gregory
Vishnepolsky at Armis on 2020-11-12</li>
<li>[1150065] High CVE-2021-21114: Use after free in audio.
Reported by Man Yue Mo of GitHub Security Lab on 2020-11-17</li>
<li>[1157790] High CVE-2020-15995: Out of bounds write in V8.
Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu
Lab on 2020-12-11</li>
<li>[1157814] High CVE-2021-21115: Use after free in safe browsing.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on
2020-12-11</li>
<li>[1151069] Medium CVE-2021-21116: Heap buffer overflow in audio.
Reported by Alison Huffman, Microsoft Browser Vulnerability
Research on 2020-11-19</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15995</cvename>
<cvename>CVE-2020-16043</cvename>
<cvename>CVE-2021-21106</cvename>
<cvename>CVE-2021-21107</cvename>
<cvename>CVE-2021-21108</cvename>
<cvename>CVE-2021-21109</cvename>
<cvename>CVE-2021-21110</cvename>
<cvename>CVE-2021-21111</cvename>
<cvename>CVE-2021-21112</cvename>
<cvename>CVE-2021-21113</cvename>
<cvename>CVE-2021-21114</cvename>
<cvename>CVE-2021-21115</cvename>
<cvename>CVE-2021-21116</cvename>
<url>https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2021-01-06</discovery>
<entry>2021-01-07</entry>
</dates>
</vuln>
<vuln vid="bd98066d-4ea4-11eb-b412-e86a64caca56">
<topic>mail/dovecot -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html">
<p>When imap hibernation is active, an attacker can cause Dovecot to
discover file system directory structure and access other users'
emails using specially crafted command.
The attacker must have valid credentials to access the
mail server.</p>
</blockquote>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html">
<p>Mail delivery / parsing crashed when the 10 000th MIME part was
message/rfc822 (or if parent was multipart/digest). This happened
due to earlier MIME parsing changes for CVE-2020-12100.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2021-January/000448.html</url>
<cvename>CVE-2020-24386</cvename>
<cvename>CVE-2020-25275</cvename>
</references>
<dates>
<discovery>2020-08-17</discovery>
<entry>2021-01-04</entry>
</dates>
</vuln>
<vuln vid="2739b88b-4b88-11eb-a4c0-08002734b9ed">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.1:</p>
<blockquote cite="https://blog.gitea.io/2020/12/gitea-1.13.1-is-released/">
<ul>
<li>Hide private participation in Orgs</li>
<li>Fix escaping issue in diff</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.1</url>
<freebsdpr>ports/252310</freebsdpr>
</references>
<dates>
<discovery>2020-12-15</discovery>
<entry>2020-12-31</entry>
</dates>
</vuln>
<vuln vid="53e9efa1-4be7-11eb-8558-3085a9a47796">
<topic>InspIRCd websocket module double free vulnerability</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>3.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The InspIRCd development team reports:</p>
<blockquote cite="https://docs.inspircd.org/security/2020-02/">
<p>The websocket module before v3.8.1 contains a double free
vulnerability. When combined with a HTTP reverse proxy this
vulnerability can be used by any user who is [GKZ]-lined to remotely
crash an InspIRCd server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.inspircd.org/security/2020-02/</url>
</references>
<dates>
<discovery>2020-02-01</discovery>
<entry>2021-01-01</entry>
</dates>
</vuln>
<vuln vid="fbcba194-ac7d-11ea-8b5e-b42e99a1b9c3">
<topic>Intel CPU issues</topic>
<affects>
<package>
<name>devcpu-data</name>
<range><lt>1.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00320.html">
<p>Intel CPUs suffer Special Register Buffer Data Sampling vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://software.intel.com/security-software-guidance/insights/processors-affected-special-register-buffer-data-sampling</url>
<cvename>CVE-2020-0543</cvename>
</references>
<dates>
<discovery>2020-06-09</discovery>
<entry>2020-12-28</entry>
</dates>
</vuln>
<vuln vid="6adf6ce0-44a6-11eb-95b7-001999f8d30b">
<topic>asterisk -- Remote crash in res_pjsip_diversion</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.38.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.15.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>AST-2020-003: A crash can occur in Asterisk when a SIP
message is received that has a History-Info header, which
contains a tel-uri.</p>
<p>AST-2020-004: A crash can occur in Asterisk when a SIP
181 response is received that has a Diversion header,
which contains a tel-uri.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2020-003.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2020-004.html</url>
</references>
<dates>
<discovery>2020-12-02</discovery>
<entry>2020-12-22</entry>
</dates>
</vuln>
<vuln vid="eb2845c4-43ce-11eb-aba5-00a09858faf5">
<topic>postsrsd -- Denial of service vulnerability</topic>
<affects>
<package>
<name>postsrsd</name>
<range><lt>1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>postsrsd developer reports:</p>
<blockquote cite="https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac">
<p>PostSRSd could be tricked into consuming a lot of CPU time with
an SRS address that has an excessively long time stamp tag.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35573</cvename>
<url>https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac</url>
<url>https://github.com/roehling/postsrsd/releases/tag/1.10</url>
</references>
<dates>
<discovery>2020-12-12</discovery>
<entry>2020-12-21</entry>
</dates>
</vuln>
<vuln vid="61d89849-43cb-11eb-aba5-00a09858faf5">
<topic>powerdns -- Various issues in GSS-TSIG support</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS developers report:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html">
<p>A remote, unauthenticated attacker can trigger a race condition
leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature.</p>
<p>A remote, unauthenticated attacker can cause a denial of service by
sending crafted queries with a GSS-TSIG signature.</p>
<p>A remote, unauthenticated attacker might be able to cause a double-free,
leading to a crash or possibly arbitrary code execution by sending crafted queries with a GSS-TSIG signature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-24696</cvename>
<cvename>CVE-2020-24697</cvename>
<cvename>CVE-2020-24698</cvename>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html</url>
</references>
<dates>
<discovery>2020-08-27</discovery>
<entry>2020-12-21</entry>
</dates>
</vuln>
<vuln vid="cc1fd3da-b8fd-4f4d-a092-c38541c0f993">
<topic>vault -- User Enumeration via LDAP auth</topic>
<affects>
<package>
<name>vault</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vault developers report:</p>
<blockquote cite="https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984">
<p>Vault allowed enumeration of users via the LDAP auth method. This vulnerability, was fixed in Vault 1.6.1 and 1.5.6.</p>
<p>An external party reported that they were able to enumerate LDAP users via error messages returned by Vault’s LDAP auth method</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-35177</cvename>
<url>https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984</url>
</references>
<dates>
<discovery>2020-12-16</discovery>
<entry>2020-12-17</entry>
</dates>
</vuln>
<vuln vid="85349584-3ba4-11eb-919d-08002728f74c">
<topic>jasper -- heap overflow vulnerability</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>2.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JasPer NEWS:</p>
<blockquote cite="https://github.com/jasper-software/jasper/blob/master/NEWS">
<p>Fix CVE-2020-27828, heap-overflow in cp_create() in jpc_enc.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-27828</cvename>
<url>https://github.com/jasper-software/jasper/blob/master/NEWS</url>
<url>https://github.com/jasper-software/jasper/issues/252</url>
</references>
<dates>
<discovery>2020-12-08</discovery>
<entry>2020-12-13</entry>
</dates>
</vuln>
<vuln vid="cfa0be42-3cd7-11eb-9de7-641c67a117d8">
<topic>py-matrix-synapse -- DoS on Federation API</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<range><lt>1.23.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers reports:</p>
<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm">
<p>A malicious or poorly-implemented homeserver can inject malformed events
into a room by specifying a different room id in the path of a /send_join,
/send_leave, /invite or /exchange_third_party_invite request.
This can lead to a denial of service in which future events will not be
correctly sent to other servers over federation.
This affects any server which accepts federation requests from untrusted
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-26257</cvename>
<url>https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm</url>
<freebsdpr>ports/251768</freebsdpr>
</references>
<dates>
<discovery>2020-12-09</discovery>
<entry>2020-12-13</entry>
</dates>
</vuln>
<vuln vid="fdc49972-3ca7-11eb-929d-d4c9ef517024">
<topic>p11-kit -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>p11-kit</name>
<range><lt>0.23.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The p11-glue project reports:</p>
<blockquote cite="https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html">
<p>CVE-2020-29363: Out-of-bounds write in
p11_rpc_buffer_get_byte_array_value function<br/>A heap-based buffer
overflow has been discovered in the RPC protocol used by p11-kit
server/remote commands and the client library. When the remote
entity supplies a serialized byte array in a CK_ATTRIBUTE, the
receiving entity may not allocate sufficient length for the buffer
to store the deserialized value.</p>
<p>CVE-2020-29362: Out-of-bounds read in p11_rpc_buffer_get_byte_array
function<br/>A heap-based buffer over-read has been discovered in
the RPC protocol used by thep11-kit server/remote commands and the
client library. When the remote entity supplies a byte array through
a serialized PKCS#11 function call, the receiving entity may allow
the reading of up to 4 bytes of memory past the heap
allocation.</p>
<p>CVE-2020-29361: Integer overflow when allocating memory for arrays
of attributes and object identifiers<br/>Multiple integer overflows
have been discovered in the array allocations in the p11-kit library
and the p11-kit list command, where overflow checks are missing
before calling realloc or calloc.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html</url>
<cvename>CVE-2020-29361</cvename>
<cvename>CVE-2020-29362</cvename>
<cvename>CVE-2020-29363</cvename>
</references>
<dates>
<discovery>2020-12-12</discovery>
<entry>2020-12-12</entry>
</dates>
</vuln>
<vuln vid="388ebb5b-3c95-11eb-929d-d4c9ef517024">
<topic>Unbound/NSD -- Denial of service vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.13.0</lt></range>
</package>
<package>
<name>nsd</name>
<range><lt>4.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLNetLabs reports:</p>
<blockquote cite="https://nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt">
<p>Unbound and NSD when writing the PID file would not check if an
existing file was a symlink. This could allow for a local symlink \
attack if an attacker has access to the user Unbound/NSD runs as.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt</url>
<cvename>CVE-2020-28935</cvename>
</references>
<dates>
<discovery>2020-12-01</discovery>
<entry>2020-12-12</entry>
</dates>
</vuln>
<vuln vid="88dfd92f-3b9c-11eb-929d-d4c9ef517024">
<topic>LibreSSL -- NULL pointer dereference</topic>
<affects>
<package>
<name>libressl</name>
<range><gt>3.2.0</gt><lt>3.2.3</lt></range>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The LibreSSL project reports:</p>
<blockquote cite="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt">
<p>Malformed ASN.1 in a certificate revocation list or a timestamp
response token can lead to a NULL pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt</url>
</references>
<dates>
<discovery>2020-12-08</discovery>
<entry>2020-12-11</entry>
<modified>2020-12-12</modified>
</dates>
</vuln>
<vuln vid="b3695b08-3b3a-11eb-af2a-080027dbe4b7">
<topic>glpi -- Public GLPIKEY can be used to decrypt any data</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5248">
<p>GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9</url>
<url>https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c</url>
<cvename>CVE-2020-5248</cvename>
</references>
<dates>
<discovery>2020-01-02</discovery>
<entry>2020-01-02</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="695b2310-3b3a-11eb-af2a-080027dbe4b7">
<topic>glpi -- Insecure Direct Object Reference on ajax/getDropdownValue.php</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27663">
<p>In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4</url>
<cvename>CVE-2020-27663</cvename>
</references>
<dates>
<discovery>2020-10-22</discovery>
<entry>2020-10-22</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="190176ce-3b3a-11eb-af2a-080027dbe4b7">
<topic>glpi -- Insecure Direct Object Reference on ajax/comments.ph</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27662">
<p>In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p</url>
<cvename>CVE-2020-27662</cvename>
</references>
<dates>
<discovery>2020-10-22</discovery>
<entry>2020-10-22</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="6a467439-3b38-11eb-af2a-080027dbe4b7">
<topic>glpi -- Any CalDAV calendars is read-only for every authenticated user</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>9.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26212">
<p>In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx</url>
<url>https://github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7</url>
<url>https://github.com/glpi-project/glpi/releases/tag/9.5.3</url>
<cvename>CVE-2020-26212</cvename>
</references>
<dates>
<discovery>2020-10-01</discovery>
<entry>2020-10-01</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="0ba61fcc-3b38-11eb-af2a-080027dbe4b7">
<topic>glpi -- SQL Injection in Search API</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.1,1</ge><lt>9.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15226">
<p>In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0</url>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc</url>
<cvename>CVE-2020-15226</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="5acd95db-3b16-11eb-af2a-080027dbe4b7">
<topic>glpi -- leakage issue with knowledge base</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>9.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15217">
<p>In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2</url>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-x9hg-j29f-wvvv</url>
<cvename>CVE-2020-15217</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="09eef008-3b16-11eb-af2a-080027dbe4b7">
<topic>glpi -- Unauthenticated Stored XSS</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15177">
<p>In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796</url>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-prvh-9m4h-4m79</url>
<cvename>CVE-2020-15177</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="b7abdb0f-3b15-11eb-af2a-080027dbe4b7">
<topic>glpi -- Multiple SQL Injections Stemming From isNameQuoted()</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15176">
<p>In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575</url>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw</url>
<cvename>CVE-2020-15176</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="675e5098-3b15-11eb-af2a-080027dbe4b7">
<topic>glpi -- Unauthenticated File Deletion</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15175">
<p>In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in /files/. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp</url>
<url>https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65</url>
<cvename>CVE-2020-15175</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="7f163c81-3b12-11eb-af2a-080027dbe4b7">
<topic>glpi -- SQL injection for all usages of "Clone" feature</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.5.0,1</ge><lt>9.5.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15108">
<p>In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v</url>
<url>https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba</url>
<url>https://github.com/glpi-project/glpi/pull/6684</url>
<cvename>CVE-2020-15108</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-06-25</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="07aecafa-3b12-11eb-af2a-080027dbe4b7">
<topic>glpi -- Reflexive XSS in Dropdown menus</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11062">
<p>In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h</url>
<url>https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf</url>
<cvename>CVE-2020-11062</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="832fd11b-3b11-11eb-af2a-080027dbe4b7">
<topic>glpi -- Remote Code Execution (RCE) via the backup functionality</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11060">
<p>In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f</url>
<url>https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c</url>
<cvename>CVE-2020-11060</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="27a230a2-3b11-11eb-af2a-080027dbe4b7">
<topic>glpi -- multiple related stored XSS vulnerabilities</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11036">
<p>In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert(1)" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
<cvename>CVE-2020-11036</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="b64edef7-3b10-11eb-af2a-080027dbe4b7">
<topic>glpi -- weak csrf tokens</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>0.83.3,1</ge><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11035">
<p>In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
<cvename>CVE-2020-11035</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="3a63f478-3b10-11eb-af2a-080027dbe4b7">
<topic>glpi -- bypass of the open redirect protection</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11034">
<p>In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
<cvename>CVE-2020-11034</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="aec9cbe0-3b0f-11eb-af2a-080027dbe4b7">
<topic>glpi -- able to read any token through API user endpoint</topic>
<affects>
<package>
<name>glpi</name>
<range><ge>9.1,1</ge><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11033">
<p>In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
<cvename>CVE-2020-11033</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="b3aae7ea-3aef-11eb-af2a-080027dbe4b7">
<topic>glpi -- SQL injection for all helpdesk instances</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11032">
<p>In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh</url>
<cvename>CVE-2020-11032</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="0309c898-3aed-11eb-af2a-080027dbe4b7">
<topic>glpi -- Improve encryption algorithm</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.5.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11031">
<p>In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh</url>
<url>https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780</url>
<url>https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780</url>
<cvename>CVE-2020-11031</cvename>
</references>
<dates>
<discovery>2020-03-30</discovery>
<entry>2020-03-30</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="d3f60db0-3aea-11eb-af2a-080027dbe4b7">
<topic>glpi -- Account takeover vulnerability</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666">
<p>GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666</url>
<url>https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q</url>
<url>https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt</url>
<cvename>CVE-2019-14666</cvename>
</references>
<dates>
<discovery>2019-08-05</discovery>
<entry>2019-08-05</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="3c77f139-3a09-11eb-929d-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><gt>4.0</gt><lt>7.74.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.se/docs/security.html">
<p>Trusting FTP PASV responses (CVE-2020-8284)</p>
<p>FTP wildcard stack overflow (CVE-2020-8285)</p>
<p>Inferior OCSP verification (CVE-2020-8286)</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.se/docs/security.html</url>
<cvename>CVE-2020-8284</cvename>
<cvename>CVE-2020-8285</cvename>
<cvename>CVE-2020-8286</cvename>
</references>
<dates>
<discovery>2020-12-09</discovery>
<entry>2020-12-09</entry>
</dates>
</vuln>
<vuln vid="1d56cfc5-3970-11eb-929d-d4c9ef517024">
<topic>OpenSSL -- NULL pointer de-reference</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.2,1</ge><lt>1.1.1i,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.2</ge><lt>12.2_2</lt></range>
<range><ge>12.1</ge><lt>12.1_12</lt></range>
<range><ge>11.4</ge><lt>11.4_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20201208.txt">
<p>EDIPARTYNAME NULL pointer de-reference (High)</p>
<p>The X.509 GeneralName type is a generic type for representing
different types of names. One of those name types is known as
EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which
compares different instances of a GENERAL_NAME to see if they
are equal or not. This function behaves incorrectly when both
GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer
dereference and a crash may occur leading to a possible denial
of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20201208.txt</url>
<cvename>CVE-2020-1971</cvename>
<freebsdsa>SA-20:33.openssl</freebsdsa>
</references>
<dates>
<discovery>2020-12-08</discovery>
<entry>2020-12-08</entry>
<modified>2020-12-15</modified>
</dates>
</vuln>
<vuln vid="5d5e5cda-38e6-11eb-bbbf-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.6.0</ge><lt>13.6.2</lt></range>
<range><ge>13.5.0</ge><lt>13.5.5</lt></range>
<range><ge>12.2</ge><lt>13.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/">
<p>XSS in Zoom Meeting URL</p>
<p>Limited Information Disclosure in Private Profile</p>
<p>User email exposed via GraphQL endpoint</p>
<p>Group and project membership potentially exposed via GraphQL</p>
<p>Search terms logged in search parameter in rails logs</p>
<p>Un-authorised access to feature flag user list</p>
<p>A specific query on the explore page causes statement timeouts</p>
<p>Exposure of starred projects on private user profiles</p>
<p>Uncontrolled Resource Consumption in any Markdown field using Mermaid</p>
<p>Former group members able to view updates to confidential epics</p>
<p>Update GraphicsMagick dependency</p>
<p>Update GnuPG dependency</p>
<p>Update libxml dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/</url>
<cvename>CVE-2020-26407</cvename>
<cvename>CVE-2020-26408</cvename>
<cvename>CVE-2020-13357</cvename>
<cvename>CVE-2020-26411</cvename>
<cvename>CVE-2020-26409</cvename>
</references>
<dates>
<discovery>2020-12-07</discovery>
<entry>2020-12-07</entry>
</dates>
</vuln>
<vuln vid="8d17229f-3054-11eb-a455-ac1f6b16e566">
<topic>consul -- Fix Consul Connect CA private key configuration</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hashicorp reports:</p>
<blockquote cite="https://github.com/hashicorp/consul/blob/master/CHANGELOG.md">
<p>Increase the permissions to read from the
/connect/ca/configuration endpoint to operator:write.
Previously Connect CA configuration, including the private
key, set via this endpoint could be read back by an operator
with operator:read privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md</url>
<cvename>CVE-2020-28053</cvename>
</references>
<dates>
<discovery>2020-11-02</discovery>
<entry>2020-12-06</entry>
</dates>
</vuln>
<vuln vid="01ffd06a-36ed-11eb-b655-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>87.0.4280.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html">
<p>This release contains 8 security fixes, including:</p>
<ul>
<li>[1142331] High CVE-2020-16037: Use after free in clipboard.
Reported by Ryoya Tsukasaki on 2020-10-26</li>
<li>[1138683] High CVE-2020-16038: Use after free in media.
Reported by Khalil Zhani on 2020-10-14</li>
<li>[1149177] High CVE-2020-16039: Use after free in extensions.
Reported by Anonymous on 2020-11-15</li>
<li>[1150649] High CVE-2020-16040: Insufficient data validation in
V8. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability
Research on 2020-11-19</li>
<li>[1151865] Medium CVE-2020-16041: Out of bounds read in
networking. Reported by Sergei Glazunov and Mark Brand of Google
Project Zero on 2020-11-23</li>
<li>[1151890] Medium CVE-2020-16042: Uninitialized Use in V8.
Reported by André Bargull on 2020-11-2</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-16037</cvename>
<cvename>CVE-2020-16038</cvename>
<cvename>CVE-2020-16039</cvename>
<cvename>CVE-2020-16040</cvename>
<cvename>CVE-2020-16041</cvename>
<cvename>CVE-2020-16042</cvename>
<url>https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-12-02</discovery>
<entry>2020-12-05</entry>
</dates>
</vuln>
<vuln vid="b99492b2-362b-11eb-9f86-08002734b9ed">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.13.0:</p>
<blockquote cite="https://blog.gitea.io/2020/12/gitea-1.13.0-is-released/">
<ul>
<li>Add Allow-/Block-List for Migrate and Mirrors</li>
<li>Prevent git operations for inactive users</li>
<li>Disallow urlencoded new lines in git protocol paths if there is a port</li>
<li>Mitigate Security vulnerability in the git hook feature</li>
<li>Disable DSA ssh keys by default </li>
<li>Set TLS minimum version to 1.2</li>
<li>Use argon as default password hash algorithm</li>
<li>Escape failed highlighted files</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.13.0</url>
<freebsdpr>ports/251577</freebsdpr>
</references>
<dates>
<discovery>2020-12-01</discovery>
<entry>2020-12-04</entry>
</dates>
</vuln>
<vuln vid="e2748c9d-3483-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- Multiple vulnerabilities in rtsold</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.2</ge><lt>12.2_1</lt></range>
<range><ge>12.1</ge><lt>12.1_11</lt></range>
<range><ge>11.4</ge><lt>11.4_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling.
First, rtsold(8) failed to perform sufficient bounds checking on the
extent of the option. In particular, it does not verify that the
option does not extend past the end of the received packet before
processing its contents. The kernel currently ignores such
malformed packets but still passes them to userspace programs.</p>
<p>Second, when processing a DNSSL option, rtsold(8) decodes domain
name labels per an encoding specified in RFC 1035 in which the first
octet of each label contains the label's length. rtsold(8) did not
validate label lengths correctly and could overflow the destination
buffer.</p>
<h1>Impact:</h1>
<p>It is believed that these bugs could be exploited to gain remote
code execution within the rtsold(8) daemon, which runs as root.
Note that rtsold(8) only processes messages received from hosts
attached to the same physical link as the interface(s) on which
rtsold(8) is listening.</p>
<p>In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the
scope of a compromised rtsold(8) process.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25577</cvename>
<freebsdsa>SA-20:32.rtsold</freebsdsa>
</references>
<dates>
<discovery>2020-12-01</discovery>
<entry>2020-12-02</entry>
</dates>
</vuln>
<vuln vid="8eed0c5c-3482-11eb-b87a-901b0ef719ab">
<topic>FreeBSD -- ICMPv6 use-after-free in error message handling</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.2</ge><lt>12.2_1</lt></range>
<range><ge>12.1</ge><lt>12.1_11</lt></range>
<range><ge>11.4</ge><lt>11.4_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack
may extract information from the message to hand to upper-layer
protocols. As a part of this operation, it may parse IPv6 header
options from a packet embedded in the ICMPv6 message.</p>
<p>The handler for a routing option caches a pointer into the packet
buffer holding the ICMPv6 message. However, when processing
subsequent options the packet buffer may be freed, rendering the
cached pointer invalid. The network stack may later dereference the
pointer, potentially triggering a use-after-free.</p>
<h1>Impact:</h1>
<p>A remote host may be able to trigger a read of freed kernel memory.
This may trigger a kernel panic if the address had been unmapped.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7469</cvename>
<freebsdsa>SA-20:31.icmp6</freebsdsa>
</references>
<dates>
<discovery>2020-12-01</discovery>
<entry>2020-12-02</entry>
</dates>
</vuln>
<vuln vid="76c8b690-340b-11eb-a2b7-54e1ad3d6335">
<topic>xorg-server -- Multiple input validation failures in X server XKB extension</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.20.9_1,1</lt></range>
</package>
<package>
<name>xephyr</name>
<range><lt>1.20.9_1,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.20.9_1,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.20.9_1,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.20.9_2,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.20.9_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-December/003066.html">
<p>These issues can lead to privileges elevations for authorized
clients on systems where the X server is running privileged.</p>
<p>Insufficient checks on the lengths of the XkbSetMap request can
lead to out of bounds memory accesses in the X server.</p>
<p>Insufficient checks on input of the XkbSetDeviceInfo request can
lead to a buffer overflow on the head in the X server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2020-December/003066.html</url>
<cvename>CVE-2020-14360</cvename>
<cvename>CVE-2020-25712</cvename>
</references>
<dates>
<discovery>2020-12-01</discovery>
<entry>2020-12-01</entry>
</dates>
</vuln>
<vuln vid="618010ff-3044-11eb-8112-000c292ee6b8">
<topic>nomad -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nomad</name>
<range><lt>0.12.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The HashiCorp team reports:</p>
<blockquote cite="https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md">
<ul>
<li>artifact: Fixed a bug where interpolation can be used in the
artifact destination field to write artifact payloads outside
the allocation directory.</li>
<li>template: Fixed a bug where interpolation can be used in the
template source and destination fields to read or write files
outside the allocation directory even when disable_file_sandbox
was set to false (the default).</li>
<li>template: Fixed a bug where the disable_file_sandbox
configuration was only respected for the template file function
and not the template source and destination fields.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md</url>
<cvename>CVE-2020-27195</cvename>
</references>
<dates>
<discovery>2020-10-21</discovery>
<entry>2020-11-27</entry>
</dates>
</vuln>
<vuln vid="55facdb0-2c24-11eb-9aac-08002734b9ed">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.12.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.12.6:</p>
<blockquote cite="https://blog.gitea.io/2020/11/gitea-1.12.6-is-released/">
<ul>
<li>Prevent git operations for inactive users</li>
<li>Disallow urlencoded new lines in git protocol paths if there is a port</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>Disallow urlencoded new lines in git protocol paths if there is a port</url>
<freebsdpr>ports/251296</freebsdpr>
</references>
<dates>
<discovery>2020-11-16</discovery>
<entry>2020-11-21</entry>
</dates>
</vuln>
<vuln vid="ad792169-2aa4-11eb-ab71-0022489ad614">
<topic>Node.js -- November 2020 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><lt>15.2.1</lt></range>
</package>
<package>
<name>node14</name>
<range><lt>14.15.1</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/">
<p>Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues.</p>
<h1>Denial of Service through DNS request (CVE-2020-8277)</h1>
<p>A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of service by getting the application to resolve a DNS record with a larger number of responses.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/</url>
<cvename>CVE-2020-8277</cvename>
</references>
<dates>
<discovery>2020-11-16</discovery>
<entry>2020-11-21</entry>
</dates>
</vuln>
<vuln vid="dc132c91-2b71-11eb-8cfd-4437e6ad11c4">
<topic>mutt -- authentication credentials being sent over an unencrypted connection</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin J. McCarthy reports:</p>
<blockquote cite="https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a">
<p>Mutt had incorrect error handling when initially connecting to an IMAP
server, which could result in an attempt to authenticate without enabling TLS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-28896</cvename>
<url>https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a</url>
</references>
<dates>
<discovery>2020-11-20</discovery>
<entry>2020-11-20</entry>
</dates>
</vuln>
<vuln vid="040707f9-0b2a-11eb-8834-00155d01f202">
<topic>mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file</topic>
<affects>
<package>
<name>mozjpeg</name>
<range><lt>4.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-13790">
<ul>
<li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-13790</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-10-10</entry>
</dates>
</vuln>
<vuln vid="23a667c7-0b28-11eb-8834-00155d01f202">
<topic>libjpeg-turbo -- Issue in the PPM reader causing a buffer overrun in cjpeg, TJBench, or the tjLoadImage() function.</topic>
<affects>
<package>
<name>libjpeg-turbo</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libjpeg-turbo releases reports:</p>
<blockquote cite="https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.5">
<p>This release fixes the following security issue:</p>
<ul>
<li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-13790</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-10-10</entry>
</dates>
</vuln>
<vuln vid="19259833-26b1-11eb-a239-1c697a013f4b">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php72</name>
<name>mantis-php73</name>
<name>mantis-php74</name>
<name>mantis-php80</name>
<range><lt>2.24.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis 2.24.3 release reports:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.24.3">
<p>This release fixes 3 security issues:</p>
<ul>
<li>0027039: CVE-2020-25781: Access to private bug note attachments</li>
<li>0027275: CVE-2020-25288: HTML Injection on bug_update_page.php</li>
<li>0027304: CVE-2020-25830: HTML Injection in bug_actiongroup_page.php</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/251141</freebsdpr>
<cvename>CVE-2020-25781</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25781</url>
<cvename>CVE-2020-25288</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25288</url>
<cvename>CVE-2020-25830</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25830</url>
</references>
<dates>
<discovery>2020-09-13</discovery>
<entry>2020-11-14</entry>
<modified>2020-11-15</modified>
</dates>
</vuln>
<vuln vid="db4b2f27-252a-11eb-865c-00155d646400">
<topic>go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.15.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/42552">
<p>A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem,
QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic
when provided crafted large inputs. For the panic to happen,
the divisor or modulo argument must be larger than 3168 bits
(on 32-bit architectures) or 6336 bits (on 64-bit architectures).
Multiple math/big.Rat methods are similarly affected.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/42556">
<p>The go command may execute arbitrary code at build time when
cgo is in use. This may occur when running go get on a malicious
package, or any other command that builds untrusted code. This
can be caused by a malicious gcc flags specified via a #cgo
directive.</p>
</blockquote>
<blockquote cite="https://github.com/golang/go/issues/42559">
<p>The go command may execute arbitrary code at build time when
cgo is in use. This may occur when running go get on a malicious
package, or any other command that builds untrusted code. This
can be caused by malicious unquoted symbol names.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-28362</cvename>
<url>https://github.com/golang/go/issues/42552</url>
<cvename>CVE-2020-28367</cvename>
<url>https://github.com/golang/go/issues/42556</url>
<cvename>CVE-2020-28366</cvename>
<url>https://github.com/golang/go/issues/42559</url>
</references>
<dates>
<discovery>2020-11-09</discovery>
<entry>2020-11-12</entry>
</dates>
</vuln>
<vuln vid="50259d8b-243e-11eb-8bae-b42e99975750">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-salt</name>
<name>py37-salt</name>
<name>py38-salt</name>
<range><ge>3002</ge><lt>3002.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports multiple security vulnerabilities in Salt 3002:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/3002.1.html">
<ul>
<li>CVE-2020-16846: Prevent shell injections in netapi ssh client.</li>
<li>CVE-2020-17490: Prevent creating world readable private keys with the tls execution module.</li>
<li>CVE-2020-25592: Properly validate eauth credentials and tokens along with their ACLs.
Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api.
Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls
to Salt ssh.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/3002.1.html</url>
<cvename>CVE-2020-16846</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-16846</url>
<cvename>CVE-2020-17490</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-17490</url>
<cvename>CVE-2020-25592</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-25592</url>
</references>
<dates>
<discovery>2020-11-06</discovery>
<entry>2020-11-12</entry>
</dates>
</vuln>
<vuln vid="4f15ca7b-23ae-11eb-9f59-1c1b0d9ea7e6">
<topic>Apache OpenOffice -- Unrestricted actions leads to arbitrary code execution in crafted documents</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.8</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1602022694,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openofffice project reports:</p>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2020-13958.html">
<h1>CVE-2020-13958 Unrestricted actions leads to arbitrary code execution in crafted documents</h1>
<h2>Description</h2>
<p>A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.</p>
<h2>Severity: Low</h2>
<p>There are no known exploits of this vulnerability.<br/>A proof-of-concept demonstration exists.</p>
<p>Thanks to the reporter for discovering this issue.</p>
<h2>Acknowledgments</h2>
<p>The Apache OpenOffice Security Team would like to thank Imre Rad for discovering and reporting this attack vector.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openoffice.org/security/cves/CVE-2020-13958.html</url>
<cvename>CVE-2020-13958</cvename>
</references>
<dates>
<discovery>2020-04-28</discovery>
<entry>2020-11-10</entry>
</dates>
</vuln>
<vuln vid="07c7ae7a-224b-11eb-aa6e-e0d55e2a8bf9">
<topic>raptor2 -- buffer overflow</topic>
<affects>
<package>
<name>raptor2</name>
<range><lt>2.0.15_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926">
<p>
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926</url>
<url>https://github.com/LibreOffice/core/blob/master/external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1</url>
<cvename>CVE-2017-18926</cvename>
</references>
<dates>
<discovery>2017-04-16</discovery>
<entry>2020-11-09</entry>
</dates>
</vuln>
<vuln vid="cf39ddf8-21be-11eb-8b47-641c67a117d8">
<topic>jupyter notebook -- open redirect vulnerability</topic>
<affects>
<package>
<name>py37-notebook</name>
<name>py38-notebook</name>
<name>py39-notebook</name>
<range><lt>6.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jupyter reports:</p>
<blockquote cite="https://jupyter-notebook.readthedocs.io/en/stable/changelog.html#release-6-1-5">
<p>6.1.5 is a security release, fixing one vulnerability:
Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned)
</p>
</blockquote>
</body>
</description>
<references>
<url>https://jupyter-notebook.readthedocs.io/en/stable/changelog.html#release-6-1-5</url>
<url>https://github.com/jupyter/notebook/blob/6.1.5/docs/source/changelog.rst</url>
</references>
<dates>
<discovery>2020-10-15</discovery>
<entry>2020-11-08</entry>
</dates>
</vuln>
<vuln vid="29b7f0be-1fb7-11eb-b9d4-001999f8d30b">
<topic>asterisk -- Outbound INVITE loop on challenge with different nonce</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.37.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.14.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If Asterisk is challenged on an outbound INVITE and
the nonce is changed in each response, Asterisk will
continually send INVITEs in a loop. This causes Asterisk
to consume more and more memory since the transaction
will never terminate (even if the call is hung up),
ultimately leading to a restart or shutdown of Asterisk.
Outbound authentication must be configured on the endpoint
for this to occur.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2020-002.html</url>
</references>
<dates>
<discovery>2020-11-05</discovery>
<entry>2020-11-05</entry>
</dates>
</vuln>
<vuln vid="972fe546-1fb6-11eb-b9d4-001999f8d30b">
<topic>asterisk -- Remote crash in res_pjsip_session</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.37.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.14.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>18.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p> Upon receiving a new SIP Invite, Asterisk did not
return the created dialog locked or referenced. This
caused a gap between the creation of the dialog object,
and its next use by the thread that created it. Depending
upon some off nominal circumstances, and timing it was
possible for another thread to free said dialog in this
gap. Asterisk could then crash when the dialog object,
or any of its dependent objects were de-referenced, or
accessed next by the initial creation thread.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2020-001.html</url>
</references>
<dates>
<discovery>2020-11-05</discovery>
<entry>2020-11-05</entry>
</dates>
</vuln>
<vuln vid="3ec6ab59-1e0c-11eb-a428-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>86.0.4240.183</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html">
<p>This release contains 10 security fixes, including:</p>
<ul>
<li>[1138911] High CVE-2020-16004: Use after free in user interface.
Reported by Leecraso and Guang Gong of 360 Alpha Lab working with
360 BugCloud on 2020-10-15</li>
<li>[1139398] High CVE-2020-16005: Insufficient policy enforcement
in ANGLE. Reported by Jaehun Jeong (@n3sk) of Theori on
2020-10-16</li>
<li>[1133527] High CVE-2020-16006: Inappropriate implementation in
V8. Reported by Bill Parks on 2020-09-29</li>
<li>[1125018] High CVE-2020-16007: Insufficient data validation in
installer. Reported by Abdelhamid Naceri (halov) on
2020-09-04</li>
<li>[1134107] High CVE-2020-16008: Stack buffer overflow in WebRTC.
Reported by Tolya Korniltsev on 2020-10-01</li>
<li>[1143772] High CVE-2020-16009: Inappropriate implementation in
V8. Reported by Clement Lecigne of Google's Threat Analysis Group
and Samuel Groß of Google Project Zero on 2020-10-29</li>
<li>[1144489] High CVE-2020-16011: Heap buffer overflow in UI on
Windows. Reported by Sergei Glazunov of Google Project Zero on
2020-11-01</li>
</ul>
<p>There are reports that an exploit for CVE-2020-16009 exists in the
wild.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-16004</cvename>
<cvename>CVE-2020-16005</cvename>
<cvename>CVE-2020-16006</cvename>
<cvename>CVE-2020-16007</cvename>
<cvename>CVE-2020-16008</cvename>
<cvename>CVE-2020-16009</cvename>
<cvename>CVE-2020-16011</cvename>
<url>https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-11-02</discovery>
<entry>2020-11-03</entry>
</dates>
</vuln>
<vuln vid="174e466b-1d48-11eb-bd0f-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.5.0</ge><lt>13.5.2</lt></range>
<range><ge>13.4.0</ge><lt>13.4.5</lt></range>
<range><ge>8.8.9</ge><lt>13.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/">
<p>Path Traversal in LFS Upload</p>
<p>Path traversal allows saving packages in arbitrary location</p>
<p>Kubernetes agent API leaks private repos</p>
<p>Terraform state deletion API exposes object storage URL</p>
<p>Stored-XSS in error message of build-dependencies</p>
<p>Git credentials persisted on disk</p>
<p>Potential Denial of service via container registry</p>
<p>Info leak when group is transferred from private to public group</p>
<p>Limited File Disclosure Via Multipart Bypass</p>
<p>Unauthorized user is able to access scheduled pipeline variables and values</p>
<p>CSRF in runner administration page allows an attacker to pause/resume runners</p>
<p>Regex backtracking attack in path parsing of Advanced Search result</p>
<p>Bypass of required CODEOWNERS approval</p>
<p>SAST CiConfiguration information visible without permissions</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/</url>
<cvename>CVE-2020-13355</cvename>
<cvename>CVE-2020-26405</cvename>
<cvename>CVE-2020-13358</cvename>
<cvename>CVE-2020-13359</cvename>
<cvename>CVE-2020-13340</cvename>
<cvename>CVE-2020-13353</cvename>
<cvename>CVE-2020-13354</cvename>
<cvename>CVE-2020-13352</cvename>
<cvename>CVE-2020-13356</cvename>
<cvename>CVE-2020-13351</cvename>
<cvename>CVE-2020-13350</cvename>
<cvename>CVE-2020-13349</cvename>
<cvename>CVE-2020-13348</cvename>
</references>
<dates>
<discovery>2020-11-02</discovery>
<entry>2020-11-02</entry>
</dates>
</vuln>
<vuln vid="11325357-1d3c-11eb-ab74-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.5.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/">
<p>Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5,
all WordPress versions since 3.7 have also been updated to fix the following security issues:
-Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests.
-Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network.
-Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables.
-Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC.
-Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE.
-Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs.
-Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2020-10-29</discovery>
<entry>2020-11-02</entry>
</dates>
</vuln>
<vuln vid="9ca85b7c-1b31-11eb-8762-005056a311d1">
<topic>samba -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>samba410</name>
<range><le>4.10.18</le></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.15</lt></range>
</package>
<package>
<name>samba412</name>
<range><lt>4.12.9</lt></range>
</package>
<package>
<name>samba413</name>
<range><lt>4.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<ul>
<li>CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify</li>
<li>CVE-2020-14323: Unprivileged user can crash winbind</li>
<li>CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2020-14318.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-14323.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-14383.html</url>
<cvename>CVE-2020-14318</cvename>
<cvename>CVE-2020-14323</cvename>
<cvename>CVE-2020-14383</cvename>
</references>
<dates>
<discovery>2020-10-29</discovery>
<entry>2020-10-30</entry>
</dates>
</vuln>
<vuln vid="8827134c-1a8f-11eb-9bb0-08002725d892">
<topic>tmux -- stack overflow in CSI parsing</topic>
<affects>
<package>
<name>tmux</name>
<range><lt>3.1c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nicholas Marriott reports:</p>
<blockquote cite="https://groups.google.com/g/tmux-users/c/DGfmsD9CM00/m/Six6uZG0AQAJ">
<p>tmux has a stack overflow in CSI parsing.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/g/tmux-users/c/DGfmsD9CM00/m/Six6uZG0AQAJ</url>
<url>https://marc.info/?l=openbsd-announce&m=160399126725142&w=2</url>
</references>
<dates>
<discovery>2020-10-29</discovery>
<entry>2020-10-30</entry>
</dates>
</vuln>
<vuln vid="94ffc0d9-1915-11eb-b809-b42e991fc52e">
<topic>motion -- Denial of Service</topic>
<affects>
<package>
<name>motion</name>
<range><ge>3.2</ge><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cxsecurity.com reports:</p>
<blockquote cite="https://cxsecurity.com/cveshow/CVE-2020-26566/">
<p>A Denial of Service condition in Motion-Project Motion 3.2 through
4.3.1 allows remote unauthenticated users to cause a webu.c
segmentation fault and kill the main process via a crafted HTTP
request</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve-search.iicrai.org/cve/CVE-2020-26566</url>
</references>
<dates>
<discovery>2020-10-05</discovery>
<entry>2020-10-28</entry>
</dates>
</vuln>
<vuln vid="458df97f-1440-11eb-aaec-e0d55e2a8bf9">
<topic>freetype2 -- heap buffer overlfow</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freetype project reports:</p>
<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/">
<p>A heap buffer overflow has been found in the handling of embedded
PNG bitmaps, introduced in FreeType version 2.6.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/</url>
<cvename>CVE-2020-15999</cvename>
</references>
<dates>
<discovery>2020-10-20</discovery>
<entry>2020-10-22</entry>
</dates>
</vuln>
<vuln vid="4fba07ca-13aa-11eb-b31e-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.26</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.16</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.7</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.50</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.32</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL">
<p>This Critical Patch Update contains 48 new security patches for
Oracle MySQL.</p>
<p>The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 8.</p>
<p>NOTE: MariaDB only contains CVE-2020-14812 CVE-2020-14765
CVE-2020-14776 and CVE-2020-14789</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL</url>
<cvename>CVE-2020-14878</cvename>
<cvename>CVE-2020-14828</cvename>
<cvename>CVE-2020-14775</cvename>
<cvename>CVE-2020-14765</cvename>
<cvename>CVE-2020-14769</cvename>
<cvename>CVE-2020-14830</cvename>
<cvename>CVE-2020-14836</cvename>
<cvename>CVE-2020-14846</cvename>
<cvename>CVE-2020-14800</cvename>
<cvename>CVE-2020-14827</cvename>
<cvename>CVE-2020-14760</cvename>
<cvename>CVE-2020-14776</cvename>
<cvename>CVE-2020-14821</cvename>
<cvename>CVE-2020-14829</cvename>
<cvename>CVE-2020-14848</cvename>
<cvename>CVE-2020-14852</cvename>
<cvename>CVE-2020-14814</cvename>
<cvename>CVE-2020-14789</cvename>
<cvename>CVE-2020-14804</cvename>
<cvename>CVE-2020-14812</cvename>
<cvename>CVE-2020-14773</cvename>
<cvename>CVE-2020-14777</cvename>
<cvename>CVE-2020-14785</cvename>
<cvename>CVE-2020-14793</cvename>
<cvename>CVE-2020-14794</cvename>
<cvename>CVE-2020-14809</cvename>
<cvename>CVE-2020-14837</cvename>
<cvename>CVE-2020-14839</cvename>
<cvename>CVE-2020-14845</cvename>
<cvename>CVE-2020-14861</cvename>
<cvename>CVE-2020-14866</cvename>
<cvename>CVE-2020-14868</cvename>
<cvename>CVE-2020-14888</cvename>
<cvename>CVE-2020-14891</cvename>
<cvename>CVE-2020-14893</cvename>
<cvename>CVE-2020-14786</cvename>
<cvename>CVE-2020-14790</cvename>
<cvename>CVE-2020-14844</cvename>
<cvename>CVE-2020-14799</cvename>
<cvename>CVE-2020-14869</cvename>
<cvename>CVE-2020-14672</cvename>
<cvename>CVE-2020-14870</cvename>
<cvename>CVE-2020-14867</cvename>
<cvename>CVE-2020-14873</cvename>
<cvename>CVE-2020-14838</cvename>
<cvename>CVE-2020-14860</cvename>
<cvename>CVE-2020-14791</cvename>
<cvename>CVE-2020-14771</cvename>
</references>
<dates>
<discovery>2020-10-20</discovery>
<entry>2020-10-21</entry>
<modified>2020-11-07</modified>
</dates>
</vuln>
<vuln vid="f4722927-1375-11eb-8711-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>86.0.4240.111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html">
<p>This release includes 5 security fixes:</p>
<ul>
<li>[1125337] High CVE-2020-16000: Inappropriate implementation in
Blink. Reported by amaebi_jp on 2020-09-06</li>
<li>[1135018] High CVE-2020-16001: Use after free in media.
Reported by Khalil Zhani on 2020-10-05</li>
<li>[1137630] High CVE-2020-16002: Use after free in PDFium.
Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
at Qi'anxin Group on 2020-10-13</li>
<li>[1139963] High CVE-2020-15999: Heap buffer overflow in
Freetype. Reported by Sergei Glazunov of Google Project Zero on
2020-10-19</li>
<li>[1134960] Medium CVE-2020-16003: Use after free in printing.
Reported by Khalil Zhani on 2020-10-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15999</cvename>
<cvename>CVE-2020-16000</cvename>
<cvename>CVE-2020-16001</cvename>
<cvename>CVE-2020-16002</cvename>
<cvename>CVE-2020-16003</cvename>
<url>https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2020-10-20</discovery>
<entry>2020-10-21</entry>
</dates>
</vuln>
<vuln vid="a6860b11-0dee-11eb-94ff-6805ca2fa271">
<topic>powerdns-recursor -- cache pollution</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><ge>4.3.0</ge><lt>4.3.5</lt></range>
<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
<range><ge>4.1.0</ge><lt>4.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.5">
<p>CVE-2020-25829: An issue has been found in PowerDNS Recursor where a
remote attacker can cause the cached records for a given name to be
updated to the ‘Bogus’ DNSSEC validation state, instead of their actual
DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a denial
of service for installations that always validate (dnssec=validate)
and for clients requesting validation when on-demand validation is
enabled (dnssec=process).</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html</url>
<cvename>CVE-2020-25829</cvename>
</references>
<dates>
<discovery>2020-10-13</discovery>
<entry>2020-10-14</entry>
</dates>
</vuln>
<vuln vid="a2565962-1156-11eb-9c9c-d4c9ef517024">
<topic>MariaDB -- Undisclosed vulnerability</topic>
<affects>
<package>
<name>mariadb103-client</name>
<range><lt>10.3.25</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.25</lt></range>
</package>
<package>
<name>mariadb104-client</name>
<range><lt>10.4.15</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.15</lt></range>
</package>
<package>
<name>mariadb105-client</name>
<range><lt>10.5.6</lt></range>
</package>
<package>
<name>mariadb105-server</name>
<range><lt>10.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/mariadb-1056-release-notes/">
<p>Details of this vulnerability have not yet been disclosed</p>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/mariadb-1056-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb-10415-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb-10325-release-notes/</url>
<cvename>CVE-2020-15180</cvename>
</references>
<dates>
<discovery>2020-10-07</discovery>
<entry>2020-10-18</entry>
</dates>
</vuln>
<vuln vid="5f39d80f-107c-11eb-8b47-641c67a117d8">
<topic>py-matrix-synapse -- XSS vulnerability</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<range><lt>1.21.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers reports:</p>
<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq">
<p>The fallback authentication endpoint served via Synapse were vulnerable
to cross-site scripting (XSS) attacks. The impact depends on the
configuration of the domain that Synapse is deployed on, but may allow
access to cookies and other browser data, CSRF vulnerabilities, and
access to other resources served on the same domain or parent domains.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-26891</cvename>
<url>https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq</url>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.21.2</url>
<freebsdpr>ports/249948</freebsdpr>
</references>
<dates>
<discovery>2020-10-01</discovery>
<entry>2020-10-17</entry>
</dates>
</vuln>
<vuln vid="95d9d986-1078-11eb-ab74-4c72b94353b5">
<topic>drupal -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/project/drupal/releases/7.73">
<p>The Drupal AJAX API does not disable JSONP by default, which can
lead to cross-site scripting.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2020-007</url>
</references>
<dates>
<discovery>2020-09-16</discovery>
<entry>2020-10-17</entry>
</dates>
</vuln>
<vuln vid="42926d7b-0da3-11eb-8dbd-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.445</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-58.html">
<ul>
<li>This update resolves a NULL pointer dereference vulnerability
that could lead to arbitrary code execution (CVE-2020-9746).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-9746</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb20-58.html</url>
</references>
<dates>
<discovery>2020-10-13</discovery>
<entry>2020-10-13</entry>
</dates>
</vuln>
<vuln vid="95f306a6-0aee-11eb-add4-08002728f74c">
<topic>Rails -- Possible XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-actionpack60</name>
<range><lt>6.0.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2020/10/7/Rails-6-0-3-4-has-been-released/">
<p>Rails version 6.0.3.4 has been released! This version is a security
release and addresses one possible XSS attack vector in Actionable
Exceptions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2020/10/7/Rails-6-0-3-4-has-been-released/</url>
<cvename>CVE-2020-8264</cvename>
</references>
<dates>
<discovery>2020-10-07</discovery>
<entry>2020-10-10</entry>
</dates>
</vuln>
<vuln vid="b07bdd3c-0809-11eb-a3a4-0019dbb15b3f">
<topic>Payara -- path trasversal flaw via either loc/con parameters in Eclipse Mojarra</topic>
<affects>
<package>
<name>payara</name>
<range><lt>5.201</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Payara Releases reports:</p>
<blockquote cite="https://docs.payara.fish/community/docs/5.2020.4/security/security-fix-list.html">
<p>The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:</p>
<ul>
<li>CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw via either loc/con parameters</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6950</cvename>
<url>https://docs.payara.fish/community/docs/5.2020.4/security/security-fix-list.html</url>
</references>
<dates>
<discovery>2020-01-13</discovery>
<entry>2020-10-06</entry>
</dates>
</vuln>
<vuln vid="bd159669-0808-11eb-a3a4-0019dbb15b3f">
<topic>Payara -- A Polymorphic Typing issue in FasterXML jackson-databind</topic>
<affects>
<package>
<name>payara</name>
<range><lt>5.193</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Payara Releases reports:</p>
<blockquote cite="https://docs.payara.fish/community/docs/5.193/security/security-fix-list.html">
<p>The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:</p>
<ul>
<li>CVE-2019-12086 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12086</cvename>
<url>https://docs.payara.fish/community/docs/5.193/security/security-fix-list.html</url>
</references>
<dates>
<discovery>2019-05-17</discovery>
<entry>2020-10-06</entry>
</dates>
</vuln>
<vuln vid="71c71ce0-0805-11eb-a3a4-0019dbb15b3f">
<topic>payara -- multiple vulnerabilities</topic>
<affects>
<package>
<name>payara</name>
<range><lt>5.191</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Payara Releases reports:</p>
<blockquote cite="https://docs.payara.fish/community/docs/5.191/security/security-fix-list.html">
<p>The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:</p>
<ul>
<li>CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks</li>
<li>CVE-2018-14720 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct external XML entity (XXE) attacks</li>
<li>CVE-2018-14719 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code</li>
<li>CVE-2018-14718 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code</li>
<li>CVE-2018-14371 Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14721</cvename>
<cvename>CVE-2018-14720</cvename>
<cvename>CVE-2018-14719</cvename>
<cvename>CVE-2018-14718</cvename>
<cvename>CVE-2018-14371</cvename>
<url>https://docs.payara.fish/community/docs/5.191/security/security-fix-list.html</url>
</references>
<dates>
<discovery>2019-02-01</discovery>
<entry>2020-10-06</entry>
</dates>
</vuln>
<vuln vid="769a4f60-9056-4c27-89a1-1758a59a21f8">
<topic>zeek -- Vulnerability due to memory leak</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.11">
<p>This release fixes the following security issue:</p>
<ul>
<li>A memory leak in multipart MIME code has potential
for remote exploitation and cause for Denial of Service
via resource exhaustion.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v3.0.11</url>
</references>
<dates>
<discovery>2020-09-29</discovery>
<entry>2020-10-07</entry>
</dates>
</vuln>
<vuln vid="64988354-0889-11eb-a01b-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>86.0.4240.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html">
<p>This release contains 35 security fixes, including:</p>
<ul>
<li>[1127322] Critical CVE-2020-15967: Use after free in payments.
Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11</li>
<li>[1126424] High CVE-2020-15968: Use after free in Blink.
Reported by Anonymous on 2020-09-09</li>
<li>[1124659] High CVE-2020-15969: Use after free in WebRTC.
Reported by Anonymous on 2020-09-03</li>
<li>[1108299] High CVE-2020-15970: Use after free in NFC. Reported
by Man Yue Mo of GitHub Security Lab on 2020-07-22</li>
<li>[1114062] High CVE-2020-15971: Use after free in printing.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on
2020-08-07</li>
<li>[1115901] High CVE-2020-15972: Use after free in audio.
Reported by Anonymous on 2020-08-13</li>
<li>[1133671] High CVE-2020-15990: Use after free in autofill.
Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo 360 on
2020-09-30</li>
<li>[1133688] High CVE-2020-15991: Use after free in password
manager. Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo
360 on 2020-09-30</li>
<li>[1106890] Medium CVE-2020-15973: Insufficient policy
enforcement in extensions. Reported by David Erceg on
2020-07-17</li>
<li>[1104103] Medium CVE-2020-15974: Integer overflow in Blink.
Reported by Juno Im (junorouse) of Theori on 2020-07-10</li>
<li>[1110800] Medium CVE-2020-15975: Integer overflow in
SwiftShader. Reported by Anonymous on 2020-07-29</li>
<li>[1123522] Medium CVE-2020-15976: Use after free in WebXR.
Reported by YoungJoo Lee (@ashuu_lee) of Raon Whitehat on
2020-08-31</li>
<li>[1083278] Medium CVE-2020-6557: Inappropriate implementation
in networking. Reported by Matthias Gierlings and Marcus Brinkmann
(NDS Ruhr-University Bochum) on 2020-05-15</li>
<li>[1097724] Medium CVE-2020-15977: Insufficient data validation
in dialogs. Reported by Narendra Bhati (@imnarendrabhati) on
2020-06-22</li>
<li>[1116280] Medium CVE-2020-15978: Insufficient data validation
in navigation. Reported by Luan Herrera (@lbherrera_) on
2020-08-14</li>
<li>[1127319] Medium CVE-2020-15979: Inappropriate implementation
in V8. Reported by Avihay Cohen (@SeraphicAlgorithms) on
2020-09-11</li>
<li>[1092453] Medium CVE-2020-15980: Insufficient policy
enforcement in Intents. Reported by Yongke Wang (@Rudykewang) and
Aryb1n (@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08</li>
<li>[1123023] Medium CVE-2020-15981: Out of bounds read in audio.
Reported by Christoph Guttandin on 2020-08-28</li>
<li>[1039882] Medium CVE-2020-15982: Side-channel information
leakage in cache. Reported by Luan Herrera (@lbherrera_) on
2020-01-07</li>
<li>[1076786] Medium CVE-2020-15983: Insufficient data validation
in webUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
Research on 2020-04-30</li>
<li>[1080395] Medium CVE-2020-15984: Insufficient policy
enforcement in Omnibox. Reported by Rayyan Bijoora on
2020-05-07</li>
<li>[1099276] Medium CVE-2020-15985: Inappropriate implementation
in Blink. Reported by Abdulrahman Alqabandi, Microsoft Browser
Vulnerability Research on 2020-06-25</li>
<li>[1100247] Medium CVE-2020-15986: Integer overflow in media.
Reported by Mark Brand of Google Project Zero on 2020-06-29</li>
<li>[1127774] Medium CVE-2020-15987: Use after free in WebRTC.
Reported by Philipp Hancke on 2020-09-14</li>
<li>[1110195] Medium CVE-2020-15992: Insufficient policy
enforcement in networking. Reported by Alison Huffman, Microsoft
Browser Vulnerability Research on 2020-07-28</li>
<li>[1092518] Low CVE-2020-15988: Insufficient policy enforcement
in downloads. Reported by Samuel Attard on 2020-06-08</li>
<li>[1108351] Low CVE-2020-15989: Uninitialized Use in PDFium.
Reported by Gareth Evans (Microsoft) on 2020-07-22</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6557</cvename>
<cvename>CVE-2020-15967</cvename>
<cvename>CVE-2020-15968</cvename>
<cvename>CVE-2020-15969</cvename>
<cvename>CVE-2020-15970</cvename>
<cvename>CVE-2020-15971</cvename>
<cvename>CVE-2020-15972</cvename>
<cvename>CVE-2020-15973</cvename>
<cvename>CVE-2020-15974</cvename>
<cvename>CVE-2020-15975</cvename>
<cvename>CVE-2020-15976</cvename>
<cvename>CVE-2020-15977</cvename>
<cvename>CVE-2020-15978</cvename>
<cvename>CVE-2020-15979</cvename>
<cvename>CVE-2020-15980</cvename>
<cvename>CVE-2020-15981</cvename>
<cvename>CVE-2020-15982</cvename>
<cvename>CVE-2020-15983</cvename>
<cvename>CVE-2020-15984</cvename>
<cvename>CVE-2020-15985</cvename>
<cvename>CVE-2020-15986</cvename>
<cvename>CVE-2020-15987</cvename>
<cvename>CVE-2020-15988</cvename>
<cvename>CVE-2020-15989</cvename>
<cvename>CVE-2020-15990</cvename>
<cvename>CVE-2020-15991</cvename>
<cvename>CVE-2020-15992</cvename>
<url>https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-10-06</discovery>
<entry>2020-10-07</entry>
</dates>
</vuln>
<vuln vid="cff0b2e2-0716-11eb-9e5d-08002728f74c">
<topic>libexif -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libexif</name>
<range><lt>0.6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Release notes:</p>
<blockquote cite="https://github.com/libexif/libexif/blob/master/NEWS">
<p>Lots of fixes exposed by fuzzers like AFL, ClusterFuzz, OSSFuzz and others:</p>
<p>CVE-2016-6328: fixed integer overflow when parsing maker notes</p>
<p>CVE-2017-7544: fixed buffer overread</p>
<p>CVE-2018-20030: Fix for recursion DoS</p>
<p>CVE-2019-9278: replaced integer overflow checks the compiler could optimize away by safer constructs</p>
<p>CVE-2020-0093: read overflow</p>
<p>CVE-2020-12767: fixed division by zero </p>
<p>CVE-2020-13112: Various buffer overread fixes due to integer overflows in maker notes</p>
<p>CVE-2020-13113: Potential use of uninitialized memory </p>
<p>CVE-2020-13114: Time consumption DoS when parsing canon array markers</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libexif/libexif/blob/master/NEWS</url>
<url>CVE-2016-6328</url>
<url>CVE-2017-7544</url>
<url>CVE-2018-20030</url>
<url>CVE-2019-9278</url>
<url>CVE-2020-0093</url>
<url>CVE-2020-12767</url>
<url>CVE-2020-13112</url>
<url>CVE-2020-13113</url>
<url>CVE-2020-13114</url>
</references>
<dates>
<discovery>2020-05-18</discovery>
<entry>2020-10-05</entry>
</dates>
</vuln>
<vuln vid="c71ed065-0600-11eb-8758-e0d55e2a8bf9">
<topic>kdeconnect -- packet manipulation can be exploited in a Denial of Service attack</topic>
<affects>
<package>
<name>kdeconnect-kde</name>
<range><le>20.08.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://kde.org/info/security/advisory-20201002-1.txt">
<h3>KDE Project Security Advisory</h3>
<table>
<tr>
<td>Title</td>
<td>KDE Connect: packet manipulation can be exploited in a Denial of Service attack</td>
</tr>
<tr>
<td>Risk Rating</td>
<td>Important</td>
</tr>
<tr>
<td>CVE</td>
<td>CVE-2020-26164</td>
</tr>
<tr>
<td>Versions</td>
<td>kdeconnect <= 20.08.1</td>
</tr>
<tr>
<td>Author</td>
<td>Albert Vaca Cintora <albertvaka@gmail.com></td>
</tr>
<tr>
<td>Date</td>
<td>2 October 2020</td>
</tr>
</table>
<h3>Overview</h3>
<p>
An attacker on your local network could send maliciously crafted
packets to other hosts running kdeconnect on the network, causing
them to use large amounts of CPU, memory or network connections,
which could be used in a Denial of Service attack within the
network.
</p>
<h3>Impact</h3>
<p>
Computers that run kdeconnect are susceptible to DoS attacks from
the local network.
</p>
<h3>Workaround</h3>
<p>
We advise you to stop KDE Connect when on untrusted networks like
those on airports or conferences.
</p>
<p>
Since kdeconnect is dbus activated it is relatively hard to make
sure it stays stopped so the brute force approach is to uninstall
the kdeconnect package from your system and then run
</p>
<pre>
kquitapp5 kdeconnectd
</pre>
<p>
Just install the package again once you're back in a trusted
network.
</p>
<h3>Solution</h3>
<p>
KDE Connect 20.08.2 patches several code paths that could result
in a DoS.
</p>
<p>You can apply these patches on top of 20.08.1:</p>
<ul>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/b279c52101d3f7cc30a26086d58de0b5f1c547fa
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/d35b88c1b25fe13715f9170f18674d476ca9acdc
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/b496e66899e5bc9547b6537a7f44ab44dd0aaf38
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/5310eae85dbdf92fba30375238a2481f2e34943e
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/721ba9faafb79aac73973410ee1dd3624ded97a5
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/ae58b9dec49c809b85b5404cee17946116f8a706
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/66c768aa9e7fba30b119c8b801efd49ed1270b0a
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/85b691e40f525e22ca5cc4ebe79c361d71d7dc05
</li>
<li>
https://invent.kde.org/network/kdeconnect-kde/-/commit/48180b46552d40729a36b7431e97bbe2b5379306
</li>
</ul>
<h3>Credits</h3>
<p>
Thanks Matthias Gerstner and the openSUSE security team for
reporting the issue.
</p>
<p>
Thanks to Aleix Pol, Nicolas Fella and Albert Vaca Cintora for the
patches.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://kde.org/info/security/advisory-20201002-1.txt</url>
<cvename>CVE-2020-26164</cvename>
</references>
<dates>
<discovery>2020-10-02</discovery>
<entry>2020-10-04</entry>
</dates>
</vuln>
<vuln vid="a23871f6-059b-11eb-8758-e0d55e2a8bf9">
<topic>upnp -- denial of service (crash)</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.12.1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13848">
<p>Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c. </p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13848</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13848</url>
<url>https://github.com/pupnp/pupnp/issues/177</url>
<url>https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0</url>
<cvename>CVE-2020-13848</cvename>
</references>
<dates>
<discovery>2020-06-04</discovery>
<entry>2020-10-03</entry>
</dates>
</vuln>
<vuln vid="a3495e61-047f-11eb-86ea-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.4.0</ge><lt>13.4.2</lt></range>
<range><ge>13.3.0</ge><lt>13.3.7</lt></range>
<range><ge>7.12</ge><lt>13.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/">
<p>Potential Denial Of Service Via Update Release Links API</p>
<p>Insecure Storage of Session Key In Redis</p>
<p>Improper Access Expiration Date Validation</p>
<p>Cross-Site Scripting in Multiple Pages</p>
<p>Unauthorized Users Can View Custom Project Template</p>
<p>Cross-Site Scripting in SVG Image Preview</p>
<p>Incomplete Handling in Account Deletion</p>
<p>Insufficient Rate Limiting at Re-Sending Confirmation Email</p>
<p>Improper Type Check in GraphQL</p>
<p>To-dos Are Not Redacted When Membership Changes</p>
<p>Guest users can modify confidentiality attribute</p>
<p>Command injection on runner host</p>
<p>Insecure Runner Configuration in Kubernetes Environments</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/</url>
<cvename>CVE-2020-13333</cvename>
<cvename>CVE-2020-13332</cvename>
<cvename>CVE-2020-13335</cvename>
<cvename>CVE-2020-13334</cvename>
<cvename>CVE-2020-13327</cvename>
</references>
<dates>
<discovery>2020-10-01</discovery>
<entry>2020-10-02</entry>
</dates>
</vuln>
<vuln vid="2eec1e85-faf3-11ea-8ac0-4437e6ad11c4">
<topic>tt-rss -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tt-rss</name>
<range><lt>g20200919</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tt-rss project reports:</p>
<blockquote cite="https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799">
<p>The cached_url feature mishandles JavaScript inside an SVG document.</p>
<p>imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.</p>
<p>It does not validate all URLs before requesting them.</p>
</blockquote>
<blockquote cite="https://community.tt-rss.org/t/replace-php-gettext/2889">
<p>Allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799</url>
<url>https://community.tt-rss.org/t/replace-php-gettext/2889</url>
<cvename>CVE-2020-25789</cvename>
<cvename>CVE-2020-25788</cvename>
<cvename>CVE-2020-25787</cvename>
<cvename>CVE-2016-6175</cvename>
</references>
<dates>
<discovery>2020-09-15</discovery>
<entry>2020-09-20</entry>
</dates>
</vuln>
<vuln vid="6d5f1b0b-b865-48d5-935b-3fb6ebb425fc">
<topic>Apache Ant leaks sensitive information via the java.io.tmpdir</topic>
<affects>
<package>
<name>apache-ant</name>
<range><ge>1.1</ge><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel">
<p>Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the
default temporary directory identified by the Java
system property java.io.tmpdir for several tasks and
may thus leak sensitive information. The fixcrlf and
replaceregexp tasks also copy files from the temporary
directory back into the build tree allowing an attacker
to inject modified source files into the build
process.</p>
</blockquote>
</body>
</description>
<references>
<url>https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel</url>
<cvename>CVE-2020-1945</cvename>
</references>
<dates>
<discovery>2020-05-14</discovery>
<entry>2020-09-28</entry>
</dates>
</vuln>
<vuln vid="b371db92-fe34-11ea-b90e-6805ca2fa271">
<topic>powerdns -- Leaking uninitialised memory through crafted zone records</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>4.3.0</ge><lt>4.3.1</lt></range>
<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
<range><ge>4.1.0</ge><lt>4.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.3.html#change-4.3.1">
<p>CVE-2020-17482: An issue has been found in PowerDNS Authoritative
Server before 4.3.1 where an authorized user with the
ability to insert crafted records into a zone might
be able to leak the content of uninitialized memory.
Such a user could be a customer inserting data via a
control panel, or somebody with access to the REST
API. Crafted records cannot be inserted via AXFR.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html</url>
<cvename>CVE-2020-17482</cvename>
</references>
<dates>
<discovery>2020-09-22</discovery>
<entry>2020-09-24</entry>
</dates>
</vuln>
<vuln vid="e68d3db1-fd04-11ea-a67f-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>85.0.4183.121</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html">
<p>This release fixes 10 security issues, including:</p>
<ul>
<li>[1100136] High CVE-2020-15960: Out of bounds read in storage.
Reported by Anonymous on 2020-06-28</li>
<li>[1114636] High CVE-2020-15961: Insufficient policy
enforcement in extensions. Reported by David Erceg on
2020-08-10</li>
<li>[1121836] High CVE-2020-15962: Insufficient policy
enforcement in serial. Reported by Leecraso and Guang Gong of 360
Alpha Lab working with 360 BugCloud on 2020-08-26</li>
<li>[1113558] High CVE-2020-15963: Insufficient policy
enforcement in extensions. Reported by David Erceg on
2020-08-06</li>
<li>[1126249] High CVE-2020-15965: Out of bounds write in V8.
Reported by Lucas Pinheiro, Microsoft Browser Vulnerability
Research on 2020-09-08</li>
<li>[1113565] Medium CVE-2020-15966: Insufficient policy
enforcement in extensions. Reported by David Erceg on
2020-08-06</li>
<li>[1121414] Low CVE-2020-15964: Insufficient data validation in
media. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on
2020-08-25</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15960</cvename>
<cvename>CVE-2020-15961</cvename>
<cvename>CVE-2020-15962</cvename>
<cvename>CVE-2020-15963</cvename>
<cvename>CVE-2020-15964</cvename>
<cvename>CVE-2020-15965</cvename>
<cvename>CVE-2020-15966</cvename>
<url>https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2020-09-21</discovery>
<entry>2020-09-22</entry>
</dates>
</vuln>
<vuln vid="f5abafc0-fcf6-11ea-8758-e0d55e2a8bf9">
<topic>libxml -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.10_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE mitre reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-20388">
<h3>CVE-2019-20388</h3>
<p>
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
</p>
<h3>CVE-2020-7595</h3>
<p>
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
</p>
<h3>CVE-2020-24977</h3>
<p>
GNOME project libxml2 v2.9.10 and earlier have a global buffer over-read vulnerability in xmlEncodeEntitiesInternal
</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-20388</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-7595</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-24977</url>
</references>
<dates>
<discovery>2020-01-21</discovery>
<entry>2020-09-22</entry>
</dates>
</vuln>
<vuln vid="2327234d-fc4b-11ea-adef-641c67a117d8">
<topic>py-matrix-synapse -- malformed events may prevent users from joining federated rooms</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Affected Synapse versions assume that all events have an "origin" field set. If an event
without the "origin" field is sent into a federated room, servers not already joined to
the room will be unable to do so due to failing to fetch the malformed event.</p>
<h1>Impact:</h1>
<p>An attacker could cause a denial of service by deliberately sending a malformed event
into a room, thus preventing new servers (and thus their users) from joining the
room.</p>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/issues/8319</url>
<url>https://github.com/matrix-org/synapse/pull/8324</url>
<url>https://github.com/matrix-org/synapse/blob/v1.19.3/CHANGES.md</url>
</references>
<dates>
<discovery>2020-09-16</discovery>
<entry>2020-09-21</entry>
</dates>
</vuln>
<vuln vid="2cb21232-fb32-11ea-a929-a4bf014bf5f7">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python35</name>
<range><lt>3.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-10">
<p>bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest(…).</p>
<p>bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (CVE-2020-15523).</p>
<p>bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).</p>
<p>bpo-39073: Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.</p>
<p>bpo-38576: Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.</p>
<p>bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.</p>
<p>bpo-38945: Newline characters have been escaped when performing uu encoding to prevent them from overflowing into to content section of the encoded file. This prevents malicious or accidental modification of data during the decoding process.</p>
<p>bpo-38804: Fixes a ReDoS vulnerability in http.cookiejar. Patch by Ben Caller.</p>
<p>bpo-39017: Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).</p>
<p>bpo-41183: Use 3072 RSA keys and SHA-256 signature for test certs and keys.</p>
<p>bpo-39503: AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-15523</cvename>
<cvename>CVE-2020-14422</cvename>
<cvename>CVE-2019-18348</cvename>
<cvename>CVE-2020-8492</cvename>
<cvename>CVE-2019-20907</cvename>
</references>
<dates>
<discovery>2020-08-19</discovery>
<entry>2020-09-20</entry>
</dates>
</vuln>
<vuln vid="24ace516-fad7-11ea-8d8c-005056a311d1">
<topic>samba -- Unauthenticated domain takeover via netlogon</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.18</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.13</lt></range>
</package>
<package>
<name>samba412</name>
<range><lt>4.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2020-1472.html">
<p>An unauthenticated attacker on the network can gain
administrator access by exploiting a netlogon protocol flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2020-1472.html</url>
<cvename>CVE-2020-1472</cvename>
</references>
<dates>
<discovery>2020-01-01</discovery>
<entry>2020-09-20</entry>
</dates>
</vuln>
<vuln vid="eeec4e6f-fa71-11ea-9bb7-d4c9ef517024">
<topic>Nextcloud -- Password share by mail not hashed</topic>
<affects>
<package>
<name>nextcloud</name>
<range><lt>19.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Nextcloud project reports:</p>
<blockquote cite="https://nextcloud.com/security/advisory/?id=NC-SA-2020-026">
<p>NC-SA-2020-026 (low): Password of share by mail is not hashed when
given on the create share call<br/>
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage
of the share password when it was given on the initial create API
call.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-026</url>
<cvename>CVE-2020-8183</cvename>
</references>
<dates>
<discovery>2020-06-04</discovery>
<entry>2020-09-19</entry>
</dates>
</vuln>
<vuln vid="efd03116-c2a9-11ea-82bc-b42e99a1b9c3">
<topic>webkit2-gtk3 -- multible vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.28.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports vulnerabilities:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2020-0006.html">
<ul>
<li>CVE-2020-9802: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
<li>CVE-2020-9803: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
<li>CVE-2020-9805: Processing maliciously crafted web content may lead to universal cross site scripting.</li>
<li>CVE-2020-9806: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
<li>CVE-2020-9807: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
<li>CVE-2020-9843: Processing maliciously crafted web content may lead to a cross site scripting attack.</li>
<li>CVE-2020-9850: A remote attacker may be able to cause arbitrary code execution.</li>
<li>CVE-2020-13753: CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2020-0006.html</url>
<cvename>CVE-2020-9802</cvename>
<cvename>CVE-2020-9803</cvename>
<cvename>CVE-2020-9805</cvename>
<cvename>CVE-2020-9806</cvename>
<cvename>CVE-2020-9807</cvename>
<cvename>CVE-2020-9843</cvename>
<cvename>CVE-2020-9850</cvename>
<cvename>CVE-2020-13753</cvename>
</references>
<dates>
<discovery>2020-07-10</discovery>
<entry>2020-07-10</entry>
</dates>
</vuln>
<vuln vid="4ca5894c-f7f1-11ea-8ff8-0022489ad614">
<topic>Node.js -- September 2020 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><lt>14.11.0</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.18.4</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.22.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/">
<p>Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues.</p>
<h1>HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201)</h1>
<p>Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.</p>
<p>Impacts:</p>
<ul>
<li>All versions of the 14.x and 12.x releases line</li>
</ul>
<h1>Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251)</h1>
<p>Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.</p>
<p>Impacts:</p>
<ul>
<li>All versions of the 14.x release line</li>
</ul>
<h1>fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252)</h1>
<p>libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.</p>
<p>Impacts:</p>
<ul>
<li>All versions of the 10.x release line</li>
<li>All versions of the 12.x release line</li>
<li>All versions of the 14.x release line before 14.9.0</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/</url>
<cvename>CVE-2020-8201</cvename>
<cvename>CVE-2020-8251</cvename>
<cvename>CVE-2020-8252</cvename>
</references>
<dates>
<discovery>2020-09-08</discovery>
<entry>2020-09-16</entry>
</dates>
</vuln>
<vuln vid="6d334fdb-f7e7-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- ftpd privilege escalation via ftpchroot feature</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_10</lt></range>
<range><ge>11.4</ge><lt>11.4_4</lt></range>
<range><ge>11.3</ge><lt>11.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A ftpd(8) bug in the implementation of the file system sandbox, combined
with capabilities available to an authenticated FTP user, can be used to
escape the file system restriction configured in ftpchroot(5).
Moreover, the bug allows a malicious client to gain root privileges.</p>
<h1>Impact:</h1>
<p>A malicious FTP user can gain privileged access to an affected system.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7468</cvename>
<freebsdsa>SA-20:30.ftpd</freebsdsa>
</references>
<dates>
<discovery>2020-09-15</discovery>
<entry>2020-09-16</entry>
</dates>
</vuln>
<vuln vid="e73c688b-f7e6-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- bhyve SVM guest escape</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_10</lt></range>
<range><ge>11.4</ge><lt>11.4_4</lt></range>
<range><ge>11.3</ge><lt>11.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A number of AMD virtualization instructions operate on host physical
addresses, are not subject to nested page table translation, and guest use of
these instructions was not trapped.</p>
<h1>Impact:</h1>
<p>From kernel mode a malicious guest can write to arbitrary host memory (with
some constraints), affording the guest full control of the host.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7467</cvename>
<freebsdsa>SA-20:29.bhyve_svm</freebsdsa>
</references>
<dates>
<discovery>2020-09-15</discovery>
<entry>2020-09-16</entry>
</dates>
</vuln>
<vuln vid="2c5b9cd7-f7e6-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- bhyve privilege escalation via VMCS access</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_10</lt></range>
<range><ge>11.4</ge><lt>11.4_4</lt></range>
<range><ge>11.3</ge><lt>11.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>AMD and Intel CPUs support hardware virtualization using specialized data
structures that control various aspects of guest operation. These are the
Virtual Machine Control Structure (VMCS) on Intel CPUs, and the Virtual
Machine Control Block (VMCB) on AMD CPUs. Insufficient access controls allow
root users, including those running in a jail, to change these data
structures.</p>
<h1>Impact:</h1>
<p>An attacker with host root access (including to a jailed bhyve instance) can
use this vulnerability to achieve kernel code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2020-24718</cvename>
<freebsdsa>SA-20:28.bhyve_vmcs</freebsdsa>
</references>
<dates>
<discovery>2020-09-15</discovery>
<entry>2020-09-16</entry>
</dates>
</vuln>
<vuln vid="bb53af7b-f7e4-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- ure device driver susceptible to packet-in-packet attack</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_10</lt></range>
<range><ge>11.4</ge><lt>11.4_4</lt></range>
<range><ge>11.3</ge><lt>11.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the ure(4) device driver caused some Realtek USB
Ethernet interfaces to incorrectly report packets with more than 2048 bytes
in a single USB transfer as having a length of only 2048 bytes.</p>
<p>An adversary can exploit this to cause the driver to misinterpret part of the
payload of a large packet as a separate packet, and thereby inject packets
across security boundaries such as VLANs.</p>
<h1>Impact:</h1>
<p>An attacker that can send large frames (larger than 2048 bytes in size) to be
received by the host (be it VLAN, or non-VLAN tagged packet), can inject
arbitrary packets to be received and processed by the host. This includes
spoofing packets from other hosts, or injecting packets to other VLANs than
the host is on.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7464</cvename>
<freebsdsa>SA-20:27.ure</freebsdsa>
</references>
<dates>
<discovery>2020-09-15</discovery>
<entry>2020-09-16</entry>
</dates>
</vuln>
<vuln vid="7b630362-f468-11ea-a96c-08002728f74c">
<topic>Rails -- Potential XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-actionview52</name>
<range><lt>5.2.4.4</lt></range>
</package>
<package>
<name>rubygem-actionview60</name>
<range><lt>6.0.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2020/9/10/Rails-5-2-4-4-and-6-0-3-3-have-been-released/">
<p>Rails 5.2.4.4 and 6.0.3.3 have been released! These releases contain an
important security fix, so please upgrade when you can.</p>
<p>Both releases contain the following fix: [CVE-2020-15169] Potential XSS
vulnerability in Action View</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2020/9/10/Rails-5-2-4-4-and-6-0-3-3-have-been-released/</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/b-C9kSGXYrc</url>
<url>https://github.com/rails/rails/blob/5-2-stable/actionview/CHANGELOG.md</url>
<url>https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md</url>
<cvename>CVE-2020-15169</cvename>
</references>
<dates>
<discovery>2020-09-09</discovery>
<entry>2020-09-12</entry>
</dates>
</vuln>
<vuln vid="2c92fdd3-896c-4a5a-a0d8-52acee69182d">
<topic>zeek -- Various vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.10">
<p>This release fixes the following security issue:</p>
<ul>
<li>The AYIYA and GTPv1 parsing/decapsulation logic may
leak memory -- These leaks have potential for remote
exploitation to cause Denial of Service via resource
exhaustion.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v3.0.10</url>
</references>
<dates>
<discovery>2020-08-28</discovery>
<entry>2020-09-09</entry>
</dates>
</vuln>
<vuln vid="bed5d41a-f2b4-11ea-a878-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>85.0.4183.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html">
<p>This release contains 5 security fixes:</p>
<ul>
<li>[1116304] High CVE-2020-6573: Use after free in video. Reported
by Leecraso and Guang Gong of 360 Alpha Lab working with 360
BugCloud on 2020-08-14</li>
<li>[1102196] High CVE-2020-6574: Insufficient policy
enforcement in installer. Reported by CodeColorist of
Ant-Financial LightYear Labs on 2020-07-05</li>
<li>[1081874] High CVE-2020-6575: Race in Mojo. Reported by
Microsoft on 2020-05-12</li>
<li>[1111737] High CVE-2020-6576: Use after free in offscreen
canvas. Reported by Looben Yang on 2020-07-31</li>
<li>[1122684] High CVE-2020-15959: Insufficient policy enforcement
in networking. Reported by Eric Lawrence of Microsoft on
2020-08-27</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6573</cvename>
<cvename>CVE-2020-6574</cvename>
<cvename>CVE-2020-6575</cvename>
<cvename>CVE-2020-6576</cvename>
<cvename>CVE-2020-15969</cvename>
<url>https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-09-08</discovery>
<entry>2020-09-09</entry>
</dates>
</vuln>
<vuln vid="cd97c7ca-f079-11ea-9c31-001b216d295b">
<topic>Multi-link PPP protocol daemon MPD5 remotely exploitable crash</topic>
<affects>
<package>
<name>mpd5</name>
<range><lt>5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Version 5.9 contains security fix for L2TP clients and servers.
Insufficient validation of incoming L2TP control packet
specially crafted by unauthenticated user might lead to unexpected
termination of the process. The problem affects mpd versions
since 4.0 that brought in initial support for L2TP.
Installations not using L2TP clients nor L2TP server configuration were not affected.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7465</cvename>
<cvename>CVE-2020-7466</cvename>
<url>http://mpd.sourceforge.net/doc5/mpd4.html#4</url>
</references>
<dates>
<discovery>2020-09-04</discovery>
<entry>2020-09-06</entry>
<modified>2020-09-07</modified>
</dates>
</vuln>
<vuln vid="bcdeb6d2-f02d-11ea-838a-0011d823eebd">
<topic>Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manuel Pégourié-Gonnard reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2">
<p>An attacker with access to precise enough timing and memory access
information (typically an untrusted operating system attacking a
secure enclave such as SGX or the TrustZone secure world) can
recover the private keys used in RSA or static (finite-field)
Diffie-Hellman operations.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2</url>
</references>
<dates>
<discovery>2020-09-01</discovery>
<entry>2020-09-06</entry>
</dates>
</vuln>
<vuln vid="4c69240f-f02c-11ea-838a-0011d823eebd">
<topic>Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manuel Pégourié-Gonnard reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1">
<p>When decrypting/authenticating (D)TLS record in a connection using
a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366,
Mbed TLS used dummy rounds of the compression function associated
with the hash used for HMAC in order to hide the length of the
padding to remote attackers, as recommended in the original Lucky
Thirteen paper.</p>
<p>A local attacker who is able to observe the state of the cache
could monitor the presence of mbedtls_md_process() in the cache in
order to determine when the actual computation ends and when the
dummy rounds start. This is a reliable target as it's always called
at least once, in response to a previous attack. The attacker can
then continue with one of many well-documented Lucky 13
variants.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1</url>
<cvename>CVE-2020-16150</cvename>
</references>
<dates>
<discovery>2020-09-01</discovery>
<entry>2020-09-06</entry>
</dates>
</vuln>
<vuln vid="2272e6f1-f029-11ea-838a-0011d823eebd">
<topic>GnuTLS -- null pointer dereference</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04">
<p>It was found by oss-fuzz that the server sending a
"no_renegotiation" alert in an unexpected timing, followed by an
invalid second handshake can cause a TLS 1.3 client to crash via a
null-pointer dereference. The crash happens in the application's
error handling path, where the gnutls_deinit function is called
after detecting a handshake failure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04</url>
<cvename>CVE-2020-24659</cvename>
</references>
<dates>
<discovery>2020-09-04</discovery>
<entry>2020-09-06</entry>
</dates>
</vuln>
<vuln vid="002432c8-ef6a-11ea-ba8f-08002728f74c">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.16</lt></range>
</package>
<package>
<name>py36-django30</name>
<name>py37-django30</name>
<name>py38-django30</name>
<range><lt>3.0.10</lt></range>
</package>
<package>
<name>py36-django31</name>
<name>py37-django31</name>
<name>py38-django31</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/3.1/releases/3.1.1/">
<p>CVE-2020-24583: Incorrect permissions on intermediate-level directories
on Python 3.7+</p>
<p>On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied
to intermediate-level directories created in the process of uploading
files and to intermediate-level collected static directories when using
the collectstatic management command.</p>
<p>CVE-2020-24584: Permission escalation in intermediate-level directories
of the file system cache on Python 3.7+</p>
<p>On Python 3.7+, the intermediate-level directories of the file system
cache had the system's standard umask rather than 0o077 (no group or
others permissions).</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/2.2/releases/2.2.16/</url>
<url>https://docs.djangoproject.com/en/3.0/releases/3.0.10/</url>
<url>https://docs.djangoproject.com/en/3.1/releases/3.1.1/</url>
<cvename>CVE-2020-24583</cvename>
<cvename>CVE-2020-24584</cvename>
</references>
<dates>
<discovery>2020-09-01</discovery>
<entry>2020-09-05</entry>
</dates>
</vuln>
<vuln vid="f9fa7adc-ee51-11ea-a240-002590acae31">
<topic>gnupg -- AEAD key import overflow</topic>
<affects>
<package>
<name>gnupg</name>
<range><ge>2.2.21</ge><lt>2.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Importing an OpenPGP key having a preference list for AEAD algorithms
will lead to an array overflow and thus often to a crash or other
undefined behaviour.</p>
<p>Importing an arbitrary key can often easily be triggered by an attacker
and thus triggering this bug. Exploiting the bug aside from crashes is
not trivial but likely possible for a dedicated attacker. The major
hurdle for an attacker is that only every second byte is under their
control with every first byte having a fixed value of 0x04.</p>
</body>
</description>
<references>
<cvename>CVE-2020-25125</cvename>
<url>https://dev.gnupg.org/T5050</url>
</references>
<dates>
<discovery>2020-09-03</discovery>
<entry>2020-09-03</entry>
</dates>
</vuln>
<vuln vid="762b7d4a-ec19-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- dhclient heap overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_9</lt></range>
<range><ge>11.4</ge><lt>11.4_3</lt></range>
<range><ge>11.3</ge><lt>11.3_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When parsing option 119 data, dhclient(8) computes the uncompressed domain
list length so that it can allocate an appropriately sized buffer to store
the uncompressed list. The code to compute the length failed to handle
certain malformed input, resulting in a heap overflow when the uncompressed
list is copied into in inadequately sized buffer.</p>
<h1>Impact:</h1>
<p>The heap overflow could in principle be exploited to achieve remote code
execution. The affected process runs with reduced privileges in a Capsicum
sandbox, limiting the immediate impact of an exploit. However, it is
possible the bug could be combined with other vulnerabilities to escape the
sandbox.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7461</cvename>
<freebsdsa>SA-20:26.dhclient</freebsdsa>
</references>
<dates>
<discovery>2020-09-02</discovery>
<entry>2020-09-02</entry>
</dates>
</vuln>
<vuln vid="77b877aa-ec18-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- SCTP socket use-after-free bug</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_9</lt></range>
<range><ge>11.4</ge><lt>11.4_3</lt></range>
<range><ge>11.3</ge><lt>11.3_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to improper handling in the kernel, a use-after-free bug can be triggered
by sending large user messages from multiple threads on the same socket.</p>
<h1>Impact:</h1>
<p>Triggering the use-after-free situation may result in unintended kernel
behaviour including a kernel panic.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7463</cvename>
<freebsdsa>SA-20:25.sctp</freebsdsa>
</references>
<dates>
<discovery>2020-09-02</discovery>
<entry>2020-09-02</entry>
</dates>
</vuln>
<vuln vid="74bbde13-ec17-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- IPv6 Hop-by-Hop options use-after-free bug</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.3</ge><lt>11.3_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to improper mbuf handling in the kernel, a use-after-free bug might be
triggered by sending IPv6 Hop-by-Hop options over the loopback interface.</p>
<h1>Impact:</h1>
<p>Triggering the use-after-free situation may result in unintended kernel
behaviour including a kernel panic.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7462</cvename>
<freebsdsa>SA-20:24.ipv6</freebsdsa>
</references>
<dates>
<discovery>2020-09-02</discovery>
<entry>2020-09-02</entry>
</dates>
</vuln>
<vuln vid="1fb13175-ed52-11ea-8b93-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.3.0</ge><lt>13.3.4</lt></range>
<range><ge>13.2.0</ge><lt>13.2.8</lt></range>
<range><ge>0</ge><lt>13.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/">
<p>Vendor Cross-Account Assume-Role Attack</p>
<p>Stored XSS on the Vulnerability Page</p>
<p>Outdated Job Token Can Be Reused to Access Unauthorized Resources</p>
<p>File Disclosure Via Workhorse File Upload Bypass</p>
<p>Unauthorized Maintainer Can Edit Group Badge</p>
<p>Denial of Service Within Wiki Functionality</p>
<p>Sign-in Vulnerable to Brute-force Attacks</p>
<p>Invalidated Session Allows Account Access With an Old Password</p>
<p>GitLab Omniauth Endpoint Renders User Controlled Messages</p>
<p>Blind SSRF Through Repository Mirroring</p>
<p>Information Disclosure Through Incorrect Group Permission Verifications</p>
<p>No Rate Limit on GitLab Webhook Feature</p>
<p>GitLab Session Revocation Feature Does Not Invalidate All Sessions</p>
<p>OAuth Authorization Scope for an External Application Can Be Changed Without User Consent</p>
<p>Unauthorized Maintainer Can Delete Repository</p>
<p>Improper Verification of Deploy-Key Leads to Access Restricted Repository</p>
<p>Disabled Repository Still Accessible With a Deploy-Token</p>
<p>Duplicated Secret Code Generated by 2 Factor Authentication Mechanism</p>
<p>Lack of Validation Within Project Invitation Flow</p>
<p>Current Sessions Not Invalidated Upon Enabling 2 Factor Authentication</p>
<p>Users Without 2 Factor Authentication Can Be Blocked Accessing GitLab</p>
<p>Lack of Upper Bound Check Leading to Possible Denial of Service</p>
<p>2 Factor Authentication for Groups Was Not Enforced Within API Endpoint</p>
<p>GitLab Runner Denial of Service via CI Jobs</p>
<p>Update jQuery Dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/</url>
<cvename>CVE-2020-13318</cvename>
<cvename>CVE-2020-13301</cvename>
<cvename>CVE-2020-13284</cvename>
<cvename>CVE-2020-13298</cvename>
<cvename>CVE-2020-13313</cvename>
<cvename>CVE-2020-13311</cvename>
<cvename>CVE-2020-13289</cvename>
<cvename>CVE-2020-13302</cvename>
<cvename>CVE-2020-13314</cvename>
<cvename>CVE-2020-13309</cvename>
<cvename>CVE-2020-13287</cvename>
<cvename>CVE-2020-13306</cvename>
<cvename>CVE-2020-13299</cvename>
<cvename>CVE-2020-13300</cvename>
<cvename>CVE-2020-13317</cvename>
<cvename>CVE-2020-13303</cvename>
<cvename>CVE-2020-13316</cvename>
<cvename>CVE-2020-13304</cvename>
<cvename>CVE-2020-13305</cvename>
<cvename>CVE-2020-13307</cvename>
<cvename>CVE-2020-13308</cvename>
<cvename>CVE-2020-13315</cvename>
<cvename>CVE-2020-13297</cvename>
<cvename>CVE-2020-13310</cvename>
<cvename>CVE-2020-11022</cvename>
</references>
<dates>
<discovery>2020-09-02</discovery>
<entry>2020-09-02</entry>
</dates>
</vuln>
<vuln vid="67b050ae-ec82-11ea-9071-10c37b4ac2ea">
<topic>go -- net/http/cgi, net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.14.8,1</lt></range>
<range><ge>1.15,1</ge><lt>1.15.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/40928">
<p>When a Handler does not explicitly set the Content-Type header, both
CGI implementations default to “text/html”. If an attacker can make
a server generate content under their control (e.g. a JSON
containing user data or an uploaded image file) this might be
mistakenly returned by the server as “text/html”. If a victim visits
such a page they could get the attacker's code executed in the
context of the server origin. If an attacker can make a server
generate content under their control (e.g. a JSON containing user
data or an uploaded image file) this might be mistakenly returned by
the server as “text/html”. If a victim visits such a page they could
get the attacker's code executed in the context of the server
origin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-24553</cvename>
<url>https://github.com/golang/go/issues/40928</url>
</references>
<dates>
<discovery>2020-08-20</discovery>
<entry>2020-09-01</entry>
</dates>
</vuln>
<vuln vid="38fdf07b-e8ec-11ea-8bbe-e0d55e2a8bf9">
<topic>ark -- extraction outside of extraction directory</topic>
<affects>
<package>
<name>ark</name>
<range><lt>20.08.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://kde.org/info/security/advisory-20200827-1.txt">
<h3>Overview</h3>
<p>A maliciously crafted TAR archive containing symlink entries
would install files anywhere in the user's home directory upon extraction.</p>
<h3>Proof of concept</h3>
<p>For testing, an example of malicious archive can be found at
<a href="https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar">dirsymlink.tar</a>
</p>
<h3>Impact</h3>
<p>Users can unwillingly install files like a modified .bashrc, or a malicious
script placed in ~/.config/autostart.</p>
<h3>Workaround</h3>
<p>Before extracting a downloaded archive using the Ark GUI, users should inspect it
to make sure it doesn't contain symlink entries pointing outside the extraction folder.</p>
<p>The 'Extract' context menu from the Dolphin file manager shouldn't be used.</p>
<h3>Solution</h3>
<p>Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.</p>
<p>Alternatively, <a href="https://invent.kde.org/utilities/ark/-/commit/8bf8c5ef07b0ac5e914d752681e470dea403a5bd">8bf8c5ef07b0ac5e914d752681e470dea403a5bd</a> can be applied to previous releases.</p>
<h3>Credits</h3>
<p>Thanks to Fabian Vogt for reporting this issue and for fixing it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kde.org/info/security/advisory-20200827-1.txt</url>
<cvename>CVE-2020-24654</cvename>
</references>
<dates>
<discovery>2020-08-27</discovery>
<entry>2020-08-28</entry>
</dates>
</vuln>
<vuln vid="ee261034-b95e-4479-b947-08b0877e029f">
<topic>php72 -- use of freed hash key</topic>
<affects>
<package>
<name>php72</name>
<range><lt>7.2.33</lt></range>
</package>
<package>
<name>php73</name>
<range><lt>7.3.21</lt></range>
</package>
<package>
<name>php74</name>
<range><lt>7.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>grigoritchy at gmail dot com reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=79797">
<p>The phar_parse_zipfile function had use-after-free
vulnerability because of mishandling of the actual_alias
variable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7068</url>
<cvename>CVE-2020-7068</cvename>
</references>
<dates>
<discovery>2020-07-06</discovery>
<entry>2020-08-27</entry>
</dates>
</vuln>
<vuln vid="d73bc4e6-e7c4-11ea-a878-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>85.0.4183.83</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html">
<p>This update includes 20 security fixes, including:</p>
<ul>
<li>[1109120] High CVE-2020-6558: Insufficient policy
enforcement in iOS. Reported by Alison Huffman, Microsoft Browser
Vulnerability Research on 2020-07-24</li>
<li>[1116706] High CVE-2020-6559: Use after free in presentation
API. Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu
Lab on 2020-08-15</li>
<li>[1108181] Medium CVE-2020-6560: Insufficient policy
enforcement in autofill. Reported by Nadja Ungethuem from
www.unnex.de on 2020-07-22</li>
<li>[932892] Medium CVE-2020-6561: Inappropriate implementation
in Content Security Policy. Reported by Rob Wu on 2019-02-16</li>
<li>[1086845] Medium CVE-2020-6562: Insufficient policy
enforcement in Blink. Reported by Masato Kinugawa on
2020-05-27</li>
<li>[1104628] Medium CVE-2020-6563: Insufficient policy
enforcement in intent handling. Reported by Pedro Oliveira on
2020-07-12</li>
<li>[841622] Medium CVE-2020-6564: Incorrect security UI in
permissions. Reported by Khalil Zhani on 2018-05-10</li>
<li>[1029907] Medium CVE-2020-6565: Incorrect security UI in
Omnibox. Reported by Khalil Zhani on 2019-12-02</li>
<li>[1065264] Medium CVE-2020-6566: Insufficient policy
enforcement in media. Reported by Jun Kokatsu, Microsoft Browser
Vulnerability Research on 2020-03-27</li>
<li>[937179] Low CVE-2020-6567: Insufficient validation of
untrusted input in command line handling. Reported by Joshua
Graham of TSS on 2019-03-01</li>
<li>[1092451] Low CVE-2020-6568: Insufficient policy enforcement
in intent handling. Reported by Yongke Wang(@Rudykewang) and
Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08</li>
<li>[995732] Low CVE-2020-6569: Integer overflow in WebUSB.
Reported by guaixiaomei on 2019-08-20</li>
<li>[1084699] Low CVE-2020-6570: Side-channel information leakage
in WebRTC. Reported by Signal/Tenable on 2020-05-19</li>
<li>[1085315] Low CVE-2020-6571: Incorrect security UI in Omnibox.
Reported by Rayyan Bijoora on 2020-05-21</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6558</cvename>
<cvename>CVE-2020-6559</cvename>
<cvename>CVE-2020-6560</cvename>
<cvename>CVE-2020-6561</cvename>
<cvename>CVE-2020-6562</cvename>
<cvename>CVE-2020-6563</cvename>
<cvename>CVE-2020-6564</cvename>
<cvename>CVE-2020-6565</cvename>
<cvename>CVE-2020-6566</cvename>
<cvename>CVE-2020-6567</cvename>
<cvename>CVE-2020-6568</cvename>
<cvename>CVE-2020-6569</cvename>
<cvename>CVE-2020-6570</cvename>
<cvename>CVE-2020-6571</cvename>
<url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html</url>
</references>
<dates>
<discovery>2020-08-25</discovery>
<entry>2020-08-26</entry>
</dates>
</vuln>
<vuln vid="6842ac7e-d250-11ea-b9b7-08002728f74c">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>2.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JasPer NEWS:</p>
<blockquote cite="https://github.com/jasper-software/jasper/blob/master/NEWS">
<p>- Fix CVE-2018-9154</p>
<p>- Fix CVE-2018-19541</p>
<p>- Fix CVE-2016-9399, CVE-2017-13751</p>
<p>- Fix CVE-2018-19540</p>
<p>- Fix CVE-2018-9055</p>
<p>- Fix CVE-2017-13748</p>
<p>- Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505</p>
<p>- Fix CVE-2018-9252</p>
<p>- Fix CVE-2018-19139</p>
<p>- Fix CVE-2018-19543, CVE-2017-9782</p>
<p>- Fix CVE-2018-20570</p>
<p>- Fix CVE-2018-20622</p>
<p>- Fix CVE-2016-9398</p>
<p>- Fix CVE-2017-14132</p>
<p>- Fix CVE-2017-5499</p>
<p>- Fix CVE-2018-18873</p>
<p>- Fix CVE-2017-13750</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jasper-software/jasper/blob/master/NEWS</url>
<cvename>CVE-2018-9154</cvename>
<cvename>CVE-2018-19541</cvename>
<cvename>CVE-2016-9399</cvename>
<cvename>CVE-2017-13751</cvename>
<cvename>CVE-2018-19540</cvename>
<cvename>CVE-2018-9055</cvename>
<cvename>CVE-2017-13748</cvename>
<cvename>CVE-2017-5503</cvename>
<cvename>CVE-2017-5504</cvename>
<cvename>CVE-2017-5505</cvename>
<cvename>CVE-2018-9252</cvename>
<cvename>CVE-2018-19139</cvename>
<cvename>CVE-2018-19543</cvename>
<cvename>CVE-2017-9782</cvename>
<cvename>CVE-2018-20570</cvename>
<cvename>CVE-2018-20622</cvename>
<cvename>CVE-2016-9398</cvename>
<cvename>CVE-2017-14132</cvename>
<cvename>CVE-2017-5499</cvename>
<cvename>CVE-2018-18873</cvename>
<cvename>CVE-2017-13750</cvename>
</references>
<dates>
<discovery>2020-07-28</discovery>
<entry>2020-08-25</entry>
<modified>2020-09-05</modified>
</dates>
</vuln>
<vuln vid="ffa15b3b-e6f6-11ea-8cbf-54e1ad3d6335">
<topic>xorg-server -- Multiple input validation failures in X server extensions</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
<package>
<name>xephyr</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.20.8_4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-August/003058.html">
<p>All theses issuses can lead to local privileges elevation on
systems where the X server is running privileged.</p>
<p>The handler for the XkbSetNames request does not validate the
request length before accessing its contents.</p>
<p>An integer underflow exists in the handler for the
XIChangeHierarchy request.</p>
<p>An integer underflow exist in the handler for the XkbSelectEvents
request.</p>
<p> An integer underflow exist in the handler for the CreateRegister
request of the X record extension.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-14345</cvename>
<cvename>CVE-2020-14346</cvename>
<cvename>CVE-2020-14361</cvename>
<cvename>CVE-2020-14362</cvename>
<url>https://lists.x.org/archives/xorg-announce/2020-August/003058.html</url>
</references>
<dates>
<discovery>2020-08-25</discovery>
<entry>2020-08-25</entry>
</dates>
</vuln>
<vuln vid="8da79498-e6f6-11ea-8cbf-54e1ad3d6335">
<topic>libX11 -- Doublefree in locale handlng code</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-August/003056.html">
<p>There is an integer overflow and a double free vulnerability in
the way LibX11 handles locales. The integer overflow is a necessary
precursor to the double free.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-14363</cvename>
<url>https://lists.x.org/archives/xorg-announce/2020-August/003056.html</url>
</references>
<dates>
<discovery>2020-08-25</discovery>
<entry>2020-08-25</entry>
<modified>2020-11-15</modified>
</dates>
</vuln>
<vuln vid="719f06af-e45e-11ea-95a1-c3b8167b8026">
<topic>chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile</topic>
<affects>
<package>
<name>chrony</name>
<range><lt>3.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Miroslav Lichvar reports:</p>
<blockquote cite="https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2020/08/msg00000.html">
<p>chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.</p>
<p>When chronyd is configured to save the pidfile in a directory where the
chrony user has write permissions (e.g. /var/run/chrony - the default
since chrony-3.4), an attacker that compromised the chrony user account
could create a symbolic link at the location of the pidfile to make
chronyd starting with root privileges follow the symlink and write its
process ID to a file for which the chrony user doesn't have write
permissions, causing a denial of service, or data loss.</p>
<p>This issue was reported by Matthias Gerstner of SUSE.</p>
</blockquote>
</body>
</description>
<references>
<url>https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2020/08/msg00000.html</url>
<cvename>CVE-2020-14367</cvename>
</references>
<dates>
<discovery>2020-08-06</discovery>
<entry>2020-08-22</entry>
</dates>
</vuln>
<vuln vid="2ed7e8db-e234-11ea-9392-002590bc43be">
<topic>sysutils/openzfs-kmod -- critical permissions issues</topic>
<affects>
<package>
<name>openzfs-kmod</name>
<range><lt>2020081800</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andrew Walker reports:</p>
<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248787">
<h5>Issue 1:</h5>
<p>
Users are always granted permissions to cd into a directory. The
check for whether execute is present on directories is a de-facto
no-op. This cannot be mitigated without upgrading. Even setting
an explicit "deny - execute" NFSv4 ACE will be bypassed.
</p>
<h5>Issue 2:</h5>
<p>
All ACEs for the owner_group (group@) and regular groups
(group:<foo>) are granted the current user. This means that
POSIX mode 770 is de-facto 777, and the below ACL is also de-facto
777 because the groupmember check for builtin_administrators
returns True.
</p>
<pre>
root@TESTBOX[~]# getfacl testfile
# file: testfile
# owner: root
# group: wheel
group:builtin_administrators:rwxpDdaARWcCos:-------:allow
</pre>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/248787</freebsdpr>
<url>https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f</url>
<url>https://reviews.freebsd.org/D26107</url>
</references>
<dates>
<discovery>2020-08-13</discovery>
<entry>2020-08-20</entry>
</dates>
</vuln>
<vuln vid="fbca6863-e2ad-11ea-9d39-00a09858faf5">
<topic>textproc/elasticsearch6 -- field disclosure flaw</topic>
<affects>
<package>
<name>elasticsearch6</name>
<range><lt>6.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456">
<p>A field disclosure flaw was found in Elasticsearch when running
a scrolling search with Field Level Security. If a user runs
the same query another more privileged user recently ran,
the scrolling search can leak fields that should be hidden.
This could result in an attacker gaining additional permissions
against a restricted index.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7019</cvename>
<url>https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456</url>
<url>https://github.com/elastic/elasticsearch/pull/39490</url>
</references>
<dates>
<discovery>2020-08-19</discovery>
<entry>2020-08-20</entry>
</dates>
</vuln>
<vuln vid="08de38d2-e2d0-11ea-9538-0c9d925bbbc0">
<topic>adns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>adns</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ian Jackson and the adns project reports:</p>
<blockquote cite="https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html">
<p>Vulnerable applications: all adns callers.
Exploitable by: the local recursive resolver.
Likely worst case: Remote code execution.</p>
<p>Vulnerable applications: those that make SOA queries.
Exploitable by: upstream DNS data sources.
Likely worst case: DoS (crash of the adns-using application)</p>
<p>Vulnerable applications: those that use adns_qf_quoteok_query.
Exploitable by: sources of query domain names.
Likely worst case: DoS (crash of the adns-using application)</p>
<p>Vulnerable applications: adnshost.
Exploitable by: code responsible for framing the input.
Likely worst case: DoS (adnshost crashes at EOF).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html</url>
<cvename>CVE-2017-9103</cvename>
<cvename>CVE-2017-9104</cvename>
<cvename>CVE-2017-9105</cvename>
<cvename>CVE-2017-9106</cvename>
<cvename>CVE-2017-9107</cvename>
<cvename>CVE-2017-9108</cvename>
<cvename>CVE-2017-9109</cvename>
</references>
<dates>
<discovery>2017-05-21</discovery>
<entry>2020-08-20</entry>
</dates>
</vuln>
<vuln vid="f60561e7-e23e-11ea-be64-507b9d01076a">
<topic>Icinga Web 2 -- directory traversal vulnerability</topic>
<affects>
<package>
<name>icingaweb2</name>
<range><le>2.8.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Icinga development team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24368">
<p>CVE-2020-24368</p>
<p>
Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a
Directory Traversal vulnerability which allows an attacker to access
arbitrary files that are readable by the process running Icinga Web
2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://icinga.com/2020/08/19/icinga-web-security-release-v2-6-4-v2-7-4-and-v2-8-2/</url>
<cvename>CVE-2020-24368</cvename>
</references>
<dates>
<discovery>2020-08-19</discovery>
<entry>2020-08-19</entry>
</dates>
</vuln>
<vuln vid="b905dff4-e227-11ea-b0ea-08002728f74c">
<topic>curl -- expired pointer dereference vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.29.0</ge><lt>7.72.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2020-8231: wrong connect-only connection</p>
<p>An application that performs multiple requests with libcurl's multi API
and sets the CURLOPT_CONNECT_ONLY option, might in rare circumstances
experience that when subsequently using the setup connect-only transfer,
libcurl will pick and use the wrong connection - and instead pick
another one the application has created since then.</p>
<p>CURLOPT_CONNECT_ONLY is the option to tell libcurl to not perform an
actual transfer, only connect. When that operation is completed, libcurl
remembers which connection it used for that transfer and "easy handle".
It remembers the connection using a pointer to the internal connectdata
struct in memory.</p>
<p>If more transfers are then done with the same multi handle before the
connect-only connection is used, leading to the initial connect-only
connection to get closed (for example due to idle time-out) while also
new transfers (and connections) are setup, such a new connection might
end up getting the exact same memory address as the now closed
connect-only connection.</p>
<p>If after those operations, the application then wants to use the
original transfer's connect-only setup to for example use
curl_easy_send() to send raw data over that connection, libcurl could
erroneously find an existing connection still being alive at the address
it remembered since before even though this is now a new and different
connection.</p>
<p>The application could then accidentally send data over that connection
which wasn't at all intended for that recipient, entirely unknowingly.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2020-8231.html</url>
<cvename>CVE-2020-8231</cvename>
</references>
<dates>
<discovery>2020-08-19</discovery>
<entry>2020-08-19</entry>
</dates>
</vuln>
<vuln vid="3fcb70a4-e22d-11ea-98b2-080027846a02">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.9</lt></range>
</package>
<package>
<name>python36</name>
<range><lt>3.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog">
<p>bpo-29778: Ensure python3.dll is loaded from correct locations when
Python is embedded (CVE-2020-15523).</p>
<p>bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface
and ipaddress.IPv6Interface incorrectly generated constant hash values
of 32 and 128 respectively. This resulted in always causing hash collisions.
The fix uses hash() to generate hash values for the tuple of (address, mask
length, network address).</p>
<p>bpo-39603: Prevent http header injection by rejecting control characters
in http.client.putrequest(...).</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog</url>
<url>https://docs.python.org/release/3.6.12/whatsnew/changelog.html#changelog</url>
<cvename>CVE-2020-14422</cvename>
<cvename>CVE-2020-15523</cvename>
</references>
<dates>
<discovery>2020-06-17</discovery>
<entry>2020-08-19</entry>
</dates>
</vuln>
<vuln vid="e37a0a7b-e1a7-11ea-9538-0c9d925bbbc0">
<topic>security/trousers -- several vulnerabilities</topic>
<affects>
<package>
<name>trousers</name>
<range><lt>0.3.14_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the TrouSerS project reports reports:</p>
<blockquote cite="https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/">
<p>If the tcsd daemon is started with root privileges, it fails to
drop the root gid after it is no longer needed.</p>
<p>If the tcsd daemon is started with root privileges, the tss user
has read and write access to the /etc/tcsd.conf file.</p>
<p>If the tcsd daemon is started with root privileges, the creation
of the system.data file is prone to symlink attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/</url>
<url>https://www.openwall.com/lists/oss-security/2020/05/20/3</url>
<cvename>CVE-2020-24330</cvename>
<cvename>CVE-2020-24331</cvename>
<cvename>CVE-2020-24332</cvename>
</references>
<dates>
<discovery>2020-05-20</discovery>
<entry>2020-08-18</entry>
</dates>
</vuln>
<vuln vid="64575bb6-e188-11ea-beed-e09467587c17">
<topic>chromium -- heap buffer overflow</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>84.0.4147.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html">
<p>This release contains one security fix:</p>
<ul>
<li>[1115345] High CVE-2020-6556: Heap buffer overflow in
SwiftShader. Reported by Alison Huffman, Microsoft Browser
Vulnerability Research on 2020-08-12</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6556</cvename>
<url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html</url>
</references>
<dates>
<discovery>2020-08-18</discovery>
<entry>2020-08-18</entry>
</dates>
</vuln>
<vuln vid="f20eb9a4-dfea-11ea-a9b8-9c5c8e84d621">
<topic>ceph14 -- HTTP header injection via CORS ExposeHeader tag</topic>
<affects>
<package>
<name>ceph14</name>
<range><lt>14.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat bugzilla reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753">
<p>A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).
The vulnerability is related to the injection of HTTP headers via a CORS
ExposeHeader tag. The newline character in the ExposeHeader tag in the
CORS configuration file generates a header injection in the response
when the CORS request is made.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753</url>
<cvename>CVE-2020-10753</cvename>
<freebsdpr>ports/248673</freebsdpr>
</references>
<dates>
<discovery>2020-05-27</discovery>
<entry>2020-08-16</entry>
</dates>
</vuln>
<vuln vid="09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8">
<topic>jenkins -- Buffer corruption in bundled Jetty</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.243</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.235.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2020-08-17/">
<h1>Description</h1>
<h5>(Critical) SECURITY-1983 / CVE-2019-17638</h5>
<p>Buffer corruption in bundled Jetty</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-17638</cvename>
<url>https://www.jenkins.io/security/advisory/2020-08-17/</url>
</references>
<dates>
<discovery>2020-08-17</discovery>
<entry>2020-08-17</entry>
</dates>
</vuln>
<vuln vid="085399ab-dfd7-11ea-96e4-80ee73bc7b66">
<topic>net/rsync -- multiple zlib issues</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rsync developers reports:</p>
<blockquote cite="https://download.samba.org/pub/rsync/NEWS#3.2.0">
<p>Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840</p>
</blockquote>
</body>
</description>
<references>
<url>https://download.samba.org/pub/rsync/NEWS#3.2.0</url>
<cvename>CVE-2016-9843</cvename>
<cvename>CVE-2016-9842</cvename>
<cvename>CVE-2016-9841</cvename>
<cvename>CVE-2016-9840</cvename>
</references>
<dates>
<discovery>2020-06-19</discovery>
<entry>2020-08-16</entry>
</dates>
</vuln>
<vuln vid="a23ebf36-e8b6-4665-b0f3-4c977f9a145c">
<topic>security/py-ecdsa -- multiple issues</topic>
<affects>
<package>
<name>py27-ecdsa</name>
<range><le>0.13.3</le></range>
</package>
<package>
<name>py37-ecdsa</name>
<range><le>0.13.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>py-ecdsa developers report:</p>
<blockquote cite="https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3">
<p>Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding.</p>
<p>Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3</url>
<cvename>CVE-2019-14853</cvename>
<cvename>CVE-2019-14859</cvename>
</references>
<dates>
<discovery>2019-10-07</discovery>
<entry>2020-08-16</entry>
</dates>
</vuln>
<vuln vid="b8ea5b66-deff-11ea-adef-641c67a117d8">
<topic>snmptt -- malicious shell code</topic>
<affects>
<package>
<name>snmptt</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Snmptt reports:</p>
<blockquote cite="http://snmptt.sourceforge.net/changelog.shtml">
<p>Fixed a security issue with EXEC / PREXEC / unknown_trap_exec that could
allow malicious shell code to be executed.</p>
<p>Fixed a bug with EXEC / PREXEC / unknown_trap_exec that caused commands to be
run as root instead of the user defined in daemon_uid.</p>
</blockquote>
</body>
</description>
<references>
<url>http://snmptt.sourceforge.net/changelog.shtml</url>
<freebsdpr>ports/248162</freebsdpr>
</references>
<dates>
<discovery>2020-07-23</discovery>
<entry>2020-08-15</entry>
</dates>
</vuln>
<vuln vid="87a07de1-e55e-4d51-bb64-8d117829a26a">
<topic>mail/dovecot -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
<p>Parsing mails with a large number of MIME parts could
have resulted in excessive CPU usage or a crash due to running out of
stack memory..</p>
</blockquote>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
<p>Dovecot's NTLM implementation does not correctly check
message buffer size, which leads to reading past allocation which can
lead to crash</p>
</blockquote>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
<p>lmtp/submission: Issuing the RCPT command with an
address that has the empty quoted string as local-part causes the lmtp
service to crash.</p>
</blockquote>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
<p>Dovecot's RPA mechanism implementation accepts
zero-length message, which leads to assert-crash later on.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html</url>
<cvename>CVE-2020-12100</cvename>
<cvename>CVE-2020-12673</cvename>
<cvename>CVE-2020-10967</cvename>
<cvename>CVE-2020-12674</cvename>
</references>
<dates>
<discovery>2020-04-23</discovery>
<entry>2020-08-13</entry>
</dates>
</vuln>
<vuln vid="b1d6b383-dd51-11ea-a688-7b12871ef3ad">
<topic>ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes</topic>
<affects>
<package>
<name>ilmbase</name>
<range><lt>2.5.3</lt></range>
</package>
<package>
<name>openexr</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3">
<p>v2.5.3 - Patch release with various bug/security fixes [...]:</p>
<ul><li>Various sanitizer/fuzz-identified issues related to handling of invalid input</li></ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3</url>
</references>
<dates>
<discovery>2020-07-13</discovery> <!-- first commit 'sanity check string vectors on read', fe727ea in Git -->
<entry>2020-08-13</entry>
</dates>
</vuln>
<vuln vid="eef0d2d9-78c0-441e-8b03-454c5baebe20">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.252</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.235.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2020-08-12/">
<h1>Description</h1>
<h5>(High) SECURITY-1955 / CVE-2020-2229</h5>
<p>Stored XSS vulnerability in help icons</p>
<h5>(High) SECURITY-1957 / CVE-2020-2230</h5>
<p>Stored XSS vulnerability in project naming strategy</p>
<h5>(High) SECURITY-1960 / CVE-2020-2231</h5>
<p>Stored XSS vulnerability in 'Trigger builds remotely'</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2229</cvename>
<cvename>CVE-2020-2230</cvename>
<cvename>CVE-2020-2231</cvename>
<url>https://www.jenkins.io/security/advisory/2020-08-12/</url>
</references>
<dates>
<discovery>2020-08-12</discovery>
<entry>2020-08-12</entry>
</dates>
</vuln>
<vuln vid="1110e286-dc08-11ea-beed-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>84.0.4147.125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html">
<p>This release contains 15 security fixes, including:</p>
<ul>
<li>[1107433] High CVE-2020-6542: Use after free in ANGLE.
Reported by Piotr Bania of Cisco Talos on 2020-07-20</li>
<li>[1104046] High CVE-2020-6543: Use after free in task
scheduling. Reported by Looben Yang on 2020-07-10</li>
<li>[1108497] High CVE-2020-6544: Use after free in media. Reported
by Tim Becker of Theori on 2020-07-22</li>
<li>[1095584] High CVE-2020-6545: Use after free in audio. Reported
by Anonymous on 2020-06-16</li>
<li>[1100280] High CVE-2020-6546: Inappropriate implementation in
installer. Reported by Andrew Hess (any1) on 2020-06-29</li>
<li>[1102153] High CVE-2020-6547: Incorrect security UI in media.
Reported by David Albert on 2020-07-05</li>
<li>[1103827] High CVE-2020-6548: Heap buffer overflow in Skia.
Reported by Choongwoo Han, Microsoft Browser Vulnerability
Research on 2020-07-09</li>
<li>[1105426] High CVE-2020-6549: Use after free in media. Reported
by Sergei Glazunov of Google Project Zero on 2020-07-14</li>
<li>[1106682] High CVE-2020-6550: Use after free in IndexedDB.
Reported by Sergei Glazunov of Google Project Zero on
2020-07-17</li>
<li>[1107815] High CVE-2020-6551: Use after free in WebXR. Reported
by Sergei Glazunov of Google Project Zero on 2020-07-21</li>
<li>[1108518] High CVE-2020-6552: Use after free in Blink. Reported
by Tim Becker of Theori on 2020-07-22</li>
<li>[1111307] High CVE-2020-6553: Use after free in offline mode.
Reported by Alison Huffman, Microsoft Browser Vulnerability
Research on 2020-07-30</li>
<li>[1094235] Medium CVE-2020-6554: Use after free in extensions.
Reported by Anonymous on 2020-06-12</li>
<li>[1105202] Medium CVE-2020-6555: Out of bounds read in WebGL.
Reported by Marcin Towalski of Cisco Talos on 2020-07-13</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6542</cvename>
<cvename>CVE-2020-6543</cvename>
<cvename>CVE-2020-6544</cvename>
<cvename>CVE-2020-6545</cvename>
<cvename>CVE-2020-6546</cvename>
<cvename>CVE-2020-6547</cvename>
<cvename>CVE-2020-6548</cvename>
<cvename>CVE-2020-6549</cvename>
<cvename>CVE-2020-6550</cvename>
<cvename>CVE-2020-6551</cvename>
<cvename>CVE-2020-6552</cvename>
<cvename>CVE-2020-6553</cvename>
<cvename>CVE-2020-6554</cvename>
<cvename>CVE-2020-6555</cvename>
<url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-08-10</discovery>
<entry>2020-08-11</entry>
</dates>
</vuln>
<vuln vid="10e3ed8a-db7f-11ea-8bdf-643150d3111d">
<topic>puppetdb -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>puppetdb5</name>
<range><lt>5.2.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppetlabs reports:</p>
<blockquote cite="https://puppet.com/security/cve/jackson-july-2020-security-fixes/">
<p>In June 2020, jackson-databind published security updates addressing several CVEs. Previous releases of PuppetDB contain a vulnerable version of jackson.core:jackson-databind. PuppetDB 5.2.18 contains an updated version of jackson-databind that has patched the vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://puppet.com/security/cve/jackson-july-2020-security-fixes/</url>
<cvename>CVE-2020-9548</cvename>
<cvename>CVE-2020-14062</cvename>
<cvename>CVE-2020-14060</cvename>
<cvename>CVE-2020-14061</cvename>
<cvename>CVE-2020-14195</cvename>
</references>
<dates>
<discovery>2020-07-23</discovery>
<entry>2020-08-11</entry>
</dates>
</vuln>
<vuln vid="6b6de127-db0b-11ea-ba1e-1c39475b9f84">
<topic>bftpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>bftpd</name>
<range><lt>5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bftpd project reports:</p>
<blockquote cite="http://bftpd.sourceforge.net/news.html">
<p>Bftpd is vulnerable to out of bounds memory access, file descriptor leak and a potential buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bftpd.sourceforge.net/news.html</url>
</references>
<dates>
<discovery>2020-04-16</discovery>
<entry>2020-08-10</entry>
</dates>
</vuln>
<vuln vid="6fd773d3-bc5a-11ea-b38d-f0def1d0c3ea">
<topic>trafficserver -- resource consumption</topic>
<affects>
<package>
<name>trafficserver</name>
<range><lt>8.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bryan Call reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3E">
<p>ATS is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9494</url>
<cvename>CVE-2020-9494</cvename>
</references>
<dates>
<discovery>2020-06-24</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="76700d2f-d959-11ea-b53c-d4c9ef517024">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.46</lt></range>
</package>
<package>
<name>mod_http2</name>
<range><lt>1.15.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd projec reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.46">
<ul>
<li>mod_http2: Important: Push Diary Crash on Specifically
Crafted HTTP/2 Header (CVE-2020-9490)<br/>
A specially crafted value for the 'Cache-Digest' header in a HTTP/2
request would result in a crash when the server actually tries to
HTTP/2 PUSH a resource afterwards.</li>
<li>mod_proxy_uwsgi: Moderate: mod_proxy_uwsgi buffer overflow
(CVE-2020-11984)<br/>
info disclosure and possible RCE</li>
<li>mod_http2: Moderate: Push Diary Crash on Specifically Crafted
HTTP/2 Header (CVE-2020-11993)<br/>
When trace/debug was enabled for the HTTP/2 module and on certain
traffic edge patterns, logging statements were made on the wrong
connection, causing concurrent use of memory pools.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.46</url>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2020-9490</cvename>
<cvename>CVE-2020-11984</cvename>
<cvename>CVE-2020-11993</cvename>
</references>
<dates>
<discovery>2020-08-07</discovery>
<entry>2020-08-08</entry>
<modified>2020-08-08</modified>
</dates>
</vuln>
<vuln vid="bc7aff8c-d806-11ea-a5aa-0800272260e5">
<topic>go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.14.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/40618">
<p>Certain invalid inputs to ReadUvarint or ReadVarint could cause
those functions to read an unlimited number of bytes from the
ByteReader argument before returning an error. This could lead to
processing more input than expected when the caller is reading
directly from the network and depends on ReadUvarint and ReadVarint
only consuming a small, bounded number of bytes, even from invalid
inputs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-16845</cvename>
<url>https://github.com/golang/go/issues/40618</url>
</references>
<dates>
<discovery>2020-08-06</discovery>
<entry>2020-08-06</entry>
</dates>
</vuln>
<vuln vid="a003b74f-d7b3-11ea-9df1-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><lt>13.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/">
<p>Arbitrary File Read when Moving an Issue</p>
<p>Memory Exhaustion via Excessive Logging of Invite Email Error</p>
<p>Denial of Service Through Project Import Feature</p>
<p>User Controlled Git Configuration Settings Resulting in SSRF</p>
<p>Stored XSS in Issue Reference Number Tooltip</p>
<p>Stored XSS in Issues List via Milestone Title</p>
<p>Improper Access Control After Group Transfer</p>
<p>Bypass Email Verification Required for OAuth Flow</p>
<p>Confusion When Using Hexadecimal Branch Names</p>
<p>Insufficient OAuth Revocation</p>
<p>Improper Access Control for Project Sharing</p>
<p>Stored XSS in Jobs Page</p>
<p>Improper Access Control of Applications Page</p>
<p>SSRF into Shared Runner</p>
<p>Update Kramdown Gem</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/</url>
<cvename>CVE-2020-10977</cvename>
<cvename>CVE-2020-13280</cvename>
<cvename>CVE-2020-13281</cvename>
<cvename>CVE-2020-14001</cvename>
</references>
<dates>
<discovery>2020-08-05</discovery>
<entry>2020-08-06</entry>
<modified>2020-08-25</modified>
</dates>
</vuln>
<vuln vid="8db74c04-d794-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- sendmsg(2) privilege escalation</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_8</lt></range>
<range><ge>11.4</ge><lt>11.4_2</lt></range>
<range><ge>11.3</ge><lt>11.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the
control message to be transmitted (if any) into kernel memory, and adjusts
alignment of control message headers. The code which performs this work
contained a time-of-check to time-of-use (TOCTOU) vulnerability which allows a
malicious userspace program to modify control message headers after they were
validated by the kernel.</p>
<h1>Impact:</h1>
<p>The TOCTOU bug can be exploited by an unprivileged malicious userspace program
to trigger privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7460</cvename>
<freebsdsa>SA-20:23.sendmsg</freebsdsa>
</references>
<dates>
<discovery>2020-08-05</discovery>
<entry>2020-08-06</entry>
</dates>
</vuln>
<vuln vid="9eb01384-d793-11ea-88f8-901b0ef719ab">
<topic>FreeBSD -- Potential memory corruption in USB network device drivers</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_8</lt></range>
<range><ge>11.4</ge><lt>11.4_2</lt></range>
<range><ge>11.3</ge><lt>11.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A missing length validation code common to these three drivers means that a
malicious USB device could write beyond the end of an allocated network
packet buffer.</p>
<h1>Impact:</h1>
<p>An attacker with physical access to a USB port and the ability to bring a
network interface up may be able to use a specially crafted USB device to
gain kernel or user-space code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7459</cvename>
<freebsdsa>SA-20:21.usb_net</freebsdsa>
</references>
<dates>
<discovery>2020-08-05</discovery>
<entry>2020-08-06</entry>
</dates>
</vuln>
<vuln vid="eab964f8-d632-11ea-9172-4c72b94353b5">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<name>typo3-9-php74</name>
<range><lt>9.5.20</lt></range>
</package>
<package>
<name>typo3-10-php72</name>
<name>typo3-10-php73</name>
<name>typo3-10-php74</name>
<range><lt>10.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 Team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-1046-and-9520-security-releases-published">
<p>In case an attacker manages to generate a valid cryptographic message authentication
code (HMAC-SHA1) - either by using a different existing vulnerability or in case the
internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a
TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php
which again contains the encryptionKey as well as credentials of the database management
system being used.
In case a database server is directly accessible either via internet or in a shared hosting
network, this allows to completely retrieve, manipulate or delete database contents.
This includes creating an administration user account - which can be used to trigger remote
code execution by injecting custom extensions.</p>
<p>It has been discovered that an internal verification mechanism can be used to generate
arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic
message authentication code (HMAC-SHA1) and can lead to various attack chains as described
below.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-1046-and-9520-security-releases-published</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-007</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-008</url>
<cvename>CVE-2020-15098</cvename>
<cvename>CVE-2020-15099</cvename>
</references>
<dates>
<discovery>2020-07-28</discovery>
<entry>2020-08-04</entry>
</dates>
</vuln>
<vuln vid="3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0">
<topic>xorg-server -- Pixel Data Uninitialized Memory Information Disclosure</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
<package>
<name>xephyr</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.20.8_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-July/003051.html">
<p>Allocation for pixmap data in AllocatePixmap() does not initialize
the memory in xserver, it leads to leak uninitialize heap memory to
clients. When the X server runs with elevated privileges.</p>
<p>This flaw can lead to ASLR bypass, which when combined with other
flaws (known/unknown) could lead to lead to privilege elevation in
the client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2020-July/003051.html</url>
<cvename>CVE-2020-14347</cvename>
</references>
<dates>
<discovery>2020-07-31</discovery>
<entry>2020-08-01</entry>
</dates>
</vuln>
<vuln vid="6faa7feb-d3fa-11ea-9aba-0c9d925bbbc0">
<topic>libX11 -- Heap corruption in the X input method client in libX11</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.9_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-July/003050.html">
<p>The X Input Method (XIM) client implementation in libX11 has some
integer overflows and signed/unsigned comparison issues that can
lead to heap corruption when handling malformed messages from an
input method.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2020-July/003050.html</url>
<cvename>CVE-2020-14344</cvename>
</references>
<dates>
<discovery>2020-07-31</discovery>
<entry>2020-08-01</entry>
</dates>
</vuln>
<vuln vid="7d7221ee-d334-11ea-bc50-080027846a02">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#python-3-8-5-final">
<p>bpo-41304: Fixes python3x._pth being ignored on Windows, caused by the fix for
bpo-29778 (CVE-2020-15801).</p>
<p>bpo-39603: Prevent http header injection by rejecting control characters in
http.client.putreques().</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3/whatsnew/changelog.html#python-3-8-5-final</url>
<cvename>CVE-2020-15801</cvename>
</references>
<dates>
<discovery>2020-02-11</discovery>
<entry>2020-07-31</entry>
</dates>
</vuln>
<vuln vid="d1ef1138-d273-11ea-a757-e0d55e2a8bf9">
<topic>ark -- directory traversal</topic>
<affects>
<package>
<name>ark</name>
<range><lt>20.04.2_1</lt></range>
<range><eq>20.04.3</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Project Security Advisory reports:</p>
<blockquote cite="https://kde.org/info/security/advisory-20200730-1.txt">
<h3>KDE Project Security Advisory</h3>
<table>
<tr>
<td>Title:</td>
<td>Ark: maliciously crafted archive can install files outside the extraction directory.</td>
</tr>
<tr>
<td>Risk Rating:</td>
<td>Important</td>
</tr>
<tr>
<td>CVE:</td>
<td>CVE-2020-16116</td>
</tr>
<tr>
<td>Versions:</td>
<td>ark <= 20.04.3</td>
</tr>
<tr>
<td>Author:</td>
<td>Elvis Angelaccio <elvis.angelaccio@kde.org></td>
</tr>
<tr>
<td>Date:</td>
<td>30 July 2020</td>
</tr>
</table>
<h3>Overview</h3>
<p>A maliciously crafted archive with "../" in the file paths
would install files anywhere in the user's home directory upon extraction.</p>
<h3>Proof of concept</h3>
<p>For testing, an example of malicious archive can be found at
https://github.com/jwilk/traversal-archives/releases/download/0/relative2.zip</p>
<h3>Impact</h3>
<p>Users can unwillingly install files like a modified .bashrc, or a malicious
script placed in ~/.config/autostart</p>
<h3>Workaround</h3>
<p>Users should not use the 'Extract' context menu from the Dolphin file manager.
Before extracting a downloaded archive using the Ark GUI, users should inspect it
to make sure it doesn't contain entries with "../" in the file path.</p>
<h3>Solution</h3>
<p>Ark 20.08.0 prevents loading of malicious archives and shows a warning message
to the users.</p>
<p>Alternatively,
https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f
can be applied to previous releases.</p>
<h3>Credits</h3>
<p>Thanks to Dominik Penner for finding and reporting this issue and thanks to
Elvis Angelaccio and Albert Astals Cid for fixing it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-16116</cvename>
<url>https://kde.org/info/security/advisory-20200730-1.txt</url>
</references>
<dates>
<discovery>2020-07-30</discovery>
<entry>2020-07-30</entry>
</dates>
</vuln>
<vuln vid="9a447f78-d0f8-11ea-9837-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>84.0.4147.105</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html">
<p>This update contains 8 security fixes, including:</p>
<ul>
<li>[1105318] High CVE-2020-6537: Type Confusion in V8. Reported by
Alphalaab on 2020-07-14</li>
<li>[1096677] High CVE-2020-6538: Inappropriate implementation in
WebView. Reported by Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n)
of Tencent Security Xuanwu Lab on 2020-06-18</li>
<li>[1104061] High CVE-2020-6532: Use after free in SCTP. Reported
by Anonymous on 2020-07-09</li>
<li>[1105635] High CVE-2020-6539: Use after free in CSS. Reported
by Oriol Brufau on 2020-07-14</li>
<li>[1105720] High CVE-2020-6540: Heap buffer overflow in Skia.
Reported by Zhen Zhou of NSFOCUS Security Team on 2020-07-15</li>
<li>[1106773] High CVE-2020-6541: Use after free in WebUSB. Reported
by Sergei Glazunov of Google Project Zero on 2020-07-17</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6532</cvename>
<cvename>CVE-2020-6537</cvename>
<cvename>CVE-2020-6538</cvename>
<cvename>CVE-2020-6539</cvename>
<cvename>CVE-2020-6540</cvename>
<cvename>CVE-2020-6541</cvename>
<url>https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html</url>
</references>
<dates>
<discovery>2020-07-27</discovery>
<entry>2020-07-28</entry>
</dates>
</vuln>
<vuln vid="086c96cd-d0cb-11ea-b922-5404a68ad561">
<topic>libsndfile -- out-of-bounds read memory access</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.0.29.p.20200620</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832">
<p>It was discovered the fix for CVE-2018-19758 was not complete and
still allows a read beyond the limits of a buffer in
wav_write_header() function in wav.c. A local attacker may use
this flaw to make the application crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832</url>
</references>
<dates>
<discovery>2019-02-14</discovery>
<entry>2020-07-28</entry>
</dates>
</vuln>
<vuln vid="a955cdb7-d089-11ea-8c6f-080027eedc6a">
<topic>FreeRDP -- Integer overflow in RDPEGFX channel</topic>
<affects>
<package>
<name>freerdp</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bernhard Miklautz reports:</p>
<blockquote cite="https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9">
<ul>
<li>
Integer overflow due to missing input sanitation in rdpegfx channel
</li>
<li>All FreeRDP clients are affected</li>
<li>
The input rectangles from the server are not checked against local
surface coordinates and blindly accepted. A malicious server can send
data that will crash the client later on (invalid length arguments to
a memcpy)
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.freerdp.com/2020/07/20/2_2_0-released</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15103</url>
<cvename>CVE-2020-15103</cvename>
</references>
<dates>
<discovery>2020-06-25</discovery>
<entry>2020-07-28</entry>
</dates>
</vuln>
<vuln vid="e333084c-9588-4eee-8bdc-323e02cb4fe0">
<topic>zeek -- Various vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.8">
<p>This release fixes the following security issues:</p>
<ul>
<li>Fix potential DNS analyzer stack overflow</li>
<li>Fix potential NetbiosSSN analyzer stack overflow</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v3.0.8</url>
</references>
<dates>
<discovery>2020-07-28</discovery>
<entry>2020-07-28</entry>
</dates>
</vuln>
<vuln vid="cd2dc126-cfe4-11ea-9172-4c72b94353b5">
<topic>Cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti developers reports:</p>
<blockquote cite="https://www.cacti.net/release_notes.php?version=1.2.13">
<p>Multiple fixes for bundled jQuery to prevent
code exec (CVE-2020-11022, CVE-2020-11023).</p>
<p>PHPMail contains a escaping bug
(CVE-2020-13625).</p>
<p>SQL Injection via color.php in Cacti
(CVE-2020-14295).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.cacti.net/release_notes.php?version=1.2.13</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13625</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295</url>
<cvename>CVE-2020-11022</cvename>
<cvename>CVE-2020-11023</cvename>
<cvename>CVE-2020-13625</cvename>
<cvename>CVE-2020-14295</cvename>
</references>
<dates>
<discovery>2020-07-15</discovery>
<entry>2020-07-27</entry>
</dates>
</vuln>
<vuln vid="e1d3a580-cd8b-11ea-bad0-08002728f74c">
<topic>Wagtail -- XSS vulnerability</topic>
<affects>
<package>
<name>py36-wagtail</name>
<name>py37-wagtail</name>
<name>py38-wagtail</name>
<range><ge>2.8.0</ge><lt>2.9.3</lt></range>
<range><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Advisory Database:</p>
<blockquote cite="https://github.com/advisories/GHSA-2473-9hgq-j7xw">
<p>When a form page type is made available to Wagtail editors through the
wagtail.contrib.forms app, and the page template is built using
Django's standard form rendering helpers such as form.as_p (as directed
in the documentation), any HTML tags used within a form field's help
text will be rendered unescaped in the page. Allowing HTML within help
text is an intentional design decision by Django; however, as a matter
of policy Wagtail does not allow editors to insert arbitrary HTML by
default, as this could potentially be used to carry out cross-site
scripting attacks, including privilege escalation. This functionality
should therefore not have been made available to editor-level users.</p>
<p>The vulnerability is not exploitable by an ordinary site visitor
without access to the Wagtail admin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/advisories/GHSA-2473-9hgq-j7xw</url>
<cvename>CVE-2020-15118</cvename>
</references>
<dates>
<discovery>2020-07-20</discovery>
<entry>2020-07-24</entry>
</dates>
</vuln>
<vuln vid="456375e1-cd09-11ea-9172-4c72b94353b5">
<topic>pango -- buffer overflow</topic>
<affects>
<package>
<name>pango</name>
<range><lt>1.42.4_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010238">
<p>Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is:
The heap based buffer overflow can be used to get code execution. The component is:
function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop
condition. The attack vector is: Bug can be used when application pass invalid utf-8
strings to functions like pango_itemize.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010238</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-1010238</url>
<cvename>CVE-2019-1010238</cvename>
</references>
<dates>
<discovery>2019-07-19</discovery>
<entry>2020-07-23</entry>
<modified>2020-09-26</modified>
</dates>
</vuln>
<vuln vid="6a72eff7-ccd6-11ea-9172-4c72b94353b5">
<topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.105</lt></range>
</package>
<package>
<name>tomcat85</name>
<range><lt>8.5.57</lt></range>
</package>
<package>
<name>tomcat9</name>
<range><lt>9.0.37</lt></range>
</package>
<package>
<name>tomcat-devel</name>
<range><lt>10.0.0.M7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<p>An h2c direct connection did not release the HTTP/1.1 processor after
the upgrade to HTTP/2. If a sufficient number of such requests were
made, an OutOfMemoryException could occur leading to a denial of service.</p>
<p>The payload length in a WebSocket frame was not correctly validated.
Invalid payload lengths could trigger an infinite loop. Multiple
requests with invalid payload lengths could lead to a denial of service.</p>
<p>A specially crafted sequence of HTTP/2 requests could trigger high CPU
usage for several seconds. If a sufficient number of such requests were
made on concurrent HTTP/2 connections, the server could become unresponsive.</p>
</body>
</description>
<references>
<url>https://tomcat.apache.org/security-7.html</url>
<url>https://tomcat.apache.org/security-8.html</url>
<url>https://tomcat.apache.org/security-9.html</url>
<url>https://tomcat.apache.org/security-10.html</url>
<cvename>CVE-2020-11996</cvename>
<cvename>CVE-2020-13934</cvename>
<cvename>CVE-2020-13935</cvename>
</references>
<dates>
<discovery>2020-07-05</discovery>
<entry>2020-07-23</entry>
<modified>2020-07-23</modified>
</dates>
</vuln>
<vuln vid="a9eeb3a3-ca5e-11ea-930b-080027846a02">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#python-3-8-4-final">
<p>bpo-41162:Audit hooks are now cleared later during finalization to avoid missing
events.</p>
<p>bpo-29778:Ensure python3.dll is loaded from correct locations when Python is
embedded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3/whatsnew/changelog.html#python-3-8-4-final</url>
<cvename>CVE-2020-15523</cvename>
</references>
<dates>
<discovery>2020-06-29</discovery>
<entry>2020-07-20</entry>
</dates>
</vuln>
<vuln vid="1e7b316b-c6a8-11ea-a7d5-001999f8d30b">
<topic>VirtualBox -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><ge>5.2</ge><lt>5.2.44</lt></range>
<range><ge>6.0</ge><lt>6.0.24</lt></range>
<range><ge>6.1</ge><lt>6.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2020.html">
<p>Vulnerabilities in VirtualBox core can allow users
with logon access to the infrastructure where Oracle VM
VirtualBox executes to compromise Oracle VM VirtualBox.
Successful attacks of these vulnerabilities can result
in unauthorized access to critical data, access to all
Oracle VM VirtualBox accessible data, unauthorized ability
to cause a hang or frequently repeatable crash (complete
DOS) or takeover of Oracle VM VirtualBox.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujul2020.html</url>
<cvename>CVE-2020-14628</cvename>
<cvename>CVE-2020-14629</cvename>
<cvename>CVE-2020-14646</cvename>
<cvename>CVE-2020-14647</cvename>
<cvename>CVE-2020-14648</cvename>
<cvename>CVE-2020-14649</cvename>
<cvename>CVE-2020-14650</cvename>
<cvename>CVE-2020-14673</cvename>
<cvename>CVE-2020-14674</cvename>
<cvename>CVE-2020-14675</cvename>
<cvename>CVE-2020-14676</cvename>
<cvename>CVE-2020-14677</cvename>
<cvename>CVE-2020-14694</cvename>
<cvename>CVE-2020-14695</cvename>
<cvename>CVE-2020-14698</cvename>
<cvename>CVE-2020-14699</cvename>
<cvename>CVE-2020-14700</cvename>
<cvename>CVE-2020-14703</cvename>
<cvename>CVE-2020-14704</cvename>
<cvename>CVE-2020-14707</cvename>
<cvename>CVE-2020-14711</cvename>
<cvename>CVE-2020-14712</cvename>
<cvename>CVE-2020-14713</cvename>
<cvename>CVE-2020-14714</cvename>
<cvename>CVE-2020-14715</cvename>
</references>
<dates>
<discovery>2020-07-14</discovery>
<entry>2020-07-19</entry>
</dates>
</vuln>
<vuln vid="f7a02651-c798-11ea-81d6-6805cabe6ebb">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html">
<dl>
<dt>CVE-2020-3350</dt>
<dd>
Fixed a vulnerability a malicious user could exploit to replace
a scan target's directory with a symlink to another path to trick
clamscan, clamdscan, or clamonacc into removing or moving a different
file (such as a critical system file). The issue would affect users
that use the --move or --remove options for clamscan, clamdscan and
clamonacc.
</dd>
<dt>CVE-2020-3327</dt>
<dd>
Fixed a vulnerability in the ARJ archive-parsing module in ClamAV
0.102.3 that could cause a denial-of-service (DoS) condition.
Improper bounds checking resulted in an out-of-bounds read that could
cause a crash. The previous fix for this CVE in version 0.102.3 was
incomplete. This fix correctly resolves the issue.
</dd>
<dt>CVE-2020-3481</dt>
<dd>
Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0
- 0.102.3 that could cause a denial-of-service (DoS) condition.
Improper error handling could cause a crash due to a NULL pointer
dereference. This vulnerability is mitigated for those using the
official ClamAV signature databases because the file type signatures
in daily.cvd will not enable the EGG archive parser in affected
versions.
</dd>
</dl>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html</url>
<cvename>CVE-2020-3350</cvename>
<cvename>CVE-2020-3327</cvename>
<cvename>CVE-2020-3481</cvename>
</references>
<dates>
<discovery>2020-07-16</discovery>
<entry>2020-07-16</entry>
</dates>
</vuln>
<vuln vid="714e6c35-c75b-11ea-aa29-d74973d1f9f3">
<topic>OpenEXR/ilmbase 2.5.2 -- patch release with various bug/security fixes</topic>
<affects>
<package>
<name>ilmbase</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>openexr</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2">
<p>openexr 2.5.2 [is a p]atch release with various bug/security and build/install fixes:</p>
<ul>
<li>Invalid input could cause a heap-use-after-free error in DeepScanLineInputFile::DeepScanLineInputFile()</li>
<li>Invalid chunkCount attributes could cause heap buffer overflow in getChunkOffsetTableSize()</li>
<li>Invalid tiled input file could cause invalid memory access TiledInputFile::TiledInputFile()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2</url>
</references>
<dates>
<discovery>2020-05-18</discovery>
<entry>2020-07-16</entry>
</dates>
</vuln>
<vuln vid="870d59b0-c6c4-11ea-8015-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>84.0.4147.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html">
<p>This update contains 38 security fixes, including:</p>
<ul>
<li>[1103195] Critical CVE-2020-6510: Heap buffer overflow in
background fetch. Reported by Leecraso and Guang Gong of 360
Alpha Lab working with 360 BugCloud on 2020-07-08</li>
<li>[1074317] High CVE-2020-6511: Side-channel information leakage
in content security policy. Reported by Mikhail Oblozhikhin on
2020-04-24</li>
<li>[1084820] High CVE-2020-6512: Type Confusion in V8. Reported by
nocma, leogan, cheneyxu of WeChat Open Platform Security Team on
2020-05-20</li>
<li>[1091404] High CVE-2020-6513: Heap buffer overflow in PDFium.
Reported by Aleksandar Nikolic of Cisco Talos on 2020-06-04</li>
<li>[1076703] High CVE-2020-6514: Inappropriate implementation in
WebRTC. Reported by Natalie Silvanovich of Google Project Zero on
2020-04-30</li>
<li>[1082755] High CVE-2020-6515: Use after free in tab strip.
Reported by DDV_UA on 2020-05-14</li>
<li>[1092449] High CVE-2020-6516: Policy bypass in CORS. Reported by
Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n) of Tencent Security
Xuanwu Lab on 2020-06-08</li>
<li>[1095560] High CVE-2020-6517: Heap buffer overflow in history.
Reported by ZeKai Wu (@hellowuzekai) of Tencent Security Xuanwu
Lab on 2020-06-16</li>
<li>[986051] Medium CVE-2020-6518: Use after free in developer
tools. Reported by David Erceg on 2019-07-20</li>
<li>[1064676] Medium CVE-2020-6519: Policy bypass in CSP. Reported
by Gal Weizman (@WeizmanGal) of PerimeterX on 2020-03-25</li>
<li>[1092274] Medium CVE-2020-6520: Heap buffer overflow in Skia.
Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-08</li>
<li>[1075734] Medium CVE-2020-6521: Side-channel information leakage
in autofill. Reported by Xu Lin (University of Illinois at
Chicago), Panagiotis Ilia (University of Illinois at Chicago),
Jason Polakis (University of Illinois at Chicago) on
2020-04-27</li>
<li>[1052093] Medium CVE-2020-6522: Inappropriate implementation in
external protocol handlers. Reported by Eric Lawrence of Microsoft
on 2020-02-13</li>
<li>[1080481] Medium CVE-2020-6523: Out of bounds write in Skia.
Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu Lab on
2020-05-08</li>
<li>[1081722] Medium CVE-2020-6524: Heap buffer overflow in
WebAudio. Reported by Sung Ta (@Mipu94) of SEFCOM Lab, Arizona
State University on 2020-05-12</li>
<li>[1091670] Medium CVE-2020-6525: Heap buffer overflow in Skia.
Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-05</li>
<li>[1074340] Low CVE-2020-6526: Inappropriate implementation in
iframe sandbox. Reported by Jonathan Kingston on 2020-04-24</li>
<li>[992698] Low CVE-2020-6527: Insufficient policy enforcement in
CSP. Reported by Zhong Zhaochen of andsecurity.cn on
2019-08-10</li>
<li>[1063690] Low CVE-2020-6528: Incorrect security UI in basic
auth. Reported by Rayyan Bijoora on 2020-03-22</li>
<li>[978779] Low CVE-2020-6529: Inappropriate implementation in
WebRTC. Reported by kaustubhvats7 on 2019-06-26</li>
<li>[1016278] Low CVE-2020-6530: Out of bounds memory access in
developer tools. Reported by myvyang on 2019-10-21</li>
<li>[1042986] Low CVE-2020-6531: Side-channel information leakage in
scroll to text. Reported by Jun Kokatsu, Microsoft Browser
Vulnerability Research on 2020-01-17</li>
<li>[1069964] Low CVE-2020-6533: Type Confusion in V8. Reported by
Avihay Cohen @ SeraphicAlgorithms on 2020-04-11</li>
<li>[1072412] Low CVE-2020-6534: Heap buffer overflow in WebRTC.
Reported by Anonymous on 2020-04-20</li>
<li>[1073409] Low CVE-2020-6535: Insufficient data validation in
WebUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
Research on 2020-04-22</li>
<li>[1080934] Low CVE-2020-6536: Incorrect security UI in PWAs.
Reported by Zhiyang Zeng of Tencent security platform department
on 2020-05-09</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6510</cvename>
<cvename>CVE-2020-6511</cvename>
<cvename>CVE-2020-6512</cvename>
<cvename>CVE-2020-6513</cvename>
<cvename>CVE-2020-6514</cvename>
<cvename>CVE-2020-6515</cvename>
<cvename>CVE-2020-6516</cvename>
<cvename>CVE-2020-6517</cvename>
<cvename>CVE-2020-6518</cvename>
<cvename>CVE-2020-6519</cvename>
<cvename>CVE-2020-6520</cvename>
<cvename>CVE-2020-6521</cvename>
<cvename>CVE-2020-6522</cvename>
<cvename>CVE-2020-6523</cvename>
<cvename>CVE-2020-6524</cvename>
<cvename>CVE-2020-6525</cvename>
<cvename>CVE-2020-6526</cvename>
<cvename>CVE-2020-6527</cvename>
<cvename>CVE-2020-6528</cvename>
<cvename>CVE-2020-6529</cvename>
<cvename>CVE-2020-6530</cvename>
<cvename>CVE-2020-6531</cvename>
<cvename>CVE-2020-6533</cvename>
<cvename>CVE-2020-6534</cvename>
<cvename>CVE-2020-6535</cvename>
<cvename>CVE-2020-6536</cvename>
<url>https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-07-14</discovery>
<entry>2020-07-15</entry>
</dates>
</vuln>
<vuln vid="1ddab5cb-14c9-4632-959f-802c412a9593">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.245</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.235.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://www.jenkins.io/security/advisory/2020-07-15/">
<h1>Description</h1>
<h5>(High) SECURITY-1868 / CVE-2020-2220</h5>
<p>Stored XSS vulnerability in job build time trend</p>
<h5>(High) SECURITY-1901 / CVE-2020-2221</h5>
<p>Stored XSS vulnerability in upstream cause</p>
<h5>(High) SECURITY-1902 / CVE-2020-2222</h5>
<p>Stored XSS vulnerability in 'keep forever' badge icons</p>
<h5>(High) SECURITY-1945 / CVE-2020-2223</h5>
<p>Stored XSS vulnerability in console links</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2220</cvename>
<cvename>CVE-2020-2221</cvename>
<cvename>CVE-2020-2222</cvename>
<cvename>CVE-2020-2223</cvename>
<url>https://www.jenkins.io/security/advisory/2020-07-15/</url>
</references>
<dates>
<discovery>2020-07-15</discovery>
<entry>2020-07-15</entry>
</dates>
</vuln>
<vuln vid="0ed71663-c369-11ea-b53c-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql56-client</name>
<range><lt>5.6.49</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.49</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.31</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.31</lt></range>
</package>
<package>
<name>mysql80-client</name>
<range><lt>8.0.21</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujul2020.html">
<p>This Critical Patch Update contains 40 new security patches for
Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
<p>The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
MySQL is 9.8.</p>
<p>This Pre-Release Announcement provides advance information about the
Oracle Critical Patch Update for July 2020, which will be released on
Tuesday, July 14, 2020.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujul2020.html</url>
</references>
<dates>
<discovery>2020-07-07</discovery>
<entry>2020-07-11</entry>
</dates>
</vuln>
<vuln vid="c11ee146-c266-11ea-8659-901b0ef719ab">
<topic>FreeBSD -- IPv6 socket option race condition and use after free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_7</lt></range>
<range><ge>11.4</ge><lt>11.4_1</lt></range>
<range><ge>11.3</ge><lt>11.3_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The IPV6_2292PKTOPTIONS set handler was missing synchronization,
so racing accesses could modify freed memory.</p>
<h1>Impact:</h1>
<p>A malicious user application could trigger memory corruption, leading
to privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7457</cvename>
<freebsdsa>SA-20:20.ipv6</freebsdsa>
</references>
<dates>
<discovery>2020-07-09</discovery>
<entry>2020-07-10</entry>
</dates>
</vuln>
<vuln vid="f8b46415-c264-11ea-8659-901b0ef719ab">
<topic>FreeBSD -- posix_spawnp(3) buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.4</ge><lt>11.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>posix_spawnp spawns a new thread with a limited stack allocated on the heap
before delegating to execvp for the final execution within that thread.</p>
<p>execvp would previously make unbounded allocations on the stack, directly
proportional to the length of the user-controlled PATH environment variable.</p>
<h1>Impact:</h1>
<p>Long values in the user-controlled PATH environment variable cause
posix_spawnp to write beyond the end of stack that was allocated, ultimately
overflowing the heap-allocated stack with a direct copy of the value stored
in PATH.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7458</cvename>
<freebsdsa>SA-20:18.posix_spawnp</freebsdsa>
</references>
<dates>
<discovery>2020-07-09</discovery>
<entry>2020-07-10</entry>
</dates>
</vuln>
<vuln vid="198a120d-c22d-11ea-9172-4c72b94353b5">
<topic>mybb -- multible vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/">
<p>High risk: Installer RCE on settings file write</p>
<p>Medium risk: Arbitrary upload paths and Local File Inclusion RCE</p>
<p>Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data</p>
<p>Low risk: Open redirect on login</p>
<p>Low risk: SCEditor reflected XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2019-12-30</discovery>
<entry>2020-07-09</entry>
</dates>
</vuln>
<vuln vid="20b46222-c12b-11ea-abe8-08002728f74c">
<topic>kramdown -- template option vulnerability</topic>
<affects>
<package>
<name>rubygem-kramdown</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kramdown news:</p>
<blockquote cite="https://kramdown.gettalong.org/news.html">
<p>CVE-2020-14001 is addressed to avoid problems when using the
{::options /} extension together with the 'template' option.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kramdown.gettalong.org/news.html</url>
<cvename>CVE-2020-14001</cvename>
</references>
<dates>
<discovery>2020-06-28</discovery>
<entry>2020-07-08</entry>
</dates>
</vuln>
<vuln vid="c685edd9-c045-11ea-8898-001cc0382b2f">
<topic>Mbed TLS -- Side-channel attack on ECC key import and validation</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manuel Pégourié-Gonnard reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07">
<p>The scalar multiplication function in Mbed TLS accepts a random
number generator (RNG) as an optional argument and, if provided,
uses it to protect against some attacks.</p>
<p>It is the caller's responsibility to provide a RNG if protection
against side-channel attacks is desired; however two groups of
functions in Mbed TLS itself fail to pass a RNG:</p>
<ol>
<li>mbedtls_pk_parse_key() and mbedtls_pk_parse_keyfile()</li>
<li>mbedtls_ecp_check_pub_priv() and mbedtls_pk_check_pair()</li>
</ol>
<p>When those functions are called, scalar multiplication is computed
without randomisation, a number of old and new attacks apply,
allowing a powerful local attacker to fully recover the private
key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07</url>
</references>
<dates>
<discovery>2020-07-01</discovery>
<entry>2020-07-07</entry>
</dates>
</vuln>
<vuln vid="f7a97d43-c039-11ea-a051-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.1.0</ge><lt>13.1.3</lt></range>
<range><ge>13.0.0</ge><lt>13.0.9</lt></range>
<range><ge>0</ge><lt>12.10.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/">
<p>Workhorse bypass allows files in /tmp to be read via Maven Repository APIs</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/</url>
<cvename>CVE-2020-15525</cvename>
</references>
<dates>
<discovery>2020-07-06</discovery>
<entry>2020-07-07</entry>
</dates>
</vuln>
<vuln vid="33c05d57-bf6e-11ea-ba1e-0800273f78d3">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#changelog">
<p>The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient
regular expression which can be exploited by an attacker to cause a denial of service.
Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben
Caller and Matt Schwager.</p>
<p>Disallow control characters in hostnames in http.client, addressing CVE-2019-18348.
Such potentially malicious header injection URLs now cause a InvalidURL to be raised.</p>
<p>Disallow CR or LF in email.headerregistry.Address arguments to guard against header
injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url>
<cvename>CVE-2019-18348</cvename>
<cvename>CVE-2020-8492</cvename>
</references>
<dates>
<discovery>2019-10-24</discovery>
<entry>2020-07-06</entry>
</dates>
</vuln>
<vuln vid="ae599263-bca2-11ea-b78f-b42e99a1b9c3">
<topic>samba -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.17</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.11</lt></range>
</package>
<package>
<name>samba412</name>
<range><lt>4.12.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/security.html">
<p>Four vulnerabilities were fixed in samba:</p>
<ul>
<li>CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results</li>
<li>CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU in the AD DC (only)</li>
<li>CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV</li>
<li>CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2020-10730.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-10745.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-10760.html</url>
<url>https://www.samba.org/samba/security/CVE-2020-14303.html</url>
<cvename>CVE-2020-10730</cvename>
<cvename>CVE-2020-10745</cvename>
<cvename>CVE-2020-10760</cvename>
<cvename>CVE-2020-14303</cvename>
</references>
<dates>
<discovery>2020-07-02</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="4344861a-be0b-11ea-9172-4c72b94353b5">
<topic>Anydesk -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>anydesk</name>
<range><lt>5.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Anydesk reports:</p>
<blockquote cite="https://download.anydesk.com/changelog.txt">
<p>AnyDesk before 5.5.3 on Linux and FreeBSD has a format string
vulnerability that can be exploited for remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13160</url>
<cvename>CVE-2020-13160</cvename>
</references>
<dates>
<discovery>2020-06-10</discovery>
<entry>2020-07-04</entry>
</dates>
</vuln>
<vuln vid="d9f686f3-fde0-48dc-ab0a-01c2fe3e0529">
<topic>py-matrix-synapse -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<range><lt>1.15.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.15.2">
<p>Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.</p>
<ul>
<li>A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers.</li>
<li>HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.15.2</url>
</references>
<dates>
<discovery>2020-07-02</discovery>
<entry>2020-07-03</entry>
</dates>
</vuln>
<vuln vid="27616957-b084-11ea-937b-b42e99a1b9c3">
<topic>dbus file descriptor leak</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.12.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub Security Lab reports:</p>
<blockquote cite="https://gitlab.freedesktop.org/dbus/dbus/-/issues/294">
<p>D-Bus has a file descriptor leak, which can lead to denial of service when the dbus-daemon runs out of file descriptors.
An unprivileged local attacker can use this to attack the system dbus-daemon, leading to denial of service for all users of the machine.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.freedesktop.org/dbus/dbus/-/issues/294</url>
<url>https://www.openwall.com/lists/oss-security/2020/06/04/3</url>
<cvename>CVE-2020-12049</cvename>
</references>
<dates>
<discovery>2020-04-09</discovery>
<entry>2020-07-03</entry>
</dates>
</vuln>
<vuln vid="0a305431-bc98-11ea-a051-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.1.0</ge><lt>13.1.2</lt></range>
<range><ge>13.0.0</ge><lt>13.0.8</lt></range>
<range><ge>0</ge><lt>12.10.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/">
<p>Missing Permission Check on Time Tracking</p>
<p>Cross-Site Scripting in PyPi Files API</p>
<p>Insecure Authorization Check on Private Project Security Dashboard</p>
<p>Cross-Site Scripting in References</p>
<p>Cross-Site Scripting in Group Names</p>
<p>Cross-Site Scripting in Blob Viewer</p>
<p>Cross-Site Scripting in Error Tracking</p>
<p>Insecure Authorisation Check on Creation and Deletion of Deploy Tokens</p>
<p>User Name Format Restiction Bypass</p>
<p>Denial of Service in Issue Comments</p>
<p>Cross-Site Scripting in Wiki Pages</p>
<p>Private Merge Request Updates Leaked via Todos</p>
<p>Private User Activity Leaked via API</p>
<p>Cross-Site Scripting in Bitbucket Import Feature</p>
<p>Github Project Restriction Bypass</p>
<p>Update PCRE Dependency</p>
<p>Update Kaminari Gem</p>
<p>Cross-Site Scripting in User Profile</p>
<p>Update Xterm.js</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/</url>
<cvename>CVE-2020-14155</cvename>
<cvename>CVE-2020-11082</cvename>
<cvename>CVE-2019-0542</cvename>
</references>
<dates>
<discovery>2020-07-01</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea">
<topic>coturn -- information leakage</topic>
<affects>
<package>
<name>coturn</name>
<range><lt>4.5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felix Dörre reports:</p>
<blockquote cite="https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm">
<p>The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665)
This is a leak of information between different client connections. One client (an attacker)
could use their connection to intelligently query coturn to get interesting bytes in the
padding bytes from the connection of another client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/coturn/coturn/commit/fdf7065d0f8e676feaf6734e86370f6dadfb8eec</url>
<cvename>CVE-2020-4067</cvename>
</references>
<dates>
<discovery>2020-06-30</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="641cd669-bc37-11ea-babf-6805ca2fa271">
<topic>powerdns-recursor -- access restriction bypass</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><ge>4.3.0</ge><lt>4.3.2</lt></range>
<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.2">
<p>CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal
web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send
HTTP queries to the internal web server, bypassing the restriction.
In the default configuration the API webserver is not enabled. Only installations using a
non-default value for webserver and webserver-address are affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/security-advisories/index.html</url>
<cvename>CVE-2020-14196</cvename>
</references>
<dates>
<discovery>2020-07-01</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="b51d5391-bb76-11ea-9172-4c72b94353b5">
<topic>drupal -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/project/drupal/releases/7.72">
<p>The Drupal core Form API does not properly handle certain form input
from cross-site requests, which can lead to other vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2020-004</url>
</references>
<dates>
<discovery>2020-06-17</discovery>
<entry>2020-07-01</entry>
</dates>
</vuln>
<vuln vid="2675f0db-baa5-11ea-aa12-80ee73419af3">
<topic>xrdp -- Local users can perform a buffer overflow attack against the xrdp-sesman service and then inpersonate it</topic>
<affects>
<package>
<name>xrdp</name>
<range><lt>0.9.13.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ashley Newson reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044">
<p>The xrdp-sesman service can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044</url>
<cvename>CVE-2020-4044</cvename>
</references>
<dates>
<discovery>2020-06-02</discovery>
<entry>2020-06-30</entry>
</dates>
</vuln>
<vuln vid="d0be8e1f-b19a-11ea-94aa-b827eb2f57d4">
<topic>MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON</topic>
<affects>
<package>
<name>mongodb36</name>
<range><lt>3.6.18</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.15</lt></range>
</package>
<package>
<name>mongodb42</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-45472">
<p>Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action.</p>
<p>Credit<br/>
Discovered by Tony Yesudas.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7921</cvename>
</references>
<dates>
<discovery>2020-01-10</discovery>
<entry>2020-06-29</entry>
</dates>
</vuln>
<vuln vid="4200d5f5-b985-11ea-b08a-f8b156b6dcc8">
<topic>libvorbis -- two vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6_1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two vulnerabilities were fixed in the upstream repository:</p>
<ul>
<li>The bark_noise_hybridmp function allows remote attackers
to cause a denial of service (out-of-bounds access and
application crash) or possibly have unspecified other
impact via a crafted file.</li>
<li>mapping0_forward does not validate the number of
channels, which allows remote attackers to cause a denial
of service (heap-based buffer overflow or over-read) or
possibly have unspecified other impact via a crafted
file.</li>
</ul>
</body>
</description>
<references>
<url>https://www.openwall.com/lists/oss-security/2017/09/21/2</url>
<cvename>CVE-2017-14160</cvename>
<url>https://gitlab.xiph.org/xiph/vorbis/-/issues/2335</url>
<cvename>CVE-2018-10392</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2020-06-28</entry>
</dates>
</vuln>
<vuln vid="6190c0cd-b945-11ea-9401-2dcf562daa69">
<topic>PuTTY -- Release 0.74 fixes two security vulnerabilities</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.74</lt></range>
</package>
<package>
<name>putty-gtk2</name>
<range><lt>0.74</lt></range>
</package>
<package>
<name>putty-nogtk</name>
<range><lt>0.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html">
<p>[Release 0.74] fixes the following security issues:</p>
<ul><li>New configuration option to disable PuTTY's default policy of
changing its host key algorithm preferences to prefer keys it
already knows. (There is a theoretical information leak in this
policy.) [CVE-2020-14002]</li>
<li>In some situations an SSH server could cause PuTTY to access freed
mdmory by pretending to accept an SSH key and then refusing the
actual signature. It can only happen if you're using an SSH agent.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-dynamic-hostkey-info-leak.html</url>
<url>https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/</url>
<cvename>CVE-2020-14002</cvename>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-keylist-used-after-free.html</url>
</references>
<dates>
<discovery>2020-06-27</discovery>
<entry>2020-06-28</entry>
</dates>
</vuln>
<vuln vid="6a5d15b6-b661-11ea-8015-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>83.0.4103.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html">
<p>This update includes 2 security fixes, including:</p>
<ul>
<li>[1092308] High CVE-2020-6509: Use after free in extensions.
Reported by Anonymous on 2020-06-08</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6509</cvename>
<url>https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html</url>
</references>
<dates>
<discovery>2020-06-22</discovery>
<entry>2020-06-24</entry>
</dates>
</vuln>
<vuln vid="29b13a34-b1d2-11ea-a11c-4437e6ad11c4">
<topic>Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP</topic>
<affects>
<package>
<name>mutt</name>
<range><le>1.14.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mutt 1.14.4 updates:</p>
<blockquote cite="https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4">
<p>CVE-2020-14954 - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-14954</cvename>
<url>https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4</url>
</references>
<dates>
<discovery>2020-06-16</discovery>
<entry>2020-06-24</entry>
</dates>
</vuln>
<vuln vid="5b397852-b1d0-11ea-a11c-4437e6ad11c4">
<topic>IMAP fcc/postpone machine-in-the-middle attack</topic>
<affects>
<package>
<name>mutt</name>
<range><le>1.14.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mutt 1.14.3 updates:</p>
<blockquote cite="https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01">
<p>CVE-2020-14093 - IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01</url>
<cvename>CVE-2020-14093</cvename>
</references>
<dates>
<discovery>2020-06-14</discovery>
<entry>2020-06-24</entry>
</dates>
</vuln>
<vuln vid="6bff5ca6-b61a-11ea-aef4-08002728f74c">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.20.0</ge><lt>7.71.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2020-8169: Partial password leak over DNS on HTTP redirect</p>
<p>libcurl can be tricked to prepend a part of the password to the
host name before it resolves it, potentially leaking the partial
password over the network and to the DNS server(s).</p>
<p>libcurl can be given a username and password for HTTP
authentication when requesting an HTTP resource - used for HTTP
Authentication such as Basic, Digest, NTLM and similar. The
credentials are set, either together with CURLOPT_USERPWD or
separately with CURLOPT_USERNAME and CURLOPT_PASSWORD. Important
detail: these strings are given to libcurl as plain C strings and
they are not supposed to be URL encoded.</p>
<p>In addition, libcurl also allows the credentials to be set in the
URL, using the standard RFC 3986 format:
http://user:password@host/path. In this case, the name and password
are URL encoded as that's how they appear in URLs.</p>
<p>If the options are set, they override the credentials set in the
URL.</p>
<p>Internally, this is handled by storing the credentials in the "URL
object" so that there is only a single set of credentials stored
associated with this single URL.</p>
<p>When libcurl handles a relative redirect (as opposed to an
absolute URL redirect) for an HTTP transfer, the server is only
sending a new path to the client and that path is applied on to the
existing URL. That "applying" of the relative path on top of an
absolute URL is done by libcurl first generating a full absolute
URL out of all the components it has, then it applies the redirect
and finally it deconstructs the URL again into its separate
components.</p>
<p>This security vulnerability originates in the fact that curl did
not correctly URL encode the credential data when set using one of
the curl_easy_setopt options described above. This made curl
generate a badly formatted full URL when it would do a redirect and
the final re-parsing of the URL would then go bad and wrongly
consider a part of the password field to belong to the host name.</p>
<p>The wrong host name would then be used in a name resolve lookup,
potentially leaking the host name + partial password in clear text
over the network (if plain DNS was used) and in particular to the
used DNS server(s).</p>
<p>CVE-2020-8177: curl overwrite local file with -J</p>
<p>curl can be tricked by a malicious server to overwrite a local
file when using -J (--remote-header-name) and -i (--include) in the
same command line.</p>
<p>The command line tool offers the -J option that saves a remote
file using the file name present in the Content-Disposition:
response header. curl then refuses to overwrite an existing local
file using the same name, if one already exists in the current
directory.</p>
<p>The -J flag is designed to save a response body, and so it doesn't
work together with -i and there's logic that forbids it. However,
the check is flawed and doesn't properly check for when the options
are used in the reversed order: first using -J and then -i were
mistakenly accepted.</p>
<p>The result of this mistake was that incoming HTTP headers could
overwrite a local file if one existed, as the check to avoid the
local file was done first when body data was received, and due to
the mistake mentioned above, it could already have received and
saved headers by that time.</p>
<p>The saved file would only get response headers added to it, as it
would abort the saving when the first body byte arrives. A
malicious server could however still be made to send back virtually
anything as headers and curl would save them like this, until the
first CRLF-CRLF sequence appears.</p>
<p>(Also note that -J needs to be used in combination with -O to have
any effect.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2020-8169.html</url>
<url>https://curl.haxx.se/docs/CVE-2020-8177.html</url>
<cvename>CVE-2020-8169</cvename>
<cvename>CVE-2020-8177</cvename>
</references>
<dates>
<discovery>2020-06-24</discovery>
<entry>2020-06-24</entry>
</dates>
</vuln>
<vuln vid="ce0c8590-b628-11ea-9d28-3c970ee9157c">
<topic>CUPS -- memory corruption</topic>
<affects>
<package>
<name>cups</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apple reports:</p>
<blockquote cite="https://github.com/apple/cups/releases/tag/v2.3.3">
<ul>
<li>CVE-2019-8842: The ippReadIO function may under-read an
extension.</li>
<li>CVE-2020-3898: The ppdOpen function did not handle invalid UI
constraint. ppdcSource::get_resolution function did not handle
invalid resolution strings. An application may be able to gain
elevated privileges.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/apple/cups/releases/tag/v2.3.3</url>
<url>https://support.apple.com/en-us/HT211100</url>
<cvename>CVE-2019-8842</cvename>
<cvename>CVE-2020-3898</cvename>
</references>
<dates>
<discovery>2020-04-28</discovery>
<entry>2020-06-24</entry>
</dates>
</vuln>
<vuln vid="feb8afdc-b3e5-11ea-9df5-08002728f74c">
<topic>Rails -- permission vulnerability</topic>
<affects>
<package>
<name>rubygem-actionpack60</name>
<range><lt>6.0.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/">
<p>Rails 6.0.3.2 has been released! This version of Rails contains an
important security patch, and you should upgrade! The release contains
only one patch that addresses CVE-2020-8185.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/</url>
<url>https://github.com/rails/rails/blob/6-0-stable/actionpack/CHANGELOG.md</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/pAe9EV8gbM0</url>
<cvename>CVE-2020-8185</cvename>
</references>
<dates>
<discovery>2020-06-17</discovery>
<entry>2020-06-22</entry>
</dates>
</vuln>
<vuln vid="77896891-b08a-11ea-937b-b42e99a1b9c3">
<topic>vlc heap-based buffer overflow</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.11,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Guillem reports:</p>
<blockquote cite="http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0">
<p>A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11
allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13428</url>
<cvename>CVE-2020-13428</cvename>
</references>
<dates>
<discovery>2020-05-27</discovery>
<entry>2020-06-17</entry>
</dates>
</vuln>
<vuln vid="f28476f7-b166-11ea-8775-507b9d01076a">
<topic>Several issues in Lynis</topic>
<affects>
<package>
<name>lynis</name>
<range><ge>2.0.0</ge><le>2.7.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lynis update:</p>
<p>This release resolves two security issues</p>
<ul>
<li>CVE-2020-13882 - Discovered by Sander Bos, code submission by Katarina Durechova</li>
<li>CVE-2019-13033 - Discovered by Sander Bos</li>
</ul>
</body>
</description>
<references>
<url>https://github.com/CISOfy/lynis/blob/master/CHANGELOG.md#security-issues</url>
</references>
<dates>
<discovery>2020-06-18</discovery>
<entry>2020-06-18</entry>
</dates>
</vuln>
<vuln vid="f00d1873-b138-11ea-8659-901b0ef719ab">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind911</name>
<range><ge>9.11.14</ge><lt>9.11.20</lt></range>
</package>
<package>
<name>bind916</name>
<range><ge>9.16.0</ge><lt>9.16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/docs/cve-2020-8619">
<p>The asterisk character ("*") is allowed in DNS zone files, where
it is most commonly present as a wildcard at a terminal node of
the Domain Name System graph. However, the RFCs do not require
and BIND does not enforce that an asterisk character be present
only at a terminal node.</p>
<p>A problem can occur when an asterisk is present in an empty
non-terminal location within the DNS graph. If such a node exists,
after a series of queries, named can reach an inconsistent state
that results in the failure of an assertion check in rbtdb.c,
followed by the program exiting due to the assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-8619</cvename>
<url>https://kb.isc.org/docs/cve-2020-8619</url>
</references>
<dates>
<discovery>2020-06-17</discovery>
<entry>2020-06-18</entry>
</dates>
</vuln>
<vuln vid="75d72e03-b137-11ea-8659-901b0ef719ab">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind916</name>
<range><ge>9.16.0</ge><lt>9.16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/docs/cve-2020-8618">
<p>An assertion check in BIND (that is meant to prevent going beyond
the end of a buffer when processing incoming data) can be
incorrectly triggered by a large response during zone transfer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-8618</cvename>
<url>https://kb.isc.org/docs/cve-2020-8618</url>
</references>
<dates>
<discovery>2020-06-17</discovery>
<entry>2020-06-18</entry>
</dates>
</vuln>
<vuln vid="96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3">
<topic>LibreOffice Security Advisory</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>6.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibreOffice reports:</p>
<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/">
<p>Two flaws were found in LibreOffice:</p>
<ul>
<li>CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'</li>
<li>CVE-2020-12803: XForms submissions could overwrite local files</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802</url>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2020-12803</url>
<cvename>CVE-2020-12802</cvename>
<cvename>CVE-2020-12803</cvename>
</references>
<dates>
<discovery>2020-06-08</discovery>
<entry>2020-06-12</entry>
</dates>
</vuln>
<vuln vid="c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3">
<topic>several security issues in sqlite3</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.32.2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_8</lt></range>
<range><ge>11.4</ge><lt>11.4_2</lt></range>
<range><ge>11.3</ge><lt>11.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sqlite3 update:</p>
<p>Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.</p>
<ul>
<li>CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.</li>
<li>CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.</li>
<li>CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.</li>
<li>CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.</li>
<li>CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.</li>
<li>CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.</li>
</ul>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-11655</url>
<cvename>CVE-2020-11655</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13434</url>
<cvename>CVE-2020-13434</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13435</url>
<cvename>CVE-2020-13435</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13630</url>
<cvename>CVE-2020-13630</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13631</url>
<cvename>CVE-2020-13631</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-13632</url>
<cvename>CVE-2020-13632</cvename>
<freebsdsa>SA-20:22.sqlite</freebsdsa>
</references>
<dates>
<discovery>2020-05-25</discovery>
<entry>2020-06-10</entry>
<modified>2020-08-06</modified>
</dates>
</vuln>
<vuln vid="11fcfa8f-ac64-11ea-9dab-000d3ab229d6">
<topic>Node.js -- June 2020 Security Releases</topic>
<affects>
<package>
<name>node</name>
<range><lt>14.4.0</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.18.0</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.21.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/">
<p>Updates are now available for all supported Node.js release lines for the following issues.</p>
<h1>TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)</h1>
<p>The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the
connection may fail to be authorized. If it was saved an authorized connection could be established
later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.</p>
<p>The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized
connections.</p>
<h1>HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)</h1>
<p>Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings,
blocking all other activities until complete.</p>
<p>The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary
using the maxSettings option.</p>
<h1>napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)</h1>
<p>Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16()
with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf,
probably overrunning the length of the buffer.</p>
<p>A exploit has not been reported and it may be difficult but the following is suggested:</p>
<ul>
<li>All users of LTS Node.js versions should update to the versions announced in this security post.
This will address the issue for any non pre-built add-on.</li>
<li>Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not
support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that
will be released soon after this announcement.</li>
</ul>
<h1>ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)</h1>
<p>An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An
integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend()
function in common/unistr.cpp.</p>
<p>Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the
overflow in 10.x.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/</url>
<cvename>CVE-2020-8174</cvename>
<cvename>CVE-2020-8172</cvename>
<cvename>CVE-2020-10531</cvename>
<cvename>CVE-2020-11080</cvename>
</references>
<dates>
<discovery>2020-06-02</discovery>
<entry>2020-06-12</entry>
</dates>
</vuln>
<vuln vid="045e46e8-abe6-11ea-99cb-10bf48e1088e">
<topic>tcpreplay -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>tcpreplay</name>
<range><lt>4.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>fklassen on Github reports:</p>
<blockquote cite="https://github.com/appneta/tcpreplay/releases/tag/v4.3.2">
<p>This release fixes the following security issues:</p>
<ul>
<li>memory access in do_checksum()</li>
<li>NULL pointer dereference get_layer4_v6()</li>
<li>NULL pointer dereference get_ipv6_l4proto()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/appneta/tcpreplay/releases/tag/v4.3.2</url>
<cvename>CVE-2019-8381</cvename>
<cvename>CVE-2019-8376</cvename>
<cvename>CVE-2019-8377</cvename>
</references>
<dates>
<discovery>2019-03-12</discovery>
<entry>2020-06-11</entry>
</dates>
</vuln>
<vuln vid="10a24ce0-ab68-11ea-b9b8-641c67a117d8">
<topic>znc -- Authenticated users can trigger an application crash</topic>
<affects>
<package>
<name>znc</name>
<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13775">
<p>ZNC 1.8.0 up to 1.8.1-rc1 allows attackers to trigger an application
crash (with a NULL pointer dereference) if echo-message is not enabled
and there is no network.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-13775</cvename>
<url>https://wiki.znc.in/ChangeLog/1.8.1</url>
</references>
<dates>
<discovery>2020-06-02</discovery>
<entry>2020-06-10</entry>
</dates>
</vuln>
<vuln vid="2a3588b4-ab12-11ea-a051-001b217b3468">
<topic>NPM -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>npm</name>
<range><lt>6.13.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NPM reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/">
<p>Global node_modules Binary Overwrite</p>
<p>Symlink reference outside of node_modules</p>
<p>Arbitrary File Write</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/</url>
<cvename>CVE-2019-16775</cvename>
<cvename>CVE-2019-16776</cvename>
<cvename>CVE-2019-16777</cvename>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2020-06-10</entry>
</dates>
</vuln>
<vuln vid="329ecd60-aaf7-11ea-8659-10bf48e1088e">
<topic>libadplug -- Various vulnerabilities</topic>
<affects>
<package>
<name>libadplug</name>
<range><lt>2.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Malvineous on Github reports:</p>
<blockquote cite="https://github.com/adplug/adplug/releases/tag/adplug-2.3.3">
<p>This release fixes the following security issues:</p>
<ul>
<li>buffer overflow in .bmf</li>
<li>buffer overflow in .dtm</li>
<li>buffer overflow in .mkj</li>
<li>buffer overflow in .a2m</li>
<li>buffer overflow in .rad</li>
<li>buffer overflow in .mtk</li>
<li>double free and OOB reads in .u6m</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/adplug/adplug/releases/tag/adplug-2.3.3</url>
<cvename>CVE-2019-14690</cvename>
<cvename>CVE-2019-14691</cvename>
<cvename>CVE-2019-14692</cvename>
<cvename>CVE-2019-14732</cvename>
<cvename>CVE-2019-14733</cvename>
<cvename>CVE-2019-14734</cvename>
<cvename>CVE-2019-15151</cvename>
</references>
<dates>
<discovery>2020-06-08</discovery>
<entry>2020-06-10</entry>
</dates>
</vuln>
<vuln vid="9f7ae7ea-da93-4f86-b257-ba76707f6d5d">
<topic>zeek -- Various vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS">
<p>This release fixes the following security issues:</p>
<ul>
<li>
Fix potential stack overflow in NVT analyzer</li>
<li>
Fix NVT analyzer memory leak from multiple telnet authn name options</li>
<li>
Fix multiple content-transfer-encoding headers causing a memory leak</li>
<li>
Fix potential leak of Analyzers added to tree during Analyzer::Done</li>
<li>
Prevent IP fragment reassembly on packets without minimal IP header</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS</url>
</references>
<dates>
<discovery>2020-05-04</discovery>
<entry>2020-06-10</entry>
</dates>
</vuln>
<vuln vid="196b31b8-aa9a-11ea-a59a-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.387</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-30.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2020-9633).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-9633</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb20-30.html</url>
</references>
<dates>
<discovery>2020-06-09</discovery>
<entry>2020-06-09</entry>
</dates>
</vuln>
<vuln vid="32c92a75-aa71-11ea-92ab-00163e433440">
<topic>FreeBSD -- USB HID descriptor parsing error</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_6</lt></range>
<range><ge>11.3</ge><lt>11.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the push/pop level of the USB HID state is not restored within
the processing of the same HID item, an invalid memory location may be
used for subsequent HID item processing.</p>
<h1>Impact:</h1>
<p>An attacker with physical access to a USB port may be able to use a
specially crafted USB device to gain kernel or user-space code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7456</cvename>
<freebsdsa>SA-20:17.usb</freebsdsa>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-06-09</entry>
</dates>
</vuln>
<vuln vid="669f3fe8-a07a-11ea-b83e-f0def1f5c5a2">
<topic>FreeRDP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freerdp</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4</p>
</body>
</description>
<references>
<url>https://github.com/FreeRDP/FreeRDP/blob/2.1.1/ChangeLog</url>
<cvename>CVE-2020-11521</cvename>
<cvename>CVE-2020-11522</cvename>
<cvename>CVE-2020-11523</cvename>
<cvename>CVE-2020-11524</cvename>
<cvename>CVE-2020-11525</cvename>
<cvename>CVE-2020-11526</cvename>
<cvename>CVE-2020-11039</cvename>
<cvename>CVE-2020-11038</cvename>
<cvename>CVE-2020-11043</cvename>
<cvename>CVE-2020-11040</cvename>
<cvename>CVE-2020-11041</cvename>
<cvename>CVE-2020-11019</cvename>
<cvename>CVE-2020-11017</cvename>
<cvename>CVE-2020-11018</cvename>
</references>
<dates>
<discovery>2020-04-10</discovery>
<entry>2020-05-28</entry>
</dates>
</vuln>
<vuln vid="a2caf7bd-a719-11ea-a857-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>83.0.4103.97</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html">
<p>This update includes 5 security fixes. Below, we highlight fixes
that were contributed by external researchers.</p>
<ul>
<li>[1082105] High CVE-2020-6493: Use after free in
WebAuthentication. Reported by Anonymous on 2020-05-13</li>
<li>[1083972] High CVE-2020-6494: Incorrect security UI in payments.
Reported by Juho Nurminen on 2020-05-18</li>
<li>[1072116] High CVE-2020-6495: Insufficient policy enforcement in
developer tools. Reported by David Erceg on 2020-04-18</li>
<li>[1085990] High CVE-2020-6496: Use after free in payments.
Reported by Khalil Zhani on 2020-05-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6493</cvename>
<cvename>CVE-2020-6494</cvename>
<cvename>CVE-2020-6495</cvename>
<cvename>CVE-2020-6496</cvename>
<url>https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-06-05</entry>
</dates>
</vuln>
<vuln vid="40bfab16-a68b-11ea-9ea5-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.0.0</ge><lt>13.0.4</lt></range>
<range><ge>12.10.0</ge><lt>12.10.9</lt></range>
<range><ge>10.6.0</ge><lt>12.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/">
<p>CI Token Access Control</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/</url>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-06-04</entry>
</dates>
</vuln>
<vuln vid="597d02ce-a66c-11ea-af32-080027846a02">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.13</lt></range>
</package>
<package>
<name>py36-django30</name>
<name>py37-django30</name>
<name>py38-django30</name>
<range><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django security release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2020/jun/03/security-releases/">
<p>CVE-2020-13254: Potential data leakage via malformed memcached keys</p>
<p>In cases where a memcached backend does not perform key validation, passing
malformed cache keys could result in a key collision, and potential data leakage.
In order to avoid this vulnerability, key validation is added to the memcached
cache backends.</p>
<p>CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget</p>
<p>Query parameters for the admin ForeignKeyRawIdWidget were not properly URL
encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query
parameters are correctly URL encoded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2020/jun/03/security-releases/</url>
<cvename>CVE-2020-13254</cvename>
<cvename>CVE-2020-13596</cvename>
</references>
<dates>
<discovery>2020-06-01</discovery>
<entry>2020-06-04</entry>
</dates>
</vuln>
<vuln vid="ced2d47e-8469-11ea-a283-b42e99a1b9c3">
<topic>malicious URLs may present credentials to wrong server</topic>
<affects>
<package>
<name>git</name>
<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
<range><ge>0</ge><lt>2.17.4</lt></range>
</package>
<package>
<name>git-lite</name>
<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
<range><ge>0</ge><lt>2.17.4</lt></range>
</package>
<package>
<name>git-gui</name>
<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
<range><ge>0</ge><lt>2.17.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git security advisory reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q">
<p>Git uses external "credential helper" programs to store and retrieve passwords or
other credentials from secure storage provided by the operating system.
Specially-crafted URLs that contain an encoded newline can inject unintended values
into the credential helper protocol stream, causing the credential helper to retrieve
the password for one server for an HTTP request being made to another
server, resulting in credentials for the former being sent to the
latter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q</url>
<cvename>CVE-2020-5260</cvename>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-22</entry>
</dates>
</vuln>
<vuln vid="67765237-8470-11ea-a283-b42e99a1b9c3">
<topic>malicious URLs can cause git to send a stored credential to wrong server</topic>
<affects>
<package>
<name>git</name>
<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
<range><ge>0</ge><lt>2.17.5</lt></range>
</package>
<package>
<name>git-lite</name>
<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
<range><ge>0</ge><lt>2.17.5</lt></range>
</package>
<package>
<name>git-gui</name>
<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
<range><ge>0</ge><lt>2.17.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>git security advisory reports:</p>
<blockquote cite="https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7">
<p>Git uses external "credential helper" programs to store and retrieve passwords or
other credentials from secure storage provided by the operating system. Specially-crafted
URLs that are considered illegal as of the recently published Git versions can cause Git
to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers
will interpret this as matching any URL, and will return some unspecified stored password,
leaking the password to an attacker's server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7</url>
<cvename>CVE-2020-11008</cvename>
</references>
<dates>
<discovery>2020-04-20</discovery>
<entry>2020-04-22</entry>
</dates>
</vuln>
<vuln vid="ef5b4f5f-a658-11ea-80d7-001cc0382b2f">
<topic>GnuTLS -- flaw in TLS session ticket key construction</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03">
<p>It was found that GnuTLS 3.6.4 introduced a regression in the TLS
protocol implementation. This caused the TLS server to not securely
construct a session ticket encryption key considering the
application supplied secret, allowing a MitM attacker to bypass
authentication in TLS 1.3 and recover previous conversations in TLS
1.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03</url>
<cvename>CVE-2020-13777</cvename>
</references>
<dates>
<discovery>2020-06-03</discovery>
<entry>2020-06-04</entry>
</dates>
</vuln>
<vuln vid="ca8327f7-a5a5-11ea-a860-08002728f74c">
<topic>websocket-extensions -- ReDoS vulnerability</topic>
<affects>
<package>
<name>rubygem-websocket-extensions</name>
<range><lt>0.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Changelog:</p>
<blockquote cite="https://github.com/faye/websocket-extensions-ruby/blob/master/CHANGELOG.md#015--2020-06-02">
<p>Remove a ReDoS vulnerability in the header parser (CVE-2020-7663)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/faye/websocket-extensions-ruby/blob/master/CHANGELOG.md</url>
<url>https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b</url>
<cvename>CVE-2020-7663</cvename>
</references>
<dates>
<discovery>2020-06-02</discovery>
<entry>2020-06-03</entry>
</dates>
</vuln>
<vuln vid="4bb56d2f-a5b0-11ea-a860-08002728f74c">
<topic>nghttp2 -- DoS vulnerability</topic>
<affects>
<package>
<name>nghttp2</name>
<name>libnghttp2</name>
<range><lt>1.41.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 security advisories:</p>
<blockquote cite="https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr">
<p>The overly large HTTP/2 SETTINGS frame payload causes denial of service.</p>
<p>The proof of concept attack involves a malicious client constructing a
SETTINGS frame with a length of 14,400 bytes (2400 individual settings
entries) over and over again. The attack causes the CPU to spike at 100%.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr</url>
<cvename>CVE-2020-11080</cvename>
</references>
<dates>
<discovery>2020-06-02</discovery>
<entry>2020-06-03</entry>
</dates>
</vuln>
<vuln vid="1650cee2-a320-11ea-a090-08002734b9ed">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.11.6:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.6">
<ul>
<li>Fix missing authorization check on pull for public repos of private/limited org (#11656) (#11683)</li>
<li>Use session for retrieving org teams (#11438) (#11439)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.11.6</url>
<freebsdpr>ports/246892</freebsdpr>
</references>
<dates>
<discovery>2020-03-01</discovery>
<entry>2020-05-31</entry>
</dates>
</vuln>
<vuln vid="4e6875a2-a126-11ea-b385-08002728f74c">
<topic>kaminari -- potential XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-kaminari-core</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kaminari Security Advisories:</p>
<blockquote cite="https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433">
<p>There was a vulnerability in versions of Kaminari that would allow an
attacker to inject arbitrary code into pages with pagination links.</p>
<p>The 1.2.1 gem including the patch has already been released.</p>
<p>All past released versions are affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433</url>
<url>https://github.com/kaminari/kaminari/blob/master/CHANGELOG.md#121</url>
<url>https://github.com/kaminari/kaminari/pull/1020</url>
<cvename>CVE-2020-11082</cvename>
</references>
<dates>
<discovery>2020-04-22</discovery>
<entry>2020-05-28</entry>
</dates>
</vuln>
<vuln vid="28481349-7e20-4f80-ae1e-e6bf48d4f17c">
<topic>Sane -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>sane-backends</name>
<range><lt>1.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sane Project reports:</p>
<blockquote cite="https://gitlab.com/sane-project/backends/-/releases/1.0.30">
<p>epson2: fixes CVE-2020-12867 (GHSL-2020-075) and several memory management issues found while addressing that CVE</p>
<p>epsonds: addresses out-of-bound memory access issues to fix CVE-2020-12862 (GHSL-2020-082) and CVE-2020-12863 (GHSL-2020-083), addresses a buffer overflow fixing CVE-2020-12865 (GHSL-2020-084) and disables network autodiscovery to mitigate CVE-2020-12866 (GHSL-2020-079), CVE-2020-12861 (GHSL-2020-080) and CVE-2020-12864 (GHSL-2020-081). Note that this backend does not support network scanners to begin with.</p>
<p>magicolor: fixes a floating point exception and uninitialized data read</p>
<p>fixes an overflow in sanei_tcp_read()</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/sane-project/backends/-/releases/1.0.30</url>
<cvename>CVE-2020-12861</cvename>
<cvename>CVE-2020-12862</cvename>
<cvename>CVE-2020-12863</cvename>
<cvename>CVE-2020-12864</cvename>
<cvename>CVE-2020-12865</cvename>
<cvename>CVE-2020-12866</cvename>
<cvename>CVE-2020-12867</cvename>
</references>
<dates>
<discovery>2020-05-17</discovery>
<entry>2020-05-28</entry>
</dates>
</vuln>
<vuln vid="69cf62a8-a0aa-11ea-9ea5-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>13.0.0</ge><lt>13.0.1</lt></range>
<range><ge>12.10.0</ge><lt>12.10.7</lt></range>
<range><ge>12.9.0</ge><lt>12.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/">
<p>User Email Verification Bypass</p>
<p>OAuth Flow Missing Email Verification Checks</p>
<p>Notification Email Verification Bypass</p>
<p>Undisclosed Vulnerability on a Third-Party Rendering Engine</p>
<p>Group Sign-Up Restriction Bypass</p>
<p>Mirror Project Owner Impersonation</p>
<p>Missing Permission Check on Fork Relation Creation</p>
<p>Cross-Site Scripting in Repository Files API</p>
<p>Kubernetes Cluster Token Disclosure</p>
<p>Object Storage File Enumeration</p>
<p>Insecure Authorization Check on Project Deploy Keys</p>
<p>Cross-Site Scripting on Metrics Dashboard</p>
<p>Denial of Service on Custom Dashboards</p>
<p>Client-Side Code Injection through Mermaid Markup</p>
<p>Cross-Site Scripting on Static Site Editor</p>
<p>Disclosure of Amazon EKS Credentials</p>
<p>Denial of Service on Workhorse</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/</url>
</references>
<dates>
<discovery>2020-05-27</discovery>
<entry>2020-05-28</entry>
</dates>
</vuln>
<vuln vid="9908a1cc-35ad-424d-be0b-7e56abd5931a">
<topic>sympa -- Denial of service caused by malformed CSRF token</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.2.54</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Moreno discovered a vulnerability in Sympa web
interface that can cause denial of service (DoS) attack.</p>
<p>By submitting requests with malformed parameters, this
flaw allows to create junk files in Sympa's directory
for temporary files. And particularly by tampering token
to prevent CSRF, it allows to originate exessive
notification messages to listmasters.</p>
</body>
</description>
<references>
<cvename>CVE-2020-9369</cvename>
<url>https://sympa-community.github.io/security/2020-001.html</url>
</references>
<dates>
<discovery>2020-02-24</discovery>
<entry>2020-05-22</entry>
</dates>
</vuln>
<vuln vid="61bc44ce-9f5a-11ea-aff3-f8b156c2bfe9">
<topic>sympa - Security flaws in setuid wrappers</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.2.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability has been discovered in Sympa web interface
by which attacker can execute arbitrary code with root privileges.
Sympa uses two sorts of setuid wrappers:</p>
<ul>
<li>FastCGI wrappers</li>
<li>newaliases wrapper</li>
</ul>
<p>The FastCGI wrappers wwsympa-wrapper.fcgi and
sympa_soap_server-wrapper.fcgi were used to make the web
interface running under privileges of a dedicated user.</p>
<p>The newaliases wrapper (sympa_newaliases-wrapper) allows
Sympa to update the alias database with root privileges.</p>
<p>Since these setuid wrappers did not clear environment variables,
if environment variables like PERL5LIB were injected,
forged code might be loaded and executed under privileges of setuid-ed
users.</p>
</body>
</description>
<references>
<url>https://sympa-community.github.io/security/2020-002.html</url>
</references>
<dates>
<discovery>2020-05-24</discovery>
<entry>2020-05-26</entry>
</dates>
</vuln>
<vuln vid="f9c5a410-9b4e-11ea-ac3f-6805ca2fa271">
<topic>powerdns-recursor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><ge>4.3.0</ge><lt>4.3.1</lt></range>
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
<range><ge>4.1.0</ge><lt>4.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.1">
<p>CVE-2020-10995: An issue in the DNS protocol has been found that allow malicious parties to use
recursive DNS services to attack third party authoritative name servers. The attack uses a crafted
reply by an authoritative name server to amplify the resulting traffic between the recursive and
other authoritative name servers. Both types of service can suffer degraded performance as an effect.</p>
<p>CVE-2020-12244: An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in
the answer section of a NXDOMAIN response lacking an SOA were not properly validated in
SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a
NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation.</p>
<p>CVE-2020-10030: An issue has been found in PowerDNS Authoritative Server allowing an attacker
with enough privileges to change the system's hostname to cause disclosure of uninitialized memory
content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does
not null-terminate the returned string if the hostname is larger than the supplied buffer. Linux
systems are not affected because the buffer is always large enough. OpenBSD systems are not affected
because the returned hostname is always null-terminated. Under some conditions this issue can lead
to the writing of one null-byte out-of-bounds on the stack, causing a denial of service or possibly
arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/security-advisories/index.html</url>
<cvename>CVE-2020-10995</cvename>
<cvename>CVE-2020-12244</cvename>
<cvename>CVE-2020-10030</cvename>
</references>
<dates>
<discovery>2020-05-19</discovery>
<entry>2020-05-26</entry>
<modified>2020-05-29</modified>
</dates>
</vuln>
<vuln vid="38c676bd-9def-11ea-a94c-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>83.0.4103.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html">
<p>This release includes 38 security fixes, including CVEs
CVE-2020-6465 through CVE-2020-6491.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6465</cvename>
<cvename>CVE-2020-6466</cvename>
<cvename>CVE-2020-6467</cvename>
<cvename>CVE-2020-6468</cvename>
<cvename>CVE-2020-6469</cvename>
<cvename>CVE-2020-6470</cvename>
<cvename>CVE-2020-6471</cvename>
<cvename>CVE-2020-6472</cvename>
<cvename>CVE-2020-6473</cvename>
<cvename>CVE-2020-6474</cvename>
<cvename>CVE-2020-6475</cvename>
<cvename>CVE-2020-6476</cvename>
<cvename>CVE-2020-6477</cvename>
<cvename>CVE-2020-6478</cvename>
<cvename>CVE-2020-6479</cvename>
<cvename>CVE-2020-6480</cvename>
<cvename>CVE-2020-6481</cvename>
<cvename>CVE-2020-6482</cvename>
<cvename>CVE-2020-6483</cvename>
<cvename>CVE-2020-6484</cvename>
<cvename>CVE-2020-6485</cvename>
<cvename>CVE-2020-6486</cvename>
<cvename>CVE-2020-6487</cvename>
<cvename>CVE-2020-6488</cvename>
<cvename>CVE-2020-6489</cvename>
<cvename>CVE-2020-6490</cvename>
<cvename>CVE-2020-6491</cvename>
<url>https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html</url>
</references>
<dates>
<discovery>2020-05-19</discovery>
<entry>2020-05-24</entry>
</dates>
</vuln>
<vuln vid="436d7f93-9cf0-11ea-82b8-4c72b94353b5">
<topic>piwigo -- Multible Vulnerabilities</topic>
<affects>
<package>
<name>piwigo</name>
<range><lt>2.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwigo reports:</p>
<blockquote cite="https://www.piwigo.org/release-2.10.2">
<p>Piwigo 2.10.1 is affected by stored XSS
via the Group Name Field to the group_list page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-8089</url>
<cvename>CVE-2020-8089</cvename>
</references>
<dates>
<discovery>2020-02-07</discovery>
<entry>2020-05-23</entry>
</dates>
</vuln>
<vuln vid="676ca486-9c1e-11ea-8b5e-b42e99a1b9c3">
<topic>Apache Tomcat Remote Code Execution via session persistence</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.104</lt></range>
</package>
<package>
<name>tomcat85</name>
<range><lt>8.5.55</lt></range>
</package>
<package>
<name>tomcat9</name>
<range><lt>9.0.35</lt></range>
</package>
<package>
<name>tomcat-devel</name>
<range><lt>10.0.0.M5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<p>Under certain circumstances an attacker will be able to trigger remote code execution via deserialization of the file under their control</p>
</body>
</description>
<references>
<url>http://tomcat.apache.org/security-7.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://tomcat.apache.org/security-9.html</url>
<url>http://tomcat.apache.org/security-10.html</url>
<cvename>CVE-2020-9484</cvename>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-22</entry>
</dates>
</vuln>
<vuln vid="a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c">
<topic>unbound -- mutliple vulnerabilities</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.10.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_7</lt></range>
<range><ge>11.4</ge><lt>11.4_1</lt></range>
<range><ge>11.3</ge><lt>11.3_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLNetLabs reports:</p>
<blockquote cite="https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-May/006833.html">
<p>This release fixes CVE-2020-12662 and CVE-2020-12663.</p>
<p>Bug Fixes:</p>
<ul>
<li>CVE-2020-12662 Unbound can be tricked into
amplifying an incoming query into a large
number of queries directed to a target.</li>
<li>CVE-2020-12663 Malformed answers from
upstream name servers can be used to make
Unbound unresponsive.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-May/006833.html</url>
<cvename>CVE-2020-12662</cvename>
<cvename>CVE-2020-12663</cvename>
<freebsdsa>SA-20:19.unbound</freebsdsa>
</references>
<dates>
<discovery>2020-05-19</discovery>
<entry>2020-05-22</entry>
<modified>2020-07-10</modified>
</dates>
</vuln>
<vuln vid="c5ec57a9-9c2b-11ea-82b8-4c72b94353b5">
<topic>drupal -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.70</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/project/drupal/releases/7.70">
<p>The jQuery project released version 3.5.0, and as part of that,
disclosed two security vulnerabilities that affect all prior versions.
As mentioned in the jQuery blog, both are: ... Security issues in
jQuerys DOM manipulation methods, as in .html(), .append(), and the others.
Security advisories for both of these issues have been published on GitHub.</p>
<p>Drupal 7 has an Open Redirect vulnerability.
For example, a user could be tricked into visiting a specially crafted link
which would redirect them to an arbitrary external URL. The vulnerability is
caused by insufficient validation of the destination query parameter in the
drupal_goto() function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2020-002</url>
<url>https://www.drupal.org/sa-core-2020-003</url>
</references>
<dates>
<discovery>2020-05-20</discovery>
<entry>2020-05-22</entry>
</dates>
</vuln>
<vuln vid="4d11d37e-9a8d-11ea-b9b8-641c67a117d8">
<topic>Zabbix -- Remote code execution</topic>
<affects>
<package>
<name>zabbix3-server</name>
<name>zabbix3-proxy</name>
<range><lt>3.0.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zabbix reports:</p>
<blockquote cite="https://www.zabbix.com/rn/rn3.0.31">
<p>Fixed security vulnerability cve-2020-11800 (remote code execution).
(ZBX-17600)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-11800</cvename>
<url>https://www.zabbix.com/rn/rn3.0.31</url>
<url>https://support.zabbix.com/browse/ZBX-17600</url>
</references>
<dates>
<discovery>2020-04-15</discovery>
<entry>2020-05-20</entry>
</dates>
</vuln>
<vuln vid="85fca718-99f6-11ea-bf1d-08002728f74c">
<topic>Rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack52</name>
<name>rubygem-actionview52</name>
<name>rubygem-activestorage52</name>
<name>rubygem-activesupport52</name>
<range><lt>5.2.4.3</lt></range>
</package>
<package>
<name>rubygem-actionpack60</name>
<name>rubygem-actionview60</name>
<name>rubygem-activestorage60</name>
<name>rubygem-activesupport60</name>
<range><lt>6.0.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/">
<p>Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can.</p>
<p>Both releases contain the following fixes:</p>
<p>CVE-2020-8162: Circumvention of file size limits in ActiveStorage</p>
<p>CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack</p>
<p>CVE-2020-8165: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore</p>
<p>CVE-2020-8166: Ability to forge per-form CSRF tokens given a global CSRF token</p>
<p>CVE-2020-8167: CSRF Vulnerability in rails-ujs</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0</url>
<cvename>CVE-2020-8162</cvename>
<cvename>CVE-2020-8164</cvename>
<cvename>CVE-2020-8165</cvename>
<cvename>CVE-2020-8166</cvename>
<cvename>CVE-2020-8167</cvename>
</references>
<dates>
<discovery>2020-05-18</discovery>
<entry>2020-05-19</entry>
</dates>
</vuln>
<vuln vid="37d106a8-15a4-483e-8247-fcb68b16eaf8">
<topic>Dovecot -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html">
<p>Vulnerability Details:
Sending malformed NOOP command causes crash in submission, submission-login or
lmtp service.
Risk:
Remote attacker can keep submission-login service down, causing denial of
service attack. For lmtp the risk is neglible, as lmtp is usually behind a
trusted MTA.
Steps to reproduce:
Send ``NOOP EE"FY`` to submission port, or similarly malformed command.</p>
<p>Vulnerability Details:
Sending command followed by sufficient number of newlines triggers a
use-after-free bug that might crash submission-login, submission or
lmtp service.
Risk:
Remote attacker can keep submission-login service down, causing denial
of service attack. For lmtp the risk is neglible, as lmtp is usually
behind a trusted MTA.
Steps to reproduce:
This can be currently reproduced with ASAN or Valgrind. Reliable way to
crash has not yet been discovered.
</p>
<p>Vulnerability Details:
Sending mail with empty quoted localpart causes submission or lmtp component
to crash.
Risk:
Malicious actor can cause denial of service to mail delivery by repeatedly
sending mails with bad sender or recipient address.
Steps to reproduce:
Send mail with envelope sender or recipient as <""@example.org>.
Workaround:
For submission there is no workaround, but triggering the bug requires valid
credentials.
For lmtp, one can implement sufficient filtering on MTA level to prevent mails
with such addresses from ending up in LMTP delivery.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html</url>
<cvename>CVE-2020-10957</cvename>
<cvename>CVE-2020-10958</cvename>
<cvename>CVE-2020-10967</cvename>
</references>
<dates>
<discovery>2020-04-02</discovery>
<entry>2020-05-18</entry>
</dates>
</vuln>
<vuln vid="91ce95d5-cd15-4105-b942-af5ccc7144c1">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html">
<p>CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module
in ClamAV 0.102.2 that could cause a denial-of-service condition.
Improper bounds checking of an unsigned variable results in an
out-of-bounds read which causes a crash. Special thanks to Daehui Chang
and Fady Othman for helping identify the ARJ parsing vulnerability.
</p>
<p>CVE-2020-3341: Fixed a vulnerability in the PDF-parsing module in ClamAV
0.101 - 0.102.2 that could cause a denial-of-service condition. Improper
size checking of a buffer used to initialize AES decryption routines
results in an out-of-bounds read, which may cause a crash. OSS-Fuzz
discovered this vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html</url>
<cvename>CVE-2020-3327</cvename>
<cvename>CVE-2020-3341</cvename>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-14</entry>
</dates>
</vuln>
<vuln vid="ce6db19b-976e-11ea-93c4-08002728f74c">
<topic>Rails -- remote code execution vulnerability</topic>
<affects>
<package>
<name>rubygem-actionview4</name>
<range><lt>4.2.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/">
<p>Due to an unfortunate oversight, Rails 4.2.11.2 has a missing constant
error. To address this Rails 4.2.11.3 has been released.</p>
<p>The original announcement for CVE-2020-8163 has a follow-up message
with an updated patch if you’re unable to use the gems.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/</url>
<url>https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0</url>
<cvename>CVE-2020-8163</cvename>
</references>
<dates>
<discovery>2020-05-15</discovery>
<entry>2020-05-16</entry>
</dates>
</vuln>
<vuln vid="6bf55af9-973b-11ea-9f2c-38d547003487">
<topic>salt -- multiple vulnerabilities in salt-master process</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<name>py37-salt</name>
<name>py38-salt</name>
<range><lt>2019.2.4</lt></range>
<range><ge>3000</ge><lt>3000.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>F-Secure reports:</p>
<blockquote cite="https://labs.f-secure.com/advisories/saltstack-authorization-bypass">
<h3>CVE-2020-11651 - Authentication bypass vulnerabilities</h3>
<p>The ClearFuncs class processes unauthenticated requests and
unintentionally exposes the _send_pub() method, which can be used to
queue messages directly on the master publish server. Such messages
can be used to trigger minions to run arbitrary commands as root.</p>
<p>The ClearFuncs class also exposes the method _prep_auth_info(),
which returns the "root key" used to authenticate commands from the
local root user on the master server. This "root key" can then be
used to remotely call administrative commands on the master server.
This unintentional exposure provides a remote un-authenticated
attacker with root-equivalent access to the salt master.</p>
<p/>
<h3>CVE-2020-11652 - Directory traversal vulnerabilities</h3>
<p>The wheel module contains commands used to read and write files
under specific directory paths. The inputs to these functions are
concatenated with the target directory and the resulting path is not
canonicalized, leading to an escape of the intended path restriction.</p>
<p>The get_token() method of the salt.tokens.localfs class (which is
exposed to unauthenticated requests by the ClearFuncs class) fails
to sanitize the token input parameter which is then used as a
filename, allowing insertion of ".." path elements and thus reading
of files outside of the intended directory. The only restriction is
that the file has to be deserializable by salt.payload.Serial.loads().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-11651</cvename>
<cvename>CVE-2020-11652</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-11651</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-11652</url>
<url>https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html</url>
<url>https://labs.f-secure.com/advisories/saltstack-authorization-bypass</url>
<url>https://blog.f-secure.com/new-vulnerabilities-make-exposed-salt-hosts-easy-targets/</url>
<url>https://www.tenable.com/blog/cve-2020-11651-cve-2020-11652-critical-salt-framework-vulnerabilities-exploited-in-the-wild</url>
</references>
<dates>
<discovery>2020-04-30</discovery>
<entry>2020-05-16</entry>
</dates>
</vuln>
<vuln vid="abc3ef37-95d4-11ea-9004-25fadb81abf4">
<topic>json-c -- integer overflow and out-of-bounds write via a large JSON file</topic>
<affects>
<package>
<name>json-c</name>
<range><lt>0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Stöckmann reports:</p>
<blockquote cite="https://github.com/json-c/json-c/pull/592">
<p>
I have discovered a way to trigger an out of boundary write while
parsing a huge json file through a malicious input source. It can be
triggered if an attacker has control over the input stream or if a
huge load during filesystem operations can be triggered.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/json-c/json-c/pull/592</url>
<url>https://github.com/json-c/json-c/pull/599</url>
<cvename>CVE-2020-12762</cvename>
</references>
<dates>
<discovery>2020-05-02</discovery>
<entry>2020-05-14</entry>
<modified>2020-05-17</modified>
</dates>
</vuln>
<vuln vid="59fabdf2-9549-11ea-9448-08002728f74c">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<name>typo3-9-php74</name>
<range><lt>9.5.17</lt></range>
</package>
<package>
<name>typo3-10-php72</name>
<name>typo3-10-php73</name>
<name>typo3-10-php74</name>
<range><lt>10.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 News:</p>
<blockquote cite="https://typo3.org/article/typo3-1042-and-9517-security-releases-published">
<p>CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in
Password Reset</p>
<p>It has been discovered that time-based attacks can be used with the
password reset functionality for backend users. This allows an attacker
to verify whether a backend user account with a given email address
exists or not.</p>
<p/>
<p>CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form
Engine</p>
<p>It has been discovered that HTML placeholder attributes containing
data of other database records are vulnerable to cross-site scripting. A
valid backend user account is needed to exploit this vulnerability.</p>
<p/>
<p>CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link
Handling</p>
<p>It has been discovered that link tags generated by typolink
functionality are vulnerable to cross-site scripting - properties being
assigned as HTML attributes have not been parsed correctly.</p>
<p/>
<p>CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing
side-effects when being unserialized</p>
<p>Calling unserialize() on malicious user-submitted content can result
in the following scenarios:</p>
<p>- trigger deletion of arbitrary directory in file system (if writable
for web server)</p>
<p>- trigger message submission via email using identity of web site
(mail relay)</p>
<p>Another insecure deserialization vulnerability is required to actually
exploit mentioned aspects.</p>
<p/>
<p>CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in
Backend User Settings</p>
<p>It has been discovered that backend user settings (in $BE_USER->uc) are
vulnerable to insecure deserialization. In combination with
vulnerabilities of 3rd party components this can lead to remote code
execution. A valid backend user account is needed to exploit this
vulnerability.</p>
<p/>
<p>CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to
Backend User Interface</p>
<p>It has been discovered that the backend user interface and install tool
are vulnerable to same-site request forgery. A backend user can be
tricked into interacting with a malicious resource an attacker
previously managed to upload to the web server - scripts are then
executed with the privileges of the victims’ user session.</p>
<p>In a worst case scenario new admin users can be created which can
directly be used by an attacker. The vulnerability is basically a
cross-site request forgery (CSRF) triggered by a cross-site scripting
vulnerability (XSS) - but happens on the same target host - thus, it’
actually a same-site request forgery (SSRF).</p>
<p>Malicious payload such as HTML containing JavaScript might be provided
by either an authenticated backend user or by a non-authenticated user
using a 3rd party extension - e.g. file upload in a contact form with
knowing the target location.</p>
<p>The attacked victim requires an active and valid backend or install
tool user session at the time of the attack to be successful.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-1042-and-9517-security-releases-published</url>
<url>https://get.typo3.org/release-notes/9.5.17</url>
<url>https://get.typo3.org/release-notes/10.4.2</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-001</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-002</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-003</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-004</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-005</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2020-006</url>
<cvename>CVE-2020-11063</cvename>
<cvename>CVE-2020-11064</cvename>
<cvename>CVE-2020-11065</cvename>
<cvename>CVE-2020-11066</cvename>
<cvename>CVE-2020-11067</cvename>
<cvename>CVE-2020-11069</cvename>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-13</entry>
</dates>
</vuln>
<vuln vid="0bfcae0b-947f-11ea-92ab-00163e433440">
<topic>FreeBSD -- Insufficient cryptodev MAC key length check</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Requests to create cryptography sessions using a MAC did not validate the
user-supplied MAC key length. The cryptodev module allocates a buffer whose
size is this user-suppled length.</p>
<h1>Impact:</h1>
<p>An unprivileged process can trigger a kernel panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-15879</cvename>
<freebsdsa>SA-20:15.cryptodev</freebsdsa>
</references>
<dates>
<discovery>2020-01-20</discovery>
<entry>2020-05-12</entry>
</dates>
</vuln>
<vuln vid="9f15c2da-947e-11ea-92ab-00163e433440">
<topic>FreeBSD -- Use after free in cryptodev module</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_5</lt></range>
<range><ge>11.3</ge><lt>11.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A race condition permitted a data structure in the kernel to be used
after it was freed by the cryptodev module.</p>
<h1>Impact:</h1>
<p>An unprivileged process can overwrite arbitrary kernel memory.</p>
</body>
</description>
<references>
<cvename>CVE-2019-15879</cvename>
<freebsdsa>SA-20:15.cryptodev</freebsdsa>
</references>
<dates>
<discovery>2020-01-20</discovery>
<entry>2020-05-12</entry>
</dates>
</vuln>
<vuln vid="253486f5-947d-11ea-92ab-00163e433440">
<topic>FreeBSD -- Improper checking in SCTP-AUTH shared key update</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.3</ge><lt>11.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SCTP layer does improper checking when an application tries to update
a shared key. Therefore an unprivileged local user can trigger a use-after-
free situation, for example by specific sequences of updating shared keys and
closing the SCTP association.</p>
<h1>Impact:</h1>
<p>Triggering the use-after-free situation may result in unintended kernel
behaviour including a kernel panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-15878</cvename>
<freebsdsa>SA-20:14.sctp</freebsdsa>
</references>
<dates>
<discovery>2019-09-19</discovery>
<entry>2020-05-12</entry>
</dates>
</vuln>
<vuln vid="78992249-947c-11ea-92ab-00163e433440">
<topic>FreeBSD -- Memory disclosure vulnerability in libalias</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_5</lt></range>
<range><ge>11.4</ge><lt>11.4_1</lt></range>
<range><ge>11.3</ge><lt>11.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The FTP packet handler in libalias incorrectly calculates some packet
lengths. This may result in disclosing small amounts of memory from the
kernel (for the in-kernel NAT implementation) or from the process space for
natd (for the userspace implementation).</p>
<h1>Impact:</h1>
<p>A malicious attacker could send specially constructed packets that exploit the
erroneous calculation allowing the attacker to disclose small amount of memory
either from the kernel (for the in-kernel NAT implementation) or from the
process space for natd (for the userspace implementation).</p>
</body>
</description>
<references>
<cvename>CVE-2020-7455</cvename>
<freebsdsa>SA-20:13.libalias</freebsdsa>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-12</entry>
</dates>
</vuln>
<vuln vid="30ce591c-947b-11ea-92ab-00163e433440">
<topic>FreeBSD -- Insufficient packet length validation in libalias</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_5</lt></range>
<range><ge>11.4</ge><lt>11.4_1</lt></range>
<range><ge>11.3</ge><lt>11.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>libalias(3) packet handlers do not properly validate the packet length before
accessing the protocol headers. As a result, if a libalias(3) module does
not properly validate the packet length before accessing the protocol header,
it is possible for an out of bound read or write condition to occur.</p>
<h1>Impact:</h1>
<p>A malicious attacker could send specially constructed packets that exploit
the lack of validation allowing the attacker to read or write memory either
from the kernel (for the in-kernel NAT implementation) or from the process
space for natd (for the userspace implementation).</p>
</body>
</description>
<references>
<cvename>CVE-2020-7454</cvename>
<freebsdsa>SA-20:12.libalias</freebsdsa>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-12</entry>
</dates>
</vuln>
<vuln vid="452d16bb-920d-11ea-9d20-18a6f7016652">
<topic>qutebrowser -- Reloading page with certificate errors shows a green URL</topic>
<affects>
<package>
<name>qutebrowser</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qutebrowser developers report:</p>
<blockquote cite="https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j">
<p>After a certificate error was overridden by the user,
qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg).
However, when the affected website was subsequently loaded again,
the URL was mistakenly displayed as green (colors.statusbar.url.success_https).
While the user already has seen a certificate error prompt at this point
(or set content.ssl_strict to false which is not recommended),
this could still provide a false sense of security.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j</url>
<url>https://github.com/qutebrowser/qutebrowser/issues/5403</url>
<cvename>CVE-2020-11054</cvename>
</references>
<dates>
<discovery>2020-05-02</discovery>
<entry>2020-05-09</entry>
</dates>
</vuln>
<vuln vid="ca595a25-91d8-11ea-b470-080027846a02">
<topic>Python -- CRLF injection via the host part of the url passed to urlopen()</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.18</lt></range>
</package>
<package>
<name>python38</name>
<range><lt>3.8.3</lt></range>
</package>
<package>
<name>python37</name>
<range><le>3.7.7</le></range>
</package>
<package>
<name>python36</name>
<range><lt>3.6.10</lt></range>
</package>
<package>
<name>python35</name>
<range><le>3.5.9_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348">
<p>An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x
through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as
demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in
the host component of a URL) followed by an HTTP header.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348</url>
<url>https://bugs.python.org/issue38576</url>
<cvename>CVE-2019-18348</cvename>
</references>
<dates>
<discovery>2019-10-24</discovery>
<entry>2020-05-09</entry>
<modified>2020-06-13</modified>
</dates>
</vuln>
<vuln vid="d222241d-91cc-11ea-82b8-4c72b94353b5">
<topic>glpi -- stored XSS</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>9.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Corporation reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239">
<p>inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb</url>
<url>https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239</url>
<cvename>CVE-2019-13239</cvename>
</references>
<dates>
<discovery>2019-02-25</discovery>
<entry>2020-05-09</entry>
<modified>2024-04-25</modified>
</dates>
</vuln>
<vuln vid="1a6b7641-aed2-4ba1-96f4-c282d5b09c37">
<topic>zeek -- Various vulnerabilities</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS">
<p>This release fixes the following security issues:</p>
<ul>
<li>
Fix buffer over-read in Ident analyzer </li>
<li>
Fix SSL scripting error leading to uninitialized field
access and memory leak </li>
<li>
Fix POP3 analyzer global buffer over-read </li>
<li>
Fix potential stack overflows due to use of
Variable-Length-Arrays </li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS</url>
</references>
<dates>
<discovery>2020-05-06</discovery>
<entry>2020-05-06</entry>
</dates>
</vuln>
<vuln vid="d5fead4f-8efa-11ea-a5c8-08002728f74c">
<topic>Wagtail -- potential timing attack vulnerability</topic>
<affects>
<package>
<name>py35-wagtail</name>
<name>py36-wagtail</name>
<name>py37-wagtail</name>
<name>py38-wagtail</name>
<range><lt>2.7.3</lt></range>
<range><ge>2.8</ge><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wagtail release notes:</p>
<blockquote cite="https://docs.wagtail.io/en/latest/releases/2.8.2.html">
<p>CVE-2020-11037: Potential timing attack on password-protected private pages</p>
<p>This release addresses a potential timing attack on pages or documents
that have been protected with a shared password through Wagtail's
"Privacy" controls. This password check is performed through a
character-by-character string comparison, and so an attacker who is
able to measure the time taken by this check to a high degree of
accuracy could potentially use timing differences to gain knowledge of
the password. (This is understood to be feasible on a local network, but
not on the public internet.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.wagtail.io/en/latest/releases/2.8.2.html</url>
<url>https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6</url>
<cvename>CVE-2020-11037</cvename>
</references>
<dates>
<discovery>2020-05-04</discovery>
<entry>2020-05-05</entry>
</dates>
</vuln>
<vuln vid="88760f4d-8ef7-11ea-a66d-4b2ef158be83">
<topic>mailman -- arbitrary content injection vulnerability via options or private archive login pages</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.30_4</lt></range>
<range><ge>2.1.31</ge><lt>2.1.33</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.30_4</lt></range>
<range><ge>2.1.31</ge><lt>2.1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1845/NEWS#L8">
<p>A content injection vulnerability via the options login page has
been discovered and reported by Vishal Singh.
</p>
</blockquote>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1873722">
<p>
An issue similar to CVE-2018-13796 exists at different endpoint & param. It can lead to a phishing attack.
</p>
</blockquote>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1877379">
<p>
(added 2020-05-07) This is essentially the same as
https://bugs.launchpad.net/mailman/+bug/1873722 except the vector is
the private archive login page and the attack only succeeds if the
list's roster visibility (private_roster) setting is 'Anyone'.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1845/NEWS#L8</url>
<url>https://bugs.launchpad.net/mailman/+bug/1873722</url>
<url>https://bugs.launchpad.net/mailman/+bug/1877379</url>
<url>https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/</url>
<cvename>CVE-2018-13796</cvename>
</references>
<dates>
<discovery>2020-04-20</discovery>
<entry>2020-05-07</entry>
</dates>
</vuln>
<vuln vid="cd864f1a-8e5a-11ea-b5b4-641c67a117d8">
<topic>cacti -- XSS exposure</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti developer reports:</p>
<blockquote cite="https://sourceforge.net/p/cacti/mailman/message/37000502/">
<p>Lack of escaping of color items can lead to XSS exposure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/cacti/mailman/message/37000502/</url>
<url>https://github.com/Cacti/cacti/blob/release/1.2.12/CHANGELOG</url>
<cvename>CVE-2020-7106</cvename>
<freebsdpr>ports/246164</freebsdpr>
</references>
<dates>
<discovery>2020-04-16</discovery>
<entry>2020-05-04</entry>
</dates>
</vuln>
<vuln vid="57c1c2ee-7914-11ea-90bf-0800276545c1">
<topic>Squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Squid developers reports:</p>
<blockquote cite="http://lists.squid-cache.org/pipermail/squid-announce/2020-February/000107.html">
<p>Improper Input Validation issues in HTTP Request
processing (CVE-2020-8449, CVE-2020-8450).</p>
<p>Information Disclosure issue in FTP Gateway
(CVE-2019-12528).</p>
<p>Buffer Overflow issue in ext_lm_group_acl helper
(CVE-2020-8517).</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.squid-cache.org/pipermail/squid-announce/2020-February/000107.html</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-8449</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-8450</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-12528</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-8517</url>
<cvename>CVE-2020-8449</cvename>
<cvename>CVE-2020-8450</cvename>
<cvename>CVE-2019-12528</cvename>
<cvename>CVE-2020-8517</cvename>
<freebsdpr>ports/244026</freebsdpr>
</references>
<dates>
<discovery>2020-02-10</discovery>
<entry>2020-04-07</entry>
</dates>
</vuln>
<vuln vid="d3f3e818-8d10-11ea-8668-e0d55e2a8bf9">
<topic>taglib -- heap-based buffer over-read via a crafted audio file</topic>
<affects>
<package>
<name>taglib</name>
<range><lt>1.12.b.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webin security lab - dbapp security Ltd reports:</p>
<blockquote cite="https://seclists.org/fulldisclosure/2018/May/49">
<p>The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/fulldisclosure/2018/May/49</url>
<cvename>CVE-2018-11439</cvename>
</references>
<dates>
<discovery>2018-05-28</discovery>
<entry>2020-05-03</entry>
</dates>
</vuln>
<vuln vid="e8483115-8b8e-11ea-bdcf-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.10.0</ge><lt>12.10.2</lt></range>
<range><ge>12.9.0</ge><lt>12.9.5</lt></range>
<range><ge>8.4.0</ge><lt>12.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/">
<p>Path Traversal in NuGet Package Registry</p>
<p>Workhorse Bypass Leads to File Disclosure</p>
<p>OAuth Application Client Secrets Revealed</p>
<p>Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes</p>
<p>Code Owners Protection Not Enforced from Web UI</p>
<p>Repository Mirror Passwords Exposed To Maintainers</p>
<p>Admin Audit Log Page Denial of Service</p>
<p>Private Project ID Revealed Through Group API</p>
<p>Elasticsearch Credentials Logged to ELK</p>
<p>GitHub Personal Access Token Exposed on Integrations Page</p>
<p>Update Nokogiri dependency</p>
<p>Update OpenSSL Dependency</p>
<p>Update git</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/</url>
<cvename>CVE-2020-12448</cvename>
<cvename>CVE-2020-10187</cvename>
<cvename>CVE-2020-7595</cvename>
<cvename>CVE-2020-1967</cvename>
<cvename>CVE-2020-11008</cvename>
</references>
<dates>
<discovery>2020-04-30</discovery>
<entry>2020-05-01</entry>
</dates>
</vuln>
<vuln vid="4a10902f-8a48-11ea-8668-e0d55e2a8bf9">
<topic>vlc -- Multiple vulnerabilities fixed in VLC media player</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.10,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN reports:</p>
<blockquote cite="https://www.videolan.org/security/sb-vlc309.html">
<h3>Details</h3>
<p> A remote user could:</p>
<ul>
<li> Create a specifically crafted image file that could trigger an out of bounds read </li>
<li> Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues</li>
</ul>
<h3>Impact</h3>
<p>
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
</p><p>
While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.</p>
<p>
We have not seen exploits performing code execution through these vulnerabilities</p>
<p>CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.videolan.org/security/sb-vlc309.html</url>
</references>
<dates>
<discovery>2020-04-01</discovery>
<entry>2020-04-29</entry>
</dates>
</vuln>
<vuln vid="3c7911c9-8a29-11ea-8d8c-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.15</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.8</lt></range>
</package>
<package>
<name>samba412</name>
<range><lt>4.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/samba-4.12.2.html">
<p>CVE-2020-10700</p>
<p>A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a
use-after-free in Samba's AD DC LDAP server.</p>
<p>CVE-2020-10704</p>
<p>A deeply nested filter in an un-authenticated LDAP search can exhaust the
LDAP server's stack memory causing a SIGSEGV.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/history/samba-4.12.2.html</url>
<cvename>CVE-2020-10700</cvename>
<cvename>CVE-2020-10704</cvename>
</references>
<dates>
<discovery>2020-04-29</discovery>
<entry>2020-04-29</entry>
</dates>
</vuln>
<vuln vid="5b6bc863-89dc-11ea-af8b-00155d0a0200">
<topic>ceph14 -- multiple security issues</topic>
<affects>
<package>
<name>ceph14</name>
<range><gt>14.1.1</gt><lt>14.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/cve-2020-1759">
<p>ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions.</p>
</blockquote>
<blockquote cite="https://access.redhat.com/security/cve/cve-2020-1760">
<p>ceph: header-splitting in RGW GetObject has a possible XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-1759</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/04/07/2</url>
<cvename>CVE-2020-1760</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/04/07/1</url>
</references>
<dates>
<discovery>2020-04-07</discovery>
<entry>2020-04-14</entry>
</dates>
</vuln>
<vuln vid="c7617931-8985-11ea-93ef-b42e99a1b9c3">
<topic>nested filters leads to stack overflow</topic>
<affects>
<package>
<name>openldap24-server</name>
<range><lt>2.4.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Howard Chu reports:</p>
<blockquote cite="https://bugs.openldap.org/show_bug.cgi?id=9202">
<p>nested filters leads to stack overflow</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.openldap.org/show_bug.cgi?id=9202</url>
<cvename>CVE-2020-12243</cvename>
</references>
<dates>
<discovery>2020-04-28</discovery>
<entry>2020-04-28</entry>
</dates>
</vuln>
<vuln vid="aae8fecf-888e-11ea-9714-08002718de91">
<topic>py-yaml -- FullLoader (still) exploitable for arbitrary command execution</topic>
<affects>
<package>
<name>py27-yaml</name>
<name>py35-yaml</name>
<name>py36-yaml</name>
<name>py37-yaml</name>
<name>py38-yaml</name>
<range><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Riccardo Schirone (https://github.com/ret2libc) reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1807367">
<p>In FullLoader python/object/new constructor, implemented by
construct_python_object_apply, has support for setting the
state of a deserialized instance through the set_python_instance_state
method. After setting the state, some operations are performed
on the instance to complete its initialization, however it is
possible for an attacker to set the instance' state in such a way
that arbitrary code is executed by the FullLoader.</p>
<p>This patch tries to block such attacks in FullLoader by
preventing set_python_instance_state from setting arbitrar
properties. It implements a blacklist that includes extend method
(called by construct_python_object_apply) and all special
methods (e.g. __set__, __setitem__, etc.).</p>
<p>Users who need special attributes being set in the state of a
deserialized object can still do it through the UnsafeLoader, which
however should not be used on untrusted input. Additionally, they can
subclass FullLoader and redefine state_blacklist_regexp to include the
additional attributes they need, passing the subclassed loader to
yaml.load.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1807367</url>
<url>https://github.com/yaml/pyyaml/pull/386</url>
<cvename>CVE-2020-1747</cvename>
<freebsdpr>ports/245937</freebsdpr>
</references>
<dates>
<discovery>2020-03-02</discovery>
<entry>2020-04-27</entry>
<modified>2020-04-29</modified>
</dates>
</vuln>
<vuln vid="4c52ec3c-86f3-11ea-b5b4-641c67a117d8">
<topic>py-bleach -- regular expression denial-of-service</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py35-bleach</name>
<name>py36-bleach</name>
<name>py37-bleach</name>
<name>py38-bleach</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bleach developers reports:</p>
<blockquote cite="https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm">
<p>bleach.clean behavior parsing style attributes could result in a
regular expression denial of service (ReDoS).</p>
<p>Calls to bleach.clean with an allowed tag with an allowed style
attribute are vulnerable to ReDoS. For example, bleach.clean(...,
attributes={'a': ['style']}).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1623633</url>
<cvename>CVE-2020-6817</cvename>
<freebsdpr>ports/245943</freebsdpr>
</references>
<dates>
<discovery>2019-03-09</discovery>
<entry>2020-04-26</entry>
</dates>
</vuln>
<vuln vid="21d59ea3-8559-11ea-a5e2-d4c9ef517024">
<topic>MySQL Server -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.45</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.32</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.23</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.13</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.48</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.30</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.20</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.68</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.48</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
<p>This Critical Patch Update contains 45 new security patches for
Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
<p>MariaDB reports 4 of these vulnerabilities exist in their software</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
<cvename>CVE-2019-5482</cvename>
<cvename>CVE-2019-15601</cvename>
<cvename>CVE-2020-2780</cvename>
<cvename>CVE-2020-2790</cvename>
<cvename>CVE-2020-2768</cvename>
<cvename>CVE-2020-2804</cvename>
<cvename>CVE-2020-2760</cvename>
<cvename>CVE-2020-2806</cvename>
<cvename>CVE-2020-2762</cvename>
<cvename>CVE-2020-2814</cvename>
<cvename>CVE-2020-2893</cvename>
<cvename>CVE-2020-2895</cvename>
<cvename>CVE-2020-2898</cvename>
<cvename>CVE-2020-2903</cvename>
<cvename>CVE-2020-2896</cvename>
<cvename>CVE-2020-2770</cvename>
<cvename>CVE-2020-2765</cvename>
<cvename>CVE-2020-2892</cvename>
<cvename>CVE-2020-2897</cvename>
<cvename>CVE-2020-2923</cvename>
<cvename>CVE-2020-2924</cvename>
<cvename>CVE-2020-2901</cvename>
<cvename>CVE-2020-2928</cvename>
<cvename>CVE-2020-2904</cvename>
<cvename>CVE-2020-2925</cvename>
<cvename>CVE-2020-2759</cvename>
<cvename>CVE-2020-2763</cvename>
<cvename>CVE-2020-2761</cvename>
<cvename>CVE-2020-2774</cvename>
<cvename>CVE-2020-2853</cvename>
<cvename>CVE-2020-2779</cvename>
<cvename>CVE-2020-2812</cvename>
<cvename>CVE-2019-1547</cvename>
<cvename>CVE-2020-2926</cvename>
<cvename>CVE-2020-2921</cvename>
<cvename>CVE-2020-2930</cvename>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-23</entry>
<modified>2020-05-16</modified>
</dates>
</vuln>
<vuln vid="622b5c47-855b-11ea-a5e2-d4c9ef517024">
<topic>MySQL Client -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mysql56-client</name>
<range><lt>5.6.48</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.30</lt></range>
</package>
<package>
<name>mysql80-client</name>
<range><lt>8.0.20</lt></range>
</package>
<package>
<name>mysql-connector-c</name>
<range><lt>8.0.20</lt></range>
</package>
<package>
<name>mysql-connector-c++</name>
<range><lt>8.0.20</lt></range>
</package>
<package>
<name>mysql-connector-java</name>
<range><lt>8.0.20</lt></range>
</package>
<package>
<name>percona55-client</name>
<range><lt>5.5.68</lt></range>
</package>
<package>
<name>percona56-client</name>
<range><lt>5.6.48</lt></range>
</package>
<package>
<name>percona57-client</name>
<range><lt>5.7.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
<p>This Critical Patch Update contains 45 new security patches for
Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
<cvename>CVE-2020-2752</cvename>
<cvename>CVE-2020-2934</cvename>
<cvename>CVE-2020-2875</cvename>
<cvename>CVE-2020-2922</cvename>
<cvename>CVE-2020-2933</cvename>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-23</entry>
</dates>
</vuln>
<vuln vid="afa018d9-8557-11ea-a5e2-d4c9ef517024">
<topic>Nextcloud -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nextcloud</name>
<range><lt>18.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nextcloud reports:</p>
<blockquote cite="https://nextcloud.com/security/advisories/">
<p>XSS in Files PDF viewer (NC-SA-2020-019)</p>
<p>Missing ownership check on remote wipe endpoint (NC-SA-2020-018)</p>
</blockquote>
</body>
</description>
<references>
<url>https://nextcloud.com/security/advisories/</url>
<url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-018</url>
<url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-019</url>
</references>
<dates>
<discovery>2020-03-18</discovery>
<entry>2020-04-23</entry>
</dates>
</vuln>
<vuln vid="a27b0bb6-84fc-11ea-b5b4-641c67a117d8">
<topic>Python -- Regular Expression DoS attack against client</topic>
<affects>
<package>
<name>python38</name>
<range><lt>3.8.3</lt></range>
</package>
<package>
<name>python37</name>
<range><le>3.7.7</le></range>
</package>
<package>
<name>python36</name>
<range><lt>3.6.10</lt></range>
</package>
<package>
<name>python35</name>
<range><le>3.5.9_4</le></range>
</package>
<package>
<name>python27</name>
<range><lt>2.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Caller and Matt Schwager reports:</p>
<blockquote cite="https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html">
<p>Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7
through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct
Regular Expression Denial of Service (ReDoS) attacks against a client
because of urllib.request.AbstractBasicAuthHandler catastrophic
backtracking.</p>
</blockquote>
</body>
</description>
<references>
<url>https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html</url>
<url>https://bugs.python.org/issue39503</url>
<cvename>CVE-2020-8492</cvename>
<freebsdpr>ports/245819</freebsdpr>
</references>
<dates>
<discovery>2019-11-17</discovery>
<entry>2020-04-23</entry>
<modified>2020-06-13</modified>
</dates>
</vuln>
<vuln vid="8d85d600-84a9-11ea-97b9-08002728f74c">
<topic>Wagtail -- XSS vulnerability</topic>
<affects>
<package>
<name>py35-wagtail</name>
<name>py36-wagtail</name>
<name>py37-wagtail</name>
<name>py38-wagtail</name>
<range><lt>2.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wagtail release notes:</p>
<blockquote cite="https://docs.wagtail.io/en/latest/releases/2.7.2.html">
<p>CVE-2020-11001: Possible XSS attack via page revision comparison view</p>
<p>This release addresses a cross-site scripting (XSS) vulnerability on
the page revision comparison view within the Wagtail admin interface. A
user with a limited-permission editor account for the Wagtail admin
could potentially craft a page revision history that, when viewed by a
user with higher privileges, could perform actions with that user
credentials. The vulnerability is not exploitable by an ordinary site
visitor without access to the Wagtail admin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.wagtail.io/en/latest/releases/2.7.2.html</url>
<url>https://github.com/advisories/GHSA-v2wc-pfq2-5cm6</url>
<cvename>CVE-2020-11001</cvename>
</references>
<dates>
<discovery>2020-04-03</discovery>
<entry>2020-04-22</entry>
</dates>
</vuln>
<vuln vid="0f798bd6-8325-11ea-9a78-08002728f74c">
<topic>libntlm -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libntlm</name>
<range><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-17455">
<p>Libntlm through 1.5 relies on a fixed buffer size for
tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse
read and write operations, as demonstrated by a stack-based buffer
over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM
request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/jas/libntlm/-/issues/2</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-17455</url>
<cvename>CVE-2019-17455</cvename>
</references>
<dates>
<discovery>2019-10-08</discovery>
<entry>2020-04-21</entry>
</dates>
</vuln>
<vuln vid="012809ce-83f3-11ea-92ab-00163e433440">
<topic>OpenSSL remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_4</lt></range>
</package>
<package>
<name>openssl</name>
<range><ge>1.1.1,1</ge><lt>1.1.1g,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Server or client applications that call the SSL_check_chain()
function during or after a TLS 1.3 handshake may crash due to a NULL
pointer dereference as a result of incorrect handling of the
"signature_algorithms_cert" TLS extension. The crash occurs if an
invalid or unrecognized signature algorithm is received from the
peer.</p>
<h1>Impact:</h1>
<p>A malicious peer could exploit the NULL pointer dereference crash,
causing a denial of service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2020-1967</cvename>
<freebsdsa>SA-20:11.openssl</freebsdsa>
<url>https://www.openssl.org/news/secadv/20200421.txt</url>
</references>
<dates>
<discovery>2020-04-21</discovery>
<entry>2020-04-21</entry>
<modified>2020-04-22</modified>
</dates>
</vuln>
<vuln vid="33edcc56-83f2-11ea-92ab-00163e433440">
<topic>FreeBSD -- ipfw invalid mbuf handling</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_4</lt></range>
<range><ge>11.3</ge><lt>11.3_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incomplete packet data validation may result in accessing
out-of-bounds memory (CVE-2019-5614) or may access memory after it has
been freed (CVE-2019-15874).</p>
<h1>Impact:</h1>
<p>Access to out of bounds or freed mbuf data can lead to a kernel panic or
other unpredictable results.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5614</cvename>
<cvename>CVE-2019-15874</cvename>
<freebsdsa>SA-20:10.ipfw</freebsdsa>
</references>
<dates>
<discovery>2020-04-21</discovery>
<entry>2020-04-21</entry>
</dates>
</vuln>
<vuln vid="9fbaefb3-837e-11ea-b5b4-641c67a117d8">
<topic>py-twisted -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-twisted</name>
<name>py35-twisted</name>
<name>py36-twisted</name>
<name>py37-twisted</name>
<name>py38-twisted</name>
<range><lt>20.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Twisted developers reports:</p>
<blockquote cite="https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst">
<p>All HTTP clients in twisted.web.client now raise a ValueError when
called with a method and/or URL that contain invalid characters. This
mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this
vulnerability.</p>
<p>The HTTP/2 server implementation now enforces TCP flow control on
control frame messages and times out clients that send invalid data
without reading responses. This closes CVE-2019-9512 (Ping Flood),
CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks
to Jonathan Looney and Piotr Sikora.</p>
<p>twisted.web.http was subject to several request smuggling attacks.
Requests with multiple Content-Length headers were allowed
(CVE-2020-10108, thanks to Jake Miller from Bishop Fox and ZeddYu Lu
for reporting this) and now fail with a 400; requests with a
Content-Length header and a Transfer-Encoding header honored the first
header (CVE-2020-10109, thanks to Jake Miller from Bishop Fox for
reporting this) and now fail with a 400; requests whose
Transfer-Encoding header had a value other than "chunked" and
"identity" (thanks to ZeddYu Lu) were allowed and now fail with a 400.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst</url>
<cvename>CVE-2019-12387</cvename>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
<cvename>CVE-2020-10108</cvename>
<cvename>CVE-2020-10109</cvename>
<freebsdpr>ports/245252</freebsdpr>
</references>
<dates>
<discovery>2019-03-01</discovery>
<entry>2020-04-21</entry>
</dates>
</vuln>
<vuln vid="3d7dfd63-823b-11ea-b3a8-240a644dd835">
<topic>Client/server denial of service when handling AES-CTR ciphers</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.8.0</ge><lt>0.8.9</lt></range>
<range><ge>0.9.0</ge><lt>0.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libssh team reports (originally reported by Yasheng Yang from
Google):</p>
<blockquote cite="https://www.libssh.org/security/advisories/CVE-2020-1730.txt">
<p>A malicious client or server could crash the counterpart implemented
with libssh AES-CTR ciphers are used and don't get fully initialized. It
will crash when it tries to cleanup the AES-CTR ciphers when closing the
connection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libssh.org/security/advisories/CVE-2020-1730.txt"</url>
<cvename>CVE-2020-1730</cvename>
</references>
<dates>
<discovery>2020-01-25</discovery>
<entry>2020-04-19</entry>
</dates>
</vuln>
<vuln vid="e418b8f0-9abb-420b-a7f1-1d8231b352e2">
<topic>webkit2-gtk3 -- Denial of service</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.28.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports the following vulnerability.</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2020-0004.html">
<p>Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2020-0004.html</url>
<cvename>CVE-2020-11793</cvename>
</references>
<dates>
<discovery>2020-04-16</discovery>
<entry>2020-04-18</entry>
</dates>
</vuln>
<vuln vid="e24fd421-8128-11ea-aa57-000ffec73f06">
<topic>drupal -- Drupal Core - Moderately critical - Third-party library</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2020-001">
<p>The Drupal project uses the third-party library CKEditor, which has
released a security improvement that is needed to protect some
Drupal configurations.</p>
<p>Vulnerabilities are possible if Drupal is configured to use the
WYSIWYG CKEditor for your site's users. An attacker that can createor
edit content may be able to exploit this Cross Site Scripting (XSS)
vulnerability to target users with access to the WYSIWYG CKEditor,
and this may include site admins with privileged access.</p>
<p>The latest versions of Drupal update CKEditor to 4.14 to mitigate
the vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2020-001</url>
</references>
<dates>
<discovery>2020-03-18</discovery>
<entry>2020-04-17</entry>
</dates>
</vuln>
<vuln vid="ae2e7871-80f6-11ea-bafd-815569f3852d">
<topic>ansible - Vault password leak from temporary file</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>ansible27</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible26</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible25</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible24</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible23</name>
<range><lt>2.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Borja Tarraso reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740">
<p>A flaw was found in Ansible Engine when using Ansible Vault for editing
encrypted files. When a user executes "ansible-vault edit", another user
on the same computer can read the old and new secret, as it is created in
a temporary file with mkstemp and the returned file descriptor is closed
and the method write_data is called to write the existing secret in the
file. This method will delete the file before recreating it insecurely.
All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740</url>
<url>https://github.com/ansible/ansible/issues/67798</url>
<cvename>CVE-2020-1740</cvename>
</references>
<dates>
<discovery>2020-02-12</discovery>
<entry>2020-04-17</entry>
</dates>
</vuln>
<vuln vid="67dbeeb6-80f4-11ea-bafd-815569f3852d">
<topic>ansible - subversion password leak from PID</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>ansible27</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible26</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible25</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible24</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible23</name>
<range><lt>2.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Borja Tarraso reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739">
<p>A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5
and prior when a password is set with the argument "password" of svn module,
it is used on svn command line, disclosing to other users within the same
node. An attacker could take advantage by reading the cmdline file from that
particular PID on the procfs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739</url>
<url>https://github.com/ansible/ansible/issues/67797</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/</url>
<cvename>CVE-2020-1739</cvename>
</references>
<dates>
<discovery>2020-02-12</discovery>
<entry>2020-04-17</entry>
</dates>
</vuln>
<vuln vid="0899c0d3-80f2-11ea-bafd-815569f3852d">
<topic>ansible - win_unzip path normalization</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>ansible27</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible26</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible25</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible24</name>
<range><lt>2.7.17</lt></range>
</package>
<package>
<name>ansible23</name>
<range><lt>2.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Borja Tarraso reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737">
<p>A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and
prior when using the Extract-Zip function from the win_unzip module as the
extracted file(s) are not checked if they belong to the destination folder. An
attacker could take advantage of this flaw by crafting an archive anywhere in
the file system, using a path traversal. This issue is fixed in 2.10.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737</url>
<url>https://github.com/ansible/ansible/issues/67795</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/</url>
<cvename>CVE-2020-1737</cvename>
</references>
<dates>
<discovery>2020-02-12</discovery>
<entry>2020-04-17</entry>
</dates>
</vuln>
<vuln vid="25efe05c-7ffc-11ea-b594-3065ec8fd3ec">
<topic>chromium -- use after free</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>81.0.4044.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html">
<p>[1067851] Critical CVE-2020-6457: Use after free in speech
recognizer. Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo
360 on 2020-04-04</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html</url>
<cvename>CVE-2020-6457</cvename>
</references>
<dates>
<discovery>2020-04-15</discovery>
<entry>2020-04-16</entry>
</dates>
</vuln>
<vuln vid="8604121c-7fc2-11ea-bcac-7781e90b0c8f">
<topic>openvpn -- illegal client float can break VPN session for other users</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.4.8_3</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.4.8_3</lt></range>
</package>
<package>
<name>openvpn-devel</name>
<range><lt>202016</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lev Stipakov and Gert Doering report:</p>
<blockquote cite="https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881">
<p>There is a time frame between allocating peer-id and initializing data
channel key (which is performed on receiving push request or on async
push-reply) in which the existing peer-id float checks do not work right.</p>
<p>If a "rogue" data channel packet arrives during that time frame from
another address and with same peer-id, this would cause client to float
to that new address.</p>
<p>The net effect of this behaviour is that the VPN session for the
"victim client" is broken. Since the "attacker client" does not have
suitable keys, it can not inject or steal VPN traffic from the other
session. The time window is small and it can not be used to attack
a specific client's session, unless some other way is found to make it
disconnect and reconnect first.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881</url>
<url>https://sourceforge.net/p/openvpn/openvpn/ci/f7b318f811bb43c0d3aa7f337ec6242ed2c33881/</url>
<url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19720.html</url>
<url>https://community.openvpn.net/openvpn/ticket/1272</url>
<url>https://patchwork.openvpn.net/patch/1077/</url>
<cvename>CVE-2020-11810</cvename>
</references>
<dates>
<discovery>2020-04-13</discovery>
<entry>2020-04-16</entry>
</dates>
</vuln>
<vuln vid="bf1f47c4-7f1b-11ea-bf94-001cc0382b2f">
<topic>Mbed TLS -- Side channel attack on ECDSA</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manuel Pégourié-Gonnard reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04">
<p>An attacker with access to precise enough timing and memory access
information (typically an untrusted operating system attacking a
secure enclave such as SGX or the TrustZone secure world) can fully
recover an ECDSA private key after observing a number of signature
operations.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04</url>
<cvename>CVE-2020-10932</cvename>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-15</entry>
</dates>
</vuln>
<vuln vid="570706ff-7ee0-11ea-bd0b-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.9.0</ge><lt>12.9.3</lt></range>
<range><ge>12.8.0</ge><lt>12.8.9</lt></range>
<range><ge>0</ge><lt>12.7.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/">
<p>NuGet Package and File Disclosure through GitLab Workhorse</p>
<p>Job Artifact Uploads and File Disclosure through GitLab Workhorse</p>
<p>Incorrect membership following group removal</p>
<p>Logging of Praefect tokens</p>
<p>Update Rack dependency</p>
<p>Update OpenSSL dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/</url>
<cvename>CVE-2020-11505</cvename>
<cvename>CVE-2020-11506</cvename>
<cvename>CVE-2020-11649</cvename>
<cvename>CVE-2020-16782</cvename>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-15</entry>
</dates>
</vuln>
<vuln vid="f59c4c53-c55f-43fe-9920-82b9d1ea9c3d">
<topic>zeek -- Remote crash vulnerability</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS">
<p>This release fixes the following security issue:</p>
<ul>
<li>
An attacker can crash Zeek remotely via crafted packet
sequence. </li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS</url>
</references>
<dates>
<discovery>2020-04-14</discovery>
<entry>2020-04-14</entry>
</dates>
</vuln>
<vuln vid="6e3b700a-7ca3-11ea-b594-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>81.0.4044.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html">
<p>This updates includes 32 security fixes, including:</p>
<ul>
<li>[1019161] High CVE-2020-6454: Use after free in extensions.
Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo 360 on
2019-10-29</li>
<li>[1043446] High CVE-2020-6423: Use after free in audio.
Reported by Anonymous on 2020-01-18</li>
<li>[1059669] High CVE-2020-6455: Out of bounds read in WebSQL.
Reported by Nan Wang(@eternalsakura13) and Guang Gong of Alpha Lab,
Qihoo 360 on 2020-03-09</li>
<li>[1031479] Medium CVE-2020-6430: Type Confusion in V8.
Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-12-06</li>
<li>[1040755] Medium CVE-2020-6456: Insufficient validation of
untrusted input in clipboard. Reported by Michał Bentkowski of
Securitum on 2020-01-10</li>
<li>[852645] Medium CVE-2020-6431: Insufficient policy
enforcement in full screen. Reported by Luan Herrera (@lbherrera_)
on 2018-06-14</li>
<li>[965611] Medium CVE-2020-6432: Insufficient policy
enforcement in navigations. Reported by David Erceg on
2019-05-21</li>
<li>[1043965] Medium CVE-2020-6433: Insufficient policy
enforcement in extensions. Reported by David Erceg on
2020-01-21</li>
<li>[1048555] Medium CVE-2020-6434: Use after free in devtools.
Reported by HyungSeok Han (DaramG) of Theori on 2020-02-04</li>
<li>[1032158] Medium CVE-2020-6435: Insufficient policy
enforcement in extensions. Reported by Sergei Glazunov of Google
Project Zero on 2019-12-09</li>
<li>[1034519] Medium CVE-2020-6436: Use after free in window
management. Reported by Igor Bukanov from Vivaldi on 2019-12-16</li>
<li>[639173] Low CVE-2020-6437: Inappropriate implementation in
WebView. Reported by Jann Horn on 2016-08-19</li>
<li>[714617] Low CVE-2020-6438: Insufficient policy enforcement in
extensions. Reported by Ng Yik Phang on 2017-04-24</li>
<li>[868145] Low CVE-2020-6439: Insufficient policy enforcement in
navigations. Reported by remkoboonstra on 2018-07-26</li>
<li>[894477] Low CVE-2020-6440: Inappropriate implementation in
extensions. Reported by David Erceg on 2018-10-11</li>
<li>[959571] Low CVE-2020-6441: Insufficient policy enforcement in
omnibox. Reported by David Erceg on 2019-05-04</li>
<li>[1013906] Low CVE-2020-6442: Inappropriate implementation in
cache. Reported by B@rMey on 2019-10-12</li>
<li>[1040080] Low CVE-2020-6443: Insufficient data validation in
developer tools. Reported by @lovasoa (Ophir LOJKINE) on
2020-01-08</li>
<li>[922882] Low CVE-2020-6444: Uninitialized Use in WebRTC.
Reported by mlfbrown on 2019-01-17</li>
<li>[933171] Low CVE-2020-6445: Insufficient policy enforcement in
trusted types. Reported by Jun Kokatsu, Microsoft Browser
Vulnerability Research on 2019-02-18</li>
<li>[933172] Low CVE-2020-6446: Insufficient policy enforcement in
trusted types. Reported by Jun Kokatsu, Microsoft Browser
Vulnerability Research on 2019-02-18</li>
<li>[991217] Low CVE-2020-6447: Inappropriate implementation in
developer tools. Reported by David Erceg on 2019-08-06</li>
<li>[1037872] Low CVE-2020-6448: Use after free in V8. Reported by
Guang Gong of Alpha Lab, Qihoo 360 on 2019-12-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-6423</cvename>
<cvename>CVE-2020-6430</cvename>
<cvename>CVE-2020-6431</cvename>
<cvename>CVE-2020-6432</cvename>
<cvename>CVE-2020-6433</cvename>
<cvename>CVE-2020-6434</cvename>
<cvename>CVE-2020-6435</cvename>
<cvename>CVE-2020-6436</cvename>
<cvename>CVE-2020-6437</cvename>
<cvename>CVE-2020-6438</cvename>
<cvename>CVE-2020-6439</cvename>
<cvename>CVE-2020-6440</cvename>
<cvename>CVE-2020-6441</cvename>
<cvename>CVE-2020-6442</cvename>
<cvename>CVE-2020-6443</cvename>
<cvename>CVE-2020-6444</cvename>
<cvename>CVE-2020-6445</cvename>
<cvename>CVE-2020-6446</cvename>
<cvename>CVE-2020-6447</cvename>
<cvename>CVE-2020-6448</cvename>
<cvename>CVE-2020-6454</cvename>
<cvename>CVE-2020-6455</cvename>
<cvename>CVE-2020-6456</cvename>
<url>https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html</url>
</references>
<dates>
<discovery>2020-04-07</discovery>
<entry>2020-04-12</entry>
</dates>
</vuln>
<vuln vid="9cb57a06-7517-11ea-b594-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>80.0.3987.162</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html">
<p>This update contains 8 security fixes.</p>
<ul>
<li>[1062247] High CVE-2020-6450: Use after free in WebAudio.
Reported by Man Yue Mo of Semmle Security Research Team on
2020-03-17</li>
<li>[1061018] High CVE-2020-6451: Use after free in WebAudio.
Reported by Man Yue Mo of Semmle Security Research Team on
2020-03-12</li>
<li>[1059764] High CVE-2020-6452: Heap buffer overflow in media
Reported by asnine on 2020-03-09</li>
<li>[1066247] Various fixes from internal audits, fuzzing and other
initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html</url>
<cvename>CVE-2020-6450</cvename>
<cvename>CVE-2020-6451</cvename>
<cvename>CVE-2020-6452</cvename>
</references>
<dates>
<discovery>2020-03-31</discovery>
<entry>2020-04-02</entry>
</dates>
</vuln>
<vuln vid="7f829d44-7509-11ea-b47c-589cfc0f81b0">
<topic>HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
</package>
<package>
<name>haproxy18</name>
<range><ge>1.8.0</ge><lt>1.8.25</lt></range>
</package>
<package>
<name>haproxy19</name>
<range><ge>1.9.0</ge><lt>1.9.15</lt></range>
</package>
<package>
<name>haproxy21</name>
<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The HAproxy Project reports:</p>
<blockquote cite="https://www.mail-archive.com/haproxy@formilux.org/msg36876.html">
<p>The main driver for this release is that it contains a fix for a serious
vulnerability that was responsibly reported last week by Felix Wilhelm
from Google Project Zero, affecting the HPACK decoder used for HTTP/2.
CVE-2020-11100 was assigned to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-11100</cvename>
<url>https://www.mail-archive.com/haproxy@formilux.org/msg36876.html</url>
<url>https://www.mail-archive.com/haproxy@formilux.org/msg36877.html</url>
<url>https://www.mail-archive.com/haproxy@formilux.org/msg36878.html</url>
<url>https://www.mail-archive.com/haproxy@formilux.org/msg36879.html</url>
</references>
<dates>
<discovery>2020-04-02</discovery>
<entry>2020-04-02</entry>
</dates>
</vuln>
<vuln vid="b360b120-74b1-11ea-a84a-4c72b94353b5">
<topic>Apache -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Team reports:</p>
<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.43">
<h1>SECURITY: CVE-2020-1934</h1>
<p>mod_proxy_ftp: Use of uninitialized value with malicious backend FTP
server.</p>
<h1>SECURITY: CVE-2020-1927</h1>
<p>rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
matches and substitutions with encoded line break characters.
The fix for CVE-2019-10098 was not effective.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.apache.org/httpd/CHANGES_2.4.43</url>
<cvename>CVE-2020-1934</cvename>
<cvename>CVE-2020-1927</cvename>
</references>
<dates>
<discovery>2020-04-01</discovery>
<entry>2020-04-02</entry>
</dates>
</vuln>
<vuln vid="e2b564fc-7462-11ea-af63-38d547003487">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti developers reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.10">
<p>When guest users have access to realtime graphs, remote code
could be executed (CVE-2020-8813).</p>
<p>Lack of escaping on some pages can lead to XSS exposure
(CVE-2020-7106).</p>
<p>Remote Code Execution due to input validation failure in
Performance Boost Debug Log (CVE-2020-7237).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.10</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-8813</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-7106</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2020-7237</url>
<cvename>CVE-2020-8813</cvename>
<cvename>CVE-2020-7106</cvename>
<cvename>CVE-2020-7237</cvename>
<freebsdpr>ports/245198</freebsdpr>
</references>
<dates>
<discovery>2020-02-04</discovery>
<entry>2020-04-02</entry>
</dates>
</vuln>
<vuln vid="d887b3d9-7366-11ea-b81a-001cc0382b2f">
<topic>GnuTLS -- flaw in DTLS protocol implementation</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31">
<p>It was found that GnuTLS 3.6.3 introduced a regression in the DTLS
protocol implementation. This caused the DTLS client to not
contribute any randomness to the DTLS negotiation breaking the
security guarantees of the DTLS protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31</url>
<cvename>CVE-2020-11501</cvename>
</references>
<dates>
<discovery>2020-03-31</discovery>
<entry>2020-03-31</entry>
</dates>
</vuln>
<vuln vid="d331f691-71f4-11ea-8bb5-6cc21735f730">
<topic>PostgresSQL -- ALTER ... DEPENDS ON EXTENSION is missing authorization checks</topic>
<affects>
<package>
<name>postgresql12-server</name>
<range><lt>12.2</lt></range>
</package>
<package>
<name>postgresql11-server</name>
<range><lt>11.7</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.12</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/2011/">
<p>
Versions Affected: 9.6 - 12
</p>
<p>
The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform
authorization checks, which can allow an unprivileged user to drop
any function, procedure, materialized view, index, or trigger under
certain conditions. This attack is possible if an administrator has
installed an extension and an unprivileged user can CREATE, or an
extension owner either executes DROP EXTENSION predictably or can be
convinced to execute DROP EXTENSION.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1960/</url>
<cvename>CVE-2020-1720</cvename>
</references>
<dates>
<discovery>2020-02-13</discovery>
<entry>2020-03-29</entry>
</dates>
</vuln>
<vuln vid="090763f6-7030-11ea-93dd-080027846a02">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.7</lt></range>
</package>
<package>
<name>mediawiki133</name>
<range><lt>1.33.3</lt></range>
</package>
<package>
<name>mediawiki134</name>
<range><lt>1.34.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-March/000247.html">
<p>Security fixes:
T246602:jquery.makeCollapsible allows applying event handler to any CSS
selector.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-March/000247.html</url>
</references>
<dates>
<discovery>2020-03-02</discovery>
<entry>2020-03-27</entry>
</dates>
</vuln>
<vuln vid="08fba28b-6f9f-11ea-bd0b-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.9.0</ge><lt>12.9.1</lt></range>
<range><ge>12.8.0</ge><lt>12.8.8</lt></range>
<range><ge>0</ge><lt>12.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/">
<p>Arbitrary File Read when Moving an Issue</p>
<p>Path Traversal in NPM Package Registry</p>
<p>SSRF on Project Import</p>
<p>External Users Can Create Personal Snippet</p>
<p>Triggers Decription Can be Updated by Other Maintainers in Project</p>
<p>Information Disclosure on Confidential Issues Moved to Private Programs</p>
<p>Potential DoS in Repository Archive Download</p>
<p>Blocked Users Can Still Pull/Push Docker Images</p>
<p>Repository Mirroring not Disabled when Feature not Activated</p>
<p>Vulnerability Feedback Page Was Leaking Information on Vulnerabilities</p>
<p>Stored XSS Vulnerability in Admin Feature</p>
<p>Upload Feature Allowed a User to Read Unauthorized Exported Files</p>
<p>Unauthorized Users Are Able to See CI Metrics</p>
<p>Last Pipeline Status of a Merge Request Leaked</p>
<p>Blind SSRF on FogBugz</p>
<p>Update Nokogiri dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/</url>
<cvename>CVE-2020-10953</cvename>
<cvename>CVE-2020-10956</cvename>
<cvename>CVE-2020-10954</cvename>
<cvename>CVE-2020-10952</cvename>
<cvename>CVE-2020-10955</cvename>
<cvename>CVE-2020-9795</cvename>
</references>
<dates>
<discovery>2020-03-26</discovery>
<entry>2020-03-26</entry>
</dates>
</vuln>
<vuln vid="40194e1c-6d89-11ea-8082-80ee73419af3">
<topic>rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix)</topic>
<affects>
<package>
<name>rubygem-json</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/">
<p>When parsing certain JSON documents, the json gem (including the
one bundled with Ruby) can be coerced into creating arbitrary objects
in the target system.</p>
<p>This is the same issue as CVE-2013-0269. The previous fix was incomplete,
which addressed JSON.parse(user_input), but didn’t address some other
styles of JSON parsing including JSON(user_input) and
JSON.parse(user_input, nil).</p>
<p>See CVE-2013-0269 in detail. Note that the issue was exploitable to
cause a Denial of Service by creating many garbage-uncollectable
Symbol objects, but this kind of attack is no longer valid because
Symbol objects are now garbage-collectable. However, creating arbitrary
bjects may cause severe security consequences depending upon the
application code.</p>
<p>Please update the json gem to version 2.3.0 or later. You can use
gem update json to update it. If you are using bundler, please add
gem "json", ">= 2.3.0" to your Gemfile.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/</url>
<cvename>CVE-2020-10663</cvename>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-26</entry>
<modified>2020-04-02</modified>
</dates>
</vuln>
<vuln vid="5bf6ed6d-9002-4f43-ad63-458f59e45384">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.227</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.204.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2020-03-25/">
<h1>Description</h1>
<h5>(High) SECURITY-1774 / CVE-2020-2160</h5>
<p>CSRF protection for any URL could be bypassed</p>
<h5>(Medium) SECURITY-1781 / CVE-2020-2161</h5>
<p>Stored XSS vulnerability in label expression validation</p>
<h5>(Medium) SECURITY-1793 / CVE-2020-2162</h5>
<p>Stored XSS vulnerability in file parameters</p>
<h5>(Medium) SECURITY-1796 / CVE-2020-2163</h5>
<p>Stored XSS vulnerability in list view column headers</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2160</cvename>
<cvename>CVE-2020-2161</cvename>
<cvename>CVE-2020-2162</cvename>
<cvename>CVE-2020-2163</cvename>
<url>https://jenkins.io/security/advisory/2020-03-25/</url>
</references>
<dates>
<discovery>2020-03-25</discovery>
<entry>2020-03-25</entry>
</dates>
</vuln>
<vuln vid="97fcc60a-6ec0-11ea-a84a-4c72b94353b5">
<topic>phpMyAdmin -- SQL injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php72</name>
<name>phpMyAdmin-php73</name>
<name>phpMyAdmin-php74</name>
<name>phpMyAdmin5</name>
<name>phpMyAdmin5-php72</name>
<name>phpMyAdmin5-php73</name>
<name>phpMyAdmin5-php74</name>
<range><lt>4.9.5</lt></range>
<range><ge>5.0</ge><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/">
<p>PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password</p>
<p>PMASA-2020-3 SQL injection vulnerability relating to the search feature</p>
<p>PMASA-2020-4 SQL injection and XSS having to do with displaying results</p>
<p>Removing of the "options" field for the external transformation</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/</url>
</references>
<dates>
<discovery>2020-03-21</discovery>
<entry>2020-03-25</entry>
</dates>
</vuln>
<vuln vid="36def7ba-6d2b-11ea-b115-643150d3111d">
<topic>puppetserver and puppetdb -- Puppet Server and PuppetDB may leak sensitive information via metrics API</topic>
<affects>
<package>
<name>puppetdb5</name>
<range><lt>5.2.13</lt></range>
</package>
<package>
<name>puppetdb6</name>
<range><lt>6.9.1</lt></range>
</package>
<package>
<name>puppetserver5</name>
<range><lt>5.3.12</lt></range>
</package>
<package>
<name>puppetserver6</name>
<range><lt>6.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppetlabs reports:</p>
<blockquote cite="https://puppet.com/security/cve/CVE-2020-7943/">
<p>Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network.</p>
<p>PE 2018.1.13 & 2019.4.0, Puppet Server 6.9.1 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7943</cvename>
<url>https://puppet.com/security/cve/CVE-2020-7943/</url>
</references>
<dates>
<discovery>2020-03-10</discovery>
<entry>2020-03-23</entry>
</dates>
</vuln>
<vuln vid="77687355-52aa-11ea-b115-643150d3111d">
<topic>puppet6 -- Arbitrary Catalog Retrieval</topic>
<affects>
<package>
<name>puppet6</name>
<range><lt>6.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppetlabs reports:</p>
<blockquote cite="https://puppet.com/security/cve/CVE-2020-7942/">
<p>Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master.</p>
<p>Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7942</cvename>
<url>https://puppet.com/security/cve/CVE-2020-7942/</url>
</references>
<dates>
<discovery>2020-02-18</discovery>
<entry>2020-03-23</entry>
</dates>
</vuln>
<vuln vid="6b90acba-6a0a-11ea-92ab-00163e433440">
<topic>FreeBSD -- Kernel memory disclosure with nested jails</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
<range><ge>11.3</ge><lt>11.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A missing NUL-termination check for the jail_set(2) configration
option "osrelease" may return more bytes when reading the jail
configuration back with jail_get(2) than were originally set.</p>
<h1>Impact:</h1>
<p>For jails with a non-default setting of children.max > 0 ("nested
jails") a superuser inside a jail can create a jail and may be able to
read and take advantage of exposed kernel memory.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7453</cvename>
<freebsdsa>SA-20:08.jail</freebsdsa>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-19</entry>
</dates>
</vuln>
<vuln vid="0cc7e547-6a0a-11ea-92ab-00163e433440">
<topic>FreeBSD -- Incorrect user-controlled pointer use in epair</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
<range><ge>11.3</ge><lt>11.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect use of a potentially user-controlled pointer in the kernel
allowed vnet jailed users to panic the system and potentially execute
aribitrary code in the kernel.</p>
<h1>Impact:</h1>
<p>Users with root level access (or the PRIV_NET_IFCREATE privilege)
can panic the system, or potentially escape the jail or execute
arbitrary code with kernel priviliges.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7452</cvename>
<freebsdsa>SA-20:07.epair</freebsdsa>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-19</entry>
</dates>
</vuln>
<vuln vid="b2b83761-6a09-11ea-92ab-00163e433440">
<topic>FreeBSD -- Insufficient ixl(4) ioctl(2) privilege checking</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The driver-specific ioctl(2) command handlers in ixl(4) failed to
check whether the caller has sufficient privileges to perform the
corresponding operation.</p>
<h1>Impact:</h1>
<p>The ixl(4) handler permits unprivileged users to trigger updates to
the device's non-volatile memory (NVM).</p>
</body>
</description>
<references>
<cvename>CVE-2019-15877</cvename>
<freebsdsa>SA-20:06.if_ixl_ioctl</freebsdsa>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-19</entry>
</dates>
</vuln>
<vuln vid="3c10ccdf-6a09-11ea-92ab-00163e433440">
<topic>FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
<range><ge>11.3</ge><lt>11.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The driver-specific ioctl(2) command handlers in oce(4) failed to
check whether the caller has sufficient privileges to perform the
corresponding operation.</p>
<h1>Impact:</h1>
<p>The oce(4) handler permits unprivileged users to send passthrough
commands to device firmware.</p>
</body>
</description>
<references>
<cvename>CVE-2019-15876</cvename>
<freebsdsa>SA-20:05.if_oce_ioctl</freebsdsa>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-19</entry>
</dates>
</vuln>
<vuln vid="0e06013e-6a06-11ea-92ab-00163e433440">
<topic>FreeBSD -- TCP IPv6 SYN cache kernel information disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
<range><ge>11.3</ge><lt>11.3_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When a TCP server transmits or retransmits a TCP SYN-ACK segment
over IPv6, the Traffic Class field is not initialized. This also
applies to challenge ACK segments, which are sent in response to
received RST segments during the TCP connection setup phase.</p>
<h1>Impact:</h1>
<p>For each TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6,
one byte of kernel memory is transmitted over the network.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7451</cvename>
<freebsdsa>SA-20:04.tcp</freebsdsa>
</references>
<dates>
<discovery>2020-03-19</discovery>
<entry>2020-03-19</entry>
</dates>
</vuln>
<vuln vid="3d19c776-68e7-11ea-91db-0050562a4d7b">
<topic>www/py-bleach -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py35-bleach</name>
<name>py36-bleach</name>
<name>py37-bleach</name>
<name>py38-bleach</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote>
<p>* ``bleach.clean`` behavior parsing embedded MathML and SVG content
with RCDATA tags did not match browser behavior and could result in
a mutation XSS.
</p>
<p> Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
``svg`` tags and one or more of the RCDATA tags ``script``,
``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
``xmp`` in the allowed tags whitelist were vulnerable to a mutation
XSS.
</p>
<p>* ``bleach.clean`` behavior parsing ``noscript`` tags did not match
browser behavior.
</p>
<p> Calls to ``bleach.clean`` allowing ``noscript`` and one or more of
the raw text tags (``title``, ``textarea``, ``script``, ``style``,
``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable
to a mutation XSS.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1615315</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1621692</url>
</references>
<dates>
<discovery>2020-02-13</discovery>
<entry>2020-03-18</entry>
</dates>
</vuln>
<vuln vid="4ae135f7-85cd-4c32-ad94-358271b31f7f">
<topic>zeek -- potential denial of service issues</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/9dda3602a760f00d9532c6314ea79108106033fa/NEWS">
<p>This release addresses the following security issues:</p>
<ul>
<li>
Potential Denial of Service due to memory leak in DNS
TSIG message parsing. </li>
<li>
Potential Denial of Service due to memory leak (or assertion
when compiling with assertions enabled) when receiving a
second SSH KEX message after a first. </li>
<li>
Potential Denial of Service due to buffer read overflow
and/or memory leaks in Kerberos analyzer. The buffer
read overflow could occur when the Kerberos message
indicates it contains an IPv6 address, but does not send
enough data to parse out a full IPv6 address. A memory
leak could occur when processing KRB_KDC_REQ KRB_KDC_REP
messages for message types that do not match a known/expected
type. </li>
<li>
Potential Denial of Service when sending many zero-length
SSL/TLS certificate data. Such messages underwent the
full Zeek file analysis treatment which is expensive (and
meaninguless here) compared to how cheaply one can "create"
or otherwise indicate many zero-length contained in an
SSL message. </li>
<li>
Potential Denial of Service due to buffer read overflow
in SMB transaction data string handling. The length of
strings being parsed from SMB messages was trusted to be
whatever the message claimed instead of the actual length
of data found in the message. </li>
<li>
Potential Denial of Service due to null pointer dereference
in FTP ADAT Base64 decoding. </li>
<li>
Potential Denial of Service due buffer read overflow in
FTP analyzer word/whitespace handling. This typically
won't be a problem in most default deployments of Zeek
since the FTP analyzer receives data from a ContentLine
(NVT) support analyzer which first null-terminates the
buffer used for further FTP parsing. </li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/blob/9dda3602a760f00d9532c6314ea79108106033fa/NEWS</url>
</references>
<dates>
<discovery>2020-02-25</discovery>
<entry>2020-03-15</entry>
</dates>
</vuln>
<vuln vid="c3600a64-64ea-11ea-bdff-e0d55e2a8bf9">
<topic>Okular -- Local binary execution via action links</topic>
<affects>
<package>
<name>okular</name>
<range><lt>19.12.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid:</p>
<blockquote cite="https://kde.org/info/security/advisory-20200312-1.txt">
<p>Okular can be tricked into executing local binaries via specially crafted
PDF files.</p>
<p>This binary execution can require almost no user interaction.</p>
<p> No parameters can be passed to those local binaries.</p>
<p>We have not been able to identify any binary that will cause actual damage,
be it in the hardware or software level, when run without parameters.</p>
<p>We remain relatively confident that for this issue to do any actual damage,
it has to run a binary specially crafted. That binary must have been deployed
to the user system via another method, be it the user downloading it directly
as an email attachment, webpage download, etc. or by the system being already
compromised.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kde.org/info/security/advisory-20200312-1.txt</url>
</references>
<dates>
<discovery>2020-03-12</discovery>
<entry>2020-03-13</entry>
</dates>
</vuln>
<vuln vid="9a09eaa2-6448-11ea-abb7-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.8.0</ge><lt>12.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/">
<p>Email Confirmation not Required on Sign-up</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/</url>
</references>
<dates>
<discovery>2020-03-11</discovery>
<entry>2020-03-12</entry>
</dates>
</vuln>
<vuln vid="1685144e-63ff-11ea-a93a-080027846a02">
<topic>Django -- potential SQL injection vulnerability</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<name>py38-django111</name>
<range><lt>1.11.29</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.11</lt></range>
</package>
<package>
<name>py36-django30</name>
<name>py37-django30</name>
<name>py38-django30</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402">
<p>Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4
allows SQL Injection if untrusted data is used as a tolerance parameter
in GIS functions and aggregates on Oracle. By passing a suitably crafted
tolerance to GIS functions and aggregates on Oracle, it was possible to
break escaping and inject malicious SQL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402</url>
<url>https://www.djangoproject.com/weblog/2020/mar/04/security-releases/</url>
<cvename>CVE-2020-9402</cvename>
</references>
<dates>
<discovery>2020-02-25</discovery>
<entry>2020-03-12</entry>
</dates>
</vuln>
<vuln vid="1afe9552-5ee3-11ea-9b6d-901b0e934d69">
<topic>py-matrix-synapse -- users of single-sign-on are vulnerable to phishing</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.11.1">
<p>[The 1.11.1] release includes a security fix impacting installations using Single Sign-On (i.e. SAML2 or CAS) for authentication. Administrators of such installations are encouraged to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.11.1</url>
</references>
<dates>
<discovery>2020-03-03</discovery>
<entry>2020-03-11</entry>
</dates>
</vuln>
<vuln vid="0032400f-624f-11ea-b495-000d3ab229d6">
<topic>Node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>13.8.0</lt></range>
</package>
<package>
<name>node12</name>
<range><lt>12.15.0</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.19.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/">
<p>Updates are now available for all active Node.js release lines for the following issues.</p>
<h1>HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)</h1>
<p>Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.</p>
<h1>HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)</h1>
<p>Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values.</p>
<h1>Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)</h1>
<p>Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate.</p>
<h1>Strict HTTP header parsing (None)</h1>
<p>Increase the strictness of HTTP header parsing. There are no known vulnerabilities addressed, but lax HTTP parsing has historically been a source of problems. Some commonly used sites are known to generate invalid HTTP headers, a --insecure-http-parser CLI option or insecureHTTPParser http option can be used if necessary for interoperability, but is not recommended.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/</url>
<cvename>CVE-2019-15605</cvename>
<cvename>CVE-2019-15606</cvename>
<cvename>CVE-2019-15604</cvename>
</references>
<dates>
<discovery>2020-02-06</discovery>
<entry>2020-03-09</entry>
</dates>
</vuln>
<vuln vid="be088777-6085-11ea-8609-08002731610e">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports for release 1.11.0:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.0">
<ul>
<li>Never allow an empty password to validate (#9682) (#9683)</li>
<li>Prevent redirect to Host (#9678) (#9679)</li>
<li>Swagger hide search field (#9554)</li>
<li>Add "search" to reserved usernames (#9063)</li>
<li>Switch to fomantic-ui (#9374)</li>
<li>Only serve attachments when linked to issue/release and if accessible by user (#9340)</li>
</ul>
</blockquote>
<p>The Gitea Team reports for release 1.11.2:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.2">
<ul>
<li>Ensure only own addresses are updated (#10397) (#10399)</li>
<li>Logout POST action (#10582) (#10585)</li>
<li>Org action fixes and form cleanup (#10512) (#10514)</li>
<li>Change action GETs to POST (#10462) (#10464)</li>
<li>Fix admin notices (#10480) (#10483)</li>
<li>Change admin dashboard to POST (#10465) (#10466)</li>
<li>Update markbates/goth (#10444) (#10445)</li>
<li>Update crypto vendors (#10385) (#10398)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2020/02/gitea-1.11.0-is-released/</url>
<url>https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/</url>
<freebsdpr>ports/244025</freebsdpr>
</references>
<dates>
<discovery>2019-11-18</discovery>
<entry>2020-03-07</entry>
</dates>
</vuln>
<vuln vid="8c98e643-6008-11ea-af63-38d547003487">
<topic>salt -- salt-api vulnerability</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<name>py37-salt</name>
<name>py38-salt</name>
<range><lt>2019.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html">
<p>With the Salt NetAPI enabled in addition to having a SSH roster
defined, unauthenticated access is possible when specifying the
client as SSH.</p>
<p>Additionally, when the raw_shell option is specified any arbitrary
command may be run on the Salt master when specifying SSH options.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-17361</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-17361</url>
</references>
<dates>
<discovery>2020-01-15</discovery>
<entry>2020-03-07</entry>
</dates>
</vuln>
<vuln vid="62f2182c-5f7a-11ea-abb7-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.8.0</ge><lt>12.8.2</lt></range>
<range><ge>12.7.0</ge><lt>12.7.7</lt></range>
<range><ge>0</ge><lt>12.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/">
<p>Directory Traversal to Arbitrary File Read</p>
<p>Account Takeover Through Expired Link</p>
<p>Server Side Request Forgery Through Deprecated Service</p>
<p>Group Two-Factor Authentication Requirement Bypass</p>
<p>Stored XSS in Merge Request Pages</p>
<p>Stored XSS in Merge Request Submission Form</p>
<p>Stored XSS in File View</p>
<p>Stored XSS in Grafana Integration</p>
<p>Contribution Analytics Exposed to Non-members</p>
<p>Incorrect Access Control in Docker Registry via Deploy Tokens</p>
<p>Denial of Service via Permission Checks</p>
<p>Denial of Service in Design For Public Issue</p>
<p>Incorrect Access Control via LFS Import</p>
<p>Unescaped HTML in Header</p>
<p>Private Merge Request Titles Leaked via Widget</p>
<p>Project Namespace Exposed via Vulnerability Feedback Endpoint</p>
<p>Denial of Service Through Recursive Requests</p>
<p>Project Authorization Not Being Updated</p>
<p>Incorrect Permission Level For Group Invites</p>
<p>Disclosure of Private Group Epic Information</p>
<p>User IP Address Exposed via Badge images</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/</url>
<cvename>CVE-2020-8113</cvename>
</references>
<dates>
<discovery>2020-03-04</discovery>
<entry>2020-03-06</entry>
</dates>
</vuln>
<vuln vid="591a706b-5cdc-11ea-9a0a-206a8a720317">
<topic>ntp -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.3</ge><lt>11.3_7</lt></range>
<range><ge>12.1</ge><lt>12.1_3</lt></range>
</package>
<package>
<name>ntp</name>
<range><lt>4.2.8p14</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><le>4.3.99_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nwtime.org reports:</p>
<blockquote cite="https://support.ntp.org/bin/view/Main/SecurityNotice">
<p>Three ntp vulnerabilities, Depending on configuration, may have
little impact up to termination of the ntpd process.</p>
<p>NTP Bug 3610: Process_control() should exit earlier on short
packets. On systems that override the default and enable ntpdc
(mode 7) fuzz testing detected that a short packet will cause
ntpd to read uninitialized data.</p>
<p>NTP Bug 3596: An unauthenticated unmonitored ntpd is vulnerable
to attack on IPv4 with highly predictable transmit timestamps. An
off-path attacker who can query time from the victim's ntp which
receives time from an unauthenticated time source must be able to
send from a spoofed IPv4 address of upstream ntp server and and
the victim must be able to process a large number of packets with
the spoofed IPv4 address of the upstream server. After eight or
more successful attacks in a row the attacker can either modify
the victim's clock by a small amount or cause ntpd to terminate.
The attack is especially effective when unusually short poll
intervals have been configured.</p>
<p>NTP Bug 3592: The fix for https://bugs.ntp.org/3445 introduced
a bug such that a ntp can be prevented from initiating a time
volley to its peer resulting in a DoS.</p>
<p>All three NTP bugs may result in DoS or terimation of the ntp
daemon.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-20:09.ntp</freebsdsa>
</references>
<dates>
<discovery>2019-05-30</discovery>
<entry>2020-03-03</entry>
</dates>
</vuln>
<vuln vid="b66583ae-5aee-4cd5-bb31-b2d397f8b6b3">
<topic>librsvg2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.21</lt></range>
</package>
<package>
<name>librsvg2-rust</name>
<range><ge>2.41.0</ge><lt>2.46.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Librsvg2 developers reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2020-February/msg00133.htmlE">
<p>Backport the following fixes from 2.46.x:</p>
<p>Librsvg now has limits on the number of loaded XML elements,
and the number of referenced elements within an SVG document. This
is to mitigate malicious SVGs which try to consume all memory, and
those which try to consume an exponential amount of CPU time.</p>
<p>Fix stack exhaustion with circular references in <use> elements.</p>
<p>Fix a denial-of-service condition from exponential explosion
of rendered elements, through nested use of SVG <use> elements in
malicious SVGs. This is similar to the XML "billion laughs attack"
but for SVG instancing.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2020-February/msg00133.html</url>
<cvename>CVE-2019-20446</cvename>
</references>
<dates>
<discovery>2020-02-26</discovery>
<entry>2020-03-02</entry>
</dates>
</vuln>
<vuln vid="d37407bd-5c5f-11ea-bb2a-8c164582fbac">
<topic>TiMidity++ -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>timidity++</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-emacs</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-gtk</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-motif</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-slang</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-tcltk</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-xaw</name>
<range><lt>2.15.0</lt></range>
</package>
<package>
<name>timidity++-xskin</name>
<range><lt>2.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>qflb.wu of DBAPPSecurity reports:</p>
<blockquote cite="https://seclists.org/fulldisclosure/2017/Jul/83">
<p>Ihe insert_note_steps function in readmidi.c in TiMidity++ 2.14.0
can cause a denial of service(divide-by-zero error and application
crash) via a crafted mid file.</p>
<p>The resample_gauss function in resample.c in TiMidity++ 2.14.0
can cause a denial of service(heap-buffer-overflow) via a crafted
mid file.</p>
<p>The play_midi function in playmidi.c in TiMidity++ 2.14.0 can
cause a denial of service(large loop and CPU consumption) via
a crafted mid file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/fulldisclosure/2017/Jul/83</url>
<cvename>CVE-2017-11546</cvename>
<cvename>CVE-2017-11547</cvename>
<cvename>CVE-2017-11549</cvename>
</references>
<dates>
<discovery>2017-07-31</discovery>
<entry>2020-03-02</entry>
</dates>
</vuln>
<vuln vid="e59cb761-5ad8-11ea-abb7-001b217b3468">
<topic>Solr -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-solr</name>
<range><lt>8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Community reports:</p>
<blockquote cite="https://lucene.apache.org/solr/security.html">
<p>8.1.1 and 8.2.0 users check ENABLE_REMOTE_JMX_OPTS setting</p>
<p>Apache Solr RCE vulnerability due to bad config default</p>
<p>Apache Solr RCE through VelocityResponseWriter</p>
</blockquote>
</body>
</description>
<references>
<url>https://lucene.apache.org/solr/security.html</url>
<cvename>CVE-2019-17558</cvename>
</references>
<dates>
<discovery>2019-12-30</discovery>
<entry>2020-02-29</entry>
</dates>
</vuln>
<vuln vid="f0683976-5779-11ea-8a77-1c872ccb1e42">
<topic>OpenSMTPd -- LPE and RCE in OpenSMTPD's default install</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>6.6.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers reports:</p>
<blockquote cite="https://opensmtpd.org/security.html">
<p>An out of bounds read in smtpd allows an attacker to inject arbitrary
commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary
commands to be run with the _smtpq group.</p>
<p>An unprivileged local attacker can read the first line of an arbitrary
file (for example, root's password hash in /etc/master.passwd) or the
entire contents of another user's file (if this file and
/var/spool/smtpd/ are on the same filesystem).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-8793</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/02/24/4</url>
<cvename>CVE-2020-8794</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/02/24/5</url>
</references>
<dates>
<discovery>2020-02-22</discovery>
<entry>2020-02-24</entry>
<modified>2020-02-27</modified>
</dates>
</vuln>
<vuln vid="056ea107-5729-11ea-a2f3-001cc0382b2f">
<topic>Mbed TLS -- Cache attack against RSA key import in SGX</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02">
<p>If Mbed TLS is running in an SGX enclave and the adversary has
control of the main operating system, they can launch a side
channel attack to recover the RSA private key when it is being
imported.</p>
<p>The attack only requires access to fine grained measurements to
cache usage. Therefore the attack might be applicable to a scenario
where Mbed TLS is running in TrustZone secure world and the
attacker controls the normal world or possibly when Mbed TLS is
part of a hypervisor and the adversary has full control of a guest
OS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02</url>
</references>
<dates>
<discovery>2020-02-18</discovery>
<entry>2020-02-24</entry>
</dates>
</vuln>
<vuln vid="b70b880f-5727-11ea-a2f3-001cc0382b2f">
<topic>Mbed TLS -- Side channel attack on ECDSA</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12">
<p>Our bignum implementation is not constant time/constant trace, so
side channel attacks can retrieve the blinded value, factor it (as
it is smaller than RSA keys and not guaranteed to have only large
prime factors), and then, by brute force, recover the key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12</url>
<cvename>CVE-2019-18222</cvename>
</references>
<dates>
<discovery>2019-10-25</discovery>
<entry>2020-02-24</entry>
</dates>
</vuln>
<vuln vid="8e3f1812-54d9-11ea-8d49-d4c9ef517024">
<topic>WeeChat -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WeeChat project reports:</p>
<blockquote cite="https://weechat.org/doc/security/">
<p>Buffer overflow when receiving a malformed IRC message 324 (channel
mode). (CVE-2020-8955)</p>
<p>Buffer overflow when a new IRC message 005 is received with longer
nick prefixes.</p>
<p>Crash when receiving a malformed IRC message 352 (WHO).</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/doc/security/</url>
<cvename>CVE-2020-8955</cvename>
</references>
<dates>
<discovery>2020-02-20</discovery>
<entry>2020-02-21</entry>
</dates>
</vuln>
<vuln vid="1cb0af4e-d641-4f99-9432-297a89447a97">
<topic>webkit-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2020-0002.html</url>
<cvename>CVE-2020-3862</cvename>
<cvename>CVE-2020-3864</cvename>
<cvename>CVE-2020-3865</cvename>
<cvename>CVE-2020-3867</cvename>
<cvename>CVE-2020-3868</cvename>
</references>
<dates>
<discovery>2020-02-14</discovery>
<entry>2020-02-19</entry>
</dates>
</vuln>
<vuln vid="6025d173-4279-11ea-b184-f8b156ac3ff9">
<topic>FreeBSD -- kernel stack data disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_2</lt></range>
<range><ge>12.0</ge><lt>12.0_13</lt></range>
<range><ge>11.3</ge><lt>11.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to incorrect initialization of a stack data structure, up to 20
bytes of kernel data stored previously stored on the stack will be
exposed to a crashing user process.</p>
<h1>Impact:</h1>
<p>Sensitive kernel data may be disclosed.</p>
</body>
</description>
<references>
<cvename>CVE-2019-15875</cvename>
<freebsdsa>SA-20:03.thrmisc</freebsdsa>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="5797c807-4279-11ea-b184-f8b156ac3ff9">
<topic>FreeBSD -- Missing IPsec anti-replay window check</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A missing check means that an attacker can reinject an old packet and
it will be accepted and processed by the IPsec endpoint.</p>
<h1>Impact:</h1>
<p>The impact depends on the higher-level protocols in use over IPsec.
For example, an attacker who can capture and inject packets could
cause an action that was intentionally performed once to be repeated.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5613</cvename>
<freebsdsa>SA-20:02.ipsec</freebsdsa>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="22b41bc5-4279-11ea-b184-f8b156ac3ff9">
<topic>FreeBSD -- libfetch buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.1</ge><lt>12.1_2</lt></range>
<range><ge>12.0</ge><lt>12.0_13</lt></range>
<range><ge>11.3</ge><lt>11.3_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error allows an attacker who can specify a URL with a
username and/or password components to overflow libfetch(3) buffers.</p>
<h1>Impact:</h1>
<p>An attacker in control of the URL to be fetched (possibly via HTTP
redirect) may cause a heap buffer overflow, resulting in program
misbehavior or malicious code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2020-7450</cvename>
<freebsdsa>SA-20:01.libfetch</freebsdsa>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="1ece5591-4ea9-11ea-86f0-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.7.0</ge><lt>12.7.6</lt></range>
<range><ge>12.6.0</ge><lt>12.6.7</lt></range>
<range><ge>12.5.0</ge><lt>12.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/">
<p>Incorrect membership handling of group sharing feature</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/</url>
<cvename>CVE-2020-8795</cvename>
</references>
<dates>
<discovery>2020-02-13</discovery>
<entry>2020-02-13</entry>
</dates>
</vuln>
<vuln vid="74db0d02-b140-4c32-aac6-1f1e81e1ad30">
<topic>dovecot -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html">
<p>lib-smtp doesn't handle truncated command parameters properly, resulting
in infinite loop taking 100% CPU for the process. This happens for LMTP
(where it doesn't matter so much) and also for submission-login where
unauthenticated users can trigger it. </p>
</blockquote>
<p>Aki also reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html">
<p>Snippet generation crashes if:
message is large enough that message-parser returns multiple body
blocks
The first block(s) don't contain the full snippet (e.g. full of
whitespace)
input ends with '>'
</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html</url>
<url>https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html</url>
<cvename>CVE-2020-7046</cvename>
<cvename>CVE-2020-7967</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-02-13</entry>
</dates>
</vuln>
<vuln vid="9d6a48a7-4dad-11ea-8a1d-7085c25400ea">
<topic>grub2-bhyve -- multiple privilege escalations</topic>
<affects>
<package>
<name>grub2-bhyve</name>
<range><lt>0.40_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Reno Robert reports:</p>
<!-- No public blog entry yet but I'm sure he'll publish one soon. -->
<blockquote cite="https://www.voidsecurity.in/">
<p>FreeBSD uses a two-process model for running a VM. For booting non-FreeBSD
guests, a modified grub-emu is used (grub-bhyve). Grub-bhyve executes command
from guest grub.cfg file. This is a security problem because grub was never
written to handle inputs from OS as untrusted. In the current design, grub
and guest OS works across trust boundaries. This exposes a grub to untrusted
inputs from guest.
</p>
<p>grub-bhyve (emu) is built without SDL graphics support which reduces lot of
gfx attack surface, however font loading code is still accessible. Guest can
provide arbitrary font file, which is parsed by grub-bhyve running as root.
</p>
<p>In grub-core/font/font.c, <code>read_section_as_string()</code> allocates
<code>section->length + 1</code> bytes of memory. However, untrusted
<code>section->length</code> is an unsigned 32-bit number, and the result can
overflow to <code>malloc(0)</code>. This can result in a controlled buffer
overflow via the 'loadfont' command in a guest VM grub2.cfg, eventually leading
to privilege escalation from guest to host.
</p>
</blockquote>
<p>Reno Robert also reports:</p>
<!-- No public blog entry yet but I'm sure he'll publish one soon. -->
<blockquote cite="https://www.voidsecurity.in/">
<p>GRUB supports commands to read and write addresses of choice. In
grub-bhyve, these commands provide a way to write to arbitrary virtual
addresses within the grub-bhyve process. This is another way for a guest
grub2.cfg, run by the host, to eventually escalate privileges.
</p>
</blockquote>
<p>These vulnerabilities are mitigated by disabling the 'loadfont', 'write_dword',
'read_dword', 'inl', 'outl', and other width variants of the same functionality in
grub2-bhyve.
</p>
<p>There is also work in progress to sandbox the grub-bhyve utility such that
an escaped guest ends up with nobody:nobody in a Capsium sandbox. It is not
included in 0.40_8.
</p>
</body>
</description>
<references>
<!-- No public blog entry yet but I'm sure he'll publish one soon. -->
<url>https://www.voidsecurity.in/</url>
</references>
<dates>
<!-- memrw was reported 2020-02-10 or 2020-02-11, but the earliest report is: -->
<discovery>2019-12-09</discovery>
<entry>2020-02-12</entry>
</dates>
</vuln>
<vuln vid="00f30cba-4d23-11ea-86ba-641c67a117d8">
<topic>libexif -- privilege escalation</topic>
<affects>
<package>
<name>libexif</name>
<range><lt>0.6.21_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278">
<p>In libexif, there is a possible out of bounds write due to an integer overflow.
This could lead to remote escalation of privilege in the media content provider
with no additional execution privileges needed. User interaction is needed for
exploitation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9278</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278</url>
<url>https://security-tracker.debian.org/tracker/CVE-2019-9278</url>
<url>https://seclists.org/bugtraq/2020/Feb/9</url>
<url>https://github.com/libexif/libexif/issues/26</url>
</references>
<dates>
<discovery>2019-02-06</discovery>
<entry>2020-02-11</entry>
</dates>
</vuln>
<vuln vid="d460b640-4cdf-11ea-a59e-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.330</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-06.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2020-3757).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-3757</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb20-06.html</url>
</references>
<dates>
<discovery>2020-02-11</discovery>
<entry>2020-02-11</entry>
</dates>
</vuln>
<vuln vid="c1202de8-4b29-11ea-9673-4c72b94353b5">
<topic>NGINX -- HTTP request smuggling</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.16.1_11,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.17.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372">
<p>NGINX before 1.17.7, with certain error_page configurations, allows HTTP
request smuggling, as demonstrated by the ability of an attacker to read
unauthorized web pages in environments where NGINX is being fronted by a
load balancer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372</url>
<cvename>CVE-2019-20372</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2020-02-09</entry>
</dates>
</vuln>
<vuln vid="8b20d716-49df-11ea-9f7b-206a8a720317">
<topic>ksh93 -- certain environment variables interpreted as arithmetic expressions on startup, leading to code injection</topic>
<affects>
<package>
<name>ksh93</name>
<range><ge>2020.0.0</ge><lt>2020.0.1_1,1</lt></range>
</package>
<package>
<name>ksh93-devel</name>
<range><lt>2020.02.07</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream ksh93 maintainer Siteshwar Vashisht reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2019-14868">
<p>A flaw was found in the way ksh evaluates certain environment
variables. An attacker could use this flaw to override or bypass
environment restrictions to execute shell commands. Services and
applications that allow remote unauthenticated attackers to
provide one of those environment variables could allow them to
exploit this issue remotely.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1757324</url>
<url>https://access.redhat.com/security/cve/CVE-2019-14868</url>
<url>https://access.redhat.com/errata/RHSA-2020:0431</url>
</references>
<dates>
<discovery>2019-10-01</discovery>
<entry>2020-02-07</entry>
</dates>
</vuln>
<vuln vid="e7bc2b99-485a-11ea-bff9-9c5c8e75236a">
<topic>clamav -- Denial-of-Service (DoS) vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html">
<p>A denial-of-service (DoS) condition may occur when using the optional
credit card data-loss-prevention (DLP) feature. Improper bounds checking of
an unsigned variable resulted in an out-of-bounds read, which causes a crash.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html</url>
<cvename>CVE-2020-3123</cvename>
</references>
<dates>
<discovery>2020-02-05</discovery>
<entry>2020-02-05</entry>
</dates>
</vuln>
<vuln vid="5a45649a-4777-11ea-bdec-08002728f74c">
<topic>Django -- potential SQL injection vulnerability</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<name>py38-django111</name>
<range><lt>1.11.28</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.10</lt></range>
</package>
<package>
<name>py36-django30</name>
<name>py37-django30</name>
<name>py38-django30</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7471">
<p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3
allows SQL Injection if untrusted data is used as a StringAgg delimiter
(e.g., in Django applications that offer downloads of data as a series
of rows with a user-specified column delimiter). By passing a suitably
crafted delimiter to a contrib.postgres.aggregates.StringAgg instance,
it was possible to break escaping and inject malicious SQL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7471</url>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.28/</url>
<url>https://docs.djangoproject.com/en/2.2/releases/2.2.10/</url>
<url>https://docs.djangoproject.com/en/3.0/releases/3.0.3/</url>
<cvename>CVE-2020-7471</cvename>
</references>
<dates>
<discovery>2020-02-03</discovery>
<entry>2020-02-04</entry>
</dates>
</vuln>
<vuln vid="cb0183bb-45f6-11ea-a1c7-b499baebfeaf">
<topic>MariaDB -- Vulnerability in C API</topic>
<affects>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.67</lt></range>
</package>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.67</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.44</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.44</lt></range>
</package>
<package>
<name>mariadb102-client</name>
<range><lt>10.2.31</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.31</lt></range>
</package>
<package>
<name>mariadb103-client</name>
<range><lt>10.3.22</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.22</lt></range>
</package>
<package>
<name>mariadb104-client</name>
<range><lt>10.4.12</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.12</lt></range>
</package>
<package>
<name>mariadb-connector-c</name>
<range><lt>3.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MariaDB reports:</p>
<blockquote cite="https://mariadb.com/kb/en/security/">
<p>Difficult to exploit vulnerability allows unauthenticated attacker
with network access via multiple protocols to compromise MySQL Client.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/security/</url>
<url>https://mariadb.com/kb/en/mdb-5567-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10412-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10322-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10231-rn/</url>
<url>https://mariadb.com/kb/en/mdb-10144-rn/</url>
<url>https://mariadb.com/kb/en/mariadb-connector-c-317-release-notes/</url>
<cvename>CVE-2020-2574</cvename>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-02-02</entry>
</dates>
</vuln>
<vuln vid="1e7fa41b-f6ca-4fe8-bd46-0e176b42b14f">
<topic>libssh -- Unsanitized location in scp could lead to unwanted command execution</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.4.0</ge><lt>0.8.8</lt></range>
<range><ge>0.9.0</ge><lt>0.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libssh team reports:</p>
<blockquote cite="https://www.libssh.org/security/advisories/CVE-2019-14889.txt">
<p>In an environment where a user is only allowed to copy files and
not to execute applications, it would be possible to pass a location
which contains commands to be executed in additon.</p>
<p>When the libssh SCP client connects to a server, the scp
command, which includes a user-provided path, is executed
on the server-side. In case the library is used in a way
where users can influence the third parameter of
ssh_scp_new(), it would become possible for an attacker to
inject arbitrary commands, leading to a compromise of the
remote target.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libssh.org/security/advisories/CVE-2019-14889.txt</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-14889</url>
<cvename>CVE-2019-14889</cvename>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2020-02-02</entry>
</dates>
</vuln>
<vuln vid="c86bfee3-4441-11ea-8be3-54e1ad3d6335">
<topic>spamassassin -- Nefarious rule configuration files can run system commands</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache SpamAssassin project reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e">
<p>A nefarious rule configuration (.cf) files can be configured to
run system commands. This issue is less stealthy and attempts to
exploit the issue will throw warnings.</p>
<p>Thanks to Damian Lukowski at credativ for reporting the issue
ethically. With this bug unpatched, exploits can be injected in a
number of scenarios though doing so remotely is difficult. In
addition to upgrading to SA 3.4.4, we again recommend that users
should only use update channels or 3rd party .cf files from trusted
places.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e</url>
<url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3ccdae17ce-acde-6060-148a-6dc5f45ee728@apache.org%3e</url>
<cvename>CVE-2020-1930</cvename>
<cvename>CVE-2020-1931</cvename>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-31</entry>
</dates>
</vuln>
<vuln vid="b4e5f782-442d-11ea-9ba9-206a8a720317">
<topic>sudo -- Potential bypass of Runas user restrictions</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/pwfeedback.html">
<p>Sudo's pwfeedback option can be used to provide visual feedback
when the user is inputting their password. For each key press,
an asterisk is printed. This option was added in response to
user confusion over how the standard Password: prompt disables
the echoing of key presses. While pwfeedback is not enabled by
default in the upstream version of sudo, some systems, such as
Linux Mint and Elementary OS, do enable it in their default
sudoers files.</p>
<p>Due to a bug, when the pwfeedback option is enabled in the
sudoers file, a user may be able to trigger a stack-based buffer
overflow. This bug can be triggered even by users not listed in
the sudoers file. There is no impact unless pwfeedback has been
enabled.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/pwfeedback.html</url>
<cvename>CVE-2019-18634</cvename>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2020-01-30</entry>
</dates>
</vuln>
<vuln vid="c5bd9068-440f-11ea-9cdb-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.7.0</ge><lt>12.7.4</lt></range>
<range><ge>12.6.0</ge><lt>12.6.6</lt></range>
<range><ge>5.3</ge><lt>12.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/">
<p>Path Traversal to Arbitrary File Read</p>
<p>User Permissions Not Validated in ProjectExportWorker</p>
<p>XSS Vulnerability in File API</p>
<p>Package and File Disclosure through GitLab Workhorse</p>
<p>XSS Vulnerability in Create Groups</p>
<p>Issue and Merge Request Activity Counts Exposed</p>
<p>Email Confirmation Bypass Using AP</p>
<p>Disclosure of Forked Private Project Source Code</p>
<p>Private Project Names Exposed in GraphQL queries</p>
<p>Disclosure of Issues and Merge Requests via Todos</p>
<p>Denial of Service via AsciiDoc</p>
<p>Last Pipeline Status Exposed</p>
<p>Arbitrary Change of Pipeline Status</p>
<p>Grafana Token Displayed in Plaintext</p>
<p>Update excon gem</p>
<p>Update rdoc gem</p>
<p>Update rack-cors gem</p>
<p>Update rubyzip gem</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/</url>
<cvename>CVE-2020-7966</cvename>
<cvename>CVE-2020-8114</cvename>
<cvename>CVE-2020-7973</cvename>
<cvename>CVE-2020-6833</cvename>
<cvename>CVE-2020-7971</cvename>
<cvename>CVE-2020-7967</cvename>
<cvename>CVE-2020-7972</cvename>
<cvename>CVE-2020-7968</cvename>
<cvename>CVE-2020-7979</cvename>
<cvename>CVE-2020-7969</cvename>
<cvename>CVE-2020-7978</cvename>
<cvename>CVE-2020-7974</cvename>
<cvename>CVE-2020-7977</cvename>
<cvename>CVE-2020-7976</cvename>
<cvename>CVE-2019-16779</cvename>
<cvename>CVE-2019-18978</cvename>
<cvename>CVE-2019-16892</cvename>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2020-01-31</entry>
</dates>
</vuln>
<vuln vid="08f5c27d-4326-11ea-af8b-00155d0a0200">
<topic>OpenSMTPd -- critical LPE / RCE vulnerability</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><ge>6.4.0,1</ge><lt>6.6.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://opensmtpd.org/security.html">
<p>An incorrect check allows an attacker to trick mbox delivery
into executing arbitrary commands as root and lmtp delivery
into executing arbitrary commands as an unprivileged user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7247</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/01/28/3</url>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="a250539d-d1d4-4591-afd3-c8bdfac335d8">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.219</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.204.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2020-01-29/">
<h1>Description</h1>
<h5>(High) SECURITY-1682 / CVE-2020-2099</h5>
<p>Inbound TCP Agent Protocol/3 authentication bypass</p>
<h5>(Medium) SECURITY-1641 / CVE-2020-2100</h5>
<p>Jenkins vulnerable to UDP amplification reflection attack</p>
<h5>(Medium) SECURITY-1659 / CVE-2020-2101</h5>
<p>Non-constant time comparison of inbound TCP agent connection secret</p>
<h5>(Medium) SECURITY-1660 / CVE-2020-2102</h5>
<p>Non-constant time HMAC comparison</p>
<h5>(Medium) SECURITY-1695 / CVE-2020-2103</h5>
<p>Diagnostic page exposed session cookies</p>
<h5>(Medium) SECURITY-1650 / CVE-2020-2104</h5>
<p>Memory usage graphs accessible to anyone with Overall/Read</p>
<h5>(Low) SECURITY-1704 / CVE-2020-2105</h5>
<p>Jenkins REST APIs vulnerable to clickjacking</p>
<h5>(Medium) SECURITY-1680 / CVE-2020-2106</h5>
<p>Stored XSS vulnerability in Code Coverage API Plugin</p>
<h5>(Medium) SECURITY-1565 / CVE-2020-2107</h5>
<p>Fortify Plugin stored credentials in plain text</p>
<h5>(High) SECURITY-1719 / CVE-2020-2108</h5>
<p>XXE vulnerability in WebSphere Deployer Plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2099</cvename>
<cvename>CVE-2020-2100</cvename>
<cvename>CVE-2020-2101</cvename>
<cvename>CVE-2020-2102</cvename>
<cvename>CVE-2020-2103</cvename>
<cvename>CVE-2020-2104</cvename>
<cvename>CVE-2020-2105</cvename>
<cvename>CVE-2020-2106</cvename>
<cvename>CVE-2020-2107</cvename>
<cvename>CVE-2020-2108</cvename>
<url>https://jenkins.io/security/advisory/2020-01-29/</url>
</references>
<dates>
<discovery>2020-01-29</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="2af10639-4299-11ea-aab1-98fa9bfec35a">
<topic>pkg -- vulnerability in libfetch</topic>
<affects>
<package>
<name>pkg</name>
<range><lt>1.12.0_1</lt></range>
</package>
<package>
<name>pkg-devel</name>
<range><lt>1.12.99_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error allows an attacker who can specify a URL with a username
and/or password components to overflow libfetch(3) buffers.</p>
</body>
</description>
<references>
<freebsdsa>SA-20:01.libfetch</freebsdsa>
<cvename>CVE-2020-7450</cvename>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="5f0dd349-40a2-11ea-8d8c-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.12</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/samba-4.10.12.html">
<p>CVE-2019-14902</p>
<p>The implementation of ACL inheritance in the Samba AD DC was not complete,
and so absent a 'full-sync' replication, ACLs could get out of sync between
domain controllers.</p>
<p>CVE-2019-14907</p>
<p>When processing untrusted string input Samba can read past the end of the
allocated buffer when printing a "Conversion error" message to the logs.</p>
<p>CVE-2019-19344</p>
<p>During DNS zone scavenging (of expired dynamic entries) there is a read of
memory after it has been freed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/history/samba-4.10.12.html</url>
<cvename>CVE-2019-14902</cvename>
<cvename>CVE-2019-14907</cvename>
<cvename>CVE-2019-19344</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-27</entry>
</dates>
</vuln>
<vuln vid="dc8cff4c-4063-11ea-8a94-3497f6939fdd">
<topic>webkit-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2020-0001.html</url>
<cvename>CVE-2019-8835</cvename>
<cvename>CVE-2019-8844</cvename>
<cvename>CVE-2019-8846</cvename>
</references>
<dates>
<discovery>2020-01-23</discovery>
<entry>2020-01-26</entry>
</dates>
</vuln>
<vuln vid="0700e76c-3eb0-11ea-8478-3085a9a95629">
<topic>Pillow -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py35-pillow</name>
<name>py36-pillow</name>
<name>py37-pillow</name>
<name>py38-pillow</name>
<range><lt>6.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pillow developers report:</p>
<blockquote cite="https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html">
<p>
This release addresses several security problems, as well as
addressing CVE-2019-19911.
</p><p>
CVE-2019-19911 is regarding FPX images. If an image reports that it
has a large number of bands, a large amount of resources will be
used when trying to process the image. This is fixed by limiting the
number of bands to those usable by Pillow.
</p><p>
Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.
</p><p>
Overflow checks have been added when calculating the size of a
memory block to be reallocated in the processing of a TIFF image.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html</url>
<cvename>CVE-2019-19911</cvename>
<cvename>CVE-2020-5310</cvename>
<cvename>CVE-2020-5311</cvename>
<cvename>CVE-2020-5312</cvename>
<cvename>CVE-2020-5313</cvename>
<freebsdpr>ports/243336</freebsdpr>
</references>
<dates>
<discovery>2019-12-19</discovery>
<entry>2020-01-24</entry>
</dates>
</vuln>
<vuln vid="a512a412-3a33-11ea-af63-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.10.3">
<ul>
<li>Hide credentials when submitting migration</li>
<li>Never allow an empty password to validate</li>
<li>Prevent redirect to Host</li>
<li>Hide public repos owned by private orgs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.10.3</url>
<freebsdpr>ports/243437</freebsdpr>
</references>
<dates>
<discovery>2019-11-22</discovery>
<entry>2020-01-18</entry>
</dates>
</vuln>
<vuln vid="a6cf65ad-37d2-11ea-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mysql56-server</name>
<range><lt>5.6.47</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.29</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.19</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.67</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.47</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
<p>This Critical Patch Update contains 17 new security fixes for
Oracle MySQL. 5 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
<cvename>CVE-2019-1547</cvename>
<cvename>CVE-2020-2579</cvename>
<cvename>CVE-2020-2686</cvename>
<cvename>CVE-2020-2627</cvename>
<cvename>CVE-2020-2570</cvename>
<cvename>CVE-2020-2573</cvename>
<cvename>CVE-2020-2574</cvename>
<cvename>CVE-2020-2577</cvename>
<cvename>CVE-2020-2589</cvename>
<cvename>CVE-2020-2580</cvename>
<cvename>CVE-2020-2588</cvename>
<cvename>CVE-2020-2660</cvename>
<cvename>CVE-2020-2679</cvename>
<cvename>CVE-2020-2584</cvename>
<cvename>CVE-2020-2694</cvename>
<cvename>CVE-2020-2572</cvename>
<cvename>CVE-2019-8457</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-15</entry>
<modified>2020-02-02</modified>
</dates>
</vuln>
<vuln vid="d2c2c815-3793-11ea-8be3-54e1ad3d6335">
<topic>drm graphics drivers -- potential information disclusure via local access</topic>
<affects>
<package>
<name>drm-fbsd11.2-kmod</name>
<range><lt>4.11.g20200115</lt></range>
</package>
<package>
<name>drm-fbsd12.0-kmod</name>
<range><lt>4.16.g20200115</lt></range>
</package>
<package>
<name>drm-current-kmod</name>
<range><lt>4.16.g20200115</lt></range>
</package>
<package>
<name>drm-devel-kmod</name>
<range><lt>5.0.g20200115</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html">
<p>.A potential security vulnerability in Intel(R) Processor Graphics
may allow information disclosure. Intel is releasing software
updates to mitigate this potential vulnerability.</p>
<p>Description: Insufficient control flow in certain data
structures for some Intel(R) Processors with Intel(R) Processor
Graphics may allow an unauthenticated user to potentially enable
information disclosure via local access.</p>
<p>This patch provides mitigation for Gen9 hardware only. Patches
for Gen7 and Gen7.5 will be provided later. Note that Gen8 is not
impacted due to a previously implemented workaround. The mitigation
involves using an existing hardware feature to forcibly clear down
all EU state at each context switch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html</url>
<cvename>CVE-2019-14615</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-15</entry>
</dates>
</vuln>
<vuln vid="2bab995f-36d4-11ea-9dad-002590acae31">
<topic>Template::Toolkit -- Directory traversal on write</topic>
<affects>
<package>
<name>p5-Template-Toolkit</name>
<range><lt>3.004</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Art Manion and Will Dormann report:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/619785/">
<p>
By using an older and less-secure form of open(), it is
possible for untrusted template files to cause reads/writes
outside of the template directories. This vulnerability is
a component of the recent Citrix exploit.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/619785/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781</url>
<cvename>CVE-2019-19781</cvename>
</references>
<dates>
<discovery>2019-12-13</discovery>
<entry>2020-01-14</entry>
</dates>
</vuln>
<vuln vid="f929b172-369e-11ea-9cdb-001b217b3468">
<topic>Gitlab -- Private objects exposed through project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.6.0</ge><lt>12.6.4</lt></range>
<range><ge>12.5.0</ge><lt>12.5.7</lt></range>
<range><ge>8.9.0</ge><lt>12.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/">
<p>Private objects exposed through project importi</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/</url>
<cvename>CVE-2020-6832</cvename>
</references>
<dates>
<discovery>2020-01-13</discovery>
<entry>2020-01-14</entry>
</dates>
</vuln>
<vuln vid="8b61308b-322a-11ea-b34b-1de6fb24355d">
<topic>e2fsprogs -- rehash.c/pass 3a mutate_name() code execution vulnerability</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.45.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lilith of Cisco Talos reports:</p>
<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973">
<p>
A code execution vulnerability exists in the directory rehashing
functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4
directory can cause an out-of-bounds write on the stack, resulting
in code execution. An attacker can corrupt a partition to trigger
this vulnerability.
</p>
</blockquote>
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5">
<p>
E2fsprogs 1.45.5 [...:] Fix a potential out of bounds write when
checking a maliciously corrupted file system. This is probably not
exploitable on 64-bit platforms, but may be exploitable on 32-bit
binaries depending on how the compiler lays out the stack variables.
(Addresses CVE-2019-5188)
</p>
</blockquote>
</body>
</description>
<references>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973</url>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5</url>
<cvename>CVE-2019-5188</cvename>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2020-01-08</entry>
</dates>
</vuln>
<vuln vid="16aed7b7-344a-11ea-9cdb-001b217b3468">
<topic>phpMyAdmin -- SQL injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php72</name>
<name>phpMyAdmin-php73</name>
<name>phpMyAdmin-php74</name>
<name>phpMyAdmin5</name>
<name>phpMyAdmin5-php72</name>
<name>phpMyAdmin5-php73</name>
<name>phpMyAdmin5-php74</name>
<range><lt>4.9.4</lt></range>
<range><ge>5.0.0</ge><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2020-1/">
<p>A SQL injection flaw has been discovered in the user accounts page</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2020-1/</url>
<cvename>CVE-2020-5504</cvename>
</references>
<dates>
<discovery>2020-01-05</discovery>
<entry>2020-01-11</entry>
</dates>
</vuln>
<vuln vid="86224a04-26de-11ea-97f2-001a8c5c04b6">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti developers reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8">
<p>
When viewing graphs, some input variables are not properly checked
(SQL injection possible).
</p>
<p>
Multiple instances of lib/functions.php are affected by unsafe
deserialization of user-controlled data to populate arrays. An
authenticated attacker could use this to influence object data
values and control actions taken by Cacti or potentially cause
memory corruption in the PHP module.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8</url>
<cvename>CVE-2019-17357</cvename>
<cvename>CVE-2019-17358</cvename>
<freebsdpr>ports/242834</freebsdpr>
</references>
<dates>
<discovery>2019-10-12</discovery>
<entry>2020-01-06</entry>
</dates>
</vuln>
<vuln vid="01bde18a-2e09-11ea-a935-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.6.0</ge><lt>12.6.2</lt></range>
<range><ge>12.5.0</ge><lt>12.5.6</lt></range>
<range><ge>5.1.0</ge><lt>12.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/">
<p>Group Maintainers Can Update/Delete Group Runners Using API</p>
<p>GraphQL Queries Can Hang the Application</p>
<p>Unauthorized Users Have Access to Milestones of Releases</p>
<p>Private Group Name Revealed Through Protected Tags API</p>
<p>Users Can Publish Reviews on Locked Merge Requests</p>
<p>DoS in the Issue and Commit Comments Pages</p>
<p>Project Name Disclosed Through Unsubscribe Link</p>
<p>Private Project Name Disclosed Through Notification Settings</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/</url>
<cvename>CVE-2019-20144</cvename>
<cvename>CVE-2019-20146</cvename>
<cvename>CVE-2019-20143</cvename>
<cvename>CVE-2019-20147</cvename>
<cvename>CVE-2019-20145</cvename>
<cvename>CVE-2019-20142</cvename>
<cvename>CVE-2019-20148</cvename>
<cvename>CVE-2020-5197</cvename>
</references>
<dates>
<discovery>2020-01-02</discovery>
<entry>2020-01-03</entry>
</dates>
</vuln>
<vuln vid="66e4dc99-28b3-11ea-8dde-08002728f74c">
<topic>rack -- information leak / session hijack vulnerability</topic>
<affects>
<package>
<name>rubygem-rack</name>
<range><ge>2.0.0</ge><lt>2.0.8,3</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><ge>1.6.0</ge><lt>1.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>National Vulnerability Database:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16782">
<p>There's a possible information leak / session hijack vulnerability in
Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12
and 2.0.8. Attackers may be able to find and hijack sessions by using
timing attacks targeting the session id. Session ids are usually stored
and indexed in a database that uses some kind of scheme for speeding up
lookups of that session id. By carefully measuring the amount of time
it takes to look up a session, an attacker may be able to find a valid
session id and hijack the session. The session id itself may be
generated randomly, but the way the session is indexed by the backing
store does not use a secure comparison.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-16782</url>
<url>https://github.com/rack/rack/blob/master/CHANGELOG.md</url>
<cvename>CVE-2019-16782</cvename>
</references>
<dates>
<discovery>2019-12-08</discovery>
<entry>2019-12-29</entry>
</dates>
</vuln>
<vuln vid="e4d9dffb-2a32-11ea-9693-e1b3f6feec79">
<topic>OpenEXR -- heap buffer overflow, and out-of-memory bugs</topic>
<affects>
<package>
<name>ilmbase</name>
<range><lt>2.3.0_4</lt></range>
</package>
<package>
<name>openexr</name>
<range><lt>2.3.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0">
<p>OpenEXR (IlmBase) v2.4.0 fixes the following security vulnerabilities:</p>
<ul>
<li>CVE-2018-18444 Issue #351 Out of Memory</li>
<li>CVE-2018-18443 Issue #350 heap-buffer-overflow</li>
</ul>
<p>The relevant patches have been backported to the FreeBSD ports.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/issues/350</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/issues/351</url>
<cvename>CVE-2018-18443</cvename>
<cvename>CVE-2018-18444</cvename>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2019-12-29</entry>
</dates>
</vuln>
<vuln vid="7b97b32e-27c4-11ea-9673-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/">
<p>Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade.
If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.
-Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
-Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS)
could be stored in well-crafted links.
-Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named
colon attribute.
-Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-12-13</discovery>
<entry>2019-12-26</entry>
</dates>
</vuln>
<vuln vid="1c9178aa-2709-11ea-9673-4c72b94353b5">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8</name>
<range><lt>8.7.30</lt></range>
</package>
<package>
<name>typo3-9</name>
<range><lt>9.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-10-2-1-9-5-12-and-8-7-30-security-releases-published">
<p>It has been discovered that the output of field validation errors in the Form Framework is vulnerable
to cross-site scripting.</p>
<p>It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site
scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering
with typolink.</p>
<p>It has been discovered that the output table listing in the Files backend module is vulnerable to cross-site
scripting when a file extension contains malicious sequences. Access to the file system of the server - either
directly or through synchronization - is required to exploit the vulnerability.</p>
<p>It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable
to directory traversal. Admin privileges are required in order to exploit this vulnerability. Since TYPO3 v9 LTS,
System Maintainer privileges are required as well.</p>
<p>Failing to properly escape user submitted content, class QueryGenerator is vulnerable to SQL injection.
Having system extension ext:lowlevel installed and a valid backend user having administrator privileges are
required to exploit this vulnerability.</p>
<p>It has been discovered that classes QueryGenerator and QueryView are vulnerable to insecure deserialization.
Requirements for successfully exploiting this vulnerability (one of the following):
- having system extension ext:lowlevel (Backend Module: DB Check) installed and valid backend user having
administrator privileges
- having system extension ext:sys_action installed and valid backend user having limited privileges</p>
<p>TYPO3 allows to upload files either in the backend user interface as well as in custom developed extensions.
To reduce the possibility to upload potential malicious code TYPO3 uses the fileDenyPattern to deny e.g. user
submitted PHP scripts from being persisted. Besides that it is possible for any editor to upload file assets
using the file module (fileadmin) or changing their avatar image shown in the TYPO3 backend.
Per default TYPO3 allows to upload and store HTML and SVG files as well using the mentioned functionalities.
Custom extension implementations probably would also accept those files when only the fileDenyPattern is evaluated.
Since HTML and SVG files - which might contain executable JavaScript code per W3C standard - could be directly
displayed in web clients, the whole web application is exposed to be vulnerable concerning Cross-Site Scripting.
Currently the following scenarios are known - given an authenticated regular editor is able to upload files using
the TYPO3 backend:
- directly target a potential victim to a known public resource in a URL, e.g. /fileadmin/malicious.svg or
/fileadmin/malicious.html
- using the TypoScript content object “SVG” (implemented in class ScalableVectorGraphicsContentObject)
having renderMode set to inline for SVG files (available since TYPO3 v9.0)
- custom implementations that directly output and render markup of HTML and SVG files
SVG files that are embedded using an img src=”malicious.svg” tag are not vulnerable since potential
scripts are not executed in these scenarios (see https://www.w3.org/wiki/SVG_Security). The icon API of TYPO3
is not scope of this announcement since SVG icons need to be registered using an individual implementation,
which is not considered as user submitted content.</p>
<p>It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization.
User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey
as secret - invalid or unsigned payload is not deserialized.
However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly
known and unprotected backup files), there is the possibility that attackers know the private encryptionKey
and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized.
Requirements for successfully exploiting this vulnerability (all of the following):
- rendering at least one Extbase plugin in the frontend
- encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file). </p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-021/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-022/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-023/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-024/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-025/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-026/</url>
<url>https://typo3.org/security/advisory/typo3-psa-2019-010/</url>
<url>https://typo3.org/security/advisory/typo3-psa-2019-011/</url>
</references>
<dates>
<discovery>2019-12-17</discovery>
<entry>2019-12-25</entry>
</dates>
</vuln>
<vuln vid="ad3451b9-23e0-11ea-8b36-f1925a339a82">
<topic>e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.45.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ted Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4">
<p>A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck.</p>
</blockquote>
</body>
</description>
<references>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4</url>
<cvename>CVE-2019-5094</cvename>
</references>
<dates>
<discovery>2019-09-23</discovery>
<entry>2019-12-21</entry>
</dates>
</vuln>
<vuln vid="3da0352f-2397-11ea-966e-000ffec0b3e1">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.69</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2019-009">
<p>A visit to install.php can cause cached data to become corrupted.
This could cause a site to be impaired until caches are rebuilt.</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-010">
<p>Drupal 8 core's file_save_upload() function does not strip the
leading and trailing dot ('.') from filenames, like Drupal 7 did.
Users with the ability to upload files with any extension in
conjunction with contributed modules may be able to use this to
upload system files such as .htaccess in order to bypass protections
afforded by Drupal's default .htaccess file. After this fix,
file_save_upload() now trims leading and trailing dots from filenames.
</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-011">
<p>The Media Library module has a security vulnerability whereby it
doesn't sufficiently restrict access to media items in certain
configurations.
</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-012">
<p>The Drupal project uses the third-party library Archive_Tar, which
has released a security-related feature that impacts some Drupal
configurations. Multiple vulnerabilities are possible if Drupal is
configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and
processes them. The latest versions of Drupal update Archive_Tar to
1.4.9 to mitigate the file processing vulnerabilities.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2019-009</url>
<url>https://www.drupal.org/sa-core-2019-010</url>
<url>https://www.drupal.org/sa-core-2019-011</url>
<url>https://www.drupal.org/sa-core-2019-012</url>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2019-12-21</entry>
</dates>
</vuln>
<vuln vid="ed8cbad5-21a8-11ea-9b6d-901b0e934d69">
<topic>py-matrix-synapse -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.7.1">
<p>The [synapse 1.7.1] release includes several security fixes as well
as a fix to a bug exposed by the security fixes. All previous releases
of Synapse are affected. Administrators are encouraged to upgrade as
soon as possible.</p>
<ul>
<li>Fix a bug which could cause room events to be incorrectly authorized
using events from a different room.</li>
<li>Fix a bug causing responses to the /context client endpoint to not
use the pruned version of the event.</li>
<li>Fix a cause of state resets in room versions 2 onwards.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.7.1</url>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2019-12-18</entry>
</dates>
</vuln>
<vuln vid="d778ddb0-2338-11ea-a1c7-b499baebfeaf">
<topic>OpenSSL -- Overflow vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2u,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20191206.txt">
<p>rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low)<br/>
There is an overflow bug in the x64_64 Montgomery squaring procedure
used in exponentiation with 512-bit moduli. No EC algorithms are
affected. Analysis suggests that attacks against 2-prime RSA1024,
3-prime RSA1536, and DSA1024 as a result of this defect would be very
difficult to perform and are not believed likely. Attacks against
DH512 are considered just feasible. However, for an attack the target
would have to re-use the DH512 private key, which is not recommended
anyway. Also applications directly using the low level API BN_mod_exp
may be affected if they use BN_FLG_CONSTTIME.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20191206.txt</url>
<cvename>CVE-2019-1551</cvename>
</references>
<dates>
<discovery>2019-12-06</discovery>
<entry>2019-12-20</entry>
</dates>
</vuln>
<vuln vid="70111759-1dae-11ea-966a-206a8a720317">
<topic>spamassassin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://www.cybersecurity-help.cz/vdb/SB2019121311">
<p>An input validation error of user-supplied input parsing
multipart emails. Specially crafted emails can consume all
resources on the system.</p>
<p>A local user is able to execute arbitrary shell commands
through specially crafted nefarious CF files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.cybersecurity-help.cz/vdb/SB2019121311</url>
<cvename>CVE-2019-12420</cvename>
<cvename>CVE-2018-11805</cvename>
</references>
<dates>
<discovery>2019-12-11</discovery>
<entry>2019-12-13</entry>
</dates>
</vuln>
<vuln vid="1edae47e-1cdd-11ea-8c2a-08002743b791">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba48</name>
<range><ge>4.8.0</ge></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.11</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/samba-4.10.11.html">
<p>CVE-2019-14861:</p>
<p>An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name.</p>
<p>CVE-2019-14870:</p>
<p>The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/history/samba-4.10.11.html</url>
<cvename>CVE-2019-14861</cvename>
<cvename>CVE-2019-14870</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-12</entry>
</dates>
</vuln>
<vuln vid="b7dc4dde-2e48-43f9-967a-c68461537cf2">
<topic>dovecot -- null pointer deref in notify with empty headers</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.9</ge><lt>2.3.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-December/117894.html">
<p>Mail with group address as sender will cause a signal 11 crash in push
notification drivers. Group address as recipient can cause crash in some
drivers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot/2019-December/117894.html</url>
<cvename>CVE-2019-19722</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-13</entry>
</dates>
</vuln>
<vuln vid="21944144-1b90-11ea-a2d4-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.4</lt></range>
<range><ge>12.4.0</ge><lt>12.4.6</lt></range>
<range><ge>10.5.0</ge><lt>12.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/">
<p>Path traversal with potential remote code execution</p>
<p>Disclosure of private code via Elasticsearch integration</p>
<p>Update Git dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/</url>
<cvename>CVE-2019-19628</cvename>
<cvename>CVE-2019-19629</cvename>
<cvename>CVE-2019-19604</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-10</entry>
</dates>
</vuln>
<vuln vid="22ae307a-1ac4-11ea-b267-001cc0382b2f">
<topic>Ghostscript -- Security bypass vulnerabilities</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cedric Buissart (Red Hat) reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14811">
<p>A flaw was found in, ghostscript versions prior to 9.50, in the
.pdf_hook_DSC_Creator procedure where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14812">
<p>A flaw was found in all ghostscript versions 9.x before 9.50, in
the .setuserparams2 procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14813">
<p>A flaw was found in ghostscript, versions 9.x before 9.50, in the
setsystemparams procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14817">
<p>A flaw was found in, ghostscript versions prior to 9.50, in the
.pdfexectoken and other procedures where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-14811</cvename>
<cvename>CVE-2019-14812</cvename>
<cvename>CVE-2019-14813</cvename>
<cvename>CVE-2019-14817</cvename>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-12-09</entry>
</dates>
</vuln>
<vuln vid="ca3fe5b3-185e-11ea-9673-4c72b94353b5">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the phpmyadmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/">
<p>This security fix is part of an ongoing effort to improve the security of the Designer feature
and is designated PMASA-2019-5. There is also an improvement for how we sanitize git version
information shown on the home page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/</url>
</references>
<dates>
<discovery>2019-11-22</discovery>
<entry>2019-12-06</entry>
</dates>
</vuln>
<vuln vid="4e3fa78b-1577-11ea-b66e-080027bdabe8">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<name>py38-django21</name>
<range><lt>2.1.15</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/dec/02/security-releases/">
<p>CVE-2019-19118: Privilege escalation in the Django admin.</p>
<p>Since Django 2.1, a Django model admin displaying a parent model with related
model inlines, where the user has view-only permissions to a parent model but
edit permissions to the inline model, would display a read-only view of the parent
model but editable forms for the inline.</p>
<p>Submitting these forms would not allow direct edits to the parent model, but would
trigger the parent model's save() method, and cause pre and post-save signal handlers
to be invoked. This is a privilege escalation as a user who lacks permission to edit
a model should not be able to trigger its save-related signals.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2019/dec/02/security-releases/</url>
<cvename>CVE-2019-19118</cvename>
</references>
<dates>
<discovery>2019-11-25</discovery>
<entry>2019-12-03</entry>
</dates>
</vuln>
<vuln vid="9c36d41c-11df-11ea-9b6d-901b0e934d69">
<topic>py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.6.1">
<p>Clean up local threepids from user on account deactivation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.6.1</url>
<url>https://github.com/matrix-org/synapse/pull/6426</url>
</references>
<dates>
<discovery>2019-11-28</discovery>
<entry>2019-11-28</entry>
</dates>
</vuln>
<vuln vid="42675046-fa70-11e9-ba4e-901b0e934d69">
<topic>py-matrix-synapse -- missing signature checks on some federation APIs</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/pull/6262">
<p>Make sure that [...] events sent over /send_join, /send_leave, and
/invite, are correctly signed and come from the expected servers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/pull/6262</url>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.5.0</url>
</references>
<dates>
<discovery>2019-10-29</discovery>
<entry>2019-10-29</entry>
</dates>
</vuln>
<vuln vid="4ce7c28a-11ac-11ea-b537-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.2</lt></range>
<range><ge>12.4.0</ge><lt>12.4.5</lt></range>
<range><ge>11.9.0</ge><lt>12.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/">
<p>Unauthorized access to grafana metrics</p>
<p>Update Mattermost dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/</url>
<cvename>CVE-2019-19262</cvename>
</references>
<dates>
<discovery>2019-11-27</discovery>
<entry>2019-11-28</entry>
</dates>
</vuln>
<vuln vid="1aa7a094-1147-11ea-b537-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.1</lt></range>
<range><ge>12.4.0</ge><lt>12.4.4</lt></range>
<range><lt>12.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/">
<p>Path traversal with potential remote code execution</p>
<p>Private objects exposed through project import</p>
<p>Disclosure of notes via Elasticsearch integration</p>
<p>Disclosure of comments via Elasticsearch integration</p>
<p>DNS Rebind SSRF in various chat notifications</p>
<p>Disclosure of vulnerability status in dependency list</p>
<p>Disclosure of commit count in Cycle Analytics</p>
<p>Exposure of related branch names</p>
<p>Tags pushes from blocked users</p>
<p>Branches and Commits exposed to Guest members via integration</p>
<p>IDOR when adding users to protected environments</p>
<p>Former project members able to access repository information</p>
<p>Unauthorized access to grafana metrics</p>
<p>Todos created for former project members</p>
<p>Update Mattermost dependency</p>
<p>Disclosure of AWS secret keys on certain Admin pages</p>
<p>Stored XSS in Group and User profile fields</p>
<p>Forked project information disclosed via Project API</p>
<p>Denial of Service in the issue and commit comment pages</p>
<p>Tokens stored in plaintext</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/</url>
<cvename>CVE-2019-19088</cvename>
<cvename>CVE-2019-19309</cvename>
<cvename>CVE-2019-19086</cvename>
<cvename>CVE-2019-19087</cvename>
<cvename>CVE-2019-19261</cvename>
<cvename>CVE-2019-19256</cvename>
<cvename>CVE-2019-19254</cvename>
<cvename>CVE-2019-19257</cvename>
<cvename>CVE-2019-19263</cvename>
<cvename>CVE-2019-19258</cvename>
<cvename>CVE-2019-19259</cvename>
<cvename>CVE-2019-19260</cvename>
<cvename>CVE-2019-19262</cvename>
<cvename>CVE-2019-19255</cvename>
<cvename>CVE-2019-19310</cvename>
<cvename>CVE-2019-19311</cvename>
<cvename>CVE-2019-19312</cvename>
<cvename>CVE-2019-19313</cvename>
<cvename>CVE-2019-19314</cvename>
</references>
<dates>
<discovery>2019-11-27</discovery>
<entry>2019-11-27</entry>
</dates>
</vuln>
<vuln vid="3e748551-c732-45f6-bd88-928da16f23a8">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0006.html</url>
<cvename>CVE-2019-8710</cvename>
<cvename>CVE-2019-8743</cvename>
<cvename>CVE-2019-8764</cvename>
<cvename>CVE-2019-8765</cvename>
<cvename>CVE-2019-8766</cvename>
<cvename>CVE-2019-8782</cvename>
<cvename>CVE-2019-8783</cvename>
<cvename>CVE-2019-8808</cvename>
<cvename>CVE-2019-8811</cvename>
<cvename>CVE-2019-8812</cvename>
<cvename>CVE-2019-8813</cvename>
<cvename>CVE-2019-8814</cvename>
<cvename>CVE-2019-8815</cvename>
<cvename>CVE-2019-8816</cvename>
<cvename>CVE-2019-8819</cvename>
<cvename>CVE-2019-8820</cvename>
<cvename>CVE-2019-8821</cvename>
<cvename>CVE-2019-8822</cvename>
<cvename>CVE-2019-8823</cvename>
</references>
<dates>
<discovery>2019-11-08</discovery>
<entry>2019-11-27</entry>
</dates>
</vuln>
<vuln vid="87270ba5-03d3-11ea-b81f-3085a9a95629">
<topic>urllib3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-urllib3</name>
<name>py35-urllib3</name>
<name>py36-urllib3</name>
<name>py37-urllib3</name>
<name>py38-urllib3</name>
<range><lt>1.24.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports: (by search in the range 2018/01/01 - 2019/11/10):</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=urllib3&search_type=all&pub_start_date=01%2F01%2F2018&pub_end_date=11%2F10%2F2019">
<p>urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.</p>
<p>In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.</p>
<p>The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=urllib3&search_type=all&pub_start_date=01%2F01%2F2018&pub_end_date=11%2F10%2F2019</url>
<cvename>CVE-2018-20060</cvename>
<cvename>CVE-2019-11236</cvename>
<cvename>CVE-2019-11324</cvename>
<freebsdpr>ports/229322</freebsdpr>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2019-11-26</entry>
</dates>
</vuln>
<vuln vid="fbe10a8a-05a1-11ea-9dfa-f8b156ac3ff9">
<topic>FreeBSD -- Intel CPU Microcode Update</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_1</lt></range>
<range><ge>12.0</ge><lt>12.0_12</lt></range>
<range><ge>11.3</ge><lt>11.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Starting with version 1.26, the devcpu-data port/package includes
updates and mitigations for the following technical and security
advisories (depending on CPU model).</p>
<p>Intel TSX Updates (TAA) CVE-2019-11135 Voltage Modulation
Vulnerability CVE-2019-11139 MD_CLEAR Operations
CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-11091
TA Indirect Sharing CVE-2017-5715 EGETKEY CVE-2018-12126
CVE-2018-12127 CVE-2018-12130 CVE-2018-11091 JCC SKX102
Erratum </p>
<p>Updated microcode includes mitigations for
CPU issues, but may also cause a performance regression due
to the JCC erratum mitigation. Please visit
http://www.intel.com/benchmarks for further information.
</p>
<p>Please visit http://www.intel.com/security for
detailed information on these advisories as well as a list of
CPUs that are affected.</p>
<p>Operating a CPU without the latest microcode may result in erratic or
unpredictable behavior, including system crashes and lock ups.
Certain issues listed in this advisory may result in the leakage of
privileged system information to unprivileged users. Please refer to
the security advisories listed above for detailed information.</p>
</body>
</description>
<references>
<cvename>CVE-2019-11135</cvename>
<cvename>CVE-2019-11139</cvename>
<cvename>CVE-2018-12126</cvename>
<cvename>CVE-2018-12127</cvename>
<cvename>CVE-2018-12130</cvename>
<cvename>CVE-2018-11091</cvename>
<cvename>CVE-2017-5715</cvename>
<freebsdsa>SA-19:26.mcu</freebsdsa>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="edc0bf7e-05a1-11ea-9dfa-f8b156ac3ff9">
<topic>FreeBSD -- Machine Check Exception on Page Size Change</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_1</lt></range>
<range><ge>12.0</ge><lt>12.0_12</lt></range>
<range><ge>11.3</ge><lt>11.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel discovered a previously published erratum on some Intel
platforms can be exploited by malicious software to potentially cause
a denial of service by triggering a machine check that will crash or
hang the system.</p>
<p>Malicious guest operating systems may be able to crash the host.</p>
</body>
</description>
<references>
<cvename>CVE-2018-12207</cvename>
<freebsdsa>SA-19:25.mcepsc</freebsdsa>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="6ade62d9-0f62-11ea-9673-4c72b94353b5">
<topic>clamav -- Denial-of-Service (DoS) vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html">
<p>A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email
file as a result of excessively long scan times. The issue is resolved by implementing
several maximums in parsing MIME messages and by optimizing use of memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html</url>
<cvename>CVE-2019-15961</cvename>
</references>
<dates>
<discovery>2019-09-06</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="ffc80e58-0dcb-11ea-9673-4c72b94353b5">
<topic>unbound -- parsing vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound Security Advisories:</p>
<blockquote cite="https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module">
<p>Recent versions of Unbound contain a vulnerability that can cause shell
code execution after receiving a specially crafted answer. This issue
can only be triggered if unbound was compiled with --enable-ipsecmod
support, and ipsecmod is enabled and used in the configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module</url>
<cvename>CVE-2019-18934</cvename>
</references>
<dates>
<discovery>2019-11-19</discovery>
<entry>2019-11-23</entry>
</dates>
</vuln>
<vuln vid="b12a341a-0932-11ea-bf09-080027e0baa0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/">
<p>This release contains five security fixes, so we recommend updating:</p>
<ul>
<li>Fix issue with user.fullname</li>
<li>Ignore mentions for users with no access</li>
<li>Be more strict with git arguments</li>
<li>Extract the username and password from the mirror url</li>
<li>Reserve .well-known username</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/</url>
<freebsdpr>ports/241981</freebsdpr>
</references>
<dates>
<discovery>2019-11-17</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="94c6951a-0d04-11ea-87ca-001999f8d30b">
<topic>asterisk -- Re-invite with T.38 and malformed SDP causes crash</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If Asterisk receives a re-invite initiating T.38 faxing
and has a port of 0 and no c line in the SDP, a crash
will occur.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-008.html</url>
<cvename>CVE-2019-18976</cvename>
</references>
<dates>
<discovery>2019-11-07</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="49b61ab6-0d04-11ea-87ca-001999f8d30b">
<topic>asterisk -- AMI user could execute system commands</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A remote authenticated Asterisk Manager Interface (AMI)
user without system authorization could use a specially
crafted Originate AMI request to execute arbitrary system
commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-007.html</url>
<cvename>CVE-2019-18610</cvename>
</references>
<dates>
<discovery>2019-10-10</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="a8d94711-0d03-11ea-87ca-001999f8d30b">
<topic>asterisk -- SIP request can change address of a SIP peer</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A SIP request can be sent to Asterisk that can change
a SIP peers IP address. A REGISTER does not need to occur,
and calls can be hijacked as a result. The only thing
that needs to be known is the peers name; authentication
details such as passwords do not need to be known. This
vulnerability is only exploitable when the nat option is
set to the default, or auto_force_rport.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-006.html</url>
<cvename>CVE-2019-18790</cvename>
</references>
<dates>
<discovery>2019-10-17</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="ecb7fdec-0b82-11ea-874d-0c9d925bbbc0">
<topic>drm graphics drivers -- Local privilege escalation and denial of service</topic>
<affects>
<package>
<name>drm-current-kmod</name>
<range><lt>4.16.g20191120</lt></range>
</package>
<package>
<name>drm-devel-kmod</name>
<range><lt>5.0.g20191120</lt></range>
</package>
<package>
<name>drm-fbsd12.0-kmod</name>
<range><lt>4.16.g20191120</lt></range>
</package>
<package>
<name>drm-fbsd11.2-kmod</name>
<range><lt>4.11.g20191204</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu">
<p>As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient
access control may allow an authenticated user to potentially
enable escalation of privilege via local access.</p>
<p>INTEL-SA-00260 advises that insufficient access control may
allow an authenticated user to potentially enable denial of
service via local access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu</url>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html</url>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00260.html</url>
<cvename>CVE-2019-0154</cvename>
<cvename>CVE-2019-11112</cvename>
</references>
<dates>
<discovery>2019-11-12</discovery>
<entry>2019-11-20</entry>
<modified>2019-12-04</modified>
</dates>
</vuln>
<vuln vid="620685d6-0aa3-11ea-9673-4c72b94353b5">
<topic>squid -- Vulnerable to HTTP Digest Authentication</topic>
<affects>
<package>
<name>squid</name>
<range><lt>4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid Team reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2019_11.txt">
<p>Problem Description: Due to incorrect data management Squid is
vulnerable to a information disclosure when processing HTTP Digest
Authentication.</p>
<p>Severity: Nonce tokens contain the raw byte value of a pointer which sits
within heap memory allocation. This information reduces ASLR protections
and may aid attackers isolating memory areas to target for remote code
execution attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2019_11.txt</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679</url>
<cvename>CVE-2019-18679</cvename>
</references>
<dates>
<discovery>2019-11-05</discovery>
<entry>2019-11-19</entry>
</dates>
</vuln>
<vuln vid="f04f840d-0840-11ea-8d66-75d3253ef913">
<topic>libidn2 -- roundtrip check vulnerability</topic>
<affects>
<package>
<name>libidn2</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE list:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290">
<p>GNU libidn2 before 2.2.0 fails to perform the roundtrip checks
specified in RFC3490 Section 4.2 when converting A-labels to U-labels.
This makes it possible in some circumstances for one domain to
impersonate another. By creating a malicious domain that matches a
target domain except for the inclusion of certain punycoded Unicode
characters (that would be discarded when converted first to a Unicode
label and then back to an ASCII label), arbitrary domains can be
impersonated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/libidn/libidn2/blob/master/NEWS</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290</url>
<cvename>CVE-2019-12290</cvename>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-18</entry>
<modified>2020-06-24</modified>
</dates>
</vuln>
<vuln vid="f59af308-07f3-11ea-8c56-f8b156b6dcc8">
<topic>GNU cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gcpio</name>
<range><lt>2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sergey Poznyakoff reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html">
<p>This stable release fixes several potential vulnerabilities</p>
<p>CVE-2015-1197: cpio, when using the --no-absolute-filenames
option, allows local users to write to arbitrary files
via a symlink attack on a file in an archive.</p>
<p>CVE-2016-2037: The cpio_safer_name_suffix function in
util.c allows remote attackers to cause a denial of service
(out-of-bounds write) via a crafted cpio file.</p>
<p>CVE-2019-14866: Improper input validation when writing
tar header fields leads to unexpected tar generation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html</url>
<cvename>CVE-2015-1197</cvename>
<cvename>CVE-2016-2037</cvename>
<cvename>CVE-2019-14866</cvename>
</references>
<dates>
<discovery>2019-11-06</discovery>
<entry>2019-11-15</entry>
</dates>
</vuln>
<vuln vid="b48e7b14-052a-11ea-a1de-53b029d2b061">
<topic>libmad -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libmad</name>
<range><lt>0.15.1b_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>National Vulnerability Database:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8372">
<p>CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a
denial of service (assertion failure and application exit) via a crafted
audio file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8373">
<p>CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
libmad 0.15.1b allows remote attackers to cause a denial of service
(heap-based buffer overflow and application crash) or possibly have
unspecified other impact via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8374">
<p>CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
libmad 0.15.1b allows remote attackers to cause a denial of service
(heap-based buffer over-read and application crash) via a crafted audio
file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8372</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8373</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8374</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/</url>
<cvename>CVE-2017-8372</cvename>
<cvename>CVE-2017-8373</cvename>
<cvename>CVE-2017-8374</cvename>
</references>
<dates>
<discovery>2017-04-30</discovery>
<entry>2019-11-13</entry>
</dates>
</vuln>
<vuln vid="88d00176-058e-11ea-bd1c-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>78.0.3904.97</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html">
<p>Four security issues were fixed, including:</p>
<ul>
<li>[1021723] Various fixes from internal audits, fuzzing and other
initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2019-11-06</discovery>
<entry>2019-11-12</entry>
</dates>
</vuln>
<vuln vid="459df1ba-051c-11ea-9673-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.2.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/">
<p>Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting)
could be added via the Customizer.</p>
<p>rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.</p>
<p>Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript
into style tags.</p>
<p>rops to David Newman for highlighting a method to poison the cache of JSON GET requests
via the Vary: Origin header.</p>
<p>Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs
are validated.</p>
<p>Props to Ben Bidner of the WordPress Security Team who discovered issues related to
referrer validation in the admin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/</url>
</references>
<dates>
<discovery>2019-10-14</discovery>
<entry>2019-11-12</entry>
</dates>
</vuln>
<vuln vid="b2f9573a-008c-11ea-9801-10c37b4ac2ea">
<topic>nexus2-oss -- Multiple vulerabilities</topic>
<affects>
<package>
<name>nexus2-oss</name>
<range><lt>2.14.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sonatype reports:</p>
<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2019-release-notes#id-2019ReleaseNotes-RepositoryManager2.14.15">
<p>Several RCE vulnerabilities have been found and corrected in 2.14.15:</p>
<p>CVE-2019-16530: An attacker with elevated privileges can upload a
specially crafted file. That file can contain commands that will
be executed on the system, with the same privileges as the user
running the server.</p>
<p>CVE-2019-15893: A Remote Code Execution vulnerability has been
discovered in Nexus Repository Manager requiring immediate
action. The vulnerability allows for an attacker with
administrative access to NXRM to create repostories that can
grant access to read/execute system data outside the scope of
NXRM.</p>
<p>CVE-2019-5475: A vulnerability has been found that can allow
user's with administrative privileges to run processes on the
target server, that the nxrm os user has access to.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16530</cvename>
<cvename>CVE-2019-15893</cvename>
<cvename>CVE-2019-5475</cvename>
</references>
<dates>
<discovery>2019-09-19</discovery>
<entry>2019-11-07</entry>
</dates>
</vuln>
<vuln vid="6a7c2ab0-00dd-11ea-83ce-705a0f828759">
<topic>php -- env_path_info underflow in fpm_main.c can lead to RCE</topic>
<affects>
<package>
<name>php71</name>
<range><lt>7.1.33</lt></range>
</package>
<package>
<name>php72</name>
<range><lt>7.2.24</lt></range>
</package>
<package>
<name>php73</name>
<range><lt>7.3.11</lt></range>
</package>
<package>
<name>php74</name>
<range><lt>7.4.0.rc5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-2">
<p>The PHP development team announces the immediate availability of PHP 7.3.11. This is a security release which also contains several bug fixes.</p>
</blockquote>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-1">
<p>The PHP development team announces the immediate availability of PHP 7.2.24. This is a security release which also contains several bug fixes.</p>
</blockquote>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-3">
<p>The PHP development team announces the immediate availability of PHP 7.1.33. This is a security release which also contains several bug fixes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11043</cvename>
<url>https://www.php.net/archive/2019.php#2019-10-24-1</url>
<url>https://www.php.net/archive/2019.php#2019-10-24-2</url>
<url>https://www.php.net/archive/2019.php#2019-10-24-3</url>
</references>
<dates>
<discovery>2019-10-24</discovery>
<entry>2019-11-06</entry>
</dates>
</vuln>
<vuln vid="c32285fe-fde4-11e9-9525-000c29c4dc65">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.5</lt></range>
</package>
<package>
<name>mediawiki132</name>
<range><lt>1.32.5</lt></range>
</package>
<package>
<name>mediawiki133</name>
<range><lt>1.33.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html">
<p>Security fixes:
T230402, CVE-2019-16738 SECURITY: Add permission check for suppressed account
to Special:Redirect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16738</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html</url>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-11-03</entry>
</dates>
</vuln>
<vuln vid="fc91f2ef-fd7b-11e9-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.66</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.42</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.28</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.19</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.9</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.46</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.28</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.18</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.66</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.46</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2019.html">
<p>This Critical Patch Update contains 31 new security fixes for
Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuoct2019.html</url>
<cvename>CVE-2019-5443</cvename>
<cvename>CVE-2019-1543</cvename>
<cvename>CVE-2019-3011</cvename>
<cvename>CVE-2019-2966</cvename>
<cvename>CVE-2019-2967</cvename>
<cvename>CVE-2019-2974</cvename>
<cvename>CVE-2019-2946</cvename>
<cvename>CVE-2019-3004</cvename>
<cvename>CVE-2019-2914</cvename>
<cvename>CVE-2019-2969</cvename>
<cvename>CVE-2019-2991</cvename>
<cvename>CVE-2019-2920</cvename>
<cvename>CVE-2019-2993</cvename>
<cvename>CVE-2019-2922</cvename>
<cvename>CVE-2019-2923</cvename>
<cvename>CVE-2019-2924</cvename>
<cvename>CVE-2019-2963</cvename>
<cvename>CVE-2019-2968</cvename>
<cvename>CVE-2019-3003</cvename>
<cvename>CVE-2019-2997</cvename>
<cvename>CVE-2019-2948</cvename>
<cvename>CVE-2019-2950</cvename>
<cvename>CVE-2019-2982</cvename>
<cvename>CVE-2019-2998</cvename>
<cvename>CVE-2019-2960</cvename>
<cvename>CVE-2019-2957</cvename>
<cvename>CVE-2019-2938</cvename>
<cvename>CVE-2019-3018</cvename>
<cvename>CVE-2019-3009</cvename>
<cvename>CVE-2019-2910</cvename>
<cvename>CVE-2019-2911</cvename>
</references>
<dates>
<discovery>2019-10-15</discovery>
<entry>2019-11-02</entry>
</dates>
</vuln>
<vuln vid="381deebb-f5c9-11e9-9c4f-74d435e60b7c">
<topic>file -- Heap buffer overflow possible</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre reports</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218">
<p>cdf_read_property_info in cdf.c in file through 5.37 does not
restrict the number of CDF_VECTOR elements, which allows a heap-based
buffer overflow (4-byte out-of-bounds write).</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780</url>
<url>https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84</url>
</references>
<dates>
<discovery>2019-08-26</discovery>
<entry>2019-11-02</entry>
</dates>
</vuln>
<vuln vid="92243b6a-5775-4aea-8727-a938058df5ba">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0005.html</url>
<cvename>CVE-2019-8625</cvename>
<cvename>CVE-2019-8674</cvename>
<cvename>CVE-2019-8707</cvename>
<cvename>CVE-2019-8719</cvename>
<cvename>CVE-2019-8720</cvename>
<cvename>CVE-2019-8726</cvename>
<cvename>CVE-2019-8733</cvename>
<cvename>CVE-2019-8735</cvename>
<cvename>CVE-2019-8763</cvename>
<cvename>CVE-2019-8768</cvename>
<cvename>CVE-2019-8769</cvename>
<cvename>CVE-2019-8771</cvename>
</references>
<dates>
<discovery>2019-10-29</discovery>
<entry>2019-10-31</entry>
</dates>
</vuln>
<vuln vid="fd10aa77-fb5e-11e9-af7b-0800274e5f20">
<topic>gitea -- information disclosure</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/8303">
<p>When a comment in an issue or PR mentions a user using
@username, the mentioned user receives a mail notification even if
they don't have permission to see the originating repository.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.5</url>
<url>https://blog.gitea.io/2019/10/gitea-1.9.5-is-released/</url>
</references>
<dates>
<discovery>2019-09-27</discovery>
<entry>2019-10-30</entry>
</dates>
</vuln>
<vuln vid="50a1bbc9-fb80-11e9-9e70-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba48</name>
<range><le>4.8.12</le></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10218.html">
<p>Malicious servers can cause Samba client code to return filenames containing
path separators to calling code.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14833.html">
<p>When the password contains multi-byte (non-ASCII) characters, the check
password script does not receive the full password string.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14847.html">
<p>Users with the "get changes" extended access right can crash the AD DC LDAP
server by requesting an attribute using the range= syntax.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2019-10218.html</url>
<cvename>CVE-2019-10218</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-14833.html</url>
<cvename>CVE-2019-14833</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-14847.html</url>
<cvename>CVE-2019-14847</cvename>
</references>
<dates>
<discovery>2019-09-29</discovery>
<entry>2019-10-29</entry>
</dates>
</vuln>
<vuln vid="6eddfa51-fb44-11e9-86e9-001b217b3468">
<topic>Gitlab -- Disclosure Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.4.0</ge><lt>12.4.1</lt></range>
<range><ge>12.3.0</ge><lt>12.3.6</lt></range>
<range><ge>0</ge><lt>12.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/">
<p>Source branch of a MR could be removed by an unauthorised user</p>
<p>Private group members could be listed</p>
<p>Disclosure of System Notes via Elasticsearch integration</p>
<p>Disclosure of Private Comments via Elasticsearch integration</p>
<p>Confirm existence of private repositories</p>
<p>Private group membership could be disclosed</p>
<p>Disclosure of Project Labels</p>
<p>Disclosure of Private Project Path and Labels</p>
<p>Uncontrolled Resource Consumption due to Nested GraphQL Queries</p>
<p>Improper access control on comments</p>
<p>Sentry Token Access Control</p>
<p>Authorisation check for Project Transfer option</p>
<p>XSS in Wiki Pages Using RDoc</p>
<p>Untrusted Input could be used for Internal Redirect</p>
<p>Access control for protected environments</p>
<p>Private Sub Group path Disclosure</p>
<p>Disclosure of Group Packages List</p>
<p>Private Repository Name Disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/</url>
<cvename>CVE-2019-18446</cvename>
<cvename>CVE-2019-18447</cvename>
<cvename>CVE-2019-18460</cvename>
<cvename>CVE-2019-18456</cvename>
<cvename>CVE-2019-18448</cvename>
<cvename>CVE-2019-18449</cvename>
<cvename>CVE-2019-18450</cvename>
<cvename>CVE-2019-18452</cvename>
<cvename>CVE-2019-18455</cvename>
<cvename>CVE-2019-18453</cvename>
<cvename>CVE-2019-18457</cvename>
<cvename>CVE-2019-18458</cvename>
<cvename>CVE-2019-18454</cvename>
<cvename>CVE-2019-18451</cvename>
<cvename>CVE-2019-18459</cvename>
<cvename>CVE-2019-18461</cvename>
<cvename>CVE-2019-18463</cvename>
<cvename>CVE-2019-18462</cvename>
</references>
<dates>
<discovery>2019-10-30</discovery>
<entry>2019-10-30</entry>
</dates>
</vuln>
<vuln vid="53b3474c-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>System calls operating on file descriptors obtain a
reference to relevant struct file which due to a programming
error was not always put back, which in turn could be used
to overflow the counter of affected struct file.</p>
<h1>Impact:</h1>
<p>A local user can use this flaw to obtain access to files,
directories, sockets, etc., opened by processes owned by
other users. If obtained struct file represents a directory
from outside of user's jail, it can be used to access files
outside of the jail. If the user in question is a jailed
root they can obtain root privileges on the host system.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5603</cvename>
<freebsdsa>SA-19:24.mqueuefs</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="5027b62e-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- kernel memory disclosure from /dev/midistat</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel driver for /dev/midistat implements a handler
for read(2). This handler is not thread-safe, and a
multi-threaded program can exploit races in the handler to
cause it to copy out kernel memory outside the boundaries
of midistat's data buffer.</p>
<h1>Impact:</h1>
<p>The races allow a program to read kernel memory within
a 4GB window centered at midistat's data buffer. The buffer
is allocated each time the device is opened, so an attacker
is not limited to a static 4GB region of memory.</p>
<p>On 32-bit platforms, an attempt to trigger the race may
cause a page fault in kernel mode, leading to a panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5612</cvename>
<freebsdsa>SA-19:23.midi</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="4d3d4f64-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- IPv6 remote Denial-of-Service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due do a missing check in the code of m_pulldown(9) data
returned may not be contiguous as requested by the caller.</p>
<h1>Impact:</h1>
<p>Extra checks in the IPv6 code catch the error condition
and trigger a kernel panic leading to a remote DoS
(denial-of-service) attack with certain Ethernet interfaces.
At this point it is unknown if any other than the IPv6 code
paths can trigger a similar condition.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5611</cvename>
<freebsdsa>SA-19:22.mbuf</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="499b22a3-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Insufficient validation of guest-supplied data (e1000 device)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The e1000 network adapters permit a variety of modifications
to an Ethernet packet when it is being transmitted. These
include the insertion of IP and TCP checksums, insertion
of an Ethernet VLAN header, and TCP segmentation offload
("TSO"). The e1000 device model uses an on-stack buffer to
generate the modified packet header when simulating these
modifications on transmitted packets.</p>
<p>When TCP segmentation offload is requested for a transmitted
packet, the e1000 device model used a guest-provided value
to determine the size of the on-stack buffer without
validation. The subsequent header generation could overflow
an incorrectly sized buffer or indirect a pointer composed
of stack garbage.</p>
<h1>Impact:</h1>
<p>A misbehaving bhyve guest could overwrite memory in the
bhyve process on the host.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5609</cvename>
<freebsdsa>SA-19:21.bhyve</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="45a95fdd-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Insufficient message length validation in bsnmp library</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A function extracting the length from type-length-value
encoding is not properly validating the submitted length.</p>
<h1>Impact:</h1>
<p>A remote user could cause, for example, an out-of-bounds
read, decoding of unrelated data, or trigger a crash of the
software such as bsnmpd resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5610</cvename>
<freebsdsa>SA-19:20.bsnmp</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="41d2f3e6-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ICMPv6 input path incorrectly handles cases where
an MLDv2 listener query packet is internally fragmented
across multiple mbufs.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause an out-of-bounds
read or write that may cause the kernel to attempt to access
an unmapped page and subsequently panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5608</cvename>
<freebsdsa>SA-19:19.mldv2</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="3c7edc7a-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Multiple vulnerabilities in bzip2</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The decompressor used in bzip2 contains a bug which can
lead to an out-of-bounds write when processing a specially
crafted bzip2(1) file.</p>
<p>bzip2recover contains a heap use-after-free bug which
can be triggered when processing a specially crafted bzip2(1)
file.</p>
<h1>Impact:</h1>
<p>An attacker who can cause maliciously crafted input to
be processed may trigger either of these bugs. The bzip2recover
bug may cause a crash, permitting a denial-of-service. The
bzip2 decompressor bug could potentially be exploited to
execute arbitrary code.</p>
<p>Note that some utilities, including the tar(1) archiver
and the bspatch(1) binary patching utility (used in portsnap(8)
and freebsd-update(8)) decompress bzip2(1)-compressed data
internally; system administrators should assume that their
systems will at some point decompress bzip2(1)-compressed
data even if they never explicitly invoke the bunzip2(1)
utility.</p>
</body>
</description>
<references>
<cvename>CVE-2016-3189</cvename>
<cvename>CVE-2019-1290</cvename>
<freebsdsa>SA-19:18.bzip2</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="2d4076eb-f679-11e9-a87f-a4badb2f4699">
<topic>varnish -- Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>varnish6</name>
<range><lt>6.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Software reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00004.html#vsv00004">
<p>A bug has been discovered in Varnish Cache where we fail to
clear a pointer between the handling of one client requests and the next
on the same connection. This can under specific circumstances lead to
information being leaked from the connection workspace.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00004.html#vsv00004</url>
</references>
<dates>
<discovery>2019-10-21</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="3a1474ba-f646-11e9-b0af-b888e347c638">
<topic>sudo -- Potential bypass of Runas user restrictions</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/minus_1_uid.html">
<p>When sudo is configured to allow a user to run commands as an
arbitrary user via the ALL keyword in a Runas specification, it
is possible to run commands as root by specifying the user ID -1
or 4294967295.</p>
<p>This can be used by a user with sufficient sudo privileges to
run commands as root even if the Runas specification explicitly
disallows root access as long as the ALL keyword is listed first
in the Runas specification.</p>
<p>Log entries for commands run this way will list the target user
as 4294967295 instead of root. In addition, PAM session modules
will not be run for the command.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/minus_1_uid.html</url>
<cvename>CVE-2019-14287</cvename>
</references>
<dates>
<discovery>2019-10-15</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="a90d040e-f5b0-11e9-acc4-4576b265fda6">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/171">
<p>This issue has been created for public disclosure of an XSS
vulnerability that was responsibly reported by
https://hackerone.com/vxhex</p>
<p>In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/171</url>
<cvename>CVE-2019-15587</cvename>
</references>
<dates>
<discovery>2019-10-22</discovery>
<entry>2019-10-23</entry>
</dates>
</vuln>
<vuln vid="9b7491fb-f253-11e9-a50c-000c29c4dc65">
<topic>python 3.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final">
<p>bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering
the document page as HTML.</p>
<p>bpo-38174: Update vendorized expat library version to 2.2.8, which resolves
CVE-2019-15903.</p>
<p>bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite
loop for a specific case in which the email header does not have trailing whitespace,
and the case in which it contains an invalid encoded word.</p>
<p>bpo-37461: Fix an infinite loop when parsing specially crafted email headers.</p>
<p>bpo-34155: Fix parsing of invalid email addresses with more than one @
(e.g. a@b@c.com.) to not return the part before 2nd @ as valid email address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final</url>
<cvename>CVE-2019-15903</cvename>
</references>
<dates>
<discovery>2019-09-14</discovery>
<entry>2019-10-19</entry>
</dates>
</vuln>
<vuln vid="998ca824-ef55-11e9-b81f-3085a9a95629">
<topic>Pillow -- Allocation of resources without limits or throttling</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py35-pillow</name>
<name>py36-pillow</name>
<name>py37-pillow</name>
<range><lt>6.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865">
<p>An issue was discovered in Pillow before 6.2.0. When reading specially
crafted invalid image files, the library can either allocate very large
amounts of memory or take an extremely long period of time to process
the image.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/issues/4123</url>
<cvename>CVE-2019-16865</cvename>
<freebsdpr>ports/241268</freebsdpr>
</references>
<dates>
<discovery>2019-09-24</discovery>
<entry>2019-10-15</entry>
</dates>
</vuln>
<vuln vid="fd2e0ca8-e3ae-11e9-8af7-08002720423d">
<topic>mongodb -- Bump Windows package dependencies</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.14</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rich Mirch reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-42233">
<p>An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2390</cvename>
<url>https://jira.mongodb.org/browse/SERVER-42233</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-30</entry>
</dates>
</vuln>
<vuln vid="273c6c43-e3ad-11e9-8af7-08002720423d">
<topic>mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name.</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.14</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-40563">
<p>Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2389</cvename>
<url>https://jira.mongodb.org/browse/SERVER-40563</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-30</entry>
</dates>
</vuln>
<vuln vid="880bca8f-e201-11e9-8af7-08002720423d">
<topic>mongodb -- Attach IDs to users</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.13</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitch Wasson of Cisco's Advanced Malware Protection Group reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-38984">
<p>After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2386</cvename>
<url>https://jira.mongodb.org/browse/SERVER-38984</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-28</entry>
</dates>
</vuln>
<vuln vid="c360d057-ea8b-11e9-859b-b885849ded8e">
<topic>mod_perl2 -- execute arbitrary Perl code</topic>
<affects>
<package>
<name>ap24-mod_perl2</name>
<range><lt>2.0.11,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context
of the user account via a user-owned .htaccess.</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2011-2767">
<p>mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary
Perl code by placing it in a user-owned .htaccess file, because
(contrary to the documentation) there is no configuration option
that permits Perl code for the administrator's control of HTTP
request processing without also permitting unprivileged users
to run Perl code in the context of the user account that runs
Apache HTTP Server processes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767</url>
<url>https://www.securityfocus.com/bid/105195</url>
<url>https://access.redhat.com/errata/RHSA-2018:2826</url>
<url>https://bugs.debian.org/644169</url>
<url>https://usn.ubuntu.com/3825-2/</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2019-10-09</entry>
</dates>
</vuln>
<vuln vid="791e8f79-e7d1-11e9-8b31-206a8a720317">
<topic>Xpdf -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>4.02,1</lt></range>
</package>
<package>
<name>xpdf4</name>
<range><lt>4.02,1</lt></range>
</package>
<package>
<name>xpdf3</name>
<range><lt>3.04_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xpdf 4.02 fixes two vulnerabilities. Both fixes have been
backported to 3.04.</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-9877">
<p>An invalid memory access vulnerability in TextPage::findGaps()
in Xpdf 4.01 through a crafted PDF document can cause a
segfault.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16927">
<p>An out of bounds write exists in TextPage::findGaps() of
Xpdf 4.01.01 </p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-9877</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-16927</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9877</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1692</url>
</references>
<dates>
<discovery>2019-10-01</discovery>
<entry>2019-10-06</entry>
</dates>
</vuln>
<vuln vid="108a4be3-e612-11e9-9963-5f1753e0aca0">
<topic>unbound -- parsing vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><ge>1.7.1</ge><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound Security Advisories:</p>
<blockquote cite="https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries">
<p>Due to an error in parsing NOTIFY queries, it is possible for Unbound
to continue processing malformed queries and may ultimately result in a
pointer dereference in uninitialized memory. This results in a crash of
the Unbound daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries</url>
<cvename>CVE-2019-16866</cvename>
</references>
<dates>
<discovery>2019-10-03</discovery>
<entry>2019-10-03</entry>
</dates>
</vuln>
<vuln vid="f7fcb75c-e537-11e9-863e-b9b7af01ba9e">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.4.0,1</ge><lt>2.4.9,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.7,1</lt></range>
<range><ge>2.6.0,1</ge><lt>2.6.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/">
<p>This release includes security fixes. Please check the topics below for
details.</p>
<p>CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and
File.fnmatch?</p>
<p>A NUL injection vulnerability of Ruby built-in methods (File.fnmatch
and File.fnmatch?) was found. An attacker who has the control of the
path pattern parameter could exploit this vulnerability to make path
matching pass despite the intention of the program author.</p>
<p>CVE-2019-16201: Regular Expression Denial of Service vulnerability of
WEBrick's Digest access authentication</p>
<p>Regular expression denial of service vulnerability of WEBrick's Digest
authentication module was found. An attacker can exploit this
vulnerability to cause an effective denial of service against a WEBrick
service.</p>
<p>CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)</p>
<p>There is an HTTP response splitting vulnerability in WEBrick bundled
with Ruby.</p>
<p>CVE-2019-16255: A code injection vulnerability of Shell#[] and
Shell#test</p>
<p>A code injection vulnerability of Shell#[] and Shell#test in a standard
library (lib/shell.rb) was found.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/</url>
<cvename>CVE-2019-15845</cvename>
<cvename>CVE-2019-16201</cvename>
<cvename>CVE-2019-16254</cvename>
<cvename>CVE-2019-16255</cvename>
</references>
<dates>
<discovery>2019-10-01</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="0762fa72-e530-11e9-86e9-001b217b3468">
<topic>Gitlab -- Disclosure Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.3.0</ge><lt>12.3.3</lt></range>
<range><ge>12.2.0</ge><lt>12.2.7</lt></range>
<range><ge>8.17.0</ge><lt>12.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/">
<p>Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/</url>
</references>
<dates>
<discovery>2019-10-02</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="b17c86b9-e52e-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.3.0</ge><lt>12.3.2</lt></range>
<range><ge>12.2.0</ge><lt>12.2.6</lt></range>
<range><ge>7.12.0</ge><lt>12.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/">
<p>XSS in Markdown Preview Using Mermaid</p>
<p>Bypass Email Verification using Salesforce Authentication</p>
<p>Account Takeover using SAML</p>
<p>Uncontrolled Resource Consumption in Markdown using Mermaid</p>
<p>Disclosure of Private Project Path and Labels</p>
<p>Disclosure of Assignees via Milestones</p>
<p>Disclosure of Project Path via Unsubscribe Link</p>
<p>Disclosure of Project Milestones via Groups</p>
<p>Disclosure of Private System Notes via GraphQL</p>
<p>GIT Command Injection via API</p>
<p>Bypass User Blocking via CI/CD token</p>
<p>IDOR Adding Groups to Protected Environments</p>
<p>Disclosure of Group Membership via Merge Request Approval Rules</p>
<p>Disclosure of Head Pipeline via Blocking Merge Request Feature</p>
<p>Grafana update</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/</url>
<cvename>CVE-2019-19039</cvename>
</references>
<dates>
<discovery>2019-09-30</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="ed18aa92-e4f4-11e9-b6fa-3085a9a95629">
<topic>cacti -- Authenticated users may bypass authorization checks</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti developers reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723">
<p>In Cacti through 1.2.6, authenticated users may bypass authorization checks
(for viewing a graph) via a direct graph_json.php request with a modified
local_graph_id parameter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16723</cvename>
<url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.7</url>
</references>
<dates>
<discovery>2019-09-23</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="e917caba-e291-11e9-89f1-152fed202bb7">
<topic>Exim -- heap-based buffer overflow in string_vformat leading to RCE</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.92</ge><lt>4.92.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers team report:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html">
<p>There is a heap overflow in string_vformat().Using a EHLO message, remote code
execution seems to be possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openwall.com/lists/oss-security/2019/09/28/1</url>
</references>
<dates>
<discovery>2019-09-28</discovery>
<entry>2019-09-29</entry>
</dates>
</vuln>
<vuln vid="a92dcc5c-e05c-11e9-b589-10c37b4ac2ea">
<topic>go -- invalid headers are normalized, allowing request smuggling</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.13.1,1</lt></range>
</package>
<package>
<name>go-devel</name>
<range><lt>g20190925</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/34540">
<p>net/http (through net/textproto) used to accept and normalize invalid
HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
If a Go server is used behind a reverse proxy that accepts and forwards
but doesn't normalize such invalid headers, the reverse proxy and the
server can interpret the headers differently. This can lead to filter
bypasses or request smuggling, the latter if requests from separate clients
are multiplexed onto the same connection by the proxy. Such invalid headers
are now rejected by Go servers, and passed without normalization to Go
client applications.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16276</cvename>
<url>https://github.com/golang/go/issues/34540</url>
</references>
<dates>
<discovery>2019-09-25</discovery>
<entry>2019-09-26</entry>
</dates>
</vuln>
<vuln vid="81fcc2f9-e15a-11e9-abbf-800dd28b22bd">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php71</name>
<name>mantis-php72</name>
<name>mantis-php73</name>
<name>mantis-php74</name>
<range><lt>2.22.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mantis developers report:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.22.1">
<p>CVE-2019-15715: [Admin Required - Post Authentication] Command Execution / Injection Vulnerability</p>
<p>CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute</p>
<p>Missing integrity hashes for CSS resources from CDNs</p>
</blockquote>
</body>
</description>
<references>
<url>https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.22.1</url>
<cvename>CVE-2019-15715</cvename>
<cvename>CVE-2019-8331</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-27</entry>
</dates>
</vuln>
<vuln vid="9720bb39-f82a-402f-9fe4-e2c875bdda83">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.196</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.176.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-09-25/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1498 / CVE-2019-10401</h5>
<p>Stored XSS vulnerability in expandable textbox form control</p>
<h5>(Medium) SECURITY-1525 / CVE-2019-10402</h5>
<p>XSS vulnerability in combobox form control</p>
<h5>(Medium) SECURITY-1537 (1) / CVE-2019-10403</h5>
<p>Stored XSS vulnerability in SCM tag action tooltip</p>
<h5>(Medium) SECURITY-1537 (2) / CVE-2019-10404</h5>
<p>Stored XSS vulnerability in queue item tooltip</p>
<h5>(Medium) SECURITY-1505 / CVE-2019-10405</h5>
<p>Diagnostic web page exposed Cookie HTTP header</p>
<h5>(Medium) SECURITY-1471 / CVE-2019-10406</h5>
<p>XSS vulnerability in Jenkins URL setting</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10401</cvename>
<cvename>CVE-2019-10402</cvename>
<cvename>CVE-2019-10403</cvename>
<cvename>CVE-2019-10404</cvename>
<cvename>CVE-2019-10405</cvename>
<cvename>CVE-2019-10406</cvename>
<url>https://jenkins.io/security/advisory/2019-09-25/</url>
</references>
<dates>
<discovery>2019-09-25</discovery>
<entry>2019-09-25</entry>
</dates>
</vuln>
<vuln vid="20b92374-d62a-11e9-af73-001b217e4ee5">
<topic>ISC KEA -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>kea</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Internet Systems Consortium, Inc. reports:</p>
<blockquote cite="https://gitlab.isc.org/isc-projects/kea/issues">
<p>A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVE-2019-6472) [Medium]</p>
<p>An invalid hostname option can cause the kea-dhcp4 server to terminate (CVE-2019-6473) [Medium]</p>
<p>An oversight when validating incoming client requests can lead to a situation where the Kea server<br/>
will exit when trying to restart (CVE-2019-6474) [Medium]</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.isc.org/isc-projects/kea/issues</url>
<cvename>CVE-2019-6472</cvename>
<cvename>CVE-2019-6473</cvename>
<cvename>CVE-2019-6474</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-20</entry>
</dates>
</vuln>
<vuln vid="6856d798-d950-11e9-aae4-f079596b62f9">
<topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>expat project reports:</p>
<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes">
<p>
Fix heap overflow triggered by
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber),
and deny internal entities closing the doctype
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes</url>
</references>
<dates>
<discovery>2019-09-13</discovery>
<entry>2019-09-17</entry>
</dates>
</vuln>
<vuln vid="b2789b2d-d521-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.2.0</ge><lt>12.2.5</lt></range>
<range><ge>12.1.0</ge><lt>12.1.9</lt></range>
<range><ge>11.6.0</ge><lt>12.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/">
<p>Project Template Functionality Could Be Used to Access Restricted Project Data</p>
<p>Security Enhancements in GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/</url>
<cvename>CVE-2019-16170</cvename>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-12</entry>
</dates>
</vuln>
<vuln vid="1c948fd3-dac0-11e9-81b2-0011d823eebd">
<topic>Mbed TLS -- Side channel attack on deterministic ECDSA</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10">
<p>Mbed TLS does not have a constant-time/constant-trace arithmetic
library and uses blinding to protect against side channel
attacks.</p>
<p>In the ECDSA signature routine previous Mbed TLS versions used the
same RNG object for generating the ephemeral key pair and for
generating the blinding values. The deterministic ECDSA function
reused this by passing the RNG object created from the private key
and the message to be signed as prescribed by RFC 6979. This meant
that the same RNG object was used whenever the same message was
signed, rendering the blinding ineffective.</p>
<p>If the victim can be tricked to sign the same message repeatedly,
the private key may be recoverable through side channels.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10</url>
</references>
<dates>
<discovery>2019-09-06</discovery>
<entry>2019-09-19</entry>
</dates>
</vuln>
<vuln vid="55571619-454e-4769-b1e5-28354659e152">
<topic>bro -- invalid memory access or heap buffer over-read</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS">
<p>This is a security patch release to address a potential
Denial of Service vulnerability:</p>
<ul>
<li>
The NTLM analyzer did not properly handle AV Pair sequences
that were either empty or unterminated, resulting in
invalid memory access or heap buffer over-read. The NTLM
analyzer is enabled by default and used in the analysis
of SMB, DCE/RPC, and GSSAPI protocols.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS</url>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-17</entry>
</dates>
</vuln>
<vuln vid="c5bd8a25-99a6-11e9-a598-f079596b62f9">
<topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>expat project reports:</p>
<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes">
<p>
XML names with multiple colons could end up in the
wrong namespace, and take a high amount of RAM and CPU
resources while processing, opening the door to
use for denial-of-service attacks
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes</url>
</references>
<dates>
<discovery>2019-06-19</discovery>
<entry>2019-09-16</entry>
</dates>
</vuln>
<vuln vid="9fb4e57b-d65a-11e9-8a5f-e5c82b486287">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.19.4</ge><lt>7.66.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2019-5481: FTP-KRB double-free</p>
<p>libcurl can be told to use kerberos over FTP to a server, as set with
the CURLOPT_KRBLEVEL option.</p>
<p>During such kerberos FTP data transfer, the server sends data to curl
in blocks with the 32 bit size of each block first and then that amount
of data immediately following.</p>
<p>A malicious or just broken server can claim to send a very large block
and if by doing that it makes curl's subsequent call to realloc() to
fail, curl would then misbehave in the exit path and double-free the
memory.</p>
<p>In practical terms, an up to 4 GB memory area may very well be fine to
allocate on a modern 64 bit system but on 32 bit systems it will fail.</p>
<p>Kerberos FTP is a rarely used protocol with curl. Also, Kerberos
authentication is usually only attempted and used with servers that the
client has a previous association with.</p>
<p>CVE-2019-5482: TFTP small blocksize heap buffer overflow</p>
<p>libcurl contains a heap buffer overflow in the function
(tftp_receive_packet()) that receives data from a TFTP server. It can
call recvfrom() with the default size for the buffer rather than with
the size that was used to allocate it. Thus, the content that might
overwrite the heap memory is controlled by the server.</p>
<p>This flaw is only triggered if the TFTP server sends an OACK without
the BLKSIZE option, when a BLKSIZE smaller than 512 bytes was requested
by the TFTP client. OACK is a TFTP extension and is not used by all
TFTP servers.</p>
<p>Users choosing a smaller block size than default should be rare as the
primary use case for changing the size is to make it larger.</p>
<p>It is rare for users to use TFTP across the Internet. It is most
commonly used within local networks. TFTP as a protocol is always
inherently insecure.</p>
<p>This issue was introduced by the add of the TFTP BLKSIZE option
handling. It was previously incompletely fixed by an almost identical
issue called CVE-2019-5436.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5481.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5482.html</url>
<cvename>CVE-2019-5481</cvename>
<cvename>CVE-2019-5482</cvename>
</references>
<dates>
<discovery>2019-09-11</discovery>
<entry>2019-09-14</entry>
</dates>
</vuln>
<vuln vid="9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2t,1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190910.txt">
<p>ECDSA remote timing attack (CVE-2019-1547) [Low]</p>
<p>Fork Protection (CVE-2019-1549) [Low]<br/>
(OpenSSL 1.1.1 only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190910.txt</url>
<cvename>CVE-2019-1547</cvename>
<cvename>CVE-2019-1549</cvename>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-11</entry>
</dates>
</vuln>
<vuln vid="c6f19fe6-d42a-11e9-b4f9-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.255</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-46.html">
<ul>
<li>This update resolves a same origin method execution
vulnerability that could lead to arbitrary code execution
(CVE-2019-8069).</li>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-8070).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-8069</cvename>
<cvename>CVE-2019-8070</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-46.html</url>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-10</entry>
</dates>
</vuln>
<vuln vid="a8d87c7a-d1b1-11e9-a616-0992a4564e7c">
<topic>oniguruma -- multiple vulnerabilities</topic>
<affects>
<package>
<name>oniguruma</name>
<range><lt>6.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224">
<p>
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe().
</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225">
<p>A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression.</p>
<p>Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13224</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224</url>
<url>https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55</url>
<cvename>CVE-2019-13225</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225</url>
<url>https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c</url>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-09-07</entry>
</dates>
</vuln>
<vuln vid="10e1d580-d174-11e9-a87f-a4badb2f4699">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Japheth Cleaver reports:</p>
<blockquote cite="https://lists.xymon.com/archive/2019-July/046570.html">
<p>Several buffer overflows were reported by University of
Cambridge Computer Security Incident Response Team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.xymon.com/archive/2019-July/046570.html</url>
<cvename>CVE-2019-13451</cvename>
<cvename>CVE-2019-13452</cvename>
<cvename>CVE-2019-13455</cvename>
<cvename>CVE-2019-13273</cvename>
<cvename>CVE-2019-13274</cvename>
<cvename>CVE-2019-13484</cvename>
<cvename>CVE-2019-13485</cvename>
<cvename>CVE-2019-13486</cvename>
</references>
<dates>
<discovery>2019-07-23</discovery>
<entry>2019-09-07</entry>
</dates>
</vuln>
<vuln vid="8a9f86de-d080-11e9-9051-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/">
<p>Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues.
The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors.
The second was a cross-site scripting vulnerability in stored comments.</p>
<p>Props to Tim Coen for disclosing an issue where validation and sanitization
of a URL could lead to an open redirect.</p>
<p>Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.</p>
<p>Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability
for cross-site scripting (XSS) in shortcode previews.</p>
<p>Props to Ian Dunn of the Core Security Team for finding and disclosing a case where
reflected cross-site scripting could be found in the dashboard.</p>
<p>Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL
sanitization that can lead to cross-site scripting (XSS) attacks.</p>
<p>In addition to the above changes, we are also updating jQuery on older versions of WordPress.
This change was added in 5.2.1 and is now being brought to older versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-09-05</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="61db9b88-d091-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE with root privileges in TLS SNI handler</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.92.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers report:</p>
<blockquote cite="https://git.exim.org/exim.git/blob/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt">
<p>If your Exim server accepts TLS connections, it is vulnerable. This does
not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.</p>
<p>The vulnerability is exploitable by sending a SNI ending in a
backslash-null sequence during the initial TLS handshake. The exploit
exists as a POC. For more details see the document qualys.mbx</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.exim.org/exim.git/blob_plain/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt</url>
</references>
<dates>
<discovery>2019-09-02</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="7d53d8da-d07a-11e9-8f1a-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in audio transcoding</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.28.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When audio frames are given to the audio transcoding
support in Asterisk the number of samples are examined
and as part of this a message is output to indicate that
no samples are present. A change was done to suppress
this message for a particular scenario in which the message
was not relevant. This change assumed that information
about the origin of a frame will always exist when in
reality it may not.</p>
<p>This issue presented itself when an RTP packet containing
no audio (and thus no samples) was received. In a particular
transcoding scenario this audio frame would get turned
into a frame with no origin information. If this new frame
was then given to the audio transcoding support a crash
would occur as no samples and no origin information would
be present. The transcoding scenario requires the genericplc
option to be set to enabled (the default) and a transcoding
path from the source format into signed linear and then
from signed linear into another format.</p>
<p>Note that there may be other scenarios that have not
been found which can cause an audio frame with no origin
to be given to the audio transcoding support and thus
cause a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-005.html</url>
<cvename>CVE-2019-15639</cvename>
</references>
<dates>
<discovery>2019-08-07</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="d94c08d2-d079-11e9-8f1a-001999f8d30b">
<topic>asterisk -- Crash when negotiating for T.38 with a declined stream</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.7.4</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk sends a re-invite initiating T.38 faxing,
and the endpoint responds with a declined media stream a
crash will then occur in Asterisk.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-004.html</url>
<cvename>CVE-2019-15297</cvename>
</references>
<dates>
<discovery>2019-08-05</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="145a3e17-cea2-11e9-81e2-005056a311d1">
<topic>samba -- combination of parameters and permissions can allow user to escape from the share path definition</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10197.html">
<p>On a Samba SMB server for all versions of Samba from 4.9.0 clients are
able to escape outside the share root directory if certain
configuration parameters set in the smb.conf file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10197</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-10197.html</url>
</references>
<dates>
<discovery>2019-09-01</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>69.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>61.0,1</ge><lt>68.1.0,1</lt></range>
<range><lt>60.9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>61.0,2</ge><lt>68.1.0,2</lt></range>
<range><lt>60.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>61.0</ge><lt>68.1.0</lt></range>
<range><lt>60.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/">
<p>CVE-2019-11751: Malicious code execution through command line parameters</p>
<p>CVE-2019-11746: Use-after-free while manipulating video</p>
<p>CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML</p>
<p>CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images</p>
<p>CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service</p>
<p>CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location</p>
<p>CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB</p>
<p>CVE-2019-9812: Sandbox escape through Firefox Sync</p>
<p>CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com</p>
<p>CVE-2019-11743: Cross-origin access to unload event attributes</p>
<p>CVE-2019-11748: Persistence of WebRTC permissions in a third party context</p>
<p>CVE-2019-11749: Camera information available without prompting using getUserMedia</p>
<p>CVE-2019-5849: Out-of-bounds read in Skia</p>
<p>CVE-2019-11750: Type confusion in Spidermonkey</p>
<p>CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard</p>
<p>CVE-2019-11738: Content security policy bypass through hash-based sources in directives</p>
<p>CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list</p>
<p>CVE-2019-11734: Memory safety bugs fixed in Firefox 69</p>
<p>CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1</p>
<p>CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11734</cvename>
<cvename>CVE-2019-11735</cvename>
<cvename>CVE-2019-11736</cvename>
<cvename>CVE-2019-11737</cvename>
<cvename>CVE-2019-11738</cvename>
<cvename>CVE-2019-11740</cvename>
<cvename>CVE-2019-11741</cvename>
<cvename>CVE-2019-11742</cvename>
<cvename>CVE-2019-11743</cvename>
<cvename>CVE-2019-11744</cvename>
<cvename>CVE-2019-11746</cvename>
<cvename>CVE-2019-11747</cvename>
<cvename>CVE-2019-11748</cvename>
<cvename>CVE-2019-11749</cvename>
<cvename>CVE-2019-11750</cvename>
<cvename>CVE-2019-11751</cvename>
<cvename>CVE-2019-11752</cvename>
<cvename>CVE-2019-11753</cvename>
<cvename>CVE-2019-5849</cvename>
<cvename>CVE-2019-9812</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-27/</url>
</references>
<dates>
<discovery>2019-09-03</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="ce231189-ce56-11e9-9fa0-0050569f0b83">
<topic>www/varnish6 -- Denial of Service</topic>
<affects>
<package>
<name>varnish6</name>
<range><lt>6.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Varnish Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00003.html">
<p>A failure in HTTP/1 parsing can allow a remote attacker to trigger
an assertion in varnish, restarting the daemon and clearing the cache.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00003.html</url>
</references>
<dates>
<discovery>2019-09-02</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="c9c6c2f8-cd54-11e9-af89-080027ef1a23">
<topic>libgcrypt -- ECDSA timing attack</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627">
<p>Mitigate an ECDSA timing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13627</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627</url>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-09-02</entry>
</dates>
</vuln>
<vuln vid="e45c3669-caf2-11e9-851a-dcf3aaa3f3ff">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.24.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports many vulnerabilities,
including several arbitrary code execution vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0004.html</url>
<cvename>CVE-2019-8644</cvename>
<cvename>CVE-2019-8649</cvename>
<cvename>CVE-2019-8658</cvename>
<cvename>CVE-2019-8666</cvename>
<cvename>CVE-2019-8669</cvename>
<cvename>CVE-2019-8671</cvename>
<cvename>CVE-2019-8672</cvename>
<cvename>CVE-2019-8673</cvename>
<cvename>CVE-2019-8676</cvename>
<cvename>CVE-2019-8677</cvename>
<cvename>CVE-2019-8678</cvename>
<cvename>CVE-2019-8679</cvename>
<cvename>CVE-2019-8680</cvename>
<cvename>CVE-2019-8681</cvename>
<cvename>CVE-2019-8683</cvename>
<cvename>CVE-2019-8684</cvename>
<cvename>CVE-2019-8686</cvename>
<cvename>CVE-2019-8687</cvename>
<cvename>CVE-2019-8688</cvename>
<cvename>CVE-2019-8689</cvename>
<cvename>CVE-2019-8690</cvename>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-08-30</entry>
</dates>
</vuln>
<vuln vid="b68cc195-cae7-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.2.0</ge><lt>12.2.3</lt></range>
<range><ge>12.1.0</ge><lt>12.1.8</lt></range>
<range><ge>0.0.0</ge><lt>12.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/">
<p>Kubernetes Integration Server-Side Request Forgery</p>
<p>Server-Side Request Forgery in Jira Integration</p>
<p>Improved Protection Against Credential Stuffing Attacks</p>
<p>Markdown Clientside Resource Exhaustion</p>
<p>Pipeline Status Disclosure</p>
<p>Group Runner Authorization Issue</p>
<p>CI Metrics Disclosure</p>
<p>User IP Disclosed by Embedded Image and Media</p>
<p>Label Description HTML Injection</p>
<p>IDOR in Epic Notes API</p>
<p>Push Rule Bypass</p>
<p>Project Visibility Restriction Bypass</p>
<p>Merge Request Discussion Restriction Bypass</p>
<p>Disclosure of Merge Request IDs</p>
<p>Weak Authentication In Certain Account Actions</p>
<p>Disclosure of Commit Title and Comments</p>
<p>Stored XSS via Markdown</p>
<p>EXIF Geolocation Data Exposure</p>
<p>Multiple SSRF Regressions on Gitaly</p>
<p>Default Branch Name Exposure</p>
<p>Potential Denial of Service via CI Pipelines</p>
<p>Privilege Escalation via Logrotate</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/</url>
<cvename>CVE-2019-15728</cvename>
<cvename>CVE-2019-15730</cvename>
<cvename>CVE-2019-15722</cvename>
<cvename>CVE-2019-15729</cvename>
<cvename>CVE-2019-15721</cvename>
<cvename>CVE-2019-15727</cvename>
<cvename>CVE-2019-15726</cvename>
<cvename>CVE-2019-15724</cvename>
<cvename>CVE-2019-15725</cvename>
<cvename>CVE-2019-15723</cvename>
<cvename>CVE-2019-15732</cvename>
<cvename>CVE-2019-15731</cvename>
<cvename>CVE-2019-15738</cvename>
<cvename>CVE-2019-15737</cvename>
<cvename>CVE-2019-15734</cvename>
<cvename>CVE-2019-15739</cvename>
<cvename>CVE-2019-15740</cvename>
<cvename>CVE-2019-15733</cvename>
<cvename>CVE-2019-15736</cvename>
<cvename>CVE-2019-15741</cvename>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-08-30</entry>
</dates>
</vuln>
<vuln vid="ed8d5535-ca78-11e9-980b-999ff59c22ea">
<topic>RDoc -- multiple jQuery vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.4.0,1</ge><lt>2.4.7,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.6,1</lt></range>
<range><ge>2.6.0,1</ge><lt>2.6.3,1</lt></range>
</package>
<package>
<name>rubygem-rdoc</name>
<range><lt>6.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/">
<p>There are multiple vulnerabilities about Cross-Site Scripting (XSS) in
jQuery shipped with RDoc which bundled in Ruby. All Ruby users are
recommended to update Ruby to the latest release which includes the
fixed version of RDoc.</p>
<p>The following vulnerabilities have been reported.</p>
<p>CVE-2012-6708</p>
<p>CVE-2015-9251</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/</url>
<cvename>CVE-2012-6708</cvename>
<cvename>CVE-2015-9251</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-08-29</entry>
<modified>2019-08-31</modified>
</dates>
</vuln>
<vuln vid="abaaecda-ea16-43e2-bad0-d34a9ac576b1">
<topic>Dovecot -- improper input validation</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.7.2</lt></range>
</package>
<package>
<name>dovecot-pigeonhole</name>
<range><lt>0.5.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-August/116874.html">
<p>Vulnerability Details:
IMAP and ManageSieve protocol parsers do not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes.
Risk:
This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot/2019-August/116874.html</url>
<cvename>CVE-2019-11500</cvename>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="7a7891fc-6318-447a-ba45-31d525ec11a0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.191</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.176.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-08-28/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1453 / CVE-2019-10383</h5>
<p>Stored XSS vulnerability in update center</p>
<h5>(High) SECURITY-1491 / CVE-2019-10384</h5>
<p>CSRF protection tokens for anonymous users did not expire in some circumstances</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10383</cvename>
<cvename>CVE-2019-10384</cvename>
<url>https://jenkins.io/security/advisory/2019-08-28/</url>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="0f31b4e9-c827-11e9-9626-589cfc01894a">
<topic>Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry</topic>
<affects>
<package>
<name>cliqz</name>
<range><lt>1.28.2</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>68.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
<h1>CVE-2019-11733: Stored passwords in 'Saved Logins' can
be copied without master password entry</h1>
<p>When a master password is set, it is required to be
entered again before stored passwords can be accessed in the 'Saved
Logins' dialog. It was found that locally stored passwords can be
copied to the clipboard thorough the 'copy password' context menu item
without re-entering the master password if the master password had
been previously entered in the same session, allowing for potential
theft of stored passwords.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2019-24/</url>
<cvename>CVE-2019-11733</cvename>
</references>
<dates>
<discovery>2019-08-14</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="72a5579e-c765-11e9-8052-0028f8d09152">
<topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
<affects>
<package>
<name>h2o-devel</name>
<range><lt>2.3.0.b2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathon Loomey of Netflix reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
<p>HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion</p>
<p>Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:</p>
<ul>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/2090</url>
<url>https://www.kb.cert.org/vuls/id/605641/</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-25</entry>
</dates>
</vuln>
<vuln vid="73b1e734-c74e-11e9-8052-0028f8d09152">
<topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathon Loomey of Netflix reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
<p>HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion</p>
<p>Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:</p>
<ul>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/2090</url>
<url>https://www.kb.cert.org/vuls/id/605641/</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-25</entry>
</dates>
</vuln>
<vuln vid="e7392840-c520-11e9-a4ef-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/">
<p>This release contains two security fixes, so we highly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.2</url>
<url>https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/</url>
</references>
<dates>
<discovery>2019-08-22</discovery>
<entry>2019-08-22</entry>
</dates>
</vuln>
<vuln vid="dbd1f627-c43b-11e9-a923-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.101.4,1</lt></range>
</package>
<package>
<name>clamav-milter</name>
<range><lt>0.101.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html">
<ul>
<li>An out of bounds write was possible within ClamAV&s NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.</li>
<li> The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html</url>
<cvename>CVE-2019-12625</cvename>
<cvename>CVE-2019-12900</cvename>
</references>
<dates>
<discovery>2019-08-21</discovery>
<entry>2019-08-21</entry>
</dates>
</vuln>
<vuln vid="c97a940b-c392-11e9-bb38-000d3ab229d6">
<topic>Node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>12.8.1</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.16.3</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/">
<p>Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.</p>
<p>Updates are now available for all active Node.js release lines, including Linux ARMv6 builds for Node.js 8.x (which had been delayed).</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>Vulnerabilities Fixed</h1>
<p>Impact: All versions of Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium"), and Node.js 12 (Current) are vulnerable to the following:</p>
<ul>
<li>CVE-2019-9511 "Data Dribble": The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9513 "Resource Loop": The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9516 "0-Length Headers Leak": The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.</li>
<li>CVE-2019-9517 "Internal Data Buffering": The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9518 "Empty Frames Flood": The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9513</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
<cvename>CVE-2019-9516</cvename>
<cvename>CVE-2019-9517</cvename>
<cvename>CVE-2019-9518</cvename>
</references>
<dates>
<discovery>2019-08-16</discovery>
<entry>2019-08-21</entry>
</dates>
</vuln>
<vuln vid="795442e7-c355-11e9-8224-5404a68ad561">
<topic>vlc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.8,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
<p>Security:
* Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)
* Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962)
* Fix a read buffer overflow in the FAAD decoder
* Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438)
* Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776)
* Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778)
* Fix a use after free in the ASF demuxer (CVE-2019-14533)
* Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602)
* Fix a null dereference in the dvdnav demuxer
* Fix a null dereference in the ASF demuxer (CVE-2019-14534)
* Fix a null dereference in the AVI demuxer
* Fix a division by zero in the CAF demuxer (CVE-2019-14498)
* Fix a division by zero in the ASF demuxer (CVE-2019-14535)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.videolan.org/developers/vlc-branch/NEWS</url>
<cvename>CVE-2019-13602</cvename>
<cvename>CVE-2019-13962</cvename>
<cvename>CVE-2019-14437</cvename>
<cvename>CVE-2019-14438</cvename>
<cvename>CVE-2019-14498</cvename>
<cvename>CVE-2019-14533</cvename>
<cvename>CVE-2019-14534</cvename>
<cvename>CVE-2019-14535</cvename>
<cvename>CVE-2019-14776</cvename>
<cvename>CVE-2019-14777</cvename>
<cvename>CVE-2019-14778</cvename>
<cvename>CVE-2019-14970</cvename>
</references>
<dates>
<discovery>2019-07-14</discovery>
<entry>2019-08-20</entry>
</dates>
</vuln>
<vuln vid="56778a31-c2a1-11e9-9051-4c72b94353b5">
<topic>nsd -- Stack-based Buffer Overflow</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-13207">
<p>nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer
Overflow in the dname_concatenate() function in dname.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-13207</url>
<url>https://github.com/NLnetLabs/nsd/issues/20</url>
<cvename>CVE-2019-13207</cvename>
</references>
<dates>
<discovery>2019-07-28</discovery>
<entry>2019-08-19</entry>
</dates>
</vuln>
<vuln vid="ece65d3b-c20c-11e9-8af4-bcaec55be5e5">
<topic>webmin -- unauthenticated remote code execution</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.930</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.780</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joe Cooper reports:</p>
<blockquote cite="https://virtualmin.com/node/66890">
<p>I've rolled out Webmin version 1.930 and Usermin version 1.780
for all repositories. This release includes several security
fixes, including one potentially serious one caused by malicious
code inserted into Webmin and Usermin at some point on our build
infrastructure. We're still investigating how and when, but the
exploitable code has never existed in our github repositories, so
we've rebuilt from git source on new infrastructure (and checked
to be sure the result does not contain the malicious code).</p>
<p>I don't have a changelog for these releases yet, but I wanted
to announce them immediately due to the severity of this issue.
To exploit the malicious code, your Webmin installation must have
Webmin -> Webmin Configuration -> Authentication -> Password
expiry policy set to Prompt users with expired passwords to enter
a new one. This option is not set by default, but if it is set,
it allows remote code execution.</p>
<p>This release addresses CVE-2019-15107, which was disclosed
earlier today. It also addresses a handful of XSS issues that we
were notified about, and a bounty was awarded to the researcher
(a different one) who found them.</p>
</blockquote>
</body>
</description>
<references>
<url>https://virtualmin.com/node/66890</url>
<cvename>CVE-2019-15107</cvename>
</references>
<dates>
<discovery>2019-08-17</discovery>
<entry>2019-08-17</entry>
</dates>
</vuln>
<vuln vid="3b2ee737-c12d-11e9-aabc-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/">
<p>This release contains two security fixes, so we highly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.1</url>
</references>
<dates>
<discovery>2019-07-31</discovery>
<entry>2019-07-31</entry>
</dates>
</vuln>
<vuln vid="d905b219-c1ca-11e9-8c46-0c9d925bbbc0">
<topic>xdm -- remote denial of service</topic>
<affects>
<package>
<name>xdm</name>
<range><lt>1.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nvd.nist.gov reports</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2013-2179">
<p>X.Org xdm 1.1.10, 1.1.11, and possibly other versions,
when performing authentication using certain implementations of
the crypt API function that can return NULL, allows remote
attackers to cause a denial of service (NULL pointer dereference
and crash) by attempting to log into an account whose password
field contains invalid characters, as demonstrated using the crypt
function from glibc 2.17 and later with (1) the "!" character in
the salt portion of a password field or (2) a password that has
been encrypted using DES or MD5 in FIPS-140 mode.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2013-2179</url>
<cvename>CVE-2013-2179</cvename>
</references>
<dates>
<discovery>2013-06-07</discovery>
<entry>2019-08-18</entry>
</dates>
</vuln>
<vuln vid="d51b52cf-c199-11e9-b13f-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.28.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.28.3">
<p>A carefully constructed commit object with a very large number
of parents may lead to potential out-of-bounds writes or
potential denial of service.</p>
<p>The ProgramData configuration file is always read for compatibility
with Git for Windows and Portable Git installations. The ProgramData
location is not necessarily writable only by administrators, so we
now ensure that the configuration file is owned by the administrator
or the current user.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.28.3</url>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-18</entry>
</dates>
</vuln>
<vuln vid="caf545f2-c0d9-11e9-9051-4c72b94353b5">
<topic>Apache -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.4">
<h1>SECURITY: CVE-2019-10081</h1>
<p>mod_http2: HTTP/2 very early pushes, for example configured with "H2PushResource",
could lead to an overwrite of memory in the pushing request's pool,
leading to crashes. The memory copied is that of the configured push
link header values, not data supplied by the client.</p>
<h1>SECURITY: CVE-2019-9517</h1>
<p>mod_http2: a malicious client could perform a DoS attack by flooding
a connection with requests and basically never reading responses
on the TCP connection. Depending on h2 worker dimensioning, it was
possible to block those with relatively few connections.</p>
<h1>SECURITY: CVE-2019-10098</h1>
<p>rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
matches and substitutions with encoded line break characters.</p>
<h1>SECURITY: CVE-2019-10092</h1>
<p>Remove HTML-escaped URLs from canned error responses to prevent misleading
text/links being displayed via crafted links.</p>
<h1>SECURITY: CVE-2019-10097</h1>
<p>mod_remoteip: Fix stack buffer overflow and NULL pointer deference
when reading the PROXY protocol header.</p>
<h1>CVE-2019-10082</h1>
<p>mod_http2: Using fuzzed network input, the http/2 session
handling could be made to read memory after being freed,
during connection shutdown.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4</url>
<cvename>CVE-2019-10081</cvename>
<cvename>CVE-2019-9517</cvename>
<cvename>CVE-2019-10098</cvename>
<cvename>CVE-2019-10092</cvename>
<cvename>CVE-2019-10082</cvename>
</references>
<dates>
<discovery>2019-08-14</discovery>
<entry>2019-08-17</entry>
</dates>
</vuln>
<vuln vid="121fec01-c042-11e9-a73f-b36f5969f162">
<topic>nghttp2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libnghttp2</name>
<name>nghttp2</name>
<range><lt>1.39.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 GitHub releases:</p>
<blockquote cite="https://github.com/nghttp2/nghttp2/releases">
<p>This release fixes CVE-2019-9511 "Data Dribble" and CVE-2019-9513
"Resource Loop" vulnerability in nghttpx and nghttpd. Specially crafted
HTTP/2 frames cause Denial of Service by consuming CPU time. Check out
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for details. For nghttpx, additionally limiting inbound traffic by
--read-rate and --read-burst options is quite effective against this
kind of attack.</p>
<p>CVE-2019-9511 "Data Dribble": The attacker requests a large amount of
data from a specified resource over multiple streams. They manipulate
window size and stream priority to force the server to queue the data in
1-byte chunks. Depending on how efficiently this data is queued, this
can consume excess CPU, memory, or both, potentially leading to a
denial of service.</p>
<p>CVE-2019-9513 "Ping Flood": The attacker sends continual pings to an
HTTP/2 peer, causing the peer to build an internal queue of responses.
Depending on how efficiently this data is queued, this can consume
excess CPU, memory, or both, potentially leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nghttp2/nghttp2/releases</url>
<url>https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9513</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-16</entry>
</dates>
</vuln>
<vuln vid="60e991ac-c013-11e9-b662-001cc0382b2f">
<topic>CUPS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups</name>
<range><lt>2.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apple reports:</p>
<blockquote cite="https://github.com/apple/cups/releases/tag/v2.2.12">
<ul>
<li>CVE-2019-8696 and CVE-2019-8675: SNMP buffer overflows.</li>
<li>IPP buffer overflow.</li>
<li>Memory disclosure in the scheduler.</li>
<li>DoS issues in the scheduler.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/apple/cups/releases/tag/v2.2.12</url>
<cvename>CVE-2019-8675</cvename>
<cvename>CVE-2019-8696</cvename>
</references>
<dates>
<discovery>2019-08-15</discovery>
<entry>2019-08-16</entry>
</dates>
</vuln>
<vuln vid="41f4baac-bf77-11e9-8d2f-5404a68ad561">
<topic>traefik -- Denial of service in HTTP/2</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>1.7.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik project reports:</p>
<blockquote cite="https://github.com/containous/traefik/releases/tag/v1.7.14">
<p>Update of dependency to go go1.12.8 resolves potential HTTP/2
denial of service in traefik.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/containous/traefik/releases/tag/v1.7.14</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-15</entry>
</dates>
</vuln>
<vuln vid="87679fcb-be60-11e9-9051-4c72b94353b5">
<topic>NGINX -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.16.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Several security issues were identified in nginx HTTP/2
implementation which might cause excessive memory consumption
and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).
The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the http2 option of the listen directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.org/en/security_advisories.html</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9513</cvename>
<cvename>CVE-2019-9516</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-14</entry>
<modified>2019-08-14</modified>
</dates>
</vuln>
<vuln vid="0569146e-bdef-11e9-bd31-8de4a4470bbb">
<topic>Nokogiri -- injection vulnerability</topic>
<affects>
<package>
<name>rubygem-nokogiri</name>
<range><lt>1.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nokogiri GitHub release:</p>
<blockquote cite="https://github.com/sparklemotion/nokogiri/releases">
<p>A command injection vulnerability in Nokogiri v1.10.3 and earlier
allows commands to be executed in a subprocess by Ruby's Kernel.open
method. Processes are vulnerable only if the undocumented method
Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.</p>
<p>This vulnerability appears in code generated by the Rexical gem
versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate
lexical scanner code for parsing CSS queries. The underlying
vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to
this version of Rexical in Nokogiri v1.10.4.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/sparklemotion/nokogiri/releases</url>
<url>https://github.com/sparklemotion/nokogiri/issues/1915</url>
<cvename>CVE-2019-5477</cvename>
</references>
<dates>
<discovery>2019-08-11</discovery>
<entry>2019-08-13</entry>
</dates>
</vuln>
<vuln vid="ddd48087-bd86-11e9-b13f-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.1.0</ge><lt>12.1.6</lt></range>
<range><ge>12.0.0</ge><lt>12.0.6</lt></range>
<range><ge>10.0.0</ge><lt>11.11.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/">
<p>Insecure Authentication Methods Disabled for Grafana By Default</p>
<p>Multiple Command-Line Flag Injection Vulnerabilities</p>
<p>Insecure Cookie Handling on GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/</url>
<cvename>CVE-2019-14943</cvename>
<cvename>CVE-2019-14944</cvename>
<cvename>CVE-2019-14942</cvename>
</references>
<dates>
<discovery>2019-08-12</discovery>
<entry>2019-08-13</entry>
</dates>
</vuln>
<vuln vid="f5f0a640-bae8-11e9-bb3a-001e2a3f778d">
<topic>KDE Frameworks -- malicious .desktop files execute code</topic>
<affects>
<package>
<name>kf5-kconfig</name>
<range><lt>5.60.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Community has released a security announcement:</p>
<blockquote cite="https://kde.org/info/security/advisory-20190807-1.txt">
<p>The syntax Key[$e]=$(shell command) in *.desktop files, .directory files, and configuration files
(typically found in ~/.config) was an intentional feature of KConfig, to allow flexible configuration.
This could however be abused by malicious people to make the users install such files and get code
executed even without intentional action by the user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-14744</cvename>
<url>https://kde.org/info/security/advisory-20190807-1.txt</url>
</references>
<dates>
<discovery>2019-08-07</discovery>
<entry>2019-08-09</entry>
</dates>
</vuln>
<vuln vid="7f7d6412-bae5-11e9-be92-3085a9a95629">
<topic>doas -- Prevent passing of environment variables</topic>
<affects>
<package>
<name>doas</name>
<range><lt>6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jesse Smith (upstream author of the doas program) reported:</p>
<blockquote cite="https://github.com/slicer69/doas/releases/tag/6.1">
<p>Previous versions of "doas" transferred most environment variables, such
as USER, HOME, and PATH from the original user to the target user.
Passing these variables could cause files in the wrong path or
home directory to be read (or written to), which resulted in potential
security problems.</p>
<p>Many thanks to Sander Bos for reporting this issue and explaining
how it can be exploited.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="2a5cda45ef35e885c9a8b1e@tedunangst.com">https://marc.info/?l=openbsd-tech&m=156105665713340&w=2</mlist>
<url>https://github.com/slicer69/doas/releases/tag/6.1</url>
</references>
<dates>
<discovery>2019-08-03</discovery>
<entry>2019-08-09</entry>
<modified>2019-08-15</modified>
</dates>
</vuln>
<vuln vid="f56669f5-d799-4ff5-9174-64a6d571c451">
<topic>bro -- Null pointer dereference and Signed integer overflow</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS">
<p>This is a security patch release to address potential
Denial of Service vulnerabilities:</p>
<ul>
<li>
Null pointer dereference in the RPC analysis code. RPC
analyzers (e.g. MOUNT or NFS) are not enabled in the
default configuration.</li>
<li>
Signed integer overflow in BinPAC-generated parser code.
The result of this is Undefined Behavior with respect to
the array bounds checking conditions that BinPAC generates,
so it's unpredictable what an optimizing compiler may
actually do under the assumption that signed integer
overlows should never happen. The specific symptom which
lead to finding this issue was with the PE analyzer causing
out-of-memory crashes due to large allocations that were
otherwise prevented when the array bounds checking logic
was changed to prevent any possible signed integer overlow.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS</url>
</references>
<dates>
<discovery>2019-06-22</discovery>
<entry>2019-08-09</entry>
</dates>
</vuln>
<vuln vid="9de4c1c1-b9ee-11e9-82aa-6cc21735f730">
<topic>PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.5</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.10</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.15</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.19</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1960/">
<p>
Versions Affected: 9.4 - 11
</p>
<p>
Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires `EXECUTE`
permission on the function, which must itself contain a function call having
inexact argument type match. For example, `length('foo'::varchar)` and
`length('foo')` are inexact, while `length('foo'::text)` is exact.
As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN`
to create a type in a `pg_temp` schema. The attack pattern and fix are similar
to that for CVE-2007-2138.
</p>
<p>
Writing `SECURITY DEFINER` functions continues to require following
the considerations noted in the documentation:
</p>
<p>
https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
</p>
</blockquote>
<blockquote cite="https://www.postgresql.org/about/news/1960/">
<p>
Versions Affected: 11
</p>
<p>
In a database containing hypothetical, user-defined hash equality operators,
an attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators.
It is possible for operators not purpose-crafted for attack to have
the properties that enable an attack, but we are not aware of specific examples.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1960/</url>
<cvename>CVE-2019-10208</cvename>
<cvename>CVE-2019-10209</cvename>
</references>
<dates>
<discovery>2019-08-08</discovery>
<entry>2019-08-08</entry>
</dates>
</vuln>
<vuln vid="6e65dfea-b614-11e9-a3a2-1506e15611cc">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.23</lt></range>
</package>
<package>
<name>py27-django21</name>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.11</lt></range>
</package>
<package>
<name>py27-django22</name>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.23/">
<p>CVE-2019-14232: Denial-of-service possibility in
django.utils.text.Truncator</p>
<p>If django.utils.text.Truncator's chars() and words() methods were
passed the html=True argument, they were extremely slow to evaluate
certain inputs due to a catastrophic backtracking vulnerability in a
regular expression. The chars() and words() methods are used to
implement the truncatechars_html and truncatewords_html template
filters, which were thus vulnerable</p>
<p>The regular expressions used by Truncator have been simplified in
order to avoid potential backtracking issues. As a consequence, trailing
punctuation may now at times be included in the truncated output.</p>
<p>CVE-2019-14233: Denial-of-service possibility in strip_tags()</p>
<p>Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML
entities. The strip_tags() method is used to implement the corresponding
striptags template filter, which was thus also vulnerable.</p>
<p>strip_tags() now avoids recursive calls to HTMLParser when progress
removing tags, but necessarily incomplete HTML entities, stops being
made.</p>
<p>Remember that absolutely NO guarantee is provided about the results of
strip_tags() being HTML safe. So NEVER mark safe the result of a
strip_tags() call without escaping it first, for example with
django.utils.html.escape().</p>
<p>CVE-2019-14234: SQL injection possibility in key and index lookups for
JSONField/HStoreField</p>
<p>Key and index lookups for JSONField and key lookups for HStoreField
were subject to SQL injection, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to QuerySet.filter().</p>
<p>CVE-2019-14235: Potential memory exhaustion in
django.utils.encoding.uri_to_iri()</p>
<p>If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
to significant memory usage due to excessive recursion when
re-percent-encoding invalid UTF-8 octet sequences.</p>
<p>uri_to_iri() now avoids recursion when re-percent-encoding invalid
UTF-8 octet sequences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.23/</url>
<url>https://docs.djangoproject.com/en/2.1/releases/2.1.11/</url>
<url>https://docs.djangoproject.com/en/2.2/releases/2.2.4/</url>
<cvename>CVE-2019-14232</cvename>
<cvename>CVE-2019-14233</cvename>
<cvename>CVE-2019-14234</cvename>
<cvename>CVE-2019-14235</cvename>
</references>
<dates>
<discovery>2019-08-01</discovery>
<entry>2019-08-03</entry>
</dates>
</vuln>
<vuln vid="e7b69694-b3b5-11e9-9bb6-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/">
<p>This version of Gitea contains security fixes that could not be
backported to 1.8. For this reason, we strongly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.0</url>
</references>
<dates>
<discovery>2019-07-31</discovery>
<entry>2019-07-31</entry>
</dates>
</vuln>
<vuln vid="0d3f99f7-b30c-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- File description reference count leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If a process attempts to transmit rights over a UNIX-domain
socket and an error causes the attempt to fail, references
acquired on the rights are not released and are leaked.
This bug can be used to cause the reference counter to wrap
around and free the corresponding file structure.</p>
<h1>Impact:</h1>
<p>A local user can exploit the bug to gain root privileges
or escape from a jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5607</cvename>
<freebsdsa>SA-19:17.fd</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="edf064fb-b30b-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Bhyve out-of-bounds read in XHCI device</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The pci_xhci_device_doorbell() function does not validate
the 'epid' and 'streamid' provided by the guest, leading
to an out-of-bounds read.</p>
<h1>Impact:</h1>
<p>A misbehaving bhyve guest could crash the system or
access memory that it should not be able to.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5604</cvename>
<freebsdsa>SA-19:16.bhyve</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="deb6e164-b30b-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Reference count overflow in mqueue filesystem</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>System calls operating on file descriptors obtain a
reference to relevant struct file which due to a programming
error was not always put back, which in turn could be used
to overflow the counter of affected struct file.</p>
<h1>Impact:</h1>
<p>A local user can use this flaw to obtain access to files,
directories, sockets etc. opened by processes owned by other
users. If obtained struct file represents a directory from
outside of user's jail, it can be used to access files
outside of the jail. If the user in question is a jailed
root they can obtain root privileges on the host system.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5603</cvename>
<freebsdsa>SA-19:15.mqueuefs</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="6b856e00-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Kernel memory disclosure in freebsd32_ioctl</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient initialization of memory copied to
userland in the components listed above small amounts of
kernel memory may be disclosed to userland processes.</p>
<h1>Impact:</h1>
<p>A user who can invoke 32-bit FreeBSD ioctls may be able
to read the contents of small portions of kernel memory.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5605</cvename>
<freebsdsa>SA-19:14.freebsd32</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="5721ae65-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- pts(4) write-after-free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The code which handles a close(2) of a descriptor created
by posix_openpt(2) fails to undo the configuration which
causes SIGIO to be raised. This bug can lead to a
write-after-free of kernel memory.</p>
<h1>Impact:</h1>
<p>The bug permits malicious code to trigger a write-after-free,
which may be used to gain root privileges or escape a
jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5606</cvename>
<freebsdsa>SA-19:13.pts</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="39f6cbff-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- telnet(1) client multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation of environment variables in the
telnet client supplied in FreeBSD can lead to stack-based
buffer overflows. A stack- based overflow is present in the
handling of environment variables when connecting via the
telnet client to remote telnet servers.</p>
<p>This issue only affects the telnet client. Inbound telnet
sessions to telnetd(8) are not affected by this issue.</p>
<h1>Impact:</h1>
<p>These buffer overflows may be triggered when connecting
to a malicious server, or by an active attacker in the
network path between the client and server. Specially crafted
TELNET command sequences may cause the execution of arbitrary
code with the privileges of the user invoking telnet(1).</p>
</body>
</description>
<references>
<cvename>CVE-2019-0053</cvename>
<freebsdsa>SA-19:12.telnet</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="14a3b376-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Privilege escalation in cd(4) driver</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>To implement one particular ioctl, the Linux emulation
code used a special interface present in the cd(4) driver
which allows it to copy subchannel information directly to
a kernel address. This interface was erroneously made
accessible to userland, allowing users with read access to
a cd(4) device to arbitrarily overwrite kernel memory when
some media is present in the device.</p>
<h1>Impact:</h1>
<p>A user in the operator group can make use of this interface
to gain root privileges on a system with a cd(4) device
when some media is present in the device.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5602</cvename>
<freebsdsa>SA-19:11.cd_ioctl</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="ff82610f-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Kernel stack disclosure in UFS/FFS</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A bug causes up to three bytes of kernel stack memory
to be written to disk as uninitialized directory entry
padding. This data can be viewed by any user with read
access to the directory. Additionally, a malicious user
with write access to a directory can cause up to 254 bytes
of kernel stack memory to be exposed.</p>
<h1>Impact:</h1>
<p>Some amount of the kernel stack is disclosed and written
out to the filesystem.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5601</cvename>
<freebsdsa>SA-19:10.ufs</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="f62bba56-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- iconv buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>With certain inputs, iconv may write beyond the end of
the output buffer.</p>
<h1>Impact:</h1>
<p>Depending on the way in which iconv is used, an attacker
may be able to create a denial of service, provoke incorrect
program behavior, or induce a remote code execution. iconv
is a libc library function and the nature of possible attacks
will depend on the way in which iconv is used by applications
or daemons.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5600</cvename>
<freebsdsa>SA-19:09.iconv</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="c294c2e6-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in non-default RACK TCP stack</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>While processing acknowledgements, the RACK code uses
several linked lists to maintain state entries. A malicious
attacker can cause the lists to grow unbounded. This can
cause an expensive list traversal on every packet being
processed, leading to resource exhaustion and a denial of
service.</p>
<h1>Impact:</h1>
<p>An attacker with the ability to send specially crafted
TCP traffic to a victim system can degrade network performance
and/or consume excessive CPU by exploiting the inefficiency
of traversing the potentially very large RACK linked lists
with relatively small bandwidth cost.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5599</cvename>
<freebsdsa>SA-19:08.rack</freebsdsa>
</references>
<dates>
<discovery>2019-06-19</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="a633651b-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Microarchitectural Data Sampling (MDS)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_5</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On some Intel processors utilizing speculative execution
a local process may be able to infer stale information from
microarchitectural buffers to obtain a memory disclosure.</p>
<h1>Impact:</h1>
<p>An attacker may be able to read secret data from the
kernel or from a process when executing untrusted code (for
example, in a web browser).</p>
</body>
</description>
<references>
<cvename>CVE-2018-1212</cvename>
<cvename>CVE-2018-1213</cvename>
<cvename>CVE-2019-1109</cvename>
<freebsdsa>SA-19:07.mds</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="59c5f255-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- ICMP/ICMP6 packet filter bypass in pf</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_4</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>States in pf(4) let ICMP and ICMP6 packets pass if they
have a packet in their payload matching an existing condition.
pf(4) does not check if the outer ICMP or ICMP6 packet has
the same destination IP as the source IP of the inner
protocol packet.</p>
<h1>Impact:</h1>
<p>A maliciously crafted ICMP/ICMP6 packet could bypass the
packet filter rules and be passed to a host that would
otherwise be unavailable.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5598</cvename>
<freebsdsa>SA-19:06.pf</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="3d02520d-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- IPv6 fragment reassembly panic in pf(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_4</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A bug in the pf(4) IPv6 fragment reassembly logic
incorrectly uses the last extension header offset from the
last received packet instead of from the first packet.</p>
<h1>Impact:</h1>
<p>Malicious IPv6 packets with different IPv6 extensions
could cause a kernel panic or potentially a filtering rule
bypass.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5597</cvename>
<freebsdsa>SA-19:05.pf</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="1cd89254-b2db-11e9-8001-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.1.0</ge><lt>12.1.2</lt></range>
<range><ge>12.0.0</ge><lt>12.0.4</lt></range>
<range><ge>8.9.0</ge><lt>11.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/">
<p>GitHub Integration SSRF</p>
<p>Trigger Token Impersonation</p>
<p>Build Status Disclosure</p>
<p>SSRF Mitigation Bypass</p>
<p>Information Disclosure New Issue ID</p>
<p>IDOR Label Name Enumeration</p>
<p>Persistent XSS Wiki Pages</p>
<p>User Revokation Bypass with Mattermost Integration</p>
<p>Arbitrary File Upload via Import Project Archive</p>
<p>Information Disclosure Vulnerability Feedback</p>
<p>Persistent XSS via Email</p>
<p>Denial Of Service Epic Comments</p>
<p>Email Verification Bypass</p>
<p>Override Merge Request Approval Rules</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/</url>
</references>
<dates>
<discovery>2019-07-29</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="38d2df4d-b143-11e9-87e7-901b0e934d69">
<topic>py-matrix-synapse -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-matrix-synapse</name>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released">
<p>The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation:</p>
<ul>
<li>Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms.</li>
<li>Prevent a denial-of-service attack where cycles of redaction events would make Synapse spin infinitely.</li>
<li>Prevent an attack where users could be joined or parted from public rooms without their consent.</li>
<li>Fix a vulnerability where a federated server could spoof read-receipts from users on other servers. </li>
<li>It was possible for a room moderator to send a redaction for an m.room.create event, which would downgrade the room to version 1.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released</url>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.2.1</url>
</references>
<dates>
<discovery>2019-07-26</discovery>
<entry>2019-07-28</entry>
</dates>
</vuln>
<vuln vid="3e0da406-aece-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE in ${sort} expansion</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.85</ge><lt>4.92.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team report:</p>
<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-13917.txt">
<p>
A local or remote attacker can execute programs with root privileges - if you've an unusual configuration.
</p>
<p>
If your configuration uses the ${sort } expansion for items that can be controlled by an attacker (e.g. $local_part, $domain). The default config, as shipped by the Exim developers, does not contain ${sort }.
</p>
<p>
The vulnerability is exploitable either remotely or locally and could
be used to execute other programs with root privilege. The ${sort }
expansion re-evaluates its items.
</p>
<p>
Exim 4.92.1 is not vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13917</cvename>
<url>https://www.exim.org/static/doc/security/CVE-2019-13917.txt</url>
</references>
<dates>
<discovery>2019-07-18</discovery>
<entry>2019-07-25</entry>
<modified>2019-07-26</modified>
</dates>
</vuln>
<vuln vid="198e6220-ac8b-11e9-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.65</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.41</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.26</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.17</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.7</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.45</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.27</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.17</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.65</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.45</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html">
<p>This Critical Patch Update contains 45 new security fixes for
Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html</url>
<cvename>CVE-2019-2730</cvename>
<cvename>CVE-2019-2731</cvename>
<cvename>CVE-2019-2737</cvename>
<cvename>CVE-2019-2738</cvename>
<cvename>CVE-2019-2739</cvename>
<cvename>CVE-2019-2740</cvename>
<cvename>CVE-2019-2741</cvename>
<cvename>CVE-2019-2743</cvename>
<cvename>CVE-2019-2746</cvename>
<cvename>CVE-2019-2747</cvename>
<cvename>CVE-2019-2752</cvename>
<cvename>CVE-2019-2755</cvename>
<cvename>CVE-2019-2757</cvename>
<cvename>CVE-2019-2758</cvename>
<cvename>CVE-2019-2774</cvename>
<cvename>CVE-2019-2778</cvename>
<cvename>CVE-2019-2780</cvename>
<cvename>CVE-2019-2784</cvename>
<cvename>CVE-2019-2785</cvename>
<cvename>CVE-2019-2789</cvename>
<cvename>CVE-2019-2791</cvename>
<cvename>CVE-2019-2795</cvename>
<cvename>CVE-2019-2796</cvename>
<cvename>CVE-2019-2797</cvename>
<cvename>CVE-2019-2798</cvename>
<cvename>CVE-2019-2800</cvename>
<cvename>CVE-2019-2801</cvename>
<cvename>CVE-2019-2802</cvename>
<cvename>CVE-2019-2803</cvename>
<cvename>CVE-2019-2805</cvename>
<cvename>CVE-2019-2808</cvename>
<cvename>CVE-2019-2810</cvename>
<cvename>CVE-2019-2811</cvename>
<cvename>CVE-2019-2812</cvename>
<cvename>CVE-2019-2814</cvename>
<cvename>CVE-2019-2815</cvename>
<cvename>CVE-2019-2819</cvename>
<cvename>CVE-2019-2822</cvename>
<cvename>CVE-2019-2826</cvename>
<cvename>CVE-2019-2830</cvename>
<cvename>CVE-2019-2834</cvename>
<cvename>CVE-2019-2879</cvename>
<cvename>CVE-2019-3822</cvename>
</references>
<dates>
<discovery>2019-07-16</discovery>
<entry>2019-07-22</entry>
</dates>
</vuln>
<vuln vid="19d648e0-ab69-11e9-bfef-000ffec0b3e1">
<topic>drupal -- Drupal core - Access bypass</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-008">
<p>In Drupal 8.7.4, when the experimental Workspaces module is enabled,
an access bypass condition is created.</p>
<p>This can be mitigated by disabling the Workspaces module. It does
not affect any release other than Drupal 8.7.4.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-008</url>
</references>
<dates>
<discovery>2019-07-17</discovery>
<entry>2019-07-21</entry>
</dates>
</vuln>
<vuln vid="5914705c-ab03-11e9-a4f9-080027ac955c">
<topic>PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client</topic>
<affects>
<package>
<name>putty</name> <range><lt>0.72</lt></range>
</package><package>
<name>putty-gtk2</name> <range><lt>0.72</lt></range>
</package><package>
<name>putty-nogtk</name> <range><lt>0.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html">
<p>Vulnerabilities fixed in this release include:</p>
<ul>
<li>A malicious SSH-1 server could trigger a buffer overrun by sending
extremely short RSA keys, or certain bad packet length fields.
Either of these could happen before host key verification, so even
if you trust the server you *intended* to connect to, you would
still be at risk.
<br/>
(However, the SSH-1 protocol is obsolete, and recent versions of
PuTTY do not try it by default, so you are only at risk if you work
with old servers and have explicitly configured SSH-1.)</li>
<li>If a malicious process found a way to impersonate Pageant, then it
could cause an integer overflow in any of the SSH client tools
(PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.</li>
</ul>
<p>Other security-related bug fixes include:</p>
<ul>
<li>The 'trust sigil' system introduced in PuTTY 0.71 to protect
against server spoofing attacks had multiple bugs. Trust sigils
were not turned off after login in the SSH-1 and Rlogin protocols,
and not turned back on if you used the Restart Session command.
Both are now fixed.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html</url>
</references>
<dates>
<discovery>2019-07-14</discovery>
<entry>2019-07-20</entry>
</dates>
</vuln>
<vuln vid="df3db21d-1a4d-4c78-acf7-4639e5a795e0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.186</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.176.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-07-17/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1424 / CVE-2019-10352</h5>
<p>Arbitrary file write vulnerability using file parameter definitions</p>
<h5>(High) SECURITY-626 / CVE-2019-10353</h5>
<p>CSRF protection tokens did not expire</p>
<h5>(Medium) SECURITY-534 / CVE-2019-10354</h5>
<p>Unauthorized view fragment access</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10352</cvename>
<cvename>CVE-2019-10353</cvename>
<cvename>CVE-2019-10354</cvename>
<url>https://jenkins.io/security/advisory/2019-07-17/</url>
</references>
<dates>
<discovery>2019-07-17</discovery>
<entry>2019-07-17</entry>
</dates>
</vuln>
<vuln vid="93167bef-9752-11e9-b61c-b885849ded8e">
<topic>libxslt -- security framework bypass</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre report:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068">
<p>libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068</url>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-07-16</entry>
</dates>
</vuln>
<vuln vid="818b2bcb-a46f-11e9-bed9-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability with MESSAGE messages</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.27.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.7.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A specially crafted SIP in-dialog MESSAGE message can cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-002.html</url>
<cvename>CVE-2019-12827</cvename>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="e9d2e981-a46d-11e9-bed9-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in chan_sip channel driver</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.27.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.7.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When T.38 faxing is done in Asterisk a T.38 reinvite
may be sent to an endpoint to switch it to T.38. If the
endpoint responds with an improperly formatted SDP answer
including both a T.38 UDPTL stream and an audio or video
stream containing only codecs not allowed on the SIP peer
or user a crash will occur. The code incorrectly assumes
that there will be at least one common codec when T.38
is also in the SDP answer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-003.html</url>
<cvename>CVE-2019-13161</cvename>
</references>
<dates>
<discovery>2019-06-28</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="a449c604-a43a-11e9-b422-fcaa147e860e">
<topic>python 3.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final">
<p>bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text
after the address and only quad-dotted notation without trailing whitespaces. Some
inet_aton() implementations ignore whitespace and all data after whitespace, e.g.'127.0.0.1
whatever'.</p>
<p>bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and
local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of
urllib.request.</p>
<p>bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().</p>
<p>bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace
or control characters through into the underlying http client request. Such potentially
malicious header injection URLs now cause an http.client.InvalidURL exception to be
raised.</p>
<p>bpo-33529: Prevent fold function used in email header encoding from entering infinite
loop when there are too many non-ASCII characters in a header.</p>
<p>bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH
environment variable is not set. Remove also the current directory from posixpath.defpath.
On Unix, shutil.which() and the subprocess module no longer search the executable in the
current directory if the PATH environment variable is not set.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final</url>
<cvename>CVE-2019-9740</cvename>
<cvename>CVE-2019-9948</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="0592f49f-b3b8-4260-b648-d1718762656c">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>68.0_4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.12</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.8.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.8.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/">
<p>CVE-2019-9811: Sandbox escape via installation of malicious language pack</p>
<p>CVE-2019-11711: Script injection within domain through inner window reuse</p>
<p>CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects</p>
<p>CVE-2019-11713: Use-after-free with HTTP/2 cached stream</p>
<p>CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread</p>
<p>CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault</p>
<p>CVE-2019-11715: HTML parsing error can contribute to content XSS</p>
<p>CVE-2019-11716: globalThis not enumerable until accessed</p>
<p>CVE-2019-11717: Caret character improperly escaped in origins</p>
<p>CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML</p>
<p>CVE-2019-11719: Out-of-bounds read when importing curve25519 private key</p>
<p>CVE-2019-11720: Character encoding XSS vulnerability</p>
<p>CVE-2019-11721: Domain spoofing through unicode latin 'kra' character</p>
<p>CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin</p>
<p>CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries</p>
<p>CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions</p>
<p>CVE-2019-11725: Websocket resources bypass safebrowsing protections</p>
<p>CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3</p>
<p>CVE-2019-11728: Port scanning through Alt-Svc header</p>
<p>CVE-2019-11710: Memory safety bugs fixed in Firefox 68</p>
<p>CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11709</cvename>
<cvename>CVE-2019-11710</cvename>
<cvename>CVE-2019-11711</cvename>
<cvename>CVE-2019-11712</cvename>
<cvename>CVE-2019-11713</cvename>
<cvename>CVE-2019-11714</cvename>
<cvename>CVE-2019-11715</cvename>
<cvename>CVE-2019-11716</cvename>
<cvename>CVE-2019-11717</cvename>
<cvename>CVE-2019-11718</cvename>
<cvename>CVE-2019-11719</cvename>
<cvename>CVE-2019-11720</cvename>
<cvename>CVE-2019-11721</cvename>
<cvename>CVE-2019-11723</cvename>
<cvename>CVE-2019-11724</cvename>
<cvename>CVE-2019-11725</cvename>
<cvename>CVE-2019-11727</cvename>
<cvename>CVE-2019-11728</cvename>
<cvename>CVE-2019-11729</cvename>
<cvename>CVE-2019-11730</cvename>
<cvename>CVE-2019-9811</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-22/</url>
</references>
<dates>
<discovery>2019-07-09</discovery>
<entry>2019-07-09</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="23f65f58-a261-11e9-b444-002590acae31">
<topic>GnuPG -- denial of service</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>2.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the GnuPG 2.2.17 changelog:</p>
<blockquote cite="https://dev.gnupg.org/T4606">
<p>gpg: Ignore all key-signatures received from keyservers. This
change is required to mitigate a DoS due to keys flooded with
faked key-signatures.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dev.gnupg.org/T4606</url>
<url>https://dev.gnupg.org/T4607</url>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-07-09</entry>
</dates>
</vuln>
<vuln vid="18ed9650-a1d6-11e9-9b17-fcaa147e860e">
<topic>python 3.6 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python36</name>
<range><lt>3.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final">
<p>bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
and local_file:// URL schemes in URLopener().open() and URLopener().retrieve()
of urllib.request.</p>
<p>bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().</p>
<p>bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
whitespace or control characters through into the underlying http client
request. Such potentially malicious header injection URLs now cause an
http.client.InvalidURL exception to be raised.</p>
<p>bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
characters that decompose under IDNA encoding (NFKC-normalization) into
characters that affect how the URL is parsed.</p>
<p>bpo-33529: Prevent fold function used in email header encoding from
entering infinite loop when there are too many non-ASCII characters in
a header.</p>
<p>bpo-35121: Don't send cookies of domain A without Domain attribute to
domain B when domain A is a suffix match of domain B while using a cookiejar
with http.cookiejar.DefaultCookiePolicy policy. Patch by Karthikeyan
Singaravelan.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final</url>
<cvename>CVE-2019-9948</cvename>
<cvename>CVE-2019-9740</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-07-08</entry>
</dates>
</vuln>
<vuln vid="3dd46e05-9fb0-11e9-bf65-00012e582166">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.24.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports many vulnerabilities,
including several arbitrary code execution vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0002.html</url>
<cvename>CVE-2019-6201</cvename>
<cvename>CVE-2019-6251</cvename>
<cvename>CVE-2019-7285</cvename>
<cvename>CVE-2019-7292</cvename>
<cvename>CVE-2019-8503</cvename>
<cvename>CVE-2019-8506</cvename>
<cvename>CVE-2019-8515</cvename>
<cvename>CVE-2019-8518</cvename>
<cvename>CVE-2019-8523</cvename>
<cvename>CVE-2019-8524</cvename>
<cvename>CVE-2019-8535</cvename>
<cvename>CVE-2019-8536</cvename>
<cvename>CVE-2019-8544</cvename>
<cvename>CVE-2019-8551</cvename>
<cvename>CVE-2019-8558</cvename>
<cvename>CVE-2019-8559</cvename>
<cvename>CVE-2019-8563</cvename>
<cvename>CVE-2019-11070</cvename>
<url>https://webkitgtk.org/security/WSA-2019-0003.html</url>
<cvename>CVE-2019-6237</cvename>
<cvename>CVE-2019-8571</cvename>
<cvename>CVE-2019-8583</cvename>
<cvename>CVE-2019-8584</cvename>
<cvename>CVE-2019-8586</cvename>
<cvename>CVE-2019-8587</cvename>
<cvename>CVE-2019-8594</cvename>
<cvename>CVE-2019-8595</cvename>
<cvename>CVE-2019-8596</cvename>
<cvename>CVE-2019-8597</cvename>
<cvename>CVE-2019-8601</cvename>
<cvename>CVE-2019-8607</cvename>
<cvename>CVE-2019-8608</cvename>
<cvename>CVE-2019-8609</cvename>
<cvename>CVE-2019-8610</cvename>
<cvename>CVE-2019-8615</cvename>
<cvename>CVE-2019-8611</cvename>
<cvename>CVE-2019-8619</cvename>
<cvename>CVE-2019-8622</cvename>
<cvename>CVE-2019-8623</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-07-06</entry>
</dates>
</vuln>
<vuln vid="3c5a4fe0-9ebb-11e9-9169-fcaa147e860e">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.3</lt></range>
</package>
<package>
<name>mediawiki132</name>
<range><lt>1.32.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html">
<p>Security fixes:
T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow
for bypassing reauthentication, allowing for potential account takeover.
T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS
by querying the entire `watchlist` table.
T207603, CVE-2019-12471: Loading user JavaScript from a non-existent account
allows anyone to create the account, and XSS the users' loading that script.
T208881: blacklist CSS var().
T199540, CVE-2019-12472: It is possible to bypass the limits on IP range
blocks (`$wgBlockCIDRLimit`) by using the API.
T212118, CVE-2019-12474: Privileged API responses that include whether a
recent change has been patrolled may be cached publicly.
T209794, CVE-2019-12467: A spammer can use Special:ChangeEmail to send out
spam with no rate limiting or ability to block them.
T25227, CVE-2019-12466: An account can be logged out without using a token(CRRF)
T222036, CVE-2019-12469: Exposed suppressed username or log in Special:EditTags.
T222038, CVE-2019-12470: Exposed suppressed log in RevisionDelete page.
T221739, CVE-2019-11358: Fix potential XSS in jQuery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11358</cvename>
<cvename>CVE-2019-12466</cvename>
<cvename>CVE-2019-12467</cvename>
<cvename>CVE-2019-12468</cvename>
<cvename>CVE-2019-12469</cvename>
<cvename>CVE-2019-12470</cvename>
<cvename>CVE-2019-12471</cvename>
<cvename>CVE-2019-12472</cvename>
<cvename>CVE-2019-12473</cvename>
<cvename>CVE-2019-12474</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html</url>
</references>
<dates>
<discovery>2019-04-23</discovery>
<entry>2019-07-05</entry>
</dates>
</vuln>
<vuln vid="b79ec16b-9da7-11e9-a0ea-a92fe7db4867">
<topic>ettercap -- out-of-bound read vulnerability</topic>
<affects>
<package>
<name>ettercap</name>
<range><lt>0.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ettercap GitHub issue:</p>
<blockquote cite="https://github.com/Ettercap/ettercap/issues/782">
<p>Etterfilter results in an invalid read of 8 bytes when parsing a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Ettercap/ettercap/issues/782</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6430</url>
<cvename>CVE-2017-6430</cvename>
</references>
<dates>
<discovery>2019-07-01</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="4ea507d1-9da8-11e9-a759-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.0.0</ge><lt>12.0.3</lt></range>
<range><ge>11.11.0</ge><lt>11.11.5</lt></range>
<range><ge>8.3.0</ge><lt>11.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/">
<p>Ability to Write a Note to a Private Snippet</p>
<p>Recent Pipeline Information Disclosed to Unauthorised Users</p>
<p>Resource Exhaustion Attack</p>
<p>Error Caused by Encoded Characters in Comments</p>
<p>Authorization Issues in GraphQL</p>
<p>Number of Merge Requests was Accessible</p>
<p>Enabling One of the Service Templates Could Cause Resource Depletion</p>
<p>Broken Access Control for the Content of Personal Snippets</p>
<p>Decoding Color Codes Caused Resource Depletion</p>
<p>Merge Request Template Name Disclosure</p>
<p>SSRF Vulnerability in Project GitHub Integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/</url>
<cvename>CVE-2019-13001</cvename>
<cvename>CVE-2019-13002</cvename>
<cvename>CVE-2019-13003</cvename>
<cvename>CVE-2019-13004</cvename>
<cvename>CVE-2019-13005</cvename>
<cvename>CVE-2019-13006</cvename>
<cvename>CVE-2019-13007</cvename>
<cvename>CVE-2019-13009</cvename>
<cvename>CVE-2019-13010</cvename>
<cvename>CVE-2019-13011</cvename>
<cvename>CVE-2019-13121</cvename>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="3394bc2b-9da4-11e9-951e-14dae9d5a9d2">
<topic>SDL2_image -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sdl2_image</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SDL_image developers report:</p>
<blockquote cite="https://www.libsdl.org/projects/SDL_image/">
<p>Fixed a number of security issues:</p>
<ul>
<li>TALOS-2019-0820</li>
<li>TALOS-2019-0821</li>
<li>TALOS-2019-0841</li>
<li>TALOS-2019-0842</li>
<li>TALOS-2019-0843</li>
<li>TALOS-2019-0844</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0820</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0821</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0841</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0842</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0843</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0844</url>
<cvename>CVE-2019-5051</cvename>
<cvename>CVE-2019-5052</cvename>
<cvename>CVE-2019-5057</cvename>
<cvename>CVE-2019-5058</cvename>
<cvename>CVE-2019-5059</cvename>
<cvename>CVE-2019-5060</cvename>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="475f952c-9b29-11e9-a8a5-6805ca0b38e8">
<topic>irssi -- Use after free when sending SASL login to the server</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2019_06.txt">
<p>Use after free when sending SASL login to the server found by ilbelkyr. (CWE-416, CWE-825)</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2019_06.txt</url>
<cvename>CVE-2019-13045</cvename>
</references>
<dates>
<discovery>2019-06-29</discovery>
<entry>2019-07-01</entry>
</dates>
</vuln>
<vuln vid="b805d7b4-9c0c-11e9-97f0-000c29e96db4">
<topic>Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.22</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.10</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django security releases issued:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jul/01/security-releases/">
<p>When deployed behind a reverse-proxy connecting to Django via HTTPS,
django.http.HttpRequest.scheme would incorrectly detect client requests
made via HTTP as using HTTPS. This entails incorrect results for is_secure(),
and build_absolute_uri(), and that HTTP requests would not be redirected to
HTTPS in accordance with SECURE_SSL_REDIRECT.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12781</cvename>
<url>https://www.djangoproject.com/weblog/2019/jul/01/security-releases/</url>
</references>
<dates>
<discovery>2019-07-01</discovery>
<entry>2019-07-01</entry>
</dates>
</vuln>
<vuln vid="4b6cb45d-881e-447a-a4e0-c97a954ea758">
<topic>bzip2 -- multiple issues</topic>
<affects>
<package>
<name>bzip2</name>
<range><lt>1.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bzip2 developers reports:</p>
<blockquote cite="https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS">
<p>CVE-2016-3189 - Fix use-after-free in bzip2recover (Jakub Martisko)</p>
<p>CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files (Albert Astals Cid). Found through fuzzing karchive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1319648</url>
<cvename>CVE-2016-3189</cvename>
<cvename>CVE-2019-12900</cvename>
</references>
<dates>
<discovery>2019-06-23</discovery>
<entry>2019-06-30</entry>
</dates>
</vuln>
<vuln vid="1c21f6a3-9415-11e9-95ec-6805ca2fa271">
<topic>powerdns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10">
<p>CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to
cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The
issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while
looking up the NS/A/AAAA records it is about to use for an outgoing notify.</p>
<p>CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized
master server to cause a high CPU load or even prevent any further updates to any slave zone by sending
a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10</url>
<cvename>CVE-2019-10162</cvename>
<cvename>CVE-2019-10163</cvename>
</references>
<dates>
<discovery>2019-06-21</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="5e35cfba-9994-11e9-b07f-df5abf8b84d6">
<topic>TYPO3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8-php71</name>
<name>typo3-8-php72</name>
<name>typo3-8-php73</name>
<range><lt>8.7.27</lt></range>
</package>
<package>
<name>typo3-9-php71</name>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<range><lt>9.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 news:</p>
<blockquote cite="https://typo3.org/article/typo3-958-and-8727-security-releases-published/">
<p>Please read the corresponding Security Advisories for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-958-and-8727-security-releases-published/</url>
<url>https://get.typo3.org/release-notes/8.7.27</url>
<url>https://get.typo3.org/release-notes/9.5.8</url>
<cvename>CVE-2019-10912</cvename>
<cvename>CVE-2019-12747</cvename>
<cvename>CVE-2019-12748</cvename>
</references>
<dates>
<discovery>2019-06-28</discovery>
<entry>2019-06-28</entry>
</dates>
</vuln>
<vuln vid="245629d4-991e-11e9-82aa-6cc21735f730">
<topic>PostgreSQL -- Stack-based buffer overflow via setting a password</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.4</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1949/">
<p>
An authenticated user could create a stack-based buffer overflow
by changing their own password to a purpose-crafted value. In addition
to the ability to crash the PostgreSQL server, this could be further
exploited to execute arbitrary code as the PostgreSQL operating system account.
</p>
<p>
Additionally, a rogue server could send a specifically crafted
message during the SCRAM authentication process and cause a libpq-enabled client
to either crash or execute arbitrary code as the client's operating system account.
</p>
<p>
This issue is fixed by upgrading and restarting your PostgreSQL
server as well as your libpq installations. All users running
PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1949/</url>
<cvename>CVE-2019-10164</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-27</entry>
</dates>
</vuln>
<vuln vid="6f15730d-94ea-11e9-a83e-641c67a117d8">
<topic>znc -- privilege escalation</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12816">
<p>Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated
non-admin users to escalate privileges and execute arbitrary
code by loading a module with a crafted name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12816</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.4</url>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-06-22</entry>
</dates>
</vuln>
<vuln vid="49beb00f-a6e1-4a42-93df-9cb14b4c2bee">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>thunderbird-60.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/">
<h1>CVE-2019-11707: Type confusion in Array.pop</h1>
<p>A type confusion vulnerability can occur when manipulating
JavaScript objects due to issues in Array.pop. This can allow
for an exploitable crash. We are aware of targeted attacks in
the wild abusing this flaw.</p>
<h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
<p>Insufficient vetting of parameters passed with the
Prompt:Open IPC message between child and parent processes can
result in the non-sandboxed parent process opening web content
chosen by a compromised child process. When combined with
additional vulnerabilities this could result in executing
arbitrary code on the user's computer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/</url>
<cvename>CVE-2019-11707</cvename>
<cvename>CVE-2019-11708</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="39bc2294-ff32-4972-9ecb-b9f40b4ccb74">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0.4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.12</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
<h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
<p>Insufficient vetting of parameters passed with the
Prompt:Open IPC message between child and parent processes
can result in the non-sandboxed parent process opening web
content chosen by a compromised child process. When combined
with additional vulnerabilities this could result in executing
arbitrary code on the user's computer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/</url>
<cvename>CVE-2019-11708</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-21</entry>
<modified>2019-07-09</modified>
</dates>
</vuln>
<vuln vid="98f1241f-8c09-4237-ad0d-67fb4158ea7a">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>60.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/">
<h1>CVE-2019-11703: Heap buffer overflow in icalparser.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a heap
buffer overflow in parser_get_next_char when processing certain
email messages, resulting in a potentially exploitable crash.</p>
<h1>CVE-2019-11704: Heap buffer overflow in icalvalue.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a heap
buffer overflow in icalmemory_strdup_and_dequote when processing
certain email messages, resulting in a potentially exploitable
crash.</p>
<h1>CVE-2019-11705: Stack buffer overflow in icalrecur.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a stack
buffer overflow in icalrecur_add_bydayrules when processing
certain email messages, resulting in a potentially exploitable
crash.</p>
<h1>CVE-2019-11706: Type confusion in icalproperty.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a type
confusion in icaltimezone_get_vtimezone_properties when
processing certain email messages, resulting in a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/</url>
<cvename>CVE-2019-11703</cvename>
<cvename>CVE-2019-11704</cvename>
<cvename>CVE-2019-11705</cvename>
<cvename>CVE-2019-11706</cvename>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="5b218581-9372-11e9-8fc4-5404a68ad561">
<topic>vlc -- Double free in Matroska demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7.1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102">
<p>mkv: Fix potential double free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12874</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874</url>
<url>http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102</url>
</references>
<dates>
<discovery>2019-05-20</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="f2144530-936f-11e9-8fc4-5404a68ad561">
<topic>vlc -- Buffer overflow vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zhangyang reports:</p>
<blockquote cite="https://hackerone.com/reports/484398">
<p>The ReadFrame function in the avi.c file uses a variable i_width_bytes,
which is obtained directly from the file. It is a signed integer.
It does not do a strict check before the memory operation(memmove, memcpy),
which may cause a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-5439</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439</url>
<url>https://hackerone.com/reports/484398</url>
</references>
<dates>
<discovery>2019-01-23</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="0cea6e0a-7a39-4dac-b3ec-dbc13d404f76">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0.3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.11</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/">
<h1>CVE-2019-11707: Type confusion in Array.pop</h1>
<p>A type confusion vulnerability can occur when
manipulating JavaScript objects due to issues in
Array.pop. This can allow for an exploitable crash. We are
aware of targeted attacks in the wild abusing this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11707</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-18/</url>
</references>
<dates>
<discovery>2019-06-18</discovery>
<entry>2019-06-19</entry>
<modified>2019-06-20</modified>
</dates>
</vuln>
<vuln vid="9c9023ff-9057-11e9-b764-00505632d232">
<topic>netatalk3 -- remote code execution vulnerability</topic>
<affects>
<package>
<name>netatalk3</name>
<range><lt>3.1.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1160">
<p>Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1160</url>
<url>https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172</url>
</references>
<dates>
<discovery>2018-11-10</discovery>
<entry>2019-06-16</entry>
</dates>
</vuln>
<vuln vid="82c07dfa-9016-11e9-af2f-712c38aa3e4c">
<topic>GraphicsMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.32,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick News:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Read "Security Fixes:" section for details.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
</references>
<dates>
<discovery>2019-06-15</discovery>
<entry>2019-06-16</entry>
</dates>
</vuln>
<vuln vid="d4fc4599-8f75-11e9-8d9f-3065ec8fd3ec">
<topic>chromium -- use after free</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>75.0.3770.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html">
<p>[961413] High CVE-2019-5842: Use-after-free in Blink. Reported by BUGFENSE Anonymous Bug Bounties https://bugfense.io on 2019-05-09</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html</url>
<cvename>CVE-2019-5842</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-06-15</entry>
</dates>
</vuln>
<vuln vid="a5681027-8e03-11e9-85f4-6805ca0b3d42">
<topic>phpMyAdmin -- CSRF vulnerability in login form</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-4/">
<h3>Summary</h3>
<p>CSRF vulnerability in login form</p>
<h3>Description</h3>
<p>A vulnerability was found that allows an attacker to
trigger a CSRF attack against a phpMyAdmin user. The
attacker can trick the user, for instance through a broken
<code><img></code> tag pointing at the victim's
phpMyAdmin database, and the attacker can potentially
deliver a payload (such as a specific INSERT or DELETE
statement) through the victim.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be severe.</p>
<h3>Mitigation factor</h3> <p>Only the 'cookie'
auth_type is affected; users can temporary use
phpMyAdmin's http authentication as a workaround.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2019-4/</url>
<cvename>CVE-2019-12616</cvename>
</references>
<dates>
<discovery>2019-06-04</discovery>
<entry>2019-06-13</entry>
</dates>
</vuln>
<vuln vid="bbdb9713-8e09-11e9-87bc-002590acae31">
<topic>Vim/NeoVim -- Security vulnerability</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-tiny</name>
<range><lt>8.1.1365</lt></range>
</package>
<package>
<name>neovim</name>
<range><lt>0.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Security releases for Vim/NeoVim:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-12735">
<p>Sandbox escape allows for arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-12735</url>
</references>
<dates>
<discovery>2019-05-22</discovery>
<entry>2019-06-13</entry>
</dates>
</vuln>
<vuln vid="13960f55-8d35-11e9-9ba0-4c72b94353b5">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/">
<p>High risk: Theme import stylesheet name RCE</p>
<p>High risk: Nested video MyCode persistent XSS</p>
<p>Medium risk: Find Orphaned Attachments reflected XSS</p>
<p>Medium risk: Post edit reflected XSS</p>
<p>Medium risk: Private Messaging folders SQL injection</p>
<p>Low risk: Potential phar deserialization through Upload Path</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2019-06-10</discovery>
<entry>2019-06-12</entry>
</dates>
</vuln>
<vuln vid="ab099d2c-8c8c-11e9-8ba7-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.207</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-30.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7845).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7845</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-30.html</url>
</references>
<dates>
<discovery>2019-06-11</discovery>
<entry>2019-06-11</entry>
</dates>
</vuln>
<vuln vid="9b8a52fc-89c1-11e9-9ba0-4c72b94353b5">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.67</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-007">
<p>CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.</p>
<p>In order to intercept file invocations like file_exists or stat on compromised Phar archives
the base name has to be determined and checked before allowing to be handled by PHP
Phar stream handling.
The current implementation is vulnerable to path traversal leading to scenarios where the
Phar archive to be assessed is not the actual (compromised) file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-007</url>
</references>
<dates>
<discovery>2019-05-08</discovery>
<entry>2019-06-08</entry>
</dates>
</vuln>
<vuln vid="45bea6b5-8855-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE in deliver_message() function</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.87</ge><lt>4.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team and Qualys report:</p>
<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-10149.txt">
<p>
We received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit.
</p>
<p>
A patch exists already, is being tested, and backported to all
versions we released since (and including) 4.87.
</p>
<p>
The severity depends on your configuration. It depends on how close to
the standard configuration your Exim runtime configuration is. The
closer the better.
</p>
<p>
Exim 4.92 is not vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10149</cvename>
<url>https://www.exim.org/static/doc/security/CVE-2019-10149.txt</url>
</references>
<dates>
<discovery>2019-05-27</discovery>
<entry>2019-06-06</entry>
</dates>
</vuln>
<vuln vid="ffc73e87-87f0-11e9-ad56-fcaa147e860e">
<topic>Django -- AdminURLFieldWidget XSS</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.21</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.9</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django security releases issued:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jun/03/security-releases/">
<p>The clickable "Current URL" link generated by AdminURLFieldWidget displayed the
provided value without validating it as a safe URL. Thus, an unvalidated value stored
in the database, or a value provided as a URL query parameter payload, could result
in an clickable JavaScript link..</p>
<p>jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype
pollution. If an unsanitized source object contained an enumerable __proto__ property,
it could extend the native Object.prototype.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12308</cvename>
<cvename>CVE-2019-11358</cvename>
<url>https://www.djangoproject.com/weblog/2019/jun/03/security-releases/</url>
</references>
<dates>
<discovery>2019-06-03</discovery>
<entry>2019-06-06</entry>
</dates>
</vuln>
<vuln vid="4091069e-860b-11e9-a05f-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.11.0</ge><lt>11.11.1</lt></range>
<range><ge>11.10.0</ge><lt>11.10.5</lt></range>
<range><ge>6.8.0</ge><lt>11.9.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/">
<p>Remote Command Execution Vulnerability on Repository Download Feature</p>
<p>Confidential Issue Titles Revealed to Restricted Users on Unsubscribe</p>
<p>Disclosure of Milestone Metadata through the Search API</p>
<p>Private Project Discovery via Comment Links</p>
<p>Metadata of Confidential Issues Disclosed to Restricted Users</p>
<p>Mandatory External Authentication Provider Sign-In Restrictions Bypass</p>
<p>Internal Projects Allowed to Be Created on in Private Groups</p>
<p>Server-Side Request Forgery Through DNS Rebinding</p>
<p>Stored Cross-Site Scripting on Wiki Pages</p>
<p>Stored Cross-Site Scripting on Notes</p>
<p>Repository Password Disclosed on Import Error Page</p>
<p>Protected Branches Restriction Rules Bypass</p>
<p>Stored Cross-Site Scripting Vulnerability on Child Epics</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/</url>
<cvename>CVE-2019-12430</cvename>
<cvename>CVE-2019-12432</cvename>
<cvename>CVE-2019-12431</cvename>
<cvename>CVE-2019-12434</cvename>
<cvename>CVE-2019-12429</cvename>
<cvename>CVE-2019-12428</cvename>
<cvename>CVE-2019-12433</cvename>
<cvename>CVE-2019-12443</cvename>
<cvename>CVE-2019-12444</cvename>
<cvename>CVE-2019-12445</cvename>
<cvename>CVE-2019-12446</cvename>
<cvename>CVE-2019-12441</cvename>
<cvename>CVE-2019-12442</cvename>
</references>
<dates>
<discovery>2019-06-03</discovery>
<entry>2019-06-03</entry>
</dates>
</vuln>
<vuln vid="ada8db8a-8471-11e9-8170-0050562a4d7b">
<topic>buildbot -- OAuth Authentication Vulnerability</topic>
<affects>
<package>
<name>py27-buildbot</name>
<name>py35-buildbot</name>
<name>py36-buildbot</name>
<name>py37-buildbot</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication">
<p>Buildbot accepted user-submitted authorization token from OAuth and used
it to authenticate user.</p>
<p>The vulnerability can lead to malicious attackers to authenticate as legitimate users
of a Buildbot instance without knowledge of the victim's login credentials on certain
scenarios.</p>
<p>If an attacker has an application authorized to access data of another user at the
same Identity Provider as the used by the Buildbot instance, then he can acquire a token
to access the data of that user, supply the token to the Buildbot instance and successfully
login as the victim.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication</url>
<url>https://github.com/buildbot/buildbot/pull/4763</url>
<cvename>CVE-2019-12300</cvename>
</references>
<dates>
<discovery>2019-05-07</discovery>
<entry>2019-06-01</entry>
</dates>
</vuln>
<vuln vid="177fa455-48fc-4ded-ba1b-9975caa7f62a">
<topic>bro -- Unsafe integer conversions can cause unintentional code paths to be executed</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/bb979702cf9a2fa67b8d1a1c7f88d0b56c6af104/NEWS">
<p>The following Denial of Service vulnerabilities are addressed:</p>
<ul>
<li>Integer type mismatches in BinPAC-generated parser code
and Bro analyzer code may allow for crafted packet data
to cause unintentional code paths in the analysis logic
to be taken due to unsafe integer conversions causing the
parser and analysis logic to each expect different fields
to have been parsed. One such example, reported by Maksim
Shudrak, causes the Kerberos analyzer to dereference a
null pointer. CVE-2019-12175 was assigned for this issue.</li>
<li>The Kerberos parser allows for several fields to be left
uninitialized, but they were not marked with an &optional
attribute and several usages lacked existence checks.
Crafted packet data could potentially cause an attempt
to access such uninitialized fields, generate a runtime
error/exception, and leak memory. Existence checks and
&optional attributes have been added to the relevent
Kerberos fields.</li>
<li>BinPAC-generated protocol parsers commonly contain fields
whose length is derived from other packet input, and for
those that allow for incremental parsing, BinPAC did not
impose a limit on how large such a field could grow,
allowing for remotely-controlled packet data to cause
growth of BinPAC's flowbuffer bounded only by the numeric
limit of an unsigned 64-bit integer, leading to memory
exhaustion. There is now a generalized limit for how
large flowbuffers are allowed to grow, tunable by setting
"BinPAC::flowbuffer_capacity_max".</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12175</cvename>
</references>
<dates>
<discovery>2019-05-29</discovery>
<entry>2019-05-31</entry>
</dates>
</vuln>
<vuln vid="183d700e-ec70-487e-a9c4-632324afa934">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<range><lt>7.0.8.47</lt></range>
</package>
<package>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.8.47</lt></range>
</package>
<package>
<name>ImageMagick6</name>
<range><lt>6.9.10.47,1</lt></range>
</package>
<package>
<name>ImageMagick6-nox11</name>
<range><lt>6.9.10.47,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cvedetails.com reports:</p>
<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html">
<p>CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.</p>
<p>CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.</p>
<p>CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.</p>
<p>CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.</p>
<p>CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.</p>
<p>CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.</p>
<p>CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.</p>
<p>CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.</p>
<p>CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.</p>
<p>CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.</p>
<p>CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.</p>
<p>CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.</p>
<p>CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.</p>
<p>CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html</url>
<cvename>CVE-2019-7175</cvename>
<cvename>CVE-2019-7395</cvename>
<cvename>CVE-2019-7396</cvename>
<cvename>CVE-2019-7397</cvename>
<cvename>CVE-2019-7398</cvename>
<cvename>CVE-2019-9956</cvename>
<cvename>CVE-2019-10131</cvename>
<cvename>CVE-2019-10649</cvename>
<cvename>CVE-2019-10650</cvename>
<cvename>CVE-2019-10714</cvename>
<cvename>CVE-2019-11470</cvename>
<cvename>CVE-2019-11472</cvename>
<cvename>CVE-2019-11597</cvename>
<cvename>CVE-2019-11598</cvename>
</references>
<dates>
<discovery>2019-03-07</discovery>
<entry>2019-05-30</entry>
<modified>2019-06-17</modified>
</dates>
</vuln>
<vuln vid="10fd731c-8088-11e9-b6ae-001871ec5271">
<topic>cyrus-imapd -- buffer overrun in httpd</topic>
<affects>
<package>
<name>cyrus-imapd30</name>
<range><ge>3.0.0</ge><lt>3.0.10</lt></range>
</package>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.0.10 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html">
<p>Fixed CVE-2019-11356: buffer overrun in httpd</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11356</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11356</url>
</references>
<dates>
<discovery>2019-04-19</discovery>
<entry>2019-05-27</entry>
</dates>
</vuln>
<vuln vid="3ba87032-7fbd-11e9-8a5f-c85b76ce9b5a">
<topic>serendipity -- XSS</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11870">
<p>Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html</url>
<cvename>CVE-2019-11870</cvename>
</references>
<dates>
<discovery>2019-05-01</discovery>
<entry>2019-05-26</entry>
</dates>
</vuln>
<vuln vid="36b905ad-7fbb-11e9-8a5f-c85b76ce9b5a">
<topic>sqlite3 -- use after free</topic>
<affects>
<package>
<name>sqlite3</name>
<range><eq>3.26.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5018">
<p>An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777</url>
<cvename>CVE-2019-5018</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-26</entry>
</dates>
</vuln>
<vuln vid="3b903bf3-7f94-11e9-8a5f-c85b76ce9b5a">
<topic>suricata -- buffer over-read</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>4.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10053">
<p>An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/</url>
<cvename>CVE-2019-10053</cvename>
</references>
<dates>
<discovery>2019-03-15</discovery>
<entry>2019-05-26</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="dd343a2b-7ee7-11e9-a290-8ddc52868fa9">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.19.4</ge><lt>7.65.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2019-5435: Integer overflows in curl_url_set()</p>
<p>libcurl contains two integer overflows in the curl_url_set()
function that if triggered, can lead to a too small buffer
allocation and a subsequent heap buffer overflow.</p>
<p>The flaws only exist on 32 bit architectures and require
excessive string input lengths.</p>
<p>CVE-2019-5436: TFTP receive buffer overflow</p>
<p>libcurl contains a heap buffer overflow in the function
(tftp_receive_packet()) that recevives data from a TFTP server. It
calls recvfrom() with the default size for the buffer rather than
with the size that was used to allocate it. Thus, the content that
might overwrite the heap memory is entirely controlled by the server.</p>
<p>The flaw exists if the user selects to use a "blksize" of 504 or
smaller (default is 512). The smaller size that is used, the larger
the possible overflow becomes.</p>
<p>Users chosing a smaller size than default should be rare as the
primary use case for changing the size is to make it larger.</p>
<p>It is rare for users to use TFTP across the Internet. It is most
commonly used within local networks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5435.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5436.html</url>
<cvename>CVE-2019-5435</cvename>
<cvename>CVE-2019-5436</cvename>
</references>
<dates>
<discovery>2019-05-22</discovery>
<entry>2019-05-25</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="8d2af843-7d8e-11e9-8464-c85b76ce9b5a">
<topic>OCaml -- Multiple Security Vulnerabilities</topic>
<affects>
<package>
<name>ocaml</name>
<range><lt>4.03.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="INSERT URL HERE">
<p>OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2015-8869</url>
<url>https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762</url>
<cvename>CVE-2015-8869</cvename>
</references>
<dates>
<discovery>2016-06-13</discovery>
<entry>2019-05-23</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="44b6dfbf-4ef7-4d52-ad52-2b1b05d81272">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/">
<p>CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS</p>
<p>CVE-2019-9816: Type confusion with object groups and UnboxedObjects</p>
<p>CVE-2019-9817: Stealing of cross-domain images using canvas</p>
<p>CVE-2019-9818: Use-after-free in crash generation server</p>
<p>CVE-2019-9819: Compartment mismatch with fetch API</p>
<p>CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell</p>
<p>CVE-2019-9821: Use-after-free in AssertWorkerThread</p>
<p>CVE-2019-11691: Use-after-free in XMLHttpRequest</p>
<p>CVE-2019-11692: Use-after-free removing listeners in the event listener manager</p>
<p>CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux</p>
<p>CVE-2019-7317: Use-after-free in png_image_free of libpng library</p>
<p>CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox</p>
<p>CVE-2019-11695: Custom cursor can render over user interface outside of web content</p>
<p>CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts</p>
<p>CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions</p>
<p>CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks</p>
<p>CVE-2019-11700: res: protocol can be used to open known local files</p>
<p>CVE-2019-11699: Incorrect domain name highlighting during page navigation</p>
<p>CVE-2019-11701: webcal: protocol default handler loads vulnerable web page</p>
<p>CVE-2019-9814: Memory safety bugs fixed in Firefox 67</p>
<p>CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9815</cvename>
<cvename>CVE-2019-9816</cvename>
<cvename>CVE-2019-9817</cvename>
<cvename>CVE-2019-9818</cvename>
<cvename>CVE-2019-9819</cvename>
<cvename>CVE-2019-9820</cvename>
<cvename>CVE-2019-9821</cvename>
<cvename>CVE-2019-11691</cvename>
<cvename>CVE-2019-11692</cvename>
<cvename>CVE-2019-11693</cvename>
<cvename>CVE-2019-7317</cvename>
<cvename>CVE-2019-11694</cvename>
<cvename>CVE-2019-11695</cvename>
<cvename>CVE-2019-11696</cvename>
<cvename>CVE-2019-11697</cvename>
<cvename>CVE-2019-11698</cvename>
<cvename>CVE-2019-11700</cvename>
<cvename>CVE-2019-11699</cvename>
<cvename>CVE-2019-11701</cvename>
<cvename>CVE-2019-9814</cvename>
<cvename>CVE-2019-9800</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-13/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-14/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-15/</url>
</references>
<dates>
<discovery>2019-05-21</discovery>
<entry>2019-05-22</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="793a0072-7822-11e9-81e2-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><le>4.6.16</le></range>
</package>
<package>
<name>samba47</name>
<range><le>4.7.12</le></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.12</lt></range>
</package>
<package>
<name>samba49</name>
<range><lt>4.9.8</lt></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16860.html">
<p>The checksum validation in the S4U2Self handler in the embedded Heimdal KDC
did not first confirm that the checksum was keyed, allowing replacement of the
requested target (client) principal</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-3880.html">
<p>Authenticated users with write permission can trigger a symlink traversal to write
or detect files outside the Samba share.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-16860.html</url>
<cvename>CVE-2018-16860</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-3880.html</url>
<cvename>CVE-2019-3880</cvename>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-05-14</entry>
</dates>
</vuln>
<vuln vid="37528379-76a8-11e9-a4fd-00012e582166">
<topic>Rust -- violation of Rust's safety guarantees</topic>
<affects>
<package>
<name>rust</name>
<range><ge>1.34.0</ge><lt>1.34.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sean McArthur reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12083">
<p>
The Rust Programming Language Standard Library 1.34.x
before 1.34.2 contains a stabilized method which, if
overridden, can violate Rust's safety guarantees and
cause memory unsafety. If the Error::type_id method
is overridden then any type can be safely cast to any
other type, causing memory safety vulnerabilities in
safe code (e.g., out-of-bounds write or read). Code
that does not manually implement Error::type_id is
unaffected.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.rust-lang.org/2019/05/13/Security-advisory.html</url>
<cvename>CVE-2019-12083</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-15</entry>
</dates>
</vuln>
<vuln vid="a99923a9-768c-11e9-885a-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.192</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-26.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7837).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7837</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-26.html</url>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-05-14</entry>
</dates>
</vuln>
<vuln vid="c2d1693b-73cb-11e9-a1c7-b499baebfeaf">
<topic>PHP -- Multiple vulnerabilities in EXIF module</topic>
<affects>
<package>
<name>php71-exif</name>
<range><lt>7.1.28</lt></range>
</package>
<package>
<name>php72-exif</name>
<range><lt>7.2.17</lt></range>
</package>
<package>
<name>php73-exif</name>
<range><lt>7.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="https://www.php.net/ChangeLog-7.php">
<p>Heap-buffer-overflow in php_ifd_get32s (CVE-2019-11034)</p>
<p>Heap-buffer-overflow in exif_iif_add_value (CVE-2019-11035)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.php.net/ChangeLog-7.php</url>
<cvename>CVE-2019-11034</cvename>
<cvename>CVE-2019-11035</cvename>
</references>
<dates>
<discovery>2019-04-04</discovery>
<entry>2019-05-11</entry>
</dates>
</vuln>
<vuln vid="065890c3-725e-11e9-b0e1-6cc21735f730">
<topic>PostgreSQL -- Selectivity estimators bypass row security policies</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.3</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.8</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.13</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1939/">
<p>
PostgreSQL maintains statistics for tables by sampling
data available in columns; this data is consulted during
the query planning process. Prior to this release, a user
able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could
read whatever data had been sampled from that column.
If this happened to include values from rows that the user
is forbidden to see by a row security policy, the user
could effectively bypass the policy. This is fixed by only
allowing a non-leakproof operator to use this data if
there are no relevant row security policies for the table.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1939/</url>
<cvename>CVE-2019-10130</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-09</entry>
</dates>
</vuln>
<vuln vid="e66a5440-7258-11e9-b0e1-6cc21735f730">
<topic>PostgreSQL -- Memory disclosure in partition routing</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1939/">
<p>
Prior to this release, a user running PostgreSQL 11 can read
arbitrary bytes of server memory by executing a purpose-crafted
INSERT statement to a partitioned table.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1939/</url>
<cvename>CVE-2019-10129</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-09</entry>
</dates>
</vuln>
<vuln vid="a1de4ae9-6fda-11e9-9ba0-4c72b94353b5">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.8.0-is-released">
<p>This release contains two new security fixes which cannot be backported
to the 1.7.0 branch, so it is recommended to update to this version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/</url>
</references>
<dates>
<discovery>2019-04-21</discovery>
<entry>2019-05-06</entry>
</dates>
</vuln>
<vuln vid="3df5a920-6edc-11e9-a44b-0050562a4d7b">
<topic>comms/hylafax -- Malformed fax sender remote code execution in JPEG support</topic>
<affects>
<package>
<name>hylafax</name>
<range><lt>6.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="ftp://ftp.hylafax.org/security/CVE-2018-17141.html">
<p>A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in
the same DCS signal or sends a large JPEG page could lead to remote code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17141</cvename>
<url>ftp://ftp.hylafax.org/security/CVE-2018-17141.html</url>
<url>https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/</url>
<url>http://bugs.hylafax.org/show_bug.cgi?id=974</url>
<url>http://git.hylafax.org/HylaFAX?a=commit;h=c6cac8d8cd0dbe313689ba77023e12bc5b3027be</url>
</references>
<dates>
<discovery>2018-08-24</discovery>
<entry>2019-05-05</entry>
</dates>
</vuln>
<vuln vid="4faac805-6be0-11e9-a685-001b217b3468">
<topic>Gitlab -- Information Disclosure</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.10.0</ge><lt>11.10.3</lt></range>
<range><ge>11.9.0</ge><lt>11.9.11</lt></range>
<range><ge>11.8.0</ge><lt>11.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/">
<p>Information Disclosure with Limited Scope Token</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/</url>
<cvename>CVE-2019-11605</cvename>
</references>
<dates>
<discovery>2019-04-30</discovery>
<entry>2019-05-01</entry>
</dates>
</vuln>
<vuln vid="3f98ccb3-6b8a-11e9-9b5c-a4badb296695">
<topic>Dovecot -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000409.html">
<p>Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s).</p>
</blockquote>
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000410.html">
<p>Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/list/dovecot-news/2019-April/000409.html</url>
<cvename>CVE-2019-11494</cvename>
<url>https://dovecot.org/list/dovecot-news/2019-April/000410.html</url>
<cvename>CVE-2019-11499</cvename>
</references>
<dates>
<discovery>2019-03-11</discovery>
<entry>2019-04-30</entry>
</dates>
</vuln>
<vuln vid="1138b39e-6abb-11e9-a685-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.10.0</ge><lt>11.10.2</lt></range>
<range><ge>11.9.0</ge><lt>11.9.10</lt></range>
<range><ge>6.0.0</ge><lt>11.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/">
<p>Moving an Issue to Private Repo Leaks Project Namespace</p>
<p>Notification Emails Sent to Restricted Users</p>
<p>Unauthorized Comments on Confidential Issues</p>
<p>Merge Request Approval Count Inflation</p>
<p>Unsanitized Branch Names on New Merge Request Notification Emails</p>
<p>Improper Sanitation of Credentials in Gitaly</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/</url>
<cvename>CVE-2019-11545</cvename>
<cvename>CVE-2019-11544</cvename>
<cvename>CVE-2019-11548</cvename>
<cvename>CVE-2019-11546</cvename>
<cvename>CVE-2019-11547</cvename>
<cvename>CVE-2019-11549</cvename>
</references>
<dates>
<discovery>2019-04-29</discovery>
<entry>2019-04-29</entry>
</dates>
</vuln>
<vuln vid="5536ea5f-6814-11e9-a8f7-0050562a4d7b">
<topic>buildbot -- CRLF injection in Buildbot login and logout redirect code</topic>
<affects>
<package>
<name>py27-buildbot</name>
<name>py35-buildbot</name>
<name>py36-buildbot</name>
<name>py37-buildbot</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code">
<p>A CRLF can be injected in Location header of /auth/login and /auth/logout
This is due to lack of input validation in the buildbot redirection code.
</p>
<p>It was not found a way to impact Buildbot product own security through
this vulnerability, but it could be used to compromise other sites
hosted on the same domain as Buildbot.
- cookie injection a master domain (ie if your buildbot is on
buildbot.buildbot.net, one can inject a cookie on *.buildbot.net,
which could impact another website hosted in your domain)
- HTTP response splitting and cache poisoning (browser or proxy) are
also typical impact of this vulnerability class, but might be impractical
to exploit.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7313</url>
<cvename>CVE-2019-7313</cvename>
</references>
<dates>
<discovery>2019-01-29</discovery>
<entry>2019-04-26</entry>
</dates>
</vuln>
<vuln vid="2bad8b5d-66fb-11e9-9815-78acc0a3b880">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.66</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-005">
<p>CVE-2019-10909: Escape validation messages in the PHP templating engine.</p>
<p>CVE-2019-10910: Check service IDs are valid.</p>
<p>CVE-2019-10911: Add a separator in the remember me cookie hash.</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-006">
<p>jQuery 3.4.0 includes a fix for some unintended behavior when using
jQuery.extend(true, {}, ...). If an unsanitized source object contained
an enumerable __proto__ property, it could extend the native Object.prototype.
This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous
jQuery versions.</p>
<p>It's possible that this vulnerability is exploitable with some Drupal modules.
As a precaution, this Drupal security release backports the fix to jQuery.extend(),
without making any other changes to the jQuery version that is included in
Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site
via some other module such as jQuery Update.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-005</url>
<url>https://www.drupal.org/SA-CORE-2019-006</url>
</references>
<dates>
<discovery>2019-04-17</discovery>
<entry>2019-04-25</entry>
</dates>
</vuln>
<vuln vid="f6ea18bb-65b9-11e9-8b31-002590045d9c">
<topic>py-yaml -- arbitrary code execution</topic>
<affects>
<package>
<name>py27-yaml</name>
<name>py35-yaml</name>
<name>py36-yaml</name>
<name>py37-yaml</name>
<range><lt>4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pyyaml reports:</p>
<blockquote cite="https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation">
<p>the PyYAML.load function could be easily exploited to call any Python
function. That means it could call any system command using os.system()</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-18342</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342</url>
<url>https://github.com/yaml/pyyaml/pull/74</url>
</references>
<dates>
<discovery>2018-06-27</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="a207bbd8-6572-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
(EAP peer) does not to validate fragmentation reassembly state
properly for a case where an unexpected fragment could be received.
This could result in process termination due to NULL pointer
dereference.</p>
<p>See
https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support could
suffer a denial of service attack through process termination.</p>
</body>
</description>
<references>
<url>https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt</url>
</references>
<dates>
<discovery>2019-04-18</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="2da3cb25-6571-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd missing commit validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
(EAP peer) does not to validate the received scalar and element values
in EAP-pwd-Commit messages properly. This could result in attacks that
would be able to complete EAP-pwd authentication exchange without the
attacker having to know the used password.</p>
<p>See
https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support.</p>
</body>
</description>
<references>
<cvename>CVE-2019-9497</cvename>
<cvename>CVE-2019-9498</cvename>
<cvename>CVE-2019-9499</cvename>
<freebsdsa>SA-19:03.wpa</freebsdsa>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
<modified>2019-07-30</modified>
</dates>
</vuln>
<vuln vid="98b71436-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- SAE confirm missing state validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When hostapd is used to operate an access point with SAE
(Simultaneous Authentication of Equals; also known as WPA3-Personal),
an invalid authentication sequence could result in the hostapd process
terminating due to a NULL pointer dereference when processing SAE
confirm message. This was caused by missing state validation steps
when processing the SAE confirm message in hostapd/AP mode.</p>
<p>See
https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All hostapd versions with SAE support (CONFIG_SAE=y in the build
configuration and SAE being enabled in the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9496</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="60129efe-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd side-channel attack</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Potential side channel attacks in the SAE implementations used
by both hostapd and wpa_supplicant (see CVE-2019-9494 and VU#871675).
EAP-pwd uses a similar design for deriving PWE from the password and
while a specific attack against EAP-pwd is not yet known to be tested,
there is no reason to believe that the EAP-pwd implementation would
be immune against the type of cache attack that was identified for the
SAE implementation. Since the EAP-pwd implementation in hostapd (EAP
server) and wpa_supplicant (EAP peer) does not support MODP groups,
the timing attack described against SAE is not applicable for the
EAP-pwd implementation.</p>
<p>See
https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support
(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled
in the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9495</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="7e53f9cc-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- SAE side-channel attacks</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Side channel attacks in the SAE implementations used by both
hostapd (AP) and wpa_supplicant (infrastructure BSS station/mesh
station). SAE (Simultaneous Authentication of Equals) is also known
as WPA3-Personal. The discovered side channel attacks may be able to
leak information about the used password based on observable timing
differences and cache access patterns. This might result in full
password recovery when combined with an offline dictionary attack and
if the password is not strong enough to protect against dictionary
attacks.</p>
<p>See
https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with SAE support
(CONFIG_SAE=y in the build configuration and SAE being enabled in
the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9494</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="484d3f5e-653a-11e9-b0e3-1c39475b9f84">
<topic>Istio -- Security vulnerabilities</topic>
<affects>
<package>
<name>istio</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Istio reports:</p>
<blockquote cite="https://istio.io/blog/2019/announcing-1.1.2/#security-update">
<p>Two security vulnerabilities have recently been identified in the Envoy proxy.
The vulnerabilities are centered on the fact that Envoy did not normalize
HTTP URI paths and did not fully validate HTTP/1.1 header values. These
vulnerabilities impact Istio features that rely on Envoy to enforce any of
authorization, routing, or rate limiting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9900</cvename>
<cvename>CVE-2019-9901</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9900</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9901</url>
<url>https://github.com/envoyproxy/envoy/issues/6434</url>
<url>https://github.com/envoyproxy/envoy/issues/6435</url>
</references>
<dates>
<discovery>2019-03-29</discovery>
<entry>2019-04-22</entry>
</dates>
</vuln>
<vuln vid="5ed7102e-6454-11e9-9a3a-001cc0382b2f">
<topic>Ghostscript -- Security bypass vulnerability</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cedric Buissart (Red Hat) reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835">
<p>It was found that the superexec operator was available in the
internal dictionary in ghostscript before 9.27. A specially crafted
PostScript file could use this flaw in order to, for example, have
access to the file system outside of the constrains imposed by
-dSAFER.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838">
<p>It was found that the forceput operator could be extracted from
the DefineResource method in ghostscript before 9.27. A specially
crafted PostScript file could use this flaw in order to, for
example, have access to the file system outside of the constrains
imposed by -dSAFER.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838</url>
<cvename>CVE-2019-3835</cvename>
<cvename>CVE-2019-3838</cvename>
</references>
<dates>
<discovery>2019-03-21</discovery>
<entry>2019-04-21</entry>
</dates>
</vuln>
<vuln vid="fb30db8f-62af-11e9-b0de-001cc0382b2f">
<topic>GnuTLS -- double free, invalid pointer access</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27">
<ul>
<li>Tavis Ormandy from Google Project Zero found a memory
corruption (double free) vulnerability in the certificate
verification API. Any client or server application that verifies
X.509 certificates with GnuTLS 3.5.8 or later is affected.</li>
<li>It was found using the TLS fuzzer tools that decoding a
malformed TLS1.3 asynchronous message can cause a server crash
via an invalid pointer access. The issue affects GnuTLS server
applications since 3.6.4.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27</url>
<cvename>CVE-2019-3829</cvename>
<cvename>CVE-2019-3836</cvename>
</references>
<dates>
<discovery>2019-03-27</discovery>
<entry>2019-04-19</entry>
</dates>
</vuln>
<vuln vid="a64aa22f-61ec-11e9-85b9-a4badb296695">
<topic>dovecot -- json encoder crash</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
</package>
<package>
<name>dovecot2</name>
<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html">
<p>* CVE-2019-10691: Trying to login with 8bit username containing
invalid UTF8 input causes auth process to crash if auth policy is
enabled. This could be used rather easily to cause a DoS. Similar
crash also happens during mail delivery when using invalid UTF8 in
From or Subject header when OX push notification driver is used.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html</url>
<cvename>CVE-2019-10691</cvename>
</references>
<dates>
<discovery>2019-04-09</discovery>
<entry>2019-04-18</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="6e58e1e9-2636-413e-9f84-4c0e21143628">
<topic>libssh2 -- multiple issues</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.8.1,3</lt></range>
</package>
<package>
<name>linux-c6-libssh2</name>
<range><lt>1.4.2_7</lt></range>
</package>
<package>
<name>linux-c7-libssh2</name>
<range><lt>1.4.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libssh2 developers report:</p>
<blockquote cite="https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1">
<ul>
<li>Defend against possible integer overflows in comp_method_zlib_decomp.</li>
<li>Defend against writing beyond the end of the payload in _libssh2_transport_read().</li>
<li>Sanitize padding_length - _libssh2_transport_read().</li>
<li>This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.</li>
<li>Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read.</li>
<li>Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.</li>
<li>Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short.</li>
<li>Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add().</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1</url>
<url>https://libssh2.org/CVE-2019-3855.html</url>
<url>https://libssh2.org/CVE-2019-3856.html</url>
<url>https://libssh2.org/CVE-2019-3857.html</url>
<url>https://libssh2.org/CVE-2019-3858.html</url>
<url>https://libssh2.org/CVE-2019-3859.html</url>
<url>https://libssh2.org/CVE-2019-3860.html</url>
<url>https://libssh2.org/CVE-2019-3861.html</url>
<url>https://libssh2.org/CVE-2019-3862.html</url>
<url>https://libssh2.org/CVE-2019-3863.html</url>
<cvename>CVE-2019-3855</cvename>
<cvename>CVE-2019-3856</cvename>
<cvename>CVE-2019-3857</cvename>
<cvename>CVE-2019-3858</cvename>
<cvename>CVE-2019-3859</cvename>
<cvename>CVE-2019-3860</cvename>
<cvename>CVE-2019-3861</cvename>
<cvename>CVE-2019-3862</cvename>
<cvename>CVE-2019-3863</cvename>
</references>
<dates>
<discovery>2019-03-14</discovery>
<entry>2019-04-18</entry>
<modified>2019-07-07</modified>
</dates>
</vuln>
<vuln vid="b747783f-5fb6-11e9-b2ac-08002705f877">
<topic>gitea -- remote code execution</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/">
<p>Prevent remote code execution vulnerability with mirror repo URL settings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/</url>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-04-17</entry>
</dates>
</vuln>
<vuln vid="4e1997e8-5de0-11e9-b95c-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.64</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.39</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.23</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.14</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.44</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.26</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.15</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.64</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.44</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html">
<p>Critical Patch Update Oracle MySQL Executive Summary</p>
<p>This Critical Patch Update contains 44 new security fixes for
Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
<p>The Oracle MySQL products and versions affected by vulnerabilities
that are fixed in this Critical Patch Update are: MySQL Server, versions
5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior</p>
<p>Further details will be published by Oracle on 2019-04-16</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html</url>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-04-13</entry>
</dates>
</vuln>
<vuln vid="a737eb11-5cfc-11e9-ab87-8cec4bf8fcfb">
<topic>wget -- security flaw in caching credentials passed as a part of the URL</topic>
<affects>
<package>
<name>wget</name>
<range><ge>1.19</ge><lt>1.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gynvael Coldwind reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483">
<p>
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a
file's origin URL in the user.xdg.origin.url metadata attribute
of the extended attributes of the downloaded file, which allows
local users to obtain sensitive information (e.g., credentials
contained in the URL) by reading this attribute, as demonstrated
by getfattr. This also applies to Referer information in the
user.xdg.referrer.url metadata attribute.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483</url>
<cvename>CVE-2018-20483</cvename>
</references>
<dates>
<discovery>2018-12-25</discovery>
<entry>2019-04-12</entry>
</dates>
</vuln>
<vuln vid="a0602fa0-5c1c-11e9-abd6-001b217b3468">
<topic>Gitlab -- Group Runner Registration Token Exposure</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.9.0</ge><lt>11.9.7</lt></range>
<range><ge>11.8.0</ge><lt>11.8.7</lt></range>
<range><ge>10.4.0</ge><lt>11.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/">
<p>Group Runner Registration Token Exposure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/</url>
<cvename>CVE-2019-11000</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-11</entry>
</dates>
</vuln>
<vuln vid="8e9c3f5a-715b-4336-8d05-19babef55e9e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.172</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.164.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-04-10/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1289</h5>
<p>Jenkins accepted cached legacy CLI authentication</p>
<h5>(Medium) SECURITY-1327</h5>
<p>XSS vulnerability in form validation button</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2019-04-10/</url>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-10</entry>
</dates>
</vuln>
<vuln vid="45d89773-5b64-11e9-80ed-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.171</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-19.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7096).</li>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2019-7108).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7096</cvename>
<cvename>CVE-2019-7108</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-19.html</url>
</references>
<dates>
<discovery>2019-04-09</discovery>
<entry>2019-04-10</entry>
</dates>
</vuln>
<vuln vid="84ce26c3-5769-11e9-abd6-001b217b3468">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.101.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav reports:</p>
<blockquote cite="https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html">
<p>An out-of-bounds heap read condition may occur when scanning PDF documents</p>
<p>An out-of-bounds heap read condition may occur when scanning PE files</p>
<p>An out-of-bounds heap write condition may occur when scanning OLE2 files</p>
<p>An out-of-bounds heap read condition may occur when scanning malformed PDF documents</p>
<p>A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives</p>
<p>A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html</url>
<cvename>CVE-2019-1787</cvename>
<cvename>CVE-2019-1789</cvename>
<cvename>CVE-2019-1788</cvename>
<cvename>CVE-2019-1786</cvename>
<cvename>CVE-2019-1785</cvename>
<cvename>CVE-2019-1798</cvename>
</references>
<dates>
<discovery>2019-03-29</discovery>
<entry>2019-04-05</entry>
</dates>
</vuln>
<vuln vid="da459dbc-5586-11e9-abd6-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.9.0</ge><lt>11.9.4</lt></range>
<range><ge>11.8.0</ge><lt>11.8.6</lt></range>
<range><lt>11.7.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/">
<p>DoS potential for regex in CI/CD refs</p>
<p>Related branches visible in issues for guests</p>
<p>Persistent XSS at merge request resolve conflicts</p>
<p>Improper authorization control "move issue"</p>
<p>Guest users of private projects have access to releases</p>
<p>DoS potential on project languages page</p>
<p>Recurity assessment: information exposure through timing discrepancy</p>
<p>Recurity assessment: loginState HMAC issues</p>
<p>Recurity assessment: open redirect</p>
<p>PDF.js vulnerable to CVE-2018-5158</p>
<p>IDOR labels of private projects/groups</p>
<p>EXIF geolocation data not stripped from uploaded images</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/</url>
<cvename>CVE-2019-10640</cvename>
<cvename>CVE-2019-10116</cvename>
<cvename>CVE-2019-10111</cvename>
<cvename>CVE-2019-10110</cvename>
<cvename>CVE-2019-10115</cvename>
<cvename>CVE-2019-10113</cvename>
<cvename>CVE-2019-10114</cvename>
<cvename>CVE-2019-10112</cvename>
<cvename>CVE-2019-10117</cvename>
<cvename>CVE-2018-5158</cvename>
<cvename>CVE-2019-10108</cvename>
<cvename>CVE-2019-10109</cvename>
</references>
<dates>
<discovery>2019-04-01</discovery>
<entry>2019-04-02</entry>
</dates>
</vuln>
<vuln vid="cf2105c6-551b-11e9-b95c-b499baebfeaf">
<topic>Apache -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd Project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>Apache HTTP Server privilege escalation from modules' scripts
(CVE-2019-0211) (important)</p>
<p>mod_auth_digest access control bypass (CVE-2019-0217)
(important)</p>
<p>mod_ssl access control bypass (CVE-2019-0215) (important)</p>
<p>mod_http2, possible crash on late upgrade (CVE-2019-0197) (low)</p>
<p>mod_http2, read-after-free on a string compare (CVE-2019-0196)
(low)</p>
<p>Apache httpd URL normalization inconsistincy (CVE-2019-0220)
(low)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.apache.org/dist/httpd/CHANGES_2.4.39</url>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2019-0211</cvename>
<cvename>CVE-2019-0217</cvename>
<cvename>CVE-2019-0215</cvename>
<cvename>CVE-2019-0196</cvename>
<cvename>CVE-2019-0220</cvename>
</references>
<dates>
<discovery>2019-04-01</discovery>
<entry>2019-04-02</entry>
</dates>
</vuln>
<vuln vid="6a0129bf-54ad-11e9-987c-1c39475b9f84">
<topic>Kubectl -- Potential directory traversal</topic>
<affects>
<package>
<name>kubectl</name>
<range><lt>1.11.9</lt></range>
<range><ge>1.12.0</ge><lt>1.12.7</lt></range>
<range><ge>1.13.0</ge><lt>1.13.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kubernetes.io reports:</p>
<blockquote cite="https://discuss.kubernetes.io/t/announce-security-release-of-kubernetes-kubectl-potential-directory-traversal-releases-1-11-9-1-12-7-1-13-5-and-1-14-0-cve-2019-1002101/5712">
<p>A security issue was discovered with the Kubernetes kubectl cp
command that could enable a directory traversal replacing or
deleting files on a user’s workstation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-1002101</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-1002101</url>
</references>
<dates>
<discovery>2019-03-28</discovery>
<entry>2019-04-01</entry>
</dates>
</vuln>
<vuln vid="b22d6d4c-53b9-11e9-9310-28d244aee256">
<topic>znc -- Denial of Service</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9917">
<p>ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial
of Service (crash) via invalid encoding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9917</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.3</url>
</references>
<dates>
<discovery>2019-03-21</discovery>
<entry>2019-03-31</entry>
</dates>
</vuln>
<vuln vid="fe7e322f-522d-11e9-98b5-216e512dad89">
<topic>Jupyter notebook -- open redirect vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<name>py37-notebook</name>
<range><lt>5.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jupyter blog:</p>
<blockquote cite="https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4">
<p>Login pages tend to take a parameter for redirecting back to a page
after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so
that you aren't disrupted too much if you try to visit a page, but have
to authenticate first. An Open Redirect Vulnerability is when a
malicious person crafts a link pointing to the login page of a trusted
site, but setting the "redirect after successful login" parameter to
send the user to their own site, instead of a page on the authenticated
site (the notebook or JupyterHub server), e.g.
/login?next=http://badwebsite.biz. This doesn't necessarily compromise
anything immediately, but it enables phishing if users don't notice
that the domain has changed, e.g. by showing a fake "re-enter your
password" page. Servers generally have to validate the redirect URL to
avoid this. Both JupyterHub and Notebook already do this, but the
validation didn't take into account all possible ways to redirect to
other sites, so some malicious URLs could still be crafted to redirect
away from the server (the above example does not work in any recent
version of either package). Only certain browsers (Chrome and Firefox,
not Safari) could be redirected from the JupyterHub login page, but all
browsers could be redirected away from a standalone notebook server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4</url>
<url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
<cvename>CVE-2019-10255</cvename>
</references>
<dates>
<discovery>2019-03-28</discovery>
<entry>2019-03-29</entry>
<modified>2019-04-06</modified>
</dates>
</vuln>
<vuln vid="7862213c-5152-11e9-8b26-a4badb296695">
<topic>dovecot -- Buffer overflow reading extension header</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524">
<p>Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.
Risk:
This can be used for local root privilege escalation or executing
arbitrary code in dovecot process context. This requires ability to
directly modify dovecot indexes.
Steps to reproduce:
Produce dovecot.index.log entry that creates an FTS header which has
more than 12 bytes of data.
Trigger dovecot indexer-worker or run doveadm index.
Dovecot will crash.
Mitigations:
Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR,
read-only GOT tables and other techniques that make exploiting this bug
much harder.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524</url>
<url>https://dovecot.org/list/dovecot-news/2019-March/000401.html</url>
<cvename>CVE-2019-7524</cvename>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-03-28</entry>
</dates>
</vuln>
<vuln vid="94d63fd7-508b-11e9-9ba0-4c72b94353b5">
<topic>drupal -- Drupal core - Moderately critical - Cross Site Scripting</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.65</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-004">
<p>Under certain circumstances the File module/subsystem allows a malicious
user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/project/drupal/releases/8.6.13</url>
<url>https://www.drupal.org/project/drupal/releases/7.65</url>
<url>https://www.drupal.org/SA-CORE-2019-004</url>
<cvename>CVE-2019-6341</cvename>
</references>
<dates>
<discovery>2019-03-20</discovery>
<entry>2019-03-27</entry>
<modified>2019-03-28</modified>
</dates>
</vuln>
<vuln vid="d74371d2-4fee-11e9-a5cd-1df8a848de3d">
<topic>Python -- NULL pointer dereference vulnerability</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.16</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.7</lt></range>
</package>
<package>
<name>python36</name>
<range><lt>3.6.8_1</lt></range>
</package>
<package>
<name>python37</name>
<range><lt>3.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python Changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html">
<p>bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html</url>
<url>https://bugs.python.org/issue35746</url>
<cvename>CVE-2019-5010</cvename>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-03-26</entry>
<modified>2019-03-27</modified>
</dates>
</vuln>
<vuln vid="15ee0e93-4bbb-11e9-9ba0-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.1.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/">
<p>Hosts can now offer a button for their users to update PHP.</p>
<p>The recommended PHP version used by the Update PHP notice can now be filtered.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-03-12</discovery>
<entry>2019-03-21</entry>
</dates>
</vuln>
<vuln vid="e0382fde-4bb0-11e9-adcb-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.8.0</ge><lt>11.8.3</lt></range>
<range><lt>11.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/">
<p>Project Runner Token Exposed Through Issues Quick Actions</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/</url>
<cvename>CVE-2019-9866</cvename>
</references>
<dates>
<discovery>2019-03-20</discovery>
<entry>2019-03-21</entry>
</dates>
</vuln>
<vuln vid="1b6a10e9-4b7b-11e9-9e89-54e1ad3d6335">
<topic>libXdmcp -- insufficient entropy generating session keys</topic>
<affects>
<package>
<name>libXdmcp</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop and x.org project reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-2625">
<p>It was discovered that libXdmcp before 1.1.3 used weak
entropy to generate session keys on platforms without
arc4random_buf() but with getentropy(). On a multi-user system using
xdmcp, a local attacker could potentially use information available
from the process list to brute force the key, allowing them to
hijack other users' sessions.</p>
<p>Please note, that since FreeBSD provides arc4random_buf(), it is
unknown if FreeBSD is affected by this vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-2625</url>
<url>https://lists.x.org/archives/xorg-announce/2019-March/002974.html</url>
<cvename>CVE-2017-2625</cvename>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2019-03-21</entry>
<modified>2019-03-22</modified>
</dates>
</vuln>
<vuln vid="7ba5a3d0-4b18-11e9-adcb-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><lt>11.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/">
<p>Public project in a private group makes the group page publicly accessible</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/</url>
<cvename>CVE-2019-9732</cvename>
</references>
<dates>
<discovery>2019-03-14</discovery>
<entry>2019-03-20</entry>
</dates>
</vuln>
<vuln vid="a8ba7358-4b02-11e9-9ba0-4c72b94353b5">
<topic>gitea -- XSS vulnerability</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/">
<p>Fix potential XSS vulnerability in repository description.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/</url>
</references>
<dates>
<discovery>2019-03-12</discovery>
<entry>2019-03-20</entry>
</dates>
</vuln>
<vuln vid="05da6b56-3e66-4306-9ea3-89fafe939726">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>66.0_3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/">
<p>CVE-2019-9790: Use-after-free when removing in-use DOM elements</p>
<p>CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey</p>
<p>CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script</p>
<p>CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled</p>
<p>CVE-2019-9794: Command line arguments not discarded during execution</p>
<p>CVE-2019-9795: Type-confusion in IonMonkey JIT compiler</p>
<p>CVE-2019-9796: Use-after-free with SMIL animation controller</p>
<p>CVE-2019-9797: Cross-origin theft of images with createImageBitmap</p>
<p>CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location</p>
<p>CVE-2019-9799: Information disclosure via IPC channel messages</p>
<p>CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content</p>
<p>CVE-2019-9802: Chrome process information leak</p>
<p>CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation</p>
<p>CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS</p>
<p>CVE-2019-9805: Potential use of uninitialized memory in Prio</p>
<p>CVE-2019-9806: Denial of service through successive FTP authorization prompts</p>
<p>CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages</p>
<p>CVE-2019-9809: Denial of service through FTP modal alert error messages</p>
<p>CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs</p>
<p>CVE-2019-9789: Memory safety bugs fixed in Firefox 66</p>
<p>CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9788</cvename>
<cvename>CVE-2019-9789</cvename>
<cvename>CVE-2019-9790</cvename>
<cvename>CVE-2019-9791</cvename>
<cvename>CVE-2019-9792</cvename>
<cvename>CVE-2019-9793</cvename>
<cvename>CVE-2019-9794</cvename>
<cvename>CVE-2019-9795</cvename>
<cvename>CVE-2019-9796</cvename>
<cvename>CVE-2019-9797</cvename>
<cvename>CVE-2019-9798</cvename>
<cvename>CVE-2019-9799</cvename>
<cvename>CVE-2019-9801</cvename>
<cvename>CVE-2019-9802</cvename>
<cvename>CVE-2019-9803</cvename>
<cvename>CVE-2019-9804</cvename>
<cvename>CVE-2019-9805</cvename>
<cvename>CVE-2019-9806</cvename>
<cvename>CVE-2019-9807</cvename>
<cvename>CVE-2019-9808</cvename>
<cvename>CVE-2019-9809</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-08/</url>
</references>
<dates>
<discovery>2019-03-19</discovery>
<entry>2019-03-19</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="6001cfc6-9f0f-4fae-9b4f-9b8fae001425">
<topic>PowerDNS -- Insufficient validation in the HTTP remote backend</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS developers report:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html">
<p>An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html</url>
<cvename>CVE-2019-3871</cvename>
</references>
<dates>
<discovery>2019-03-18</discovery>
<entry>2019-03-19</entry>
</dates>
</vuln>
<vuln vid="1396a74a-4997-11e9-b5f1-83edb3f89ba1">
<topic>Rails -- Action View vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionview4</name>
<range><lt>4.2.11.1</lt></range>
</package>
<package>
<name>rubygem-actionview50</name>
<range><lt>5.0.7.2</lt></range>
</package>
<package>
<name>rubygem-actionview5</name>
<range><lt>5.1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/">
<p>Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible:</p>
<p>CVE-2019-5418 File Content Disclosure in Action View</p>
<p>CVE-2019-5419 Denial of Service Vulnerability in Action View</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/</url>
<cvename>CVE-2019-5418</cvename>
<cvename>CVE-2019-5419</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-03-18</entry>
</dates>
</vuln>
<vuln vid="46e1ece5-48bd-11e9-9c40-080027ac955c">
<topic>PuTTY -- security fixes in new release</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.71</lt></range>
</package>
<package>
<name>putty-gtk2</name>
<range><lt>0.71</lt></range>
</package>
<package>
<name>putty-nogtk</name>
<range><lt>0.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PuTTY team reports:</p>
<blockquote cite="https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html">
<p>New in 0.71:</p>
<ul>
<li>Security fixes found by an EU-funded bug bounty programme:</li>
<li>+ a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification</li>
<li>+ potential recycling of random numbers used in cryptography</li>
<li>+ on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding</li>
<li>+ multiple denial-of-service attacks that can be triggered by writing to the terminal</li>
<li>Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels.</li>
<li>User interface changes to protect against fake authentication prompts from a malicious server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html</url>
</references>
<dates>
<discovery>2019-03-16</discovery>
<entry>2019-03-17</entry>
</dates>
</vuln>
<vuln vid="72a6e3be-483a-11e9-92d7-f1590402501e">
<topic>Jupyter notebook -- cross-site inclusion (XSSI) vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<name>py37-notebook</name>
<range><lt>5.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jupyter notebook Changelog:</p>
<blockquote cite="https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst">
<p>5.7.6 contains a security fix for a cross-site inclusion (XSSI)
vulnerability, where files at a known URL could be included in a page
from an unauthorized website if the user is logged into a Jupyter
server. The fix involves setting the X-Content-Type-Options: nosniff
header, and applying CSRF checks previously on all non-GET API requests
to GET requests to API endpoints and the /files/ endpoint.</p>
<p>The attacking page is able to access some contents of files when using
Internet Explorer through script errors, but this has not been
demonstrated with other browsers. A CVE has been requested for this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-auth-prompt-spoofing.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-fd-set-overflow.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars-double-width-gtk.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-one-column-cjk.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-unsanitised-server-output.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/side-channels.html</url>
</references>
<dates>
<discovery>2019-03-10</discovery>
<entry>2019-03-16</entry>
</dates>
</vuln>
<vuln vid="27b12d04-4722-11e9-8b7c-b5e01141761f">
<topic>RubyGems -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<name>ruby25-gems</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RubyGems Security Advisories:</p>
<blockquote cite="https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html">
<p>CVE-2019-8320: Delete directory using symlink when decompressing tar</p>
<p>CVE-2019-8321: Escape sequence injection vulnerability in 'verbose'</p>
<p>CVE-2019-8322: Escape sequence injection vulnerability in 'gem owner'</p>
<p>CVE-2019-8323: Escape sequence injection vulnerability in API response handling</p>
<p>CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution</p>
<p>CVE-2019-8325: Escape sequence injection vulnerability in errors</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html</url>
<url>https://github.com/rubygems/rubygems/blob/master/History.txt</url>
<cvename>CVE-2019-8320</cvename>
<cvename>CVE-2019-8321</cvename>
<cvename>CVE-2019-8322</cvename>
<cvename>CVE-2019-8323</cvename>
<cvename>CVE-2019-8324</cvename>
<cvename>CVE-2019-8325</cvename>
</references>
<dates>
<discovery>2019-03-05</discovery>
<entry>2019-03-15</entry>
</dates>
</vuln>
<vuln vid="e56f2f7c-410e-11e9-b95c-b499baebfeaf">
<topic>OpenSSL -- ChaCha20-Poly1305 nonce vulnerability</topic>
<affects>
<package>
<name>openssl111</name>
<range><lt>1.1.1b_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190306.txt">
<p>Low: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)</p>
<p>ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce
input for every encryption operation. RFC 7539 specifies that the nonce
value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce
length and front pads the nonce with 0 bytes if it is less than 12 bytes.
However it also incorrectly allows a nonce to be set of up to 16 bytes.
In this case only the last 12 bytes are significant and any additional
leading bytes are ignored.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190306.txt</url>
<cvename>CVE-2019-1543</cvename>
</references>
<dates>
<discovery>2019-03-06</discovery>
<entry>2019-03-07</entry>
</dates>
</vuln>
<vuln vid="c2576e14-36e2-11e9-9eda-206a8a720317">
<topic>ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p13</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_2</lt></range>
<range><ge>11.2</ge><lt>11.2_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#March_2019_ntp_4_2_8p13_NTP_Rele">
<p>A crafted malicious authenticated mode 6 (ntpq) packet from a
permitted network address can trigger a NULL pointer dereference,
crashing ntpd.</p>
<p>Note that for this attack to work, the sending
system must be on an address that the target's ntpd accepts mode 6
packets from, and must use a private key that is specifically
listed as being used for mode 6 authorization.</p>
<p>Impact: The ntpd daemon can crash due to the NULL pointer
dereference, causing a denial of service.</p>
<p>Mitigation:</p>
<ul>
<li>Use restrict noquery to limit addresses that can send mode 6
queries.</li>
<li>Limit access to the private controlkey in ntp.keys.</li>
<li>Upgrade to 4.2.8p13, or later.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.ntp.org/3565</url>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8936</url>
<url>https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:M/C:N/I:N/A:C)</url>
<url>https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H</url>
<cvename>CVE-2019-8936</cvename>
<freebsdsa>SA-19:04.ntp</freebsdsa>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-03-07</entry>
<modified>2019-07-30</modified>
</dates>
</vuln>
<vuln vid="d193aa9f-3f8c-11e9-9a24-6805ca0b38e8">
<topic>rssh - multiple vulnerabilities</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4">
<p>rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.</p>
<p>Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4</url>
<cvename>CVE-2019-1000018</cvename>
<cvename>CVE-2019-3463</cvename>
<cvename>CVE-2019-3464</cvename>
</references>
<dates>
<discovery>2019-02-04</discovery>
<entry>2019-03-06</entry>
</dates>
</vuln>
<vuln vid="416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42">
<topic>rt -- XSS via jQuery</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.16</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="https://docs.bestpractical.com/release-notes/rt/4.4.4">
<p>The version of jQuery used in RT 4.2 and 4.4 has a
Cross-site Scripting (XSS) vulnerability when using
cross-domain Ajax requests. This vulnerability is assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251">CVE-2015-9251</a>. RT
does not use this jQuery feature so it is not directly
vulnerable. jQuery version 1.12 no longer receives official
updates, however a fix was posted with recommendations for
applications to patch locally, so RT will follow this
recommendation and ship with a patched version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.bestpractical.com/release-notes/rt/4.4.4</url>
<url>https://docs.bestpractical.com/release-notes/rt/4.2.16</url>
<cvename>CVE-2015-9251</cvename>
</references>
<dates>
<discovery>2019-03-05</discovery>
<entry>2019-03-06</entry>
</dates>
</vuln>
<vuln vid="526d9642-3ae7-11e9-a669-8c164582fbac">
<topic>slixmpp -- improper access control</topic>
<affects>
<package>
<name>py35-slixmpp</name>
<name>py36-slixmpp</name>
<name>py37-slixmpp</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-1000021">
<p>slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416
contains an incorrect Access Control vulnerability in XEP-0223 plugin
(Persistent Storage of Private Data via PubSub) options profile, used
for the configuration of default access model that can result in
all of the contacts of the victim can see private data having been
published to a PEP node. This attack appears to be exploitable
if the user of this library publishes any private data on PEP,
the node isn't configured to be private. This vulnerability appears
to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416
which is included in slixmpp 1.4.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-1000021</url>
<cvename>CVE-2019-1000021</cvename>
</references>
<dates>
<discovery>2019-02-04</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="11292460-3f2f-11e9-adcb-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.8.0</ge><lt>11.8.1</lt></range>
<range><ge>11.7.0</ge><lt>11.7.6</lt></range>
<range><ge>2.9.0</ge><lt>11.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/">
<p>Arbitrary file read via MergeRequestDiff</p>
<p>CSRF add Kubernetes cluster integration</p>
<p>Blind SSRF in prometheus integration</p>
<p>Merge request information disclosure</p>
<p>IDOR milestone name information disclosure</p>
<p>Burndown chart information disclosure</p>
<p>Private merge request titles in public project information disclosure</p>
<p>Private namespace disclosure in email notification when issue is moved</p>
<p>Milestone name disclosure</p>
<p>Issue board name disclosure</p>
<p>NPM automatic package referencer</p>
<p>Path traversal snippet mover</p>
<p>Information disclosure repo existence</p>
<p>Issue DoS via Mermaid</p>
<p>Privilege escalation impersonate user</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/</url>
<cvename>CVE-2019-9221</cvename>
<cvename>CVE-2019-9176</cvename>
<cvename>CVE-2019-9174</cvename>
<cvename>CVE-2019-9172</cvename>
<cvename>CVE-2019-9170</cvename>
<cvename>CVE-2019-9175</cvename>
<cvename>CVE-2019-9178</cvename>
<cvename>CVE-2019-9179</cvename>
<cvename>CVE-2019-9171</cvename>
<cvename>CVE-2019-9224</cvename>
<cvename>CVE-2019-9225</cvename>
<cvename>CVE-2019-9219</cvename>
<cvename>CVE-2019-9217</cvename>
<cvename>CVE-2019-9222</cvename>
<cvename>CVE-2019-9223</cvename>
<cvename>CVE-2019-9220</cvename>
<cvename>CVE-2019-9485</cvename>
</references>
<dates>
<discovery>2019-03-04</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="a3e24de7-3f0c-11e9-87d1-00012e582166">
<topic>py-gunicorn -- CWE-113 vulnerability</topic>
<affects>
<package>
<name>py27-gunicorn</name>
<name>py35-gunicorn</name>
<name>py36-gunicorn</name>
<name>py37-gunicorn</name>
<range><lt>19.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Everardo reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000164">
<p>gunicorn version 19.4.5 contains a CWE-113: Improper
Neutralization of CRLF Sequences in HTTP Headers vulnerability
in process_headers function in gunicorn/http/wsgi.py
that can result in an attacker causing the server to
return arbitrary HTTP headers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000164</cvename>
<url>https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5</url>
</references>
<dates>
<discovery>2018-04-02</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="b71d7193-3c54-11e9-a3f9-00155d006b02">
<topic>Node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>11.10.1</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.15.2</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.15.1</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.17.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/">
<p>Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.</p>
<p>For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>OpenSSL: 0-byte record padding oracle (CVE-2019-1559)</h1>
<p>OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.</p>
<p>Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data.</p>
<p>Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/</url>
<cvename>CVE-2019-5737</cvename>
<cvename>CVE-2019-5739</cvename>
<cvename>CVE-2019-1559</cvename>
</references>
<dates>
<discovery>2019-02-28</discovery>
<entry>2019-03-03</entry>
</dates>
</vuln>
<vuln vid="395ed9d5-3cca-11e9-9ba0-4c72b94353b5">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/">
<p>Medium risk: Reset Password reflected XSS</p>
<p>Medium risk: ModCP Profile Editor username reflected XSS</p>
<p>Low risk: Predictable CSRF token for guest users</p>
<p>Low risk: ACP Stylesheet Properties XSS</p>
<p>Low risk: Reset Password username enumeration via email</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2019-02-27</discovery>
<entry>2019-03-02</entry>
<modified>2019-03-04</modified>
</dates>
</vuln>
<vuln vid="be0e3817-3bfe-11e9-9cd6-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability with SDP protocol violation</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.7.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk makes an outgoing call, a very specific
SDP protocol violation by the remote party can cause
Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-001.html</url>
<cvename>CVE-2019-7251</cvename>
</references>
<dates>
<discovery>2019-01-24</discovery>
<entry>2019-03-01</entry>
</dates>
</vuln>
<vuln vid="e3aacd6d-3d01-434c-9330-bc9efd40350f">
<topic>webkit-gtk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.22.6</lt></range>
</package>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webkitgtk project reports:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2019-0001.html">
<p>CVE-2019-6212 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6215 - Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</p>
<p>CVE-2019-6216 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6217 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6226 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6227 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
<p>CVE-2019-6229 - Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.</p>
<p>CVE-2019-6233 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
<p>CVE-2019-6234 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0001.html</url>
<cvename>CVE-2019-6212</cvename>
<cvename>CVE-2019-6215</cvename>
<cvename>CVE-2019-6216</cvename>
<cvename>CVE-2019-6217</cvename>
<cvename>CVE-2019-6226</cvename>
<cvename>CVE-2019-6227</cvename>
<cvename>CVE-2019-6229</cvename>
<cvename>CVE-2019-6233</cvename>
<cvename>CVE-2019-6234</cvename>
</references>
<dates>
<discovery>2019-02-08</discovery>
<entry>2019-02-24</entry>
</dates>
</vuln>
<vuln vid="3e2c9b63-223c-4575-af5c-816acb14e445">
<topic>rdesktop - critical - Remote Code Execution</topic>
<affects>
<package>
<name>rdesktop</name>
<range><lt>1.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4">
<ul>
<li>Fix memory corruption in process_bitmap_data - CVE-2018-8794
</li>
<li>Fix remote code execution in process_bitmap_data - CVE-2018-8795
</li>
<li>Fix remote code execution in process_plane - CVE-2018-8797
</li>
<li>Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
</li>
<li>Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
</li>
<li>Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
</li>
<li>Fix Denial of Service in sec_recv - CVE-2018-20176
</li>
<li>Fix minor information leak in rdpdr_process - CVE-2018-8791
</li>
<li>Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
</li>
<li>Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
</li>
<li>Fix Denial of Service in process_bitmap_data - CVE-2018-8796
</li>
<li>Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
</li>
<li>Fix Denial of Service in process_secondary_order - CVE-2018-8799
</li>
<li>Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
</li>
<li>Fix major information leak in ui_clip_handle_data - CVE-2018-20174
</li>
<li>Fix memory corruption in rdp_in_unistr - CVE-2018-20177
</li>
<li>Fix Denial of Service in process_demand_active - CVE-2018-20178
</li>
<li>Fix remote code execution in lspci_process - CVE-2018-20179
</li>
<li>Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
</li>
<li>Fix remote code execution in seamless_process - CVE-2018-20181
</li>
<li>Fix remote code execution in seamless_process_line - CVE-2018-20182
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4</url>
<cvename>CVE-2018-20175</cvename>
<cvename>CVE-2018-20176</cvename>
<cvename>CVE-2018-8791</cvename>
<cvename>CVE-2018-8792</cvename>
<cvename>CVE-2018-8793</cvename>
<cvename>CVE-2018-8794</cvename>
<cvename>CVE-2018-8795</cvename>
<cvename>CVE-2018-8796</cvename>
<cvename>CVE-2018-8797</cvename>
<cvename>CVE-2018-8798</cvename>
<cvename>CVE-2018-8799</cvename>
<cvename>CVE-2018-8800</cvename>
<cvename>CVE-2018-20174</cvename>
<cvename>CVE-2018-20177</cvename>
<cvename>CVE-2018-20178</cvename>
<cvename>CVE-2018-20179</cvename>
<cvename>CVE-2018-20180</cvename>
<cvename>CVE-2018-20181</cvename>
<cvename>CVE-2018-20182</cvename>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-02-22</entry>
</dates>
</vuln>
<vuln vid="002b4b05-35dd-11e9-94a8-000ffec0b3e1">
<topic>drupal -- Drupal core - Highly critical - Remote Code Execution</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-003">
<p>Some field types do not properly sanitize data from non-form sources.
This can lead to arbitrary PHP code execution in some cases..</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2019-002</url>
<cvename>CVE-2019-6340</cvename>
</references>
<dates>
<discovery>2019-02-20</discovery>
<entry>2019-02-21</entry>
</dates>
</vuln>
<vuln vid="7700061f-34f7-11e9-b95c-b499baebfeaf">
<topic>OpenSSL -- Padding oracle vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2r,1</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190226.txt">
<p>0-byte record padding oracle (CVE-2019-1559) (Moderate)<br/>
If an application encounters a fatal protocol error and then calls
SSL_shutdown() twice (once to send a close_notify, and once to receive
one) then OpenSSL can respond differently to the calling application if
a 0 byte record is received with invalid padding compared to if a 0 byte
record is received with an invalid MAC. If the application then behaves
differently based on that in a way that is detectable to the remote peer,
then this amounts to a padding oracle that could be used to decrypt data.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190226.txt</url>
<cvename>CVE-2019-1559</cvename>
</references>
<dates>
<discovery>2019-02-19</discovery>
<entry>2019-02-20</entry>
<modified>2019-03-07</modified>
</dates>
</vuln>
<vuln vid="f0416fb5-3130-11e9-a5ba-e0d55e883e26">
<topic>msmtp -- certificate-verification issue</topic>
<affects>
<package>
<name>msmtp</name>
<range><gt>1.8.1</gt><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>msmtp developers report:</p>
<blockquote cite="https://marlam.de/msmtp/news/msmtp-1-8-3/">
<p>In msmtp 1.8.2, when tls_trust_file has its default configuration,
certificate-verification results are not properly checked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://marlam.de/msmtp/news/msmtp-1-8-3/</url>
<cvename>CVE-2019-8337</cvename>
</references>
<dates>
<discovery>2019-02-11</discovery>
<entry>2019-02-15</entry>
</dates>
</vuln>
<vuln vid="18211552-f650-4d86-ba4f-e6d5cbfcdbeb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>65.0.1,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.5.1,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>60.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/">
<p>CVE-2018-18356: Use-after-free in Skia</p>
<p>CVE-2019-5785: Integer overflow in Skia</p>
<p>CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-18511</cvename>
<cvename>CVE-2018-18356</cvename>
<cvename>CVE-2019-5785</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/</url>
</references>
<dates>
<discovery>2019-02-13</discovery>
<entry>2019-02-13</entry>
</dates>
</vuln>
<vuln vid="de11a8fb-2eda-11e9-8fb5-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-06.html">
<ul>
<li>This update resolves an out-of-bounds vulnerability that
could lead to information disclosure (CVE-2019-7090).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7090</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-06.html</url>
</references>
<dates>
<discovery>2019-02-12</discovery>
<entry>2019-02-12</entry>
</dates>
</vuln>
<vuln vid="5efd7a93-2dfb-11e9-9549-e980e869c2e9">
<topic>OpenJPEG -- integer overflow</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.3.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5727">
<p>In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the
opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could
leverage this vulnerability to cause a denial of service via a crafted
bmp file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
<url>https://github.com/uclouvain/openjpeg/issues/1053</url>
<cvename>CVE-2018-5727</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2019-02-11</entry>
<modified>2019-03-29</modified>
</dates>
</vuln>
<vuln vid="86c89abf-2d91-11e9-bf3e-a4badb2f4699">
<topic>FreeBSD -- File description reference count leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>FreeBSD 12.0 attempts to handle the case where the
receiving process does not provide a sufficiently large
buffer for an incoming control message containing rights.
In particular, to avoid leaking the corresponding descriptors
into the receiving process' descriptor table, the kernel
handles the truncation case by closing descriptors referenced
by the discarded message.</p>
<p>The code which performs this operation failed to release
a reference obtained on the file corresponding to a received
right. This bug can be used to cause the reference counter
to wrap around and free the file structure.</p>
<h1>Impact:</h1>
<p>A local user can exploit the bug to gain root privileges
or escape from a jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5596</cvename>
<freebsdsa>SA-19:02.fd</freebsdsa>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-11</entry>
</dates>
</vuln>
<vuln vid="683c714d-2d91-11e9-bf3e-a4badb2f4699">
<topic>FreeBSD -- System call kernel data register leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The callee-save registers are used by kernel and for
some of them (%r8, %r10, and for non-PTI configurations,
%r9) the content is not sanitized before return from syscalls,
potentially leaking sensitive information.</p>
<h1>Impact:</h1>
<p>Typically an address of some kernel data structure used
in the syscall implementation, is exposed.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5595</cvename>
<freebsdsa>SA-19:01.syscall</freebsdsa>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-11</entry>
</dates>
</vuln>
<vuln vid="e8bcac84-2d5c-11e9-9a74-e0d55e2a8bf9">
<topic>kf5-kauth -- Insecure handling of arguments in helpers</topic>
<affects>
<package>
<name>kf5-kauth</name>
<range><lt>5.54.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20190209-1.txt">
<p>KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus.</p>
<p>Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20190209-1.txt</url>
<cvename>CVE-2019-7443</cvename>
</references>
<dates>
<discovery>2019-02-09</discovery>
<entry>2019-02-10</entry>
</dates>
</vuln>
<vuln vid="c95836a0-2b3b-11e9-9838-8c164567ca3c">
<topic>unit -- heap memory buffer overflow</topic>
<affects>
<package>
<name>unit</name>
<range><ge>0.3.0</ge><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>unit security problems:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/unit/2019-February/000112.html">
<p>CVE-2019-7401: a head memory buffer overflow might have</p>
<p>been caused in the router process by a specially crafted</p>
<p>request, potentially resulting in a segmentation fault</p>
<p>or other unspecified behavior.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/unit/2019-February/000112.html</url>
<cvename>CVE-2019-7401</cvename>
</references>
<dates>
<discovery>2019-02-07</discovery>
<entry>2019-02-08</entry>
</dates>
</vuln>
<vuln vid="714b033a-2b09-11e9-8bc3-610fd6e6cd05">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.64.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-16890: NTLM type-2 out-of-bounds buffer read</p>
<p>libcurl contains a heap buffer out-of-bounds read flaw.</p>
<p>The function handling incoming NTLM type-2 messages
(lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming
data correctly and is subject to an integer overflow vulnerability.</p>
<p>Using that overflow, a malicious or broken NTLM server could trick
libcurl to accept a bad length + offset combination that would lead to a
buffer read out-of-bounds.</p>
<p>CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow</p>
<p>libcurl contains a stack based buffer overflow vulnerability.</p>
<p>The function creating an outgoing NTLM type-3 header
(lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the
request HTTP header contents based on previously received data. The
check that exists to prevent the local buffer from getting overflowed is
implemented wrongly (using unsigned math) and as such it does not
prevent the overflow from happening.</p>
<p>This output data can grow larger than the local buffer if very large
"nt response" data is extracted from a previous NTLMv2 header provided
by the malicious or broken HTTP server.</p>
<p>Such a "large value" needs to be around 1000 bytes or more. The actual
payload data copied to the target buffer comes from the NTLMv2 type-2
response header.</p>
<p>CVE-2019-3823: SMTP end-of-response out-of-bounds read</p>
<p>libcurl contains a heap out-of-bounds read in the code handling the
end-of-response for SMTP.</p>
<p>If the buffer passed to smtp_endofresp() isn't NUL terminated and
contains no character ending the parsed number, and len is set to 5,
then the strtol() call reads beyond the allocated buffer. The read
contents will not be returned to the caller.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16890.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-3822.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-3823.html</url>
<cvename>CVE-2018-16890</cvename>
<cvename>CVE-2019-3822</cvename>
<cvename>CVE-2019-3823</cvename>
</references>
<dates>
<discovery>2019-02-07</discovery>
<entry>2019-02-07</entry>
</dates>
</vuln>
<vuln vid="43ee6c1d-29ee-11e9-82a1-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.7.0</ge><lt>11.7.4</lt></range>
<range><ge>11.6.0</ge><lt>11.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/">
<p>Leak of Confidential Issue and Merge Request Titles</p>
<p>Persistent XSS in User Status</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/</url>
<cvename>CVE-2019-7353</cvename>
<cvename>CVE-2019-6796</cvename>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-06</entry>
</dates>
</vuln>
<vuln vid="1340fcc1-2953-11e9-bc44-a4badb296695">
<topic>mail/dovecot -- Suitable client certificate can be used to login as other user</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi (Open-Xchange Oy) reports:</p>
<blockquote cite="https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html">
<p>Normally Dovecot is configured to authenticate
imap/pop3/managesieve/submission clients using regular username/password
combination. Some installations have also required clients to present a
trusted SSL certificate on top of that. It's also possible to configure
Dovecot to take the username from the certificate instead of from the
user provided authentication. It's also possible to avoid having a
password at all, only trusting the SSL certificate.
If the provided trusted SSL certificate is missing the username field,
Dovecot should be failing the authentication. However, the earlier
versions will take the username from the user provided authentication
fields (e.g. LOGIN command). If there is no additional password
verification, this allows the attacker to login as anyone else in the
system.
This affects only installations using:
auth_ssl_require_client_cert = yes
auth_ssl_username_from_cert = yes
Attacker must also have access to a valid trusted certificate without
the ssl_cert_username_field in it. The default is commonName, which
almost certainly exists in all certificates. This could happen for
example if ssl_cert_username_field is a field that normally doesn't
exist, and attacker has access to a web server's certificate (and key),
which is signed with the same CA.
Attack can be migitated by having the certificates with proper Extended
Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'.
Also, ssl_cert_username_field setting was ignored with external SMTP
AUTH, because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This does not
apply to Dovecot Submission service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html</url>
<cvename>CVE-2019-3814</cvename>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-02-05</entry>
</dates>
</vuln>
<vuln vid="5d8c0876-2716-11e9-9446-b7f8544ce15c">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8-php71</name>
<name>typo3-8-php72</name>
<name>typo3-8-php73</name>
<range><lt>8.7.24</lt></range>
</package>
<package>
<name>typo3-9-php71</name>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<range><lt>9.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 news:</p>
<blockquote cite="https://typo3.org/article/typo3-954-and-8723-security-releases-published/">
<p>Please read the corresponding Security Advisories for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-954-and-8723-security-releases-published/</url>
<url>https://typo3.org/article/typo3-v8724-lts-released/</url>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-02-02</entry>
</dates>
</vuln>
<vuln vid="41c1cd6f-2645-11e9-b5f1-080027fee39c">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
<p>Disable redirect for i18n</p>
<p>Only allow local login if password is non-empty</p>
<p>Fix go-get URL generation</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.7.1</url>
</references>
<dates>
<discovery>2019-01-31</discovery>
<entry>2019-02-01</entry>
</dates>
</vuln>
<vuln vid="22b90fe6-258e-11e9-9c8d-6805ca0b3d42">
<topic>p5-Email-Address-List -- DDoS related vulnerability</topic>
<affects>
<package>
<name>p5-Email-Address-List</name>
<range><lt>0.06</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best PRactical Solutions reports:</p>
<blockquote cite="https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes">
<pre>
0.06 2019-01-02
- Changes to address CVE-2018-18898 which could allow DDoS-type attacks.
Thanks to Lukas Kramer for reporting the issue and Alex Vandiver for
contributing fixes.
- Fix pathological backtracking for unkown regex
- Fix pathological backtracking in obs-phrase(i.e. obs-display-name)
- Fix pathological backtracking in cfws, quoted strings
</pre>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes</url>
<cvename>CVE-2018-18898</cvename>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-01-31</entry>
</dates>
</vuln>
<vuln vid="467b7cbe-257d-11e9-8573-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.7.0</ge><lt>11.7.3</lt></range>
<range><ge>11.6.0</ge><lt>11.6.8</lt></range>
<range><ge>0.0.0</ge><lt>11.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/">
<p>Remote Command Execution via GitLab Pages</p>
<p>Covert Redirect to Steal GitHub/Bitbucket Tokens</p>
<p>Remote Mirror Branches Leaked by Git Transfer Refs</p>
<p>Denial of Service with Markdown</p>
<p>Guests Can View List of Group Merge Requests</p>
<p>Guest Can View Merge Request Titles via System Notes</p>
<p>Persistent XSS via KaTeX</p>
<p>Emails Sent to Unauthorized Users</p>
<p>Hyperlink Injection in Notification Emails</p>
<p>Unauthorized Access to LFS Objects</p>
<p>Trigger Token Exposure</p>
<p>Upgrade Rails to 5.0.7.1 and 4.2.11</p>
<p>Contributed Project Information Visible in Private Profile</p>
<p>Imported Project Retains Prior Visibility Setting</p>
<p>Error disclosure on Project Import</p>
<p>Persistent XSS in User Status</p>
<p>Last Commit Status Leaked to Guest Users</p>
<p>Mitigations for IDN Homograph and RTLO Attacks</p>
<p>Access to Internal Wiki When External Wiki Enabled</p>
<p>User Can Comment on Locked Project Issues</p>
<p>Unauthorized Reaction Emojis by Guest Users</p>
<p>User Retains Project Role After Removal from Private Group</p>
<p>GitHub Token Leaked to Maintainers</p>
<p>Unauthenticated Blind SSRF in Jira Integration</p>
<p>Unauthorized Access to Group Membership</p>
<p>Validate SAML Response in Group SAML SSO</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/</url>
<cvename>CVE-2019-6783</cvename>
<cvename>CVE-2019-6788</cvename>
<cvename>CVE-2019-6785</cvename>
<cvename>CVE-2019-6790</cvename>
<cvename>CVE-2019-6997</cvename>
<cvename>CVE-2019-6784</cvename>
<cvename>CVE-2019-6789</cvename>
<cvename>CVE-2019-6781</cvename>
<cvename>CVE-2019-6786</cvename>
<cvename>CVE-2019-6787</cvename>
<cvename>CVE-2018-16476</cvename>
<cvename>CVE-2019-6782</cvename>
<cvename>CVE-2019-6791</cvename>
<cvename>CVE-2019-6792</cvename>
<cvename>CVE-2019-6796</cvename>
<cvename>CVE-2019-6794</cvename>
<cvename>CVE-2019-6795</cvename>
<cvename>CVE-2019-6960</cvename>
<cvename>CVE-2019-6995</cvename>
<cvename>CVE-2019-7176</cvename>
<cvename>CVE-2019-7155</cvename>
<cvename>CVE-2019-6797</cvename>
<cvename>CVE-2019-6793</cvename>
<cvename>CVE-2019-6996</cvename>
</references>
<dates>
<discovery>2019-01-31</discovery>
<entry>2019-01-31</entry>
</dates>
</vuln>
<vuln vid="181beef6-2482-11e9-b4a3-00155d006b02">
<topic>turnserver -- multiple vulnerabilities</topic>
<affects>
<package>
<name>turnserver</name>
<range><lt>4.5.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mihály Mészáros reports:</p>
<blockquote cite="https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog">
<p>We made 4.5.1.0 release public today that fixes many vulnerabilities.</p>
<p>It fix the following vulnerabilities:</p>
<ul>
<li>CVE-2018-4056</li>
<li>CVE-2018-4058</li>
<li>CVE-2018-4059</li>
</ul>
<p>They will be exposed very soon..</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog</url>
<url>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/0RuCzcQa0ew/ebZfNEDqBwAJ</url>
<cvename>CVE-2018-4056</cvename>
<cvename>CVE-2018-4058</cvename>
<cvename>CVE-2018-4059</cvename>
</references>
<dates>
<discovery>2019-01-28</discovery>
<entry>2019-01-30</entry>
</dates>
</vuln>
<vuln vid="b1f7d52f-fc42-48e8-8403-87d4c9d26229">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>65.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.5.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/">
<p>CVE-2018-18500: Use-after-free parsing HTML5 stream</p>
<p>CVE-2018-18503: Memory corruption with Audio Buffer</p>
<p>CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer</p>
<p>CVE-2018-18505: Privilege escalation through IPC channel messages</p>
<p>CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied</p>
<p>CVE-2018-18502: Memory safety bugs fixed in Firefox 65</p>
<p>CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-18500</cvename>
<cvename>CVE-2018-18501</cvename>
<cvename>CVE-2018-18502</cvename>
<cvename>CVE-2018-18503</cvename>
<cvename>CVE-2018-18504</cvename>
<cvename>CVE-2018-18505</cvename>
<cvename>CVE-2018-18506</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/</url>
</references>
<dates>
<discovery>2019-01-29</discovery>
<entry>2019-01-29</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="40d92cc5-1e2b-11e9-bef6-6805ca2fa271">
<topic>powerdns-recursor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are
not properly applied to queries received over TCP in some specific combination of
settings, possibly bypassing security policies enforced using Lua.
When the recursor is configured to run with more than one thread (threads=X) and to
do the distribution of incoming queries to the worker threads itself
(pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread
handling incoming TCP queries, causing the Lua hooks to not be properly applied.</p>
<p>CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the
answer section of responses received from authoritative servers with the AA flag not
set were not properly validated, allowing an attacker to bypass DNSSEC validation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2019-3806</cvename>
<cvename>CVE-2019-3807</cvename>
</references>
<dates>
<discovery>2019-01-21</discovery>
<entry>2019-01-22</entry>
</dates>
</vuln>
<vuln vid="d3d02d3a-2242-11e9-b95c-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.38</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.38</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.22</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.13</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.43</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.25</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.14</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.43</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
<p>Not all listed CVE's are present in all versions/flavors</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL</url>
<cvename>CVE-2019-2534</cvename>
<cvename>CVE-2019-2533</cvename>
<cvename>CVE-2019-2529</cvename>
<cvename>CVE-2019-2482</cvename>
<cvename>CVE-2019-2434</cvename>
<cvename>CVE-2019-2455</cvename>
<cvename>CVE-2019-2503</cvename>
<cvename>CVE-2019-2436</cvename>
<cvename>CVE-2019-2536</cvename>
<cvename>CVE-2019-2502</cvename>
<cvename>CVE-2019-2510</cvename>
<cvename>CVE-2019-2539</cvename>
<cvename>CVE-2019-2494</cvename>
<cvename>CVE-2019-2495</cvename>
<cvename>CVE-2019-2537</cvename>
<cvename>CVE-2019-2420</cvename>
<cvename>CVE-2019-2481</cvename>
<cvename>CVE-2019-2507</cvename>
<cvename>CVE-2019-2530</cvename>
<cvename>CVE-2019-2528</cvename>
<cvename>CVE-2019-2531</cvename>
<cvename>CVE-2019-2486</cvename>
<cvename>CVE-2019-2532</cvename>
<cvename>CVE-2019-2535</cvename>
<cvename>CVE-2019-2513</cvename>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="d8e7e854-17fa-11e9-bef6-6805ca2fa271">
<topic>botan2 -- Side channel during ECC key generation</topic>
<affects>
<package>
<name>botan2</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>botan2 developers reports:</p>
<blockquote cite="https://botan.randombit.net/security.html#id1">
<p>A timing side channel during ECC key generation could leak information about the
high bits of the secret scalar. Such information allows an attacker to perform a
brute force attack on the key somewhat more efficiently than they would otherwise.
Found by Ján Jančár using ECTester.</p>
<p>Bug introduced in 1.11.20, fixed in 2.9.0</p>
</blockquote>
</body>
</description>
<references>
<url>https://botan.randombit.net/security.html#id1</url>
<cvename>CVE-2018-20187</cvename>
</references>
<dates>
<discovery>2018-12-17</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="111aefca-2213-11e9-9c8d-6805ca0b3d42">
<topic>phpMyAdmin -- File disclosure and SQL injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-1/">
<h3>Summary</h3>
<p>Arbitrary file read vulnerability</p>
<h3>Description</h3>
<p>When <code>AllowArbitraryServer</code> configuration set
to <code>true</code>, with the use of a rogue MySQL server,
an attacker can read any file on the server that the web
server's user can access.</p>
<p>phpMyadmin attempts to block the use of <code>LOAD DATA
INFILE</code>, but due to a <a href="https://bugs.php.net/bug.php?id=77496">bug in PHP</a>,
this check is not honored. Additionally, when using the
'mysql' extension, <a href="http://php.net/manual/en/mysql.configuration.php#ini.mysql.allow-local-infile">mysql.allow_local_infile</a>
is enabled by default. Both of these conditions allow the
attack to occur.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
<h3>Mitigation factor</h3>
<p>This attack can be mitigated by setting the
`AllowArbitraryServer` configuration directive to false
(which is the default value).</p>
<h3>Affected Versions</h3>
<p>phpMyAdmin versions from at least 4.0 through 4.8.4 are
affected</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-2/">
<h3>Summary</h3>
<p>SQL injection in Designer feature</p>
<h3>Description</h3>
<p>A vulnerability was reported where a specially crafted
username can be used to trigger an SQL injection attack
through the designer feature.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be serious.</p>
<h3>Affected Versions</h3>
<p>phpMyAdmin versions from 4.5.0 through 4.8.4 are affected</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2019-1/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2019-2/</url>
</references>
<dates>
<discovery>2019-01-21</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="7f6146aa-2157-11e9-9ba0-4c72b94353b5">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
<p>Do not display the raw OpenID error in the UI</p>
<p>When redirecting clean the path to avoid redirecting to external site</p>
<p>Prevent DeleteFilePost doing arbitrary deletion</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.7.0</url>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-01-26</entry>
</dates>
</vuln>
<vuln vid="8e48365a-214d-11e9-9f8a-0050562a4d7b">
<topic>libzmq4 -- Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>libzmq4</name>
<range><ge>4.2.0</ge><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.1">
<p>A vulnerability has been found that would allow attackers to direct a peer to
jump to and execute from an address indicated by the attacker.
This issue has been present since v4.2.0. Older releases are not affected.
NOTE: The attacker needs to know in advance valid addresses in the peer's
memory to jump to, so measures like ASLR are effective mitigations.
NOTE: this attack can only take place after authentication, so peers behind
CURVE/GSSAPI are not vulnerable to unauthenticated attackers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-6250</cvename>
<url>https://github.com/zeromq/libzmq/issues/3351</url>
<url>https://github.com/zeromq/libzmq/pull/3353</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-6250</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250</url>
</references>
<dates>
<discovery>2019-01-08</discovery>
<entry>2019-01-26</entry>
</dates>
</vuln>
<vuln vid="eb888ce5-1f19-11e9-be05-4c72b94353b5">
<topic>Apache -- vulnerability</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd Project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>SECURITY: CVE-2018-17199
mod_session: mod_session_cookie does not respect expiry time allowing
sessions to be reused.</p>
<p>SECURITY: CVE-2019-0190
mod_ssl: Fix infinite loop triggered by a client-initiated
renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and
later. PR 63052.</p>
<p>SECURITY: CVE-2018-17189
mod_http2: fixes a DoS attack vector. By sending slow request bodies
to resources not consuming them, httpd cleanup code occupies a server
thread unnecessarily. This was changed to an immediate stream reset
which discards all stream state and incoming data.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4.38</url>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-17199</cvename>
<cvename>CVE-2018-17189</cvename>
<cvename>CVE-2019-0190</cvename>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-01-23</entry>
</dates>
</vuln>
<vuln vid="4af3241d-1f0c-11e9-b4bd-d43d7eed0ce2">
<topic>www/mod_dav_svn -- Malicious SVN clients can crash mod_dav_svn.</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.10.0</ge><lt>1.10.3</lt></range>
<range><eq>1.11.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2018-11803-advisory.txt">
<p>Malicious SVN clients can trigger a crash in mod_dav_svn by omitting
the root path from a recursive directory listing request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2018-11803-advisory.txt</url>
</references>
<dates>
<discovery>2019-01-23</discovery>
<entry>2019-01-23</entry>
</dates>
</vuln>
<vuln vid="50ad9a9a-1e28-11e9-98d7-0050562a4d7b">
<topic>www/py-requests -- Information disclosure vulnerability</topic>
<affects>
<package>
<name>py27-requests</name>
<name>py35-requests</name>
<name>py36-requests</name>
<name>py37-requests</name>
<range><lt>2.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074">
<p>The Requests package before 2.20.0 for Python sends an HTTP Authorization header
to an http URI upon receiving a same-hostname https-to-http redirect, which makes
it easier for remote attackers to discover credentials by sniffing the network.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-18074</url>
<url>https://github.com/requests/requests/issues/4716</url>
<url>https://github.com/requests/requests/pull/4718</url>
<url>https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff</url>
</references>
<dates>
<discovery>2018-06-27</discovery>
<entry>2019-01-22</entry>
<modified>2019-01-27</modified>
</dates>
</vuln>
<vuln vid="6aa398d0-1c4d-11e9-96dd-a4badb296695">
<topic>joomla3 -- vulnerabilitiesw</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports:</p>
<blockquote cite="https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html">
<p>Inadequate escaping in mod_banners leads to a stored XSS vulnerability.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html">
<p>Inadequate escaping in com_contact leads to a stored XSS vulnerability</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html">
<p>Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html">
<p>Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html</url>
<cvename>CVE-2019-6264</cvename>
<url>https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html</url>
<cvename>CVE-2019-6261</cvename>
<url>https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html</url>
<cvename>CVE-2019-6263</cvename>
<url>https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html</url>
<cvename>CVE-2019-6262</cvename>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2019-01-20</entry>
</dates>
</vuln>
<vuln vid="e00ed3d9-1c27-11e9-a257-000ffec0b3e1">
<topic>drupal -- Drupal core - Arbitrary PHP code execution</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.63</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2019-002">
<p>A remote code execution vulnerability exists in PHP's built-in
phar stream wrapper when performing file operations on an untrusted phar:// URI.</p>
<p>Some Drupal code (core, contrib, and custom) may be performing file operations on
insufficiently validated user input, thereby being exposed to this vulnerability.</p>
<p>This vulnerability is mitigated by the fact that such code paths typically require
access to an administrative permission or an atypical configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-006</url>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-19</entry>
</dates>
</vuln>
<vuln vid="2a8b79c3-1b6e-11e9-8cf4-1c39475b9f84">
<topic>Helm -- client unpacking chart that contains malicious content</topic>
<affects>
<package>
<name>helm</name>
<range><ge>2.0.0</ge><lt>2.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Helm security notice</p>
<blockquote cite="https://helm.sh/blog/helm-security-notice-2019/index.html">
<p>A specially crafted chart may be able to unpack content into locations on
the filesystem outside of the chart's path, potentially
overwriting existing files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://helm.sh/blog/helm-security-notice-2019/index.html</url>
</references>
<dates>
<discovery>2019-01-14</discovery>
<entry>2019-01-18</entry>
</dates>
</vuln>
<vuln vid="ff50192c-19eb-11e9-8573-001b217b3468">
<topic>Gitlab -- Arbitrary repo read in Gitlab project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.6.0</ge><lt>11.6.4</lt></range>
<range><ge>11.5.0</ge><lt>11.5.7</lt></range>
<range><ge>8.9.0</ge><lt>11.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/">
<p>Arbitrary repo read in Gitlab project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/</url>
<cvename>CVE-2019-6240</cvename>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-17</entry>
</dates>
</vuln>
<vuln vid="debf6353-5753-4e9a-b710-a83ecdd743de">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.160</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.150.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-01-16/">
<h1>Description</h1>
<h5>(High) SECURITY-868</h5>
<p>Administrators could persist access to Jenkins using crafted 'Remember me' cookie</p>
<h5>(Medium) SECURITY-901</h5>
<p>Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2019-01-16/</url>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-16</entry>
</dates>
</vuln>
<vuln vid="383931ba-1818-11e9-92ea-448a5b29e8a9">
<topic>py-matrix-synapse -- undisclosed vulnerability</topic>
<affects>
<package>
<name>py27-matrix-synapse</name>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>0.34.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/">
<p>The matrix team announces the availablility of synapse security releases 0.34.0.1 and 0.34.1.1, fixing CVE-2019-5885.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-5885</cvename>
<url>https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/</url>
</references>
<dates>
<discovery>2019-01-10</discovery>
<entry>2019-01-15</entry>
</dates>
</vuln>
<vuln vid="d38bbb79-14f3-11e9-9ce2-28d244aee256">
<topic>irssi -- Use after free</topic>
<affects>
<package>
<name>irssi</name>
<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2019_01.txt">
<p>Use after free when hidden lines were expired from the scroll
buffer. It may affect the stability of Irssi. (CWE-417, CWE-825)</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2019_01.txt</url>
<cvename>CVE-2019-5882</cvename>
<freebsdpr>ports/234798</freebsdpr>
</references>
<dates>
<discovery>2019-01-09</discovery>
<entry>2019-01-10</entry>
</dates>
</vuln>
<vuln vid="924bd4f8-11e7-11e9-9fe8-5404a68ad561">
<topic>uriparser -- Out-of-bounds read</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog">
<p>Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6
addresses with embedded IPv4 address, e.g. "//[::44.1";
mitigated if passed parameter afterLast points to readable memory
containing a '\0' byte.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog</url>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-01-06</entry>
</dates>
</vuln>
<vuln vid="63e36475-119f-11e9-aba7-080027fee39c">
<topic>gitea -- insufficient privilege check</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2019/01/release-of-1.6.3/">
<p>Security</p>
<ul>
<li>Prevent DeleteFilePost doing arbitrary deletion</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/5631</url>
</references>
<dates>
<discovery>2019-01-04</discovery>
<entry>2019-01-06</entry>
</dates>
</vuln>
<vuln vid="720590df-10eb-11e9-b407-080027ef1a23">
<topic>chromium -- Use after free in PDFium</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>71.0.3578.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html">
<p>1 security fix contributed by external researches:</p>
<ul>
<li>High CVE-2018-17481: Use after free in PDFium</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17481</cvename>
<url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2018-12-12</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>71.0.3578.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">
<p>43 security fixes in this release, including:</p>
<ul>
<li>High CVE-2018-17480: Out of bounds write in V8</li>
<li>High CVE-2018-17481: Use after free in PDFium</li>
<li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
<li>High CVE-2018-18336: Use after free in PDFium</li>
<li>High CVE-2018-18337: Use after free in Blink</li>
<li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
<li>High CVE-2018-18339: Use after free in WebAudio</li>
<li>High CVE-2018-18340: Use after free in MediaRecorder</li>
<li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
<li>High CVE-2018-18342: Out of bounds write in V8</li>
<li>High CVE-2018-18343: Use after free in Skia</li>
<li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
<li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
<li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
<li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
<li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
<li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
<li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
<li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
<li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
<li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
<li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
<li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
<li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
<li>Medium CVE-2018-18356: Use after free in Skia</li>
<li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
<li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
<li>Medium CVE-2018-18359: Out of bounds read in V8</li>
<li>Low To be allocated: Inappropriate implementation in PDFium</li>
<li>Low To be allocated: Use after free in Extensions</li>
<li>Low To be allocated: Inappropriate implementation in Navigation</li>
<li>Low To be allocated: Inappropriate implementation in Navigation</li>
<li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
<li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
<li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
<li>Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17480</cvename>
<cvename>CVE-2018-17481</cvename>
<cvename>CVE-2018-18335</cvename>
<cvename>CVE-2018-18336</cvename>
<cvename>CVE-2018-18337</cvename>
<cvename>CVE-2018-18338</cvename>
<cvename>CVE-2018-18339</cvename>
<cvename>CVE-2018-18340</cvename>
<cvename>CVE-2018-18341</cvename>
<cvename>CVE-2018-18342</cvename>
<cvename>CVE-2018-18343</cvename>
<cvename>CVE-2018-18344</cvename>
<cvename>CVE-2018-18345</cvename>
<cvename>CVE-2018-18346</cvename>
<cvename>CVE-2018-18347</cvename>
<cvename>CVE-2018-18348</cvename>
<cvename>CVE-2018-18349</cvename>
<cvename>CVE-2018-18350</cvename>
<cvename>CVE-2018-18351</cvename>
<cvename>CVE-2018-18352</cvename>
<cvename>CVE-2018-18353</cvename>
<cvename>CVE-2018-18354</cvename>
<cvename>CVE-2018-18355</cvename>
<cvename>CVE-2018-18356</cvename>
<cvename>CVE-2018-18357</cvename>
<cvename>CVE-2018-18358</cvename>
<cvename>CVE-2018-18359</cvename>
<url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-12-04</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
<topic>Django -- Content spoofing possibility in the default 404 page</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.18</lt></range>
</package>
<package>
<name>py35-django20</name>
<name>py36-django20</name>
<name>py37-django20</name>
<range><lt>2.0.10</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Django security releases issued reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jan/04/security-releases/">
<p>An attacker could craft a malicious URL that could make spoofed content
appear on the default page generated by the django.views.defaults.page_not_found()
view.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-3498</cvename>
<url>https://www.djangoproject.com/weblog/2019/jan/04/security-releases/</url>
</references>
<dates>
<discovery>2019-01-03</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="b2f4ab91-0e6b-11e9-8700-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.6.0</ge><lt>11.6.1</lt></range>
<range><ge>11.5.0</ge><lt>11.5.6</lt></range>
<range><ge>8.0.0</ge><lt>11.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/">
<p>Source code disclosure merge request diff</p>
<p>Todos improper access control</p>
<p>URL rel attribute not set</p>
<p>Persistent XSS Autocompletion</p>
<p>SSRF repository mirroring</p>
<p>CI job token LFS error message disclosure</p>
<p>Secret CI variable exposure</p>
<p>Guest user CI job disclosure</p>
<p>Persistent XSS label reference</p>
<p>Persistent XSS wiki in IE browser</p>
<p>SSRF in project imports with LFS</p>
<p>Improper access control CI/CD settings</p>
<p>Missing authorization control merge requests</p>
<p>Improper access control branches and tags</p>
<p>Missing authentication for Prometheus alert endpoint</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/</url>
<cvename>CVE-2018-20493</cvename>
<cvename>CVE-2018-20492</cvename>
<cvename>CVE-2018-20489</cvename>
<cvename>CVE-2018-20490</cvename>
<cvename>CVE-2018-20497</cvename>
<cvename>CVE-2018-20495</cvename>
<cvename>CVE-2018-20488</cvename>
<cvename>CVE-2018-20494</cvename>
<cvename>CVE-2018-20496</cvename>
<cvename>CVE-2018-20491</cvename>
<cvename>CVE-2018-20499</cvename>
<cvename>CVE-2018-20500</cvename>
<cvename>CVE-2018-20501</cvename>
<cvename>CVE-2018-20498</cvename>
<cvename>CVE-2018-20507</cvename>
</references>
<dates>
<discovery>2018-12-31</discovery>
<entry>2019-01-02</entry>
</dates>
</vuln>
<vuln vid="29d34524-0542-11e9-a444-080027fee39c">
<topic>gitea -- privilege escalation, XSS</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.6.2">
<p>Security</p>
<ul>
<li>Sanitize uploaded file names</li>
<li>HTMLEncode user added text</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/5569</url>
<url>https://github.com/go-gitea/gitea/issues/5565</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-21</entry>
</dates>
</vuln>
<vuln vid="f8fe2905-0918-11e9-a550-00262d164c21">
<topic>rpm4 -- regression in -setperms, -setugids and -restore</topic>
<affects>
<package>
<name>rpm4</name>
<range><lt>4.14.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rpm4 reports:</p>
<blockquote cite="http://rpm.org/wiki/Releases/4.14.2.1">
<p>Regression in -setperms, -setugids and -restore</p>
<p>Note that this update can not automatically fix possible damage
done by using -setperms, -setugids or -restore with rpm 4.14.2, it
merely fixes the functionlity itself. Any damage needs to be
investigated and fixed manually, such as using -verify and -restore
or reinstalling packages.</p>
</blockquote>
</body>
</description>
<references>
<url>http://rpm.org/wiki/Releases/4.14.2.1</url>
</references>
<dates>
<discovery>2018-10-22</discovery>
<entry>2018-12-26</entry>
</dates>
</vuln>
<vuln vid="70b774a8-05bc-11e9-87ad-001b217b3468">
<topic>Gitlab -- Arbitrary File read in Gitlab project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.5</lt></range>
<range><ge>11.4.0</ge><lt>11.4.12</lt></range>
<range><ge>8.9.0</ge><lt>11.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released">
<p>Arbitrary File read in Gitlab project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</url>
<cvename>CVE-2018-20229</cvename>
</references>
<dates>
<discovery>2018-12-20</discovery>
<entry>2018-12-22</entry>
</dates>
</vuln>
<vuln vid="4f8665d0-0465-11e9-b77a-6cc21735f730">
<topic>shibboleth-sp -- crashes on malformed date/time content</topic>
<affects>
<package>
<name>shibboleth-sp</name>
<range><ge>3.0.0</ge><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Shibboleth Consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20181219a.txt">
<p>SAML messages, assertions, and metadata all commonly contain
date/time information in a standard XML format.</p>
<p>Invalid formatted data in such fields cause an exception of a type
that was not handled properly in the V3 software and causes a crash
(usually to the shibd daemon process, but possibly to Apache in rare
cases). Note that the crash occurs prior to evaluation of a message's
authenticity, so can be exploited by an untrusted attacker.</p>
<p>The problem is believed to be specific to the V3 software and would
not cause a crash in the older, now unsupported, V2 software.</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20181219a.txt</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="1999a215-fc6b-11e8-8a95-ac1f6b67e138">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.3.0,2</lt></range>
</package>
<package>
<name>couchdb2</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/...">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-17188.html</url>
<cvename>CVE-2018-17188</cvename>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-13</entry>
</dates>
</vuln>
<vuln vid="b80f039d-579e-4b82-95ad-b534a709f220">
<topic>bro -- "Magellan" remote code execution vulnerability in bundled sqlite</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bro Network security Monitor reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.6.1 updates the embedded SQLite to version 3.26.0
to address the "Magellan" remote code execution vulnerability.
The stock Bro configuration/scripts don't use SQLite by
default, but custom user scripts/packages may.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="fa6a4a69-03d1-11e9-be12-a4badb2f4699">
<topic>FreeBSD -- bootpd buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_1</lt></range>
<range><ge>11.2</ge><lt>11.2_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of network-provided data
it may be possible for a malicious attacker to craft a bootp
packet which could cause a stack buffer overflow.</p>
<h1>Impact:</h1>
<p>It is possible that the buffer overflow could lead to a
Denial of Service or remote code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:15.bootpd</freebsdsa>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-19</entry>
</dates>
</vuln>
<vuln vid="4b98613c-0078-11e9-b05b-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.0.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/">
<p>WordPress versions 5.0 and earlier are affected by the following bugs, which are
fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are
also available, for users who have not yet updated to 5.0.</p>
<p>Karim El Ouerghemmi discovered that authors could alter meta data to delete files
that they weren’t authorized to.</p>
<p>Simon Scannell of RIPS Technologies discovered that authors could create posts of
unauthorized post types with specially crafted input.</p>
<p>Sam Thomas discovered that contributors could craft meta data in a way that resulted
in PHP object injection.</p>
<p>Tim Coen discovered that contributors could edit new comments from higher-privileged
users, potentially leading to a cross-site scripting vulnerability.</p>
<p>Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site
scripting vulnerability in some circumstances. WordPress itself was not affected,
but plugins could be in some situations.</p>
<p>Team Yoast discovered that the user activation screen could be indexed by search
engines in some uncommon configurations, leading to exposure of email addresses,
and in some rare cases, default generated passwords.</p>
<p>Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload
specifically crafted files that bypass MIME verification, leading to a cross-site
scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/</url>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-15</entry>
</dates>
</vuln>
<vuln vid="293f40a0-ffa1-11e8-b258-0011d823eebd">
<topic>Mbed TLS -- Local timing attack on RSA decryption</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03">
<p>An attacker who can run code on the same machine that is
performing an RSA decryption can potentially recover the plaintext
through a Bleichenbacher-like oracle.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03</url>
<cvename>CVE-2018-19608</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="bab29816-ff93-11e8-b05b-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8</name>
<range><lt>8.7.21</lt></range>
</package>
<package>
<name>typo3-9</name>
<range><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/">
<p>CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr.
The vulnerability stemmed from the fact that it was possible to execute XSS inside
the CKEditor source area after persuading the victim to: (i) switch CKEditor to
source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker,
into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.</p>
<p>Failing to properly encode user input, online media asset rendering
(*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user
account or write access on the server system (e.g. SFTP) is needed in order to exploit this
vulnerability.</p>
<p>Failing to properly encode user input, notifications shown in modal windows in the TYPO3
backend are vulnerable to cross-site scripting. A valid backend user account is needed in
order to exploit this vulnerability.</p>
<p>Failing to properly encode user input, login status display is vulnerable to cross-site
scripting in the website frontend. A valid user account is needed in order to exploit this
vulnerability - either a backend user or a frontend user having the possibility to modify
their user profile.</p>
<p>Template patterns that are affected are:</p>
<ul>
<li>###FEUSER_[fieldName]### using system extension felogin</li>
<li><!--###USERNAME###--> for regular frontend rendering
(pattern can be defined individually using TypoScript setting
config.USERNAME_substToken)</li>
</ul>
<p>It has been discovered that cookies created in the Install Tool are not hardened to be
submitted only via HTTP. In combination with other vulnerabilities such as cross-site
scripting it can lead to hijacking an active and valid session in the Install Tool.</p>
<p>The Install Tool exposes the current TYPO3 version number to non-authenticated users.</p>
<p>Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable
to denial of service. Putting large files with according file extensions results in high
consumption of system resources. This can lead to exceeding limits of the current PHP process
which results in a dysfunctional backend component. A valid backend user account or write
access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.</p>
<p>TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs
URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous
user sessions are valid, attackers can use this vulnerability in order to create an arbitrary
amount of individual session-data records in the database.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="757e6ee8-ff91-11e8-a148-001b217b3468">
<topic>Gitlab -- Arbitrary File read in GitLab project import with Git LFS</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.4</lt></range>
<range><ge>11.4.0</ge><lt>11.4.11</lt></range>
<range><ge>11.0.0</ge><lt>11.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/">
<p>Arbitrary File read in GitLab project import with Git LFS</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</url>
<cvename>CVE-2018-20144</cvename>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="ed10ed3f-fddc-11e8-94cf-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-6/">
<h3>Summary</h3>
<p>Local file inclusion through transformation feature</p>
<h3>Description</h3>
<p>A flaw has been found where an attacker can exploit
phpMyAdmin to leak the contents of a local file. The
attacker must have access to the phpMyAdmin Configuration
Storage tables, although these can easily be created in any
database to which the attacker has access. An attacker must
have valid credentials to log in to phpMyAdmin; this
vulnerability does not allow an attacker to circumvent the
login system.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be severe.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-7/">
<h3>Summary</h3>
<p>XSRF/CSRF vulnerability in phpMyAdmin</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful SQL operations such as renaming
databases, creating new tables/routines, deleting designer
pages, adding/deleting users, updating user passwords,
killing SQL processes, etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-8/">
<h3>Summary</h3>
<p>XSS vulnerability in navigation tree</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
navigation tree, where an attacker can deliver a payload to
a user through a specially-crafted database/table name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>The stored XSS vulnerabilities can be triggered only by
someone who logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required forms.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-6/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-7/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-8/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-12</entry>
</dates>
</vuln>
<vuln vid="d10b49b2-8d02-49e8-afde-0844626317af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>64.0_3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/">
<p>CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module</p>
<p>CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11</p>
<p>CVE-2018-18492: Use-after-free with select element</p>
<p>CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia</p>
<p>CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs</p>
<p>CVE-2018-18495: WebExtension content scripts can be loaded in about: pages</p>
<p>CVE-2018-18496: Embedded feed preview page can be abused for clickjacking</p>
<p>CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators</p>
<p>CVE-2018-18498: Integer overflow when calculating buffer sizes for images</p>
<p>CVE-2018-12406: Memory safety bugs fixed in Firefox 64</p>
<p>CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12405</cvename>
<cvename>CVE-2018-12406</cvename>
<cvename>CVE-2018-12407</cvename>
<cvename>CVE-2018-17466</cvename>
<cvename>CVE-2018-18492</cvename>
<cvename>CVE-2018-18493</cvename>
<cvename>CVE-2018-18494</cvename>
<cvename>CVE-2018-18495</cvename>
<cvename>CVE-2018-18496</cvename>
<cvename>CVE-2018-18497</cvename>
<cvename>CVE-2018-18498</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-11</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="32498c8f-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Insufficient bounds checking in bhyve(8) device model</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient bounds checking in one of the device models
provided by bhyve(8) can permit a guest operating system
to overwrite memory in the bhyve(8) processing possibly
permitting arbitary code execution.</p>
<h1>Impact:</h1>
<p>A guest OS using a firmware image can cause the bhyve
process to crash, or possibly execute arbitrary code on the
host as root.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:14.bhyve</freebsdsa>
</references>
<dates>
<discovery>2018-12-04</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="268a4289-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Multiple vulnerabilities in NFS server code</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient and improper checking in the NFS server
code could cause a denial of service or possibly remote
code execution via a specially crafted network packet.</p>
<h1>Impact:</h1>
<p>A remote attacker could cause the NFS server to crash,
resulting in a denial of service, or possibly execute
arbitrary code on the server.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1715</cvename>
<freebsdsa>SA-18:13.nfs</freebsdsa>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="2a86f45a-fc3c-11e8-a414-00155d006b02">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.15.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.14.0</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.14.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>11.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/">
<p>Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>Debugger port 5858 listens on any interface by default (CVE-2018-12120)</h1>
<p>All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with <code>node --debug</code> or <code>node debug</code>, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as <code>node --debug=localhost</code>. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.</p>
<h1>Denial of Service with large HTTP headers (CVE-2018-12121)</h1>
<p>All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.</p>
<h1>"Slowloris" HTTP Denial of Service (CVE-2018-12122)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with <code>server.headersTimeout</code>. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with <code>server.setTimeout()</code>, this aids in protecting against excessive resource retention and possible Denial of Service.</p>
<h1>Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using <code>url.parse()</code> to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.</p>
<h1>HTTP request splitting (CVE-2018-12116)</h1>
<p>Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the <code>path</code> option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.</p>
<h1>OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)</h1>
<p>The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)</h1>
<p>The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)</h1>
<p>OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/</url>
<cvename>CVE-2018-12120</cvename>
<cvename>CVE-2018-12121</cvename>
<cvename>CVE-2018-12122</cvename>
<cvename>CVE-2018-12123</cvename>
<cvename>CVE-2018-12116</cvename>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="f6d6308a-f2ec-11e8-b005-6805ca2fa271">
<topic>powerdns-recursor -- Crafted query can cause a denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-16855</cvename>
</references>
<dates>
<discovery>2018-11-26</discovery>
<entry>2018-12-09</entry>
</dates>
</vuln>
<vuln vid="0e8f496a-b498-11e8-bdcf-74d435e60b7c">
<topic>py-asyncssh -- Allows bypass of authentication</topic>
<affects>
<package>
<name>py-asyncssh</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre.org Reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749">
<p>The SSH server implementation of AsyncSSH before 1.12.1 does not properly check
whether authentication is completed before processing other requests
A customized SSH client can simply skip the authentication step.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-12-08</entry>
</dates>
</vuln>
<vuln vid="9d3428d4-f98c-11e8-a148-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.3</lt></range>
<range><ge>11.4.0</ge><lt>11.4.10</lt></range>
<range><ge>8.11.0</ge><lt>11.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released">
<p>Directory Traversal in Templates API</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</url>
<cvename>CVE-2018-19856</cvename>
</references>
<dates>
<discovery>2018-12-06</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="49cbe200-f92a-11e8-a89d-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2018-15982).</li>
<li>This update resolves an insecure library loading vulnerability that
could lead to privilege escalation (CVE-2018-15983).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15982</cvename>
<cvename>CVE-2018-15983</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-42.html</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="3aa27226-f86f-11e8-a085-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.154</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-12-05/">
<h1>Description</h1>
<h5>(Critical) SECURITY-595</h5>
<p>Code execution through crafted URLs</p>
<h5>(Medium) SECURITY-904</h5>
<p>Forced migration of user records</p>
<h5>(Medium) SECURITY-1072</h5>
<p>Workspace browser allowed accessing files outside the workspace</p>
<h5>(Medium) SECURITY-1193</h5>
<p>Potential denial of service through cron expression form validation</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-12-05/</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-05</entry>
</dates>
</vuln>
<vuln vid="889e35f4-f6a0-11e8-82dc-fcaa147e860e">
<topic>moodle -- Login CSRF vulnerability</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.15</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.9</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.6</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=378731">
<p>The login form is not protected by a token to prevent login cross-site
request forgery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16854</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=378731</url>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-12-03</entry>
</dates>
</vuln>
<vuln vid="f96044a2-7df9-414b-9f6b-6e5b85d06c86">
<topic>Rails -- Active Job vulnerability</topic>
<affects>
<package>
<name>rubygem-activejob4</name>
<range><lt>4.2.11</lt></range>
</package>
<package>
<name>rubygem-activejob5</name>
<range><lt>5.1.6.1</lt></range>
</package>
<package>
<name>rubygem-activejob50</name>
<range><lt>5.0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/">
<p>Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
contain the following important security fixes, and it is recommended
that users upgrade as soon as possible</p>
<p>CVE-2018-16476 Broken Access Control vulnerability in Active Job:
Carefully crafted user input can cause Active Job to deserialize it
using GlobalId and allow an attacker to have access to information that
they should not have.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/</url>
<cvename>CVE-2018-16476</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="3563fae5-f60c-11e8-b513-5404a68ad561">
<topic>uriparser -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog">
<p>* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
Commit 864f5d4c127def386dd5cc926ad96934b297f04e
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
Commit f76275d4a91b28d687250525d3a0c5509bbd666f
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Protect uriResetUri* against acting on NULL input
Commit f58c25069cf4a986fe17a80c5b38687e31feb539</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19198</cvename>
<cvename>CVE-2018-19199</cvename>
<cvename>CVE-2018-19200</cvename>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog</url>
</references>
<dates>
<discovery>2018-10-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9">
<topic>messagelib -- HTML email can open browser window automatically</topic>
<affects>
<package>
<name>messagelib</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181128-1.txt">
<p>messagelib is the library used by KMail to display emails.</p>
<p>messagelib by default displays emails as plain text, but gives the user
an option to "Prefer HTML to plain text" in the settings and if that option
is not enabled there is way to enable HTML display when an email contains HTML.</p>
<p>Some HTML emails can trick messagelib into opening a new browser window when
displaying said email as HTML.</p>
<p>This happens even if the option to allow the HTML emails to access
remote servers is disabled in KMail settings.</p>
<p>This means that the owners of the servers referred in the email can see
in their access logs your IP address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19516</cvename>
<url>https://www.kde.org/info/security/advisory-20181128-1.txt</url>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="93f8e0ff-f33d-11e8-be46-0019dbb15b3f">
<topic>payara -- Default typing issue in Jackson Databind</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.181.3</eq></range>
<range><eq>4.1.2.182</eq></range>
<range><eq>5.181.3</eq></range>
<range><eq>5.182</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489">
<p>FasterXML jackson-databind before 2.8.11.1 and 2.9.x before
2.9.5 allows unauthenticated remote code execution because of
an incomplete fix for the CVE-2017-7525 deserialization flaw.
This is exploitable by sending maliciously crafted JSON input
to the readValue method of the ObjectMapper, bypassing a
blacklist that is ineffective if the c3p0 libraries are
available in the classpath.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489</url>
<cvename>CVE-2018-7489</cvename>
</references>
<dates>
<discovery>2018-02-26</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="22bc5327-f33f-11e8-be46-0019dbb15b3f">
<topic>payara -- Code execution via crafted PUT requests to JSPs</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.174</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">
<p>When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP
PUTs enabled (e.g. via setting the readonly initialisation
parameter of the Default to false) it was possible to upload a
JSP file to the server via a specially crafted request. This
JSP could then be requested and any code it contained would be
executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615</url>
<cvename>CVE-2017-12615</cvename>
</references>
<dates>
<discovery>2017-08-07</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="d70c9e18-f340-11e8-be46-0019dbb15b3f">
<topic>payara -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.173</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031">
<p>Apache Commons FileUpload before 1.3.3
DiskFileItem File Manipulation Remote Code Execution.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Administration).
Supported versions that are affected are 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows low privileged attacker
with logon to the infrastructure where Oracle GlassFish Server
executes to compromise Oracle GlassFish Server. Successful
attacks of this vulnerability can result in unauthorized read
access to a subset of Oracle GlassFish Server accessible data.
CVSS v3.0 Base Score 3.3 (Confidentiality impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Core). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via SMTP to compromise Oracle GlassFish Server. Successful
attacks require human interaction from a person other than the
attacker. Successful attacks of this vulnerability can result in
unauthorized update, insert or delete access to some of Oracle
GlassFish Server accessible data. CVSS v3.0 Base Score 4.3
(Integrity impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Security). Supported
versions that are affected are 2.1.1, 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows unauthenticated attacker
with network access via LDAP to compromise Oracle GlassFish Server.
Successful attacks of this vulnerability can result in unauthorized
update, insert or delete access to some of Oracle GlassFish Server
accessible data as well as unauthorized read access to a subset of
Oracle GlassFish Server accessible data and unauthorized ability
to cause a partial denial of service (partial DOS) of Oracle
GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality,
Integrity and Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via HTTP to compromise Oracle GlassFish Server. Successful attacks
of this vulnerability can result in unauthorized update, insert or
delete access to some of Oracle GlassFish Server accessible data as
well as unauthorized read access to a subset of Oracle GlassFish
Server accessible data and unauthorized ability to cause a partial
denial of service (partial DOS) of Oracle GlassFish Server.
CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit
vulnerability allows unauthenticated attacker with network access
via multiple protocols to compromise Oracle GlassFish Server. While
the vulnerability is in Oracle GlassFish Server, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle GlassFish Server.
CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031</url>
<cvename>CVE-2016-1000031</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239</url>
<cvename>CVE-2017-3239</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247</url>
<cvename>CVE-2017-3247</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249</url>
<cvename>CVE-2017-3249</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250</url>
<cvename>CVE-2017-3250</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528</url>
<cvename>CVE-2016-5528</cvename>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="8a4aba2d-f33e-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.1</lt></range>
<range><ge>11.4.0</ge><lt>11.4.8</lt></range>
<range><ge>0</ge><lt>11.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released">
<p>View Names of Private Groups</p>
<p>Persistent XSS in Environments</p>
<p>SSRF in Prometheus integration</p>
<p>Unauthorized Promotion of Milestones</p>
<p>Exposure of Confidential Issue Title</p>
<p>Persisent XSS in Markdown Fields via Mermaid Script</p>
<p>Persistent XSS in Markdown Fields via Unrecognized HTML Tags</p>
<p>Symlink Race Condition in Pages</p>
<p>Unauthorized Changes by Guest User in Issues</p>
<p>Unauthorized Comments on Locked Issues</p>
<p>Improper Enforcement of Token Scope</p>
<p>CRLF Injection in Project Mirroring</p>
<p>XSS in OAuth Authorization</p>
<p>SSRF in Webhooks</p>
<p>Send Email on Email Address Change</p>
<p>Workhorse Logs Contained Tokens</p>
<p>Unauthorized Publishing of Draft Comments</p>
<p>Guest Can Set Weight of a New Issue</p>
<p>Disclosure of Private Group's Members and Milestones</p>
<p>Persisent XSS in Operations</p>
<p>Reporter Can View Operations Page</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</url>
<cvename>CVE-2018-19494</cvename>
<cvename>CVE-2018-19493</cvename>
<cvename>CVE-2018-19495</cvename>
<cvename>CVE-2018-19496</cvename>
<cvename>CVE-2018-19577</cvename>
<cvename>CVE-2018-19573</cvename>
<cvename>CVE-2018-19570</cvename>
<cvename>CVE-2018-19572</cvename>
<cvename>CVE-2018-19576</cvename>
<cvename>CVE-2018-19575</cvename>
<cvename>CVE-2018-19569</cvename>
<cvename>CVE-2018-19585</cvename>
<cvename>CVE-2018-19574</cvename>
<cvename>CVE-2018-19571</cvename>
<cvename>CVE-2018-19580</cvename>
<cvename>CVE-2018-19583</cvename>
<cvename>CVE-2018-19582</cvename>
<cvename>CVE-2018-19581</cvename>
<cvename>CVE-2018-19584</cvename>
<cvename>CVE-2018-19579</cvename>
<cvename>CVE-2018-19578</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="54976998-f248-11e8-81e2-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><le>4.6.16</le></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.12</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>samba49</name>
<range><lt>4.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-14629.html">
<p>All versions of Samba from 4.0.0 onwards are vulnerable to infinite
query recursion caused by CNAME loops. Any dns record can be added via
ldap by an unprivileged user using the ldbadd tool, so this is a
security issue.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16841.html">
<p>When configured to accept smart-card authentication, Samba's KDC will call
talloc_free() twice on the same memory if the principal in a validly signed
certificate does not match the principal in the AS-REQ.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16851.html">
<p>During the processing of an LDAP search before Samba's AD DC returns
the LDAP entries to the client, the entries are cached in a single
memory object with a maximum size of 256MB. When this size is
reached, the Samba process providing the LDAP service will follow the
NULL pointer, terminating the process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16852.html">
<p>During the processing of an DNS zone in the DNS management DCE/RPC server,
the internal DNS server or the Samba DLZ plugin for BIND9, if the
DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS
property is set, the server will follow a NULL pointer and terminate</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16853.html">
<p>A user in a Samba AD domain can crash the KDC when Samba is built in the
non-default MIT Kerberos configuration.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16857.html">
<p>AD DC Configurations watching for bad passwords (to restrict brute forcing
of passwords) in a window of more than 3 minutes may not watch for bad
passwords at all.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-14629.html</url>
<cvename>CVE-2018-14629</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16841.html</url>
<cvename>CVE-2018-16841</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16851.html</url>
<cvename>CVE-2018-16851</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16852.html</url>
<cvename>CVE-2018-16852</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16853.html</url>
<cvename>CVE-2018-16853</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16857.html</url>
<cvename>CVE-2018-16857</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="ec49f6b5-ee39-11e8-b2f4-74d435b63d51">
<topic>php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter</topic>
<affects>
<package>
<name>php56-imap</name>
<range><lt>5.6.38_1</lt></range>
</package>
<package>
<name>php70-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php71-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php72-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php73-imap</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP team reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=77153">
<p>imap_open allows to run arbitrary shell commands via mailbox parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=77153</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-22</entry>
<modified>2018-11-22</modified>
</dates>
</vuln>
<vuln vid="b036faba-edd8-11e8-b3b7-00e04c1ea73d">
<topic>phpmailer -- Multiple vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.27</lt></range>
</package>
<package>
<name>phpmailer6</name>
<range><lt>6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6">
<p>CVE-2018-19296:Fix potential object injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27</url>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6</url>
<cvename>CVE-2018-19296</cvename>
</references>
<dates>
<discovery>2018-11-16</discovery>
<entry>2018-11-21</entry>
<modified>2018-11-23</modified>
</dates>
</vuln>
<vuln vid="8f128c72-ecf9-11e8-aa00-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-44.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-15981).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15981</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-44.html</url>
</references>
<dates>
<discovery>2018-11-20</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="d889d32c-ecd9-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.6</lt></range>
<range><ge>8.9.0</ge><lt>11.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/">
<p>Persistent XSS Autocompletion</p>
<p>Unauthorized service template creation</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</url>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-19359</cvename>
</references>
<dates>
<discovery>2018-11-19</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="0aee2f13-ec1d-11e8-8c92-6805ca2fa271">
<topic>powerdns -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing
an authorized user to cause a memory leak by inserting a specially crafted record
in a zone under their control, then sending a DNS query for that record. The issue
is due to the fact that some memory is allocated before the parsing and is not
always properly released if the record is malformed. When the PowerDNS
Authoritative Server is run inside the guardian (--guardian), or inside a
supervisor like supervisord or systemd, an out-of-memory crash will lead to an
automatic restart, limiting the impact to a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing
a remote user to craft a DNS query that will cause an answer without DNSSEC
records to be inserted into the packet cache and be returned to clients asking for
DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname
and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients
will consider the answer to be bogus until it expires from the packet cache,
leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-19</entry>
</dates>
</vuln>
<vuln vid="e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d">
<topic>powerdns-recursor -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.7</lt></range>
</package>
<package>
<name>powerdns-recursor40</name>
<range><lt>4.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing
a malicious authoritative server to cause a memory leak by sending specially
crafted records. The issue is due to the fact that some memory is allocated
before the parsing and is not always properly released if the record is malformed.
When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd,
an out-of-memory crash will lead to an automatic restart, limiting the impact to
a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote
user to craft a DNS query that will cause an answer without DNSSEC records to be
inserted into the packet cache and be returned to clients asking for DNSSEC
records, thus hiding the presence of DNSSEC signatures for a specific qname and
qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC
validation by themselves might consider the answer to be bogus until it expires
from the packet cache, leading to a denial of service.</p>
<p>CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker
sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached
as failing DNSSEC validation. It only arises if the parent zone is signed, and all
the authoritative servers for that parent zone answer with FORMERR to a query for at
least one of the meta-types. As a result, subsequent queries from clients requesting
DNSSEC validation will be answered with a ServFail.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
<cvename>CVE-2018-14644</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-17</entry>
<modified>2018-11-19</modified>
</dates>
</vuln>
<vuln vid="c6fb2734-e835-11e8-b14b-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a buffer overflow vulnerability in dns_srv
and dns_naptr functions of Asterisk that allows an attacker
to crash Asterisk via a specially crafted DNS SRV or NAPTR
response. The attackers request causes Asterisk to segfault
and crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-010.html</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-14</entry>
</dates>
</vuln>
<vuln vid="b69292e8-e798-11e8-ae07-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.148</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html">
<ul>
<li>This update resolves a out-of-bounds vulnerability that
could lead to information disclosure (CVE-2018-15978).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15978</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-39.html</url>
</references>
<dates>
<discovery>2018-11-13</discovery>
<entry>2018-11-13</entry>
</dates>
</vuln>
<vuln vid="6f170cf2-e6b7-11e8-a9a8-b499baebfeaf">
<topic>OpenSSL -- timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2p_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181112.txt">
<p>Microarchitecture timing vulnerability in ECC scalar
multiplication. Severity: Low<br/>
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing
attacks during ECDSA signature generation could recover the private
key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181112.txt</url>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="1460aa25-e6ab-11e8-a733-e0d55e2a8bf9">
<topic>kio-extras -- HTML Thumbnailer automatic remote file access</topic>
<affects>
<package>
<name>kio-extras</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181012-1.txt">
<p>Various KDE applications share a plugin system to create thumbnails
of various file types for displaying in file managers, file dialogs, etc.
kio-extras contains a thumbnailer plugin for HTML files.
</p>
<p>
The HTML thumbnailer was incorrectly accessing some content of
remote URLs listed in HTML files. This meant that the owners of the servers
referred in HTML files in your system could have seen in their access logs
your IP address every time the thumbnailer tried to create the thumbnail.
</p>
<p>
The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
because it was actually not creating thumbnails for files at all.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19120</cvename>
<url>https://www.kde.org/info/security/advisory-20181012-1.txt</url>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="791841a3-d484-4878-8909-92ef9ce424f4">
<topic>patch -- multiple vulnerabilities</topic>
<affects>
<package>
<name>patch</name>
<range><lt>2.7.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6951">
<p>An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6952">
<p>A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000156">
<p>GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6951</cvename>
<cvename>CVE-2018-6952</cvename>
<cvename>CVE-2018-1000156</cvename>
<url>https://savannah.gnu.org/bugs/?53132</url>
<url>https://savannah.gnu.org/bugs/?53133</url>
<url>https://savannah.gnu.org/bugs/?53566</url>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-11-11</entry>
<modified>2018-11-11</modified>
</dates>
</vuln>
<vuln vid="92a6efd0-e40d-11e8-ada4-408d5cf35399">
<topic>lighttpd - use-after-free vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="https://www.lighttpd.net/2018/10/14/1.4.51/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: process headers after combining folded headers</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.lighttpd.net/2018/10/14/1.4.51/</url>
<freebsdpr>ports/232278</freebsdpr>
</references>
<dates>
<discovery>2018-08-26</discovery>
<entry>2018-11-09</entry>
</dates>
</vuln>
<vuln vid="1c27a706-e3aa-11e8-b77a-6cc21735f730">
<topic>PostgreSQL -- SQL injection in pg_upgrade and pg_dump</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.15</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-16850: SQL injection in pg_upgrade and pg_dump,
via CREATE TRIGGER ... REFERENCING.</p>
<p>Using a purpose-crafted trigger definition, an attacker can run
arbitrary SQL statements with superuser privileges when a superuser
runs pg_upgrade on the database or during a pg_dump dump/restore
cycle. This attack requires a CREATE privilege on some non-temporary
schema or a TRIGGER privilege on a table. This is exploitable in the
default PostgreSQL configuration, where all users have CREATE
privilege on public schema.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1905/</url>
<cvename>CVE-2018-16850</cvename>
</references>
<dates>
<discovery>2018-11-08</discovery>
<entry>2018-11-08</entry>
</dates>
</vuln>
<vuln vid="84ca56be-e1de-11e8-bcfd-00e04c1ea73d">
<topic>NGINX -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.14.1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Two security issues were identified in nginx HTTP/2 implementation,
which might cause excessive memory consumption (CVE-2018-16843)
and CPU usage (CVE-2018-16844).</p>
<p>The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the "http2" option of the "listen" directive is
used in a configuration file.</p>
<p>A security issue was identified in the ngx_http_mp4_module, which might
allow an attacker to cause infinite loop in a worker process, cause a
worker process crash, or might result in worker process memory
isclosure by using a specially crafted mp4 file (CVE-2018-16845).</p>
<p>The issue only affects nginx if it is built with the ngx_http_mp4_module
(the module is not built by default) and the "mp4" directive is used in
the configuration file. Further, the attack is only possible if an
attacker is able to trigger processing of a specially crafted mp4 file
with the ngx_http_mp4_module. </p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.org/en/security_advisories.html</url>
<cvename>CVE-2018-16843</cvename>
<cvename>CVE-2018-16844</cvename>
<cvename>CVE-2018-16845</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-06</entry>
</dates>
</vuln>
<vuln vid="deb4f633-de1d-11e8-a9fb-080027f43a02">
<topic>gitea -- remote code exeution</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/10/gitea-1.5.3-is-released/">
<p>[This release] contains crit[i]cal security fix for vulnerability
that could potentially allow for authorized users to do remote code
ex[e]cution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/5177</url>
<url>https://github.com/go-gitea/gitea/pull/5196</url>
<url>https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14</url>
</references>
<dates>
<discovery>2018-10-25</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="e0ab1773-07c1-46c6-9170-4c5e81c00927">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.14.1</ge><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-16839: SASL password overflow via integer overflow</p>
<p>libcurl contains a buffer overrun in the SASL authentication code.</p>
<p>The internal function Curl_auth_create_plain_message fails to
correctly verify that the passed in lengths for name and password
aren't too long, then calculates a buffer size to allocate.</p>
<p>On systems with a 32 bit size_t, the math to calculate the buffer size
triggers an integer overflow when the user name length exceeds 2GB
(2^31 bytes). This integer overflow usually causes a very small buffer
to actually get allocated instead of the intended very huge one, making
the use of that buffer end up in a heap buffer overflow.</p>
<p>This bug is very similar to CVE-2017-14618.</p>
<p>It affects curl 7.33.0 to 7.61.1.</p>
<p>CVE-2018-16840: use-after-free in handle close</p>
<p>libcurl contains a heap use-after-free flaw in code related to closing
an easy handle.</p>
<p>When closing and cleaning up an "easy" handle in the Curl_close()
function, the library code first frees a struct (without nulling the
pointer) and might then subsequently erroneously write to a struct
field within that already freed struct.</p>
<p>It affects curl 7.59.0 to 7.61.1.</p>
<p>CVE-2018-16842: warning message out-of-buffer read</p>
<p>curl contains a heap out of buffer read vulnerability.</p>
<p>The command line tool has a generic function for displaying warning
and informational messages to stderr for various situations. For
example if an unknown command line argument is used, or passed to it in
a "config" file.</p>
<p>This display function formats the output to wrap at 80 columns. The
wrap logic is however flawed, so if a single word in the message is
itself longer than 80 bytes the buffer arithmetic calculates the
remainder wrong and will end up reading behind the end of the buffer.
This could lead to information disclosure or crash.</p>
<p>This vulnerability could lead to a security issue if used in this or
similar situations:</p>
<p>1. a server somewhere uses the curl command line to run something</p>
<p>2. if it fails, it shows stderr to the user</p>
<p>3. the server takes user input for parts of its command line input</p>
<p>4. user provides something overly long that triggers this crash</p>
<p>5. the stderr output may now contain user memory contents that wasn't
meant to be available</p>
<p>It affects curl 7.14.1 to 7.61.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16839.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16840.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16842.html</url>
<cvename>CVE-2018-16839</cvename>
<cvename>CVE-2018-16840</cvename>
<cvename>CVE-2018-16842</cvename>
</references>
<dates>
<discovery>2018-10-31</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b51d9e83-de08-11e8-9416-001b217b3468">
<topic>Gitlab -- SSRF in Kubernetes integration</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.4</lt></range>
<range><ge>11.3.0</ge><lt>11.3.9</lt></range>
<range><ge>11.0.0</ge><lt>11.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/">
<p>SSRF in Kubernetes integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</url>
<cvename>CVE-2018-18843</cvename>
</references>
<dates>
<discovery>2018-11-01</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/154">
<p>This issue has been created for public disclosure of an XSS
vulnerability that was responsibly reported (independently) by Shubham
Pathak and @yasinS (Yasin Soliman).</p>
<p>In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/154</url>
<cvename>CVE-2018-16468</cvename>
</references>
<dates>
<discovery>2018-10-30</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b9591212-dba7-11e8-9416-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.3</lt></range>
<range><ge>11.3.0</ge><lt>11.3.8</lt></range>
<range><ge>5.3.0</ge><lt>11.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/">
<p>RCE in Gitlab Wiki API</p>
<p>SSRF in Hipchat integration</p>
<p>Cleartext storage of personal access tokens</p>
<p>Information exposure through stack trace error message</p>
<p>Persistent XSS autocomplete</p>
<p>Information exposure in stored browser history</p>
<p>Information exposure when replying to issues through email</p>
<p>Persistent XSS in License Management and Security Reports</p>
<p>Metrics information disclosure in Prometheus integration</p>
<p>Unauthorized changes to a protected branch's access levels</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</url>
<cvename>CVE-2018-18649</cvename>
<cvename>CVE-2018-18646</cvename>
<cvename>CVE-2018-18641</cvename>
<cvename>CVE-2018-18648</cvename>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-18640</cvename>
<cvename>CVE-2018-18645</cvename>
<cvename>CVE-2018-18642</cvename>
<cvename>CVE-2018-18644</cvename>
<cvename>CVE-2018-18647</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
</dates>
</vuln>
<vuln vid="238ae7de-dba2-11e8-b713-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities in 1.1 branch</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0i_1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1_2</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181029.txt">
<p>Timing vulnerability in ECDSA signature generation
(CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
shown to be vulnerable to a timing side channel attack. An
attacker could use variations in the signing algorithm to
recover the private key (Low).</p>
<p>Timing vulnerability in DSA signature generation (CVE-2018-0734):
Avoid a timing attack that leaks information via a side channel
that triggers when a BN is resized. Increasing the size of the
BNs prior to doing anything with them suppresses the attack (Low).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181029.txt</url>
<url>https://github.com/openssl/openssl/commit/8abfe72e</url>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
<modified>2018-11-10</modified>
</dates>
</vuln>
<vuln vid="fa194483-dabd-11e8-bf39-5404a68ad561">
<topic>liveMedia -- potential remote code execution</topic>
<affects>
<package>
<name>liveMedia</name>
<range><lt>2018.10.17,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684">
<p>An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality
of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer
overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4013</cvename>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684</url>
<url>http://lists.live555.com/pipermail/live-devel/2018-October/021071.html</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-28</entry>
</dates>
</vuln>
<vuln vid="33c384f3-5af6-4662-9741-0acb21c7e499">
<topic>mini_httpd -- disclose arbitrary files is some circumstances</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jef Poskanzer reports:</p>
<blockquote cite="http://acme.com/updates/archive/211.html">
<p>Prior versions allowed remote users to read arbitrary files in some circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/211.html</url>
</references>
<dates>
<discovery>2018-10-26</discovery>
<entry>2018-10-26</entry>
</dates>
</vuln>
<vuln vid="4f7c6af3-6a2c-4ead-8453-04e509688d45">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<name>py37-salt</name>
<range><lt>2017.7.8</lt></range>
<range><ge>2018.3.0</ge><lt>2018.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html">
<p>Remote command execution and incorrect access control when using
salt-api.</p>
<p>Directory traversal vulnerability when using salt-api. Allows an
attacker to determine what files exist on a server when querying
/run or /events.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15751</cvename>
<cvename>CVE-2018-15750</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html</url>
<url>https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html</url>
</references>
<dates>
<discovery>2018-10-24</discovery>
<entry>2018-10-27</entry>
</dates>
</vuln>
<vuln vid="7c3a02b9-3273-4426-a0ba-f90fad2ff72e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>63.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/">
<p>CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin</p>
<p>CVE-2018-12392: Crash with nested event loops</p>
<p>CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript</p>
<p>CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting</p>
<p>CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts</p>
<p>CVE-2018-12397:</p>
<p>CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs</p>
<p>CVE-2018-12399: Spoofing of protocol registration notification bar</p>
<p>CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android</p>
<p>CVE-2018-12401: DOS attack through special resource URI parsing</p>
<p>CVE-2018-12402: SameSite cookies leak when pages are explicitly saved</p>
<p>CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP</p>
<p>CVE-2018-12388: Memory safety bugs fixed in Firefox 63</p>
<p>CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12388</cvename>
<cvename>CVE-2018-12390</cvename>
<cvename>CVE-2018-12391</cvename>
<cvename>CVE-2018-12392</cvename>
<cvename>CVE-2018-12393</cvename>
<cvename>CVE-2018-12395</cvename>
<cvename>CVE-2018-12396</cvename>
<cvename>CVE-2018-12397</cvename>
<cvename>CVE-2018-12398</cvename>
<cvename>CVE-2018-12399</cvename>
<cvename>CVE-2018-12400</cvename>
<cvename>CVE-2018-12401</cvename>
<cvename>CVE-2018-12402</cvename>
<cvename>CVE-2018-12403</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-10-23</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="140a14b5-d615-11e8-b3cb-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.60</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-006">
<p>he path module allows users with the 'administer paths' to create pretty URLs
for content. In certain circumstances the user can enter a particular path that
triggers an open redirect to a malicious url.The issue is mitigated by the fact
that the user needs the administer paths permission to exploit.</p>
<p>When sending email some variables were not being sanitized for shell arguments,
which could lead to remote code execution. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-006</url>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-22</entry>
<modified>2018-11-04</modified>
</dates>
</vuln>
<vuln vid="afc60484-0652-440e-b01a-5ef814747f06">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.8,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.5,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/">
<p>CVE-2018-16395: OpenSSL::X509::Name equality check does not work
correctly</p>
<p>An instance of OpenSSL::X509::Name contains entities such as CN, C and
so on. Some two instances of OpenSSL::X509::Name are equal only when
all entities are exactly equal. However, there is a bug that the
equality check is not correct if the value of an entity of the
argument (right-hand side) starts with the value of the receiver
(left-hand side). So, if a malicious X.509 certificate is passed to
compare with an existing certificate, there is a possibility to be
judged incorrectly that they are equal.</p>
<p>CVE-2018-16396: Tainted flags are not propagated in Array#pack and
String#unpack with some directives</p>
<p>Array#pack method converts the receiver's contents into a string with
specified format. If the receiver contains some tainted objects, the
returned string also should be tainted. String#unpack method which
converts the receiver into an array also should propagate its tainted
flag to the objects contained in the returned array. But, with B, b, H
and h directives, the tainted flags are not propagated. So, if a script
processes unreliable inputs by Array#pack and/or String#unpack with
these directives and checks the reliability with tainted flags, the
check might be wrong.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/</url>
<cvename>CVE-2018-16395</cvename>
<cvename>CVE-2018-16396</cvename>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-20</entry>
</dates>
</vuln>
<vuln vid="ec5072b0-d43a-11e8-a6d2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.37</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.37</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.19</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.11</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.24</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.13</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL</url>
<cvename>CVE-2016-9843</cvename>
<cvename>CVE-2018-3155</cvename>
<cvename>CVE-2018-3143</cvename>
<cvename>CVE-2018-3156</cvename>
<cvename>CVE-2018-3251</cvename>
<cvename>CVE-2018-3182</cvename>
<cvename>CVE-2018-3137</cvename>
<cvename>CVE-2018-3203</cvename>
<cvename>CVE-2018-3133</cvename>
<cvename>CVE-2018-3145</cvename>
<cvename>CVE-2018-3144</cvename>
<cvename>CVE-2018-3185</cvename>
<cvename>CVE-2018-3195</cvename>
<cvename>CVE-2018-3247</cvename>
<cvename>CVE-2018-3187</cvename>
<cvename>CVE-2018-3174</cvename>
<cvename>CVE-2018-3171</cvename>
<cvename>CVE-2018-3277</cvename>
<cvename>CVE-2018-3162</cvename>
<cvename>CVE-2018-3173</cvename>
<cvename>CVE-2018-3200</cvename>
<cvename>CVE-2018-3170</cvename>
<cvename>CVE-2018-3212</cvename>
<cvename>CVE-2018-3280</cvename>
<cvename>CVE-2018-3186</cvename>
<cvename>CVE-2018-3161</cvename>
<cvename>CVE-2018-3278</cvename>
<cvename>CVE-2018-3279</cvename>
<cvename>CVE-2018-3282</cvename>
<cvename>CVE-2018-3284</cvename>
<cvename>CVE-2018-3283</cvename>
<cvename>CVE-2018-3286</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-20</entry>
<modified>2018-11-08</modified>
</dates>
</vuln>
<vuln vid="44864c84-d3b8-11e8-b3cb-00e04c1ea73d">
<topic>matomo -- XSS vulnerability</topic>
<affects>
<package>
<name>matomo</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matomo reports:</p>
<blockquote cite="https://matomo.org/changelog/matomo-3-6-1/">
<p>Several XSS issues have been fixed thanks to the great work of security
researchers who responsible disclosed issues to us.</p>
</blockquote>
</body>
</description>
<references>
<url>https://matomo.org/changelog/matomo-3-6-1/</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-19</entry>
</dates>
</vuln>
<vuln vid="2383767c-d224-11e8-9623-a4badb2f4699">
<topic>libssh -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.6</ge><lt>0.7.6</lt></range>
<range><ge>0.8</ge><lt>0.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gladiac reports:</p>
<blockquote cite="https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/">
<p>libssh versions 0.6 and above have an authentication bypass
vulnerability in the server code. By presenting the server an
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
initiate authentication, the attacker could successfully authentciate
without any credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/</url>
<cvename>CVE-2018-10933</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-17</entry>
</dates>
</vuln>
<vuln vid="8c08ab4c-d06c-11e8-b35c-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.5">
<p>Multiple vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.5</url>
<cvename>CVE-2018-17456</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-15</entry>
</dates>
</vuln>
<vuln vid="4c11b51e-cd8d-11e8-b0cb-a0f3c100ae18">
<topic>Memory leak bug in Toxcore</topic>
<affects>
<package>
<name>toxcore</name>
<range><lt>0.2.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tox project blog reports:</p>
<blockquote cite="https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/">
<p>A memory leak bug was discovered in Toxcore that can be triggered remotely to
exhaust one’s system memory, resulting in a denial of service attack.
The bug is present in the TCP Server module of Toxcore and therefore it
affects mostly bootstrap nodes. Regular Tox clients generally have the
TCP Server functionality disabled by default, leaving them unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/</url>
</references>
<dates>
<discovery>2018-09-29</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="cb539d4e-cd68-11e8-8819-00e04c1ea73d">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4357">
<p>CSRF Vulnerability on API.</p>
<p>Enforce token on api routes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4357</url>
<url>ttps://github.com/go-gitea/gitea/pull/4840</url>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="3350275d-cd5a-11e8-a7be-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.146</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-10-10/">
<h1>Description</h1>
<h5>(Low) SECURITY-867</h5>
<p>Path traversal vulnerability in Stapler allowed accessing internal data</p>
<h5>(Medium) SECURITY-1074</h5>
<p>Arbitrary file write vulnerability using file parameter definitions</p>
<h5>(Medium) SECURITY-1129</h5>
<p>Reflected XSS vulnerability</p>
<h5>(Medium) SECURITY-1162</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-1128</h5>
<p>Ephemeral user record creation</p>
<h5>(Medium) SECURITY-1158</h5>
<p>Session fixation vulnerability on user signup</p>
<h5>(Medium) SECURITY-765</h5>
<p>Failures to process form submission data could result in secrets being displayed or written to logs</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-10-10/</url>
</references>
<dates>
<discovery>2018-10-10</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="a4eb38ea-cc06-11e8-ada4-408d5cf35399">
<topic>tinc -- Buffer overflow</topic>
<affects>
<package>
<name>tinc</name>
<range><lt>1.0.35</lt></range>
</package>
<package>
<name>tinc-devel</name>
<range><lt>1.1pre17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tinc-vpn.org reports:</p>
<blockquote cite="http://www.tinc-vpn.org/news/">
<p>The authentication protocol allows an oracle attack that could
potentially be exploited.</p>
<p>If a man-in-the-middle has intercepted the TCP connection it
might be able to force plaintext UDP packets between two nodes for up to
a PingInterval period.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a</url>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f</url>
<cvename>CVE-2018-16737</cvename>
<cvename>CVE-2018-16738</cvename>
<cvename>CVE-2018-16758</cvename>
</references>
<dates>
<discovery>2018-10-08</discovery>
<entry>2018-10-09</entry>
</dates>
</vuln>
<vuln vid="23413442-c8ea-11e8-b35c-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.4</lt></range>
<range><ge>11.2.0</ge><lt>11.2.5</lt></range>
<range><ge>10.2.0</ge><lt>11.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/">
<p>Merge request information disclosure</p>
<p>Private project namespace information disclosure</p>
<p>Gitlab Flavored Markdown API information disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/</url>
<cvename>CVE-2018-17939</cvename>
<cvename>CVE-2018-17976</cvename>
<cvename>CVE-2018-17975</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-05</entry>
</dates>
</vuln>
<vuln vid="8b812395-c739-11e8-ab5b-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html">
<ul>
<li>CVE-2018-15378:
<ul>
<li>Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</li>
<li>Reported by Secunia Research at Flexera.</li>
</ul>
</li>
<li>Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.
<ul>
<li>Reported by Alex Gaynor.</li>
</ul>
</li>
<li>CVE-2018-14680:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.</li>
</ul>
</li>
<li>CVE-2018-14681:
<ul>
<li>An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.</li>
</ul>
</li>
<li>CVE-2018-14682:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.</li>
</ul>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html</url>
<cvename>CVE-2018-15378</cvename>
<cvename>CVE-2018-14680</cvename>
<cvename>CVE-2018-14681</cvename>
<cvename>CVE-2018-14682</cvename>
</references>
<dates>
<discovery>2018-10-03</discovery>
<entry>2018-10-03</entry>
<modified>2020-06-24</modified>
</dates>
</vuln>
<vuln vid="004d8c23-c710-11e8-98c7-000c29434208">
<topic>Django -- password hash disclosure</topic>
<affects>
<package>
<name>py34-django21</name>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/2.1/releases/2.1.2/">
<p>CVE-2018-16984: Password hash disclosure to "view only" admin users</p>
<p>If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with the
view (but not change) permission to the user model were displayed the entire
hash. While it's typically infeasible to reverse a strong password hash, if
your site uses weaker password hashing algorithms such as MD5 or SHA1, it
could be a problem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/2.1/releases/2.1.2/</url>
<cvename>CVE-2018-16984</cvename>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-03</entry>
</dates>
</vuln>
<vuln vid="c4f39920-781f-4aeb-b6af-17ed566c4272">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/">
<h1>CVE-2018-12386: Type confusion in JavaScript</h1>
<p>A vulnerability in register allocation in JavaScript can
lead to type confusion, allowing for an arbitrary read and
write. This leads to remote code execution inside the
sandboxed content process when triggered.</p>
<h1>CVE-2018-12387: </h1>
<p>A vulnerability where the JavaScript JIT compiler inlines
Array.prototype.push with multiple arguments that results
in the stack pointer being off by 8 bytes after a
bailout. This leaks a memory address to the calling
function which can be used as part of an exploit inside
the sandboxed content process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12386</cvename>
<cvename>CVE-2018-12387</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/</url>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-02</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="065b3b72-c5ab-11e8-9ae2-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.1</lt></range>
<range><ge>11.2.0</ge><lt>11.2.4</lt></range>
<range><ge>7.6.0</ge><lt>11.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/">
<p>SSRF GCP access token disclosure</p>
<p>Persistent XSS on issue details</p>
<p>Diff formatter DoS in Sidekiq jobs</p>
<p>Confidential information disclosure in events API endpoint</p>
<p>validate_localhost function in url_blocker.rb could be bypassed</p>
<p>Slack integration CSRF Oauth2</p>
<p>GRPC::Unknown logging token disclosure</p>
<p>IDOR merge request approvals</p>
<p>Persistent XSS package.json</p>
<p>Persistent XSS merge request project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</url>
<cvename>CVE-2018-17450</cvename>
<cvename>CVE-2018-17454</cvename>
<cvename>CVE-2018-15472</cvename>
<cvename>CVE-2018-17449</cvename>
<cvename>CVE-2018-17452</cvename>
<cvename>CVE-2018-17451</cvename>
<cvename>CVE-2018-17453</cvename>
<cvename>CVE-2018-17455</cvename>
<cvename>CVE-2018-17537</cvename>
<cvename>CVE-2018-17536</cvename>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="5a757a31-f98e-4bd4-8a85-f1c0f3409769">
<topic>pango -- remote DoS vulnerability</topic>
<affects>
<package>
<name>pango</name>
<range><lt>1.42.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120">
<p>libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120</url>
<url>https://www.exploit-db.com/exploits/45263/</url>
<url>https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html</url>
<url>https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f</url>
<cvename>CVE-2018-15120</cvename>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="01018916-c47c-11e8-8b07-00e04c1ea73d">
<topic>Serendipity -- multiple vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Serendipity reports:</p>
<blockquote cite="https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html">
<p>Security: Fix XSS for pagination, when multi-category selection is used.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html</url>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-30</entry>
</dates>
</vuln>
<vuln vid="40a844bf-c430-11e8-96dc-000743165db0">
<topic>bitcoin -- Denial of Service and Possible Mining Inflation</topic>
<affects>
<package>
<name>bitcoin</name>
<name>bitcoin-daemon</name>
<range><lt>0.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitcoin Core reports:</p>
<blockquote cite="https://bitcoincore.org/en/2018/09/20/notice/">
<p>CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bitcoincore.org/en/2018/09/20/notice/</url>
<cvename>CVE-2018-17144</cvename>
</references>
<dates>
<discovery>2018-09-17</discovery>
<entry>2018-09-29</entry>
</dates>
</vuln>
<vuln vid="613193a0-c1b4-11e8-ae2d-54e1ad3d6335">
<topic>spamassassin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2018/q3/242">
<p>In Apache SpamAssassin, using HTML::Parser, we setup an object and
hook into the begin and end tag event handlers In both cases, the
"open" event is immediately followed by a "close" event - even if
the tag *does not* close in the HTML being parsed.</p>
<p>Because of this, we are missing the "text" event to deal with
the object normally. This can cause carefully crafted emails that
might take more scan time than expected leading to a Denial of
Service.</p>
<p>Fix a reliance on "." in @INC in one configuration script. Whether
this can be exploited in any way is uncertain.</p>
<p>Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.</p>
<p> Fourth, this release fixes a local user code injection in the
meta rule syntax. Thanks again to cPanel Security Team for their
report of this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/oss-sec/2018/q3/242</url>
<cvename>CVE-2017-15705</cvename>
<cvename>CVE-2016-1238</cvename>
<cvename>CVE-2018-11780</cvename>
<cvename>CVE-2018-11781</cvename>
</references>
<dates>
<discovery>2018-09-16</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="bad59128-c188-11e8-9d40-f0def10dca57">
<topic>wesnoth -- Code Injection vulnerability</topic>
<affects>
<package>
<name>wesnoth</name>
<range><ge>1.7.0</ge><lt>1.14.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>shadowm reports:</p>
<blockquote cite="https://forums.wesnoth.org/viewtopic.php?t=48528">
<p>A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0.
Users of all previous version should upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999023</cvename>
<url>https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="e182c076-c189-11e8-a6d2-b499baebfeaf">
<topic>Apache -- Denial of service vulnerability in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>low: DoS for HTTP/2 connections by continuous SETTINGS</p>
<p>By sending continous SETTINGS frames of maximum size an ongoing
HTTP/2 connection could be kept busy and would never time out. This
can be abused for a DoS on the server. This only affect a server
that has enabled the h2 protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-11763</cvename>
</references>
<dates>
<discovery>2018-09-25</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="6bf71117-c0c9-11e8-b760-6023b685b1ee">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis-php56</name>
<name>mantis-php70</name>
<name>mantis-php71</name>
<name>mantis-php72</name>
<range><lt>2.17.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Carpenter reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=24731">
<p>Reflected XSS in view_filters_page.php via core/filter_form_api.php</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16514</cvename>
</references>
<dates>
<discovery>2018-09-03</discovery>
<entry>2018-09-25</entry>
</dates>
</vuln>
<vuln vid="2d6de6a8-fb78-4149-aeda-77fc8f140f06">
<topic>smart_proxy_dynflow -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>rubygem-smart_proxy_dynflow</name>
<range><lt>0.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643">
<p>An authentication bypass flaw was found in the smart_proxy_dynflow
component used by Foreman. A malicious attacker can use this flaw to
remotely execute arbitrary commands on machines managed by vulnerable
Foreman instances, in a highly privileged context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643</url>
<cvename>CVE-2018-14643</cvename>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="be1aada2-be6c-11e8-8fc6-000c29434208">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.5</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><le>1.29.3</le></range>
</package>
<package>
<name>mediawiki130</name>
<range><lt>1.30.1</lt></range>
</package>
<package>
<name>mediawiki131</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html">
<p>Security fixes:</p>
<p>T169545: $wgRateLimits entry for 'user' overrides 'newbie'.</p>
<p>T194605: BotPasswords can bypass CentralAuth's account lock.</p>
<p>T187638: When a log event is (partially) hidden Special:Redirect/logid
can link to the incorrect log and reveal hidden</p>
<p>T193237: Special:BotPasswords should require reauthenticate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0503</cvename>
<cvename>CVE-2018-0505</cvename>
<cvename>CVE-2018-0504</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html</url>
</references>
<dates>
<discovery>2018-08-29</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="3284d948-140c-4a3e-aa76-3b440e2006a8">
<topic>firefox -- Crash in TransportSecurityInfo due to cached data</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/">
<p>A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12385</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-22/</url>
</references>
<dates>
<discovery>2018-09-21</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="77f67b46-bd75-11e8-81b6-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability in HTTP websocket upgrade</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.23.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a stack overflow vulnerability in the
res_http_websocket.so module of Asterisk that allows an
attacker to crash Asterisk via a specially crafted HTTP
request to upgrade the connection to a websocket. The
attackers request causes Asterisk to run out of stack
space and crash.</p>
<p>As a workaround disable HTTP websocket access by not
loading the res_http_websocket.so module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-009.html</url>
<cvename>CVE-2018-17281</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="074cb225-bb2d-11e8-90e1-fcaa147e860e">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.14</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.8</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=376023">
<p>Moodle XML import of ddwtos could lead to intentional remote code
execution</p>
<p>QuickForm library remote code vulnerability (upstream)</p>
<p>Boost theme - blog search GET parameter insufficiently filtered</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14630</cvename>
<cvename>CVE-2018-1999022</cvename>
<cvename>CVE-2018-14631</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=376023</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-18</entry>
</dates>
</vuln>
<vuln vid="bf2b9c56-b93e-11e8-b2a8-a4badb296695">
<topic>joomla3 -- vulnerabilitiesw</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports: Multiple low-priority Vulnerabilities</p>
<blockquote cite="https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html">
<p>Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html">
<p>Inadequate output filtering on the user profile page could lead to a stored XSS attack.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html">
<p>Inadequate checks regarding disabled fields can lead to an ACL violation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15860</cvename>
<cvename>CVE-2018-15881</cvename>
<cvename>CVE-2018-15882</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882</url>
<url>https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html</url>
<url>https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html</url>
<url>https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html</url>
</references>
<dates>
<discovery>2018-08-23</discovery>
<entry>2018-09-15</entry>
</dates>
</vuln>
<vuln vid="ab38d9f8-b787-11e8-8e7a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/">
<p>High risk: Email field SQL Injection.</p>
<p>Medium risk: Video MyCode Persistent XSS in Visual Editor.</p>
<p>Low risk: Insufficient permission check in User CP’s attachment management.</p>
<p>Low risk: Insufficient email address verification.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-13</entry>
</dates>
</vuln>
<vuln vid="a67c122a-b693-11e8-ac58-a4badb2f4699">
<topic>FreeBSD -- Improper ELF header parsing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_3</lt></range>
<range><ge>11.1</ge><lt>11.1_14</lt></range>
<range><ge>10.4</ge><lt>10.4_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation was performed in the ELF header
parser, and malformed or otherwise invalid ELF binaries
were not rejected as they should be.</p>
<h1>Impact:</h1>
<p>Execution of a malicious ELF binary may result in a
kernel crash or may disclose kernel memory.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6924</cvename>
<freebsdsa>SA-18:12.elf</freebsdsa>
</references>
<dates>
<discovery>2018-09-12</discovery>
<entry>2018-09-12</entry>
</dates>
</vuln>
<vuln vid="fe818607-b5ff-11e8-856b-485b3931c969">
<topic>Containous Traefik -- exposes the configuration and secret</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>1.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15598">
<p>Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the
configuration and secret if authentication is missing and the API's port
is publicly reachable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15598</cvename>
<url>https://github.com/containous/traefik/pull/3790</url>
<url>https://github.com/containous/traefik/releases/tag/v1.6.6</url>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f9d73a20-b5f0-11e8-b1da-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html">
<ul>
<li>This update resolves a privilege escalation vulnerability that
could lead to information disclosure (CVE-2018-15967).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15967</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-31.html</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="337960ec-b5dc-11e8-ac58-a4badb2f4699">
<topic>Plex Media Server -- Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>plexmediaserver</name>
<name>plexmediaserver-plexpass</name>
<range><lt>1.13.5.5332</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris reports:</p>
<blockquote cite="https://seclists.org/fulldisclosure/2018/Aug/1">
<p>The XML parsing engine for Plex Media Server's SSDP/UPNP
functionality is vulnerable to an XML External Entity
Processing (XXE) attack. Unauthenticated attackers on the same LAN can
use this vulnerability to:</p>
<ul>
<li>Access arbitrary files from the filesystem with the same permission as
the user account running Plex.</li>
<li>Initiate SMB connections to capture NetNTLM challenge/response and
crack to clear-text password.</li>
<li>Initiate SMB connections to relay NetNTLM challenge/response and
achieve Remote Command Execution in Windows domains.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/fulldisclosure/2018/Aug/1</url>
<cvename>CVE-2018-13415</cvename>
</references>
<dates>
<discovery>2018-08-01</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f00acdec-b59f-11e8-805d-001e2a3f778d">
<topic>X11 Session -- SDDM allows unauthorised unlocking</topic>
<affects>
<package>
<name>sddm</name>
<range><lt>0.17.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14345">
<p>An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.</p>
</blockquote>
<p>The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.</p>
</body>
</description>
<references>
<url>https://www.suse.com/security/cve/CVE-2018-14345/</url>
<cvename>CVE-2018-14345</cvename>
</references>
<dates>
<discovery>2018-08-13</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="db2acdac-b5a7-11e8-8f6f-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/">
<p>High risk: Image MyCode “alt” attribute persistent XSS.</p>
<p>Medium risk: RSS Atom 1.0 item title persistent XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-08-22</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="7c750960-b129-11e8-9fcd-080027f43a02">
<topic>Information disclosure - Gitea leaks email addresses</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4417">
<p>[Privacy] Gitea leaks hidden email addresses #4417</p>
<p>A fix has been implemented in Gitea 1.5.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4417</url>
<url>https://github.com/go-gitea/gitea/pull/4784</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-09-05</entry>
</dates>
</vuln>
<vuln vid="2a92555f-a6f8-11e8-8acd-10c37b4ac2ea">
<topic>links -- denial of service</topic>
<affects>
<package>
<name>links</name>
<range><lt>2.16,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-11114">
<p>The put_chars function in html_r.c in Twibright Links 2.14 allows
remote attackers to cause a denial of service (buffer over-read)
via a crafted HTML file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11114</url>
<cvename>CVE-2017-11114</cvename>
</references>
<dates>
<discovery>2017-07-31</discovery>
<entry>2018-08-23</entry>
</dates>
</vuln>
<vuln vid="f4d638b9-e6e5-4dbe-8c70-571dbc116174">
<topic>curl -- password overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.15.4</ge><lt>7.61.1</lt></range>
</package>
<package>
<name>linux-c7-curl</name>
<range><lt>7.29.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-14618: NTLM password overflow via integer overflow</p>
<p>The internal function Curl_ntlm_core_mk_nt_hash multiplies the length
of the password by two (SUM) to figure out how large temporary storage
area to allocate from the heap.</p>
<p>The length value is then subsequently used to iterate over the
password and generate output into the allocated storage buffer. On
systems with a 32 bit size_t, the math to calculate SUM triggers an
integer overflow when the password length exceeds 2GB (2^31 bytes).
This integer overflow usually causes a very small buffer to actually
get allocated instead of the intended very huge one, making the use of
that buffer end up in a heap buffer overflow.</p>
<p>This bug is almost identical to CVE-2017-8816.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-14618.html</url>
<cvename>CVE-2018-14618</cvename>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
<modified>2019-08-03</modified>
</dates>
</vuln>
<vuln vid="c96d416a-eae7-4d5d-bc84-40deca9329fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/">
<p>CVE-2018-12377: Use-after-free in refresh driver timers</p>
<p>CVE-2018-12378: Use-after-free in IndexedDB</p>
<p>CVE-2018-12379: Out-of-bounds write with malicious MAR file</p>
<p>CVE-2017-16541: Proxy bypass using automount and autofs</p>
<p>CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation</p>
<p>CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android</p>
<p>CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords</p>
<p>CVE-2018-12375: Memory safety bugs fixed in Firefox 62</p>
<p>CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16541</cvename>
<cvename>CVE-2018-12375</cvename>
<cvename>CVE-2018-12376</cvename>
<cvename>CVE-2018-12377</cvename>
<cvename>CVE-2018-12378</cvename>
<cvename>CVE-2018-12379</cvename>
<cvename>CVE-2018-12381</cvename>
<cvename>CVE-2018-12382</cvename>
<cvename>CVE-2018-12383</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
<modified>2018-09-15</modified>
</dates>
</vuln>
<vuln vid="30c0f878-b03e-11e8-be8a-0011d823eebd">
<topic>Ghostscript -- arbitrary code execution</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/332928">
<p>Ghostscript contains an optional -dSAFER option, which is supposed
to prevent unsafe PostScript operations. Multiple PostScript
operations bypass the protections provided by -dSAFER, which can
allow an attacker to execute arbitrary commands with arbitrary
arguments. This vulnerability can also be exploited in applications
that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
evince, Okular, Nautilus, and others.</p>
<p>Exploit code for this vulnerability is publicly available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/332928</url>
<cvename>CVE-2018-15908</cvename>
<cvename>CVE-2018-15909</cvename>
<cvename>CVE-2018-15910</cvename>
<cvename>CVE-2018-15911</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-09-04</entry>
</dates>
</vuln>
<vuln vid="1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea">
<topic>grafana -- LDAP and OAuth login vulnerability</topic>
<affects>
<package>
<name>grafana5</name>
<range><ge>5.0.0</ge><lt>5.2.3</lt></range>
</package>
<package>
<name>grafana4</name>
<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
</package>
<package>
<name>grafana3</name>
<range><ge>3.0.0</ge></range>
</package>
<package>
<name>grafana2</name>
<range><ge>2.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
<p>On the 20th of August at 1800 CEST we were contacted about a
potential security issue with the “remember me” cookie Grafana
sets upon login. The issue targeted users without a local Grafana
password (LDAP & OAuth users) and enabled a potential attacker
to generate a valid cookie knowing only a username.</p>
<p>All installations which use the Grafana LDAP or OAuth
authentication features must be upgraded as soon as possible. If
you cannot upgrade, you should switch authentication mechanisms
or put additional protections in front of Grafana such as a
reverse proxy.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
<cvename>CVE-2018-558213</cvename>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-08-31</entry>
</dates>
</vuln>
<vuln vid="ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.2.0</ge><lt>11.2.3</lt></range>
<range><ge>11.1.0</ge><lt>11.1.6</lt></range>
<range><ge>2.7.0</ge><lt>11.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/">
<p>Persistent XSS in Pipeline Tooltip</p>
<p>GitLab.com GCP Endpoints Exposure</p>
<p>Persistent XSS in Merge Request Changes View</p>
<p>Sensitive Data Disclosure in Sidekiq Logs</p>
<p>Missing CSRF in System Hooks</p>
<p>Orphaned Upload Files Exposure</p>
<p>Missing Authorization Control API Repository Storage</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-30</entry>
</dates>
</vuln>
<vuln vid="d0be41fe-2a20-4633-b057-4e8b25c41780">
<topic>bro -- array bounds and potential DOS issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.5 primarily addresses security issues:</p>
<ul>
<li>Fix array bounds checking in BinPAC: for arrays
that are fields within a record, the bounds check
was based on a pointer to the start of the record
rather than the start of the array field, potentially
resulting in a buffer over-read.</li>
<li>Fix SMTP command string comparisons: the number
of bytes compared was based on the user-supplied
string length and can lead to incorrect matches.
e.g. giving a command of "X" incorrectly matched
"X-ANONYMOUSTLS" (and an empty commands match
anything).</li>
</ul>
<p>Address potential vectors for Denial of Service:</p>
<ul>
<li>"Weird" events are now generally suppressed/sampled
by default according to some tunable parameters.</li>
<li>Improved handling of empty lines in several text
protocol analyzers that can cause performance issues
when seen in long sequences.</li>
<li>Add `smtp_excessive_pending_cmds' weird which
serves as a notification for when the "pending
command" queue has reached an upper limit and been
cleared to prevent one from attempting to slowly
exhaust memory.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-29</entry>
</dates>
</vuln>
<vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>10.9.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/">
<h1>OpenSSL: Client DoS due to large DH parameter</h1>
<p>This fixes a potential denial of service (DoS) attack
against client connections by a malicious server. During a TLS
communication handshake, where both client and server agree to
use a cipher-suite using DH or DHE (Diffie-Hellman, in both
ephemeral and non-ephemeral modes), a malicious server can
send a very large prime value to the client. Because this has
been unbounded in OpenSSL, the client can be forced to spend
an unreasonably long period of time to generate a key,
potentially causing a denial of service.</p>
<h1>OpenSSL: ECDSA key extraction via local side-channel</h1>
<p>Attackers with access to observe cache-timing may be able
to extract DSA or ECDSA private keys by causing the victim to
create several signatures and watching responses. This flaw
does not have a CVE due to OpenSSL policy to not assign itself
CVEs for local-only vulnerabilities that are more academic
than practical. This vulnerability was discovered by Keegan
Ryan at NCC Group and impacts many cryptographic libraries
including OpenSSL.</p>
<h1>Unintentional exposure of uninitialized memory</h1>
<p>Only Node.js 10 is impacted by this flaw.</p>
<p>Node.js TSC member Nikita Skovoroda discovered an argument
processing flaw that causes Buffer.alloc() to return
uninitialized memory. This method is intended to be safe and
only return initialized, or cleared, memory. The third
argument specifying encoding can be passed as a number, this
is misinterpreted by Buffer's internal "fill" method as the
start to a fill operation. This flaw may be abused where
Buffer.alloc() arguments are derived from user input to return
uncleared memory blocks that may contain sensitive
information.</p>
<h1>Out of bounds (OOB) write</h1>
<p>Node.js TSC member Nikita Skovoroda discovered an OOB write
in Buffer that can be used to write to memory outside of a
Buffer's memory space. This can corrupt unrelated Buffer
objects or cause the Node.js process to crash.</p>
<p>When used with UCS-2 encoding (recognized by Node.js under
the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
Buffer#write() can be abused to write outside of the bounds of
a single Buffer. Writes that start from the second-to-last
position of a buffer cause a miscalculation of the maximum
length of the input bytes to be written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/</url>
<cvename>CVE-2018-0732</cvename>
<cvename>CVE-2018-7166</cvename>
<cvename>CVE-2018-12115</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-08-25</entry>
</dates>
</vuln>
<vuln vid="45671c0e-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
<range><ge>10.4</ge><lt>10.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When using WPA2, EAPOL-Key frames with the Encrypted
flag and without the MIC flag set, the data field was
decrypted first without verifying the MIC. When the dta
field was encrypted using RC4, for example, when negotiating
TKIP as a pairwise cipher, the unauthenticated but decrypted
data was subsequently processed. This opened wpa_supplicant(8)
to abuse by decryption and recovery of sensitive information
contained in EAPOL-Key messages.</p>
<p>See
https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All users of the WPA2 TKIP pairwise cipher are vulnerable
to information, for example, the group key.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1452</cvename>
<freebsdsa>SA-18:11.hostapd</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="359e1548-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in IP fragment reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A researcher has notified us of a DoS attack applicable
to another operating system. While FreeBSD may not be
vulnerable to that exact attack, we have identified several
places where inadequate DoS protection could allow an
attacker to consume system resources.</p>
<p>It is not necessary that the attacker be able to establish
two-way communication to carry out these attacks. These
attacks impact both IPv4 and IPv6 fragment reassembly.</p>
<h1>Impact:</h1>
<p>In the worst case, an attacker could send a stream of
crafted fragments with a low packet rate which would consume
a substantial amount of CPU.</p>
<p>Other attack vectors allow an attacker to send a stream
of crafted fragments which could consume a large amount of
CPU or all available mbuf clusters on the system.</p>
<p>These attacks could temporarily render a system unreachable
through network interfaces or temporarily render a system
unresponsive. The effects of the attack should clear within
60 seconds after the attack stops.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6923</cvename>
<freebsdsa>SA-18:10.ip</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="2310b814-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On certain Intel 64-bit x86 systems there is a period
of time during terminal fault handling where the CPU may
use speculative execution to try to load data. The CPU may
speculatively access the level 1 data cache (L1D). Data
which would otherwise be protected may then be determined
by using side channel methods.</p>
<p>This issue affects bhyve on FreeBSD/amd64 systems.</p>
<h1>Impact:</h1>
<p>An attacker executing user code, or kernel code inside
of a virtual machine, may be able to read secret data from
the kernel or from another virtual machine.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3620</cvename>
<cvename>CVE-2018-3646</cvename>
<freebsdsa>SA-18:09.l1tf</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="e53a908d-a645-11e8-8acd-10c37b4ac2ea">
<topic>gogs -- open redirect vulnerability</topic>
<affects>
<package>
<name>gogs</name>
<range><lt>0.11.53_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bluecatli (Tencent's Xuanwu Lab) reports:</p>
<blockquote cite="https://github.com/gogs/gogs/issues/5364">
<p>The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.</p>
<p>If the Location header startswith /\, it will be transformed to // by browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/gogs/gogs/issues/5364</url>
<url>https://github.com/gogs/gogs/pull/5365</url>
<url>https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2</url>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9e205ef5-a649-11e8-b1f6-6805ca0b3d42">
<topic>phpmyadmin -- XSS in the import dialog</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-5/">
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
file import feature, where an attacker can deliver a payload
to a user through importing a specially-crafted file.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-5/</url>
<cvename>CVE-2018-15605</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335">
<topic>libX11 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2018-August/002915.html">
<p>The functions XGetFontPath, XListExtensions, and XListFonts are
vulnerable to an off-by-one override on malicious server responses.
The server replies consist of chunks consisting of a length byte
followed by actual string, which is not NUL-terminated.
While parsing the response, the length byte is overridden with '\0',
thus the memory area can be used as storage of C strings later on.
To be able to NUL-terminate the last string, the buffer is reserved
with an additional byte of space. For a boundary check, the variable
chend (end of ch) was introduced, pointing at the end of the buffer
which ch initially points to. Unfortunately there is a difference
in handling "the end of ch". While chend points at the first byte
that must not be written to, the for-loop uses chend as the last
byte that can be written to. Therefore, an off-by-one can occur.</p>
<p>The length value is interpreted as signed char on many systems
(depending on default signedness of char), which can lead to an out
of boundary write up to 128 bytes in front of the allocated storage,
but limited to NUL byte(s).</p>
<p>If the server sends a reply in which even the first string would
overflow the transmitted bytes, list[0] (or flist[0]) will be set to
NULL and a count of 0 is returned. If the resulting list is freed
with XFreeExtensionList or XFreeFontPath later on, the first Xfree
call is turned into Xfree (NULL-1) which will most likely trigger a
segmentation fault. Casting the length value to unsigned char fixes
the problem and allows string values with up to 255 characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2018-August/002915.html</url>
<cvename>CVE-2018-14598</cvename>
<cvename>CVE-2018-14599</cvename>
<cvename>CVE-2018-14600</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9b19b6df-a4be-11e8-9366-0028f8d09152">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.2.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-11769.html</url>
<cvename>CVE-2018-11769</cvename>
</references>
<dates>
<discovery>2018-06-05</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="7762d7ad-2e38-41d2-9785-c51f653ba8bd">
<topic>botan2 -- ECDSA side channel</topic>
<affects>
<package>
<name>botan2</name>
<range><ge>2.5.0</ge><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>botan2 developers report:</p>
<blockquote cite="https://botan.randombit.net/security.html#id1">
<p>A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.</p>
<p>Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://botan.randombit.net/security.html#id1</url>
<url>https://github.com/randombit/botan/pull/1604</url>
<cvename>CVE-2018-12435</cvename>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-08-17</entry>
</dates>
</vuln>
<vuln vid="6905f05f-a0c9-11e8-8335-8c164535ad80">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.138</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-08-15/">
<h1>Description</h1>
<h5>(Low) SECURITY-637</h5>
<p> Jenkins allowed deserialization of URL objects with host components</p>
<h5>(Medium) SECURITY-672</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-790</h5>
<p>Cron expression form validation could enter infinite loop, potentially resulting in denial of service</p>
<h5>(Low) SECURITY-996</h5>
<p>"Remember me" cookie was evaluated even if that feature is disabled</p>
<h5>(Medium) SECURITY-1071</h5>
<p>Unauthorized users could access agent logs</p>
<h5>(Low) SECURITY-1076</h5>
<p>Unauthorized users could cancel scheduled restarts initiated from the update center</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-08-15/</url>
</references>
<dates>
<discovery>2018-08-15</discovery>
<entry>2018-08-15</entry>
</dates>
</vuln>
<vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.154</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html">
<ul>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-12824,
CVE-2018-12826, CVE-2018-12827).</li>
<li>This update resolves a security bypass vulnerability that
could lead to security mitigation bypass (CVE-2018-12825).</li>
<li>This update resolves a component vulnerability that
could lead to privilege escalation (CVE-2018-12828).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12824</cvename>
<cvename>CVE-2018-12825</cvename>
<cvename>CVE-2018-12826</cvename>
<cvename>CVE-2018-12827</cvename>
<cvename>CVE-2018-12828</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-25.html</url>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="c4e9a427-9fc2-11e8-802a-000c29a1e3ec">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><lt>4.6.16</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.9</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1139.html">
<p>Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which
allows authentication using NTLMv1 over an SMB1 transport (either
directory or via NETLOGON SamLogon calls from a member server), even
when NTLMv1 is explicitly disabled on the server.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1140.html">
<p>Missing input sanitization checks on some of the input parameters to
LDB database layer cause the LDAP server and DNS server to crash when
following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10858.html">
<p>Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in
libsmbclient that could allow a malicious server to overwrite
client heap memory by returning an extra long filename in a directory
listing.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10918.html">
<p>Missing database output checks on the returned directory attributes
from the LDB database layer cause the DsCrackNames call in the DRSUAPI
server to crash when following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10919.html">
<p>All versions of the Samba Active Directory LDAP server from 4.0.0
onwards are vulnerable to the disclosure of confidential attribute
values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
(0x80) searchFlags bit and where an explicit Access Control Entry has
been specified on the ntSecurityDescriptor.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1139.html</url>
<cvename>CVE-2018-1139</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1140.html</url>
<cvename>CVE-2018-1140</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10858.html</url>
<cvename>CVE-2018-10858</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10918.html</url>
<cvename>CVE-2018-10918</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10919.html</url>
<cvename>CVE-2018-10919</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="e714b7d2-39f6-4992-9f48-e6b2f5f949df">
<topic>GraphicsMagick -- SVG/Rendering vulnerability</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.30,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick News:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is
another manefestation of CVE-2016-2317, which should finally be fixed
correctly due to active detection/correction of pending overflow rather
than using estimation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-2317</cvename>
</references>
<dates>
<discovery>2018-06-23</discovery>
<entry>2018-08-11</entry>
</dates>
</vuln>
<vuln vid="5a771686-9e33-11e8-8b2d-9cf7a8059466">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.13.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CHICKEN reports:</p>
<blockquote cite="https://code.call-cc.org/releases/4.13.0/NEWS">
<ul>
<li>CVE-2017-6949: Unchecked malloc() call in SRFI-4
constructors when allocating in non-GC memory, resulting
in potential 1-word buffer overrun and/or segfault</li>
<li>CVE-2017-9334: "length" crashes on improper lists</li>
<li>CVE-2017-11343: The randomization factor of the symbol
table was set before the random seed was set, causing it
to have a fixed value on many platforms</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://code.call-cc.org/releases/4.13.0/NEWS</url>
<cvename>CVE-2017-6949</cvename>
<cvename>CVE-2017-9334</cvename>
<cvename>CVE-2017-11343</cvename>
</references>
<dates>
<discovery>2017-03-16</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="bcf56a42-9df8-11e8-afb0-589cfc0f81b0">
<topic>gitea -- TOTP passcode reuse</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/">
<p>TOTP passcodes can be reused.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/3878</url>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="f4876dd4-9ca8-11e8-aa17-0011d823eebd">
<topic>mbed TLS -- plaintext recovery vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02">
<ul>
<li>When using a CBC based ciphersuite, a remote attacker can
partially recover the plaintext.</li>
<li>When using a CBC based ciphersuite, an attacker with the
ability to execute arbitrary code on the machine under attack
can partially recover the plaintext by use of cache based
side-channels.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02</url>
<cvename>CVE-2018-0497</cvename>
<cvename>CVE-2018-0498</cvename>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="96eab874-9c79-11e8-b34b-6cc21735f730">
<topic>PostgreSQL -- two vulnerabilities</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.5</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.10</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.14</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.19</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-10915: Certain host connection parameters defeat
client-side security defenses</p>
<p>libpq, the client connection API for PostgreSQL that is also used
by other connection libraries, had an internal issue where it did not
reset all of its connection state variables when attempting to
reconnect. In particular, the state variable that determined whether
or not a password is needed for a connection would not be reset, which
could allow users of features requiring libpq, such as the "dblink" or
"postgres_fdw" extensions, to login to servers they should not be able
to access.</p>
<p>CVE-2018-10925: Memory disclosure and missing authorization in
`INSERT ... ON CONFLICT DO UPDATE`</p>
<p>An attacker able to issue CREATE TABLE can read arbitrary bytes of
server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`)
query. By default, any user can exploit that. A user that has
specific INSERT privileges and an UPDATE privilege on at least one
column in a given table can also update other columns using a view and
an upsert query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1878/</url>
<cvename>CVE-2018-10915</cvename>
<cvename>CVE-2018-10925</cvename>
</references>
<dates>
<discovery>2018-08-09</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="909be51b-9b3b-11e8-add2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.36</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.35</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.17</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.9</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.23</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html">
<p>Multiple vulnerabilities have been disclosed by Oracle without
further detail. CVSS scores 7.1 - 2.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html</url>
<cvename>CVE-2018-3064</cvename>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2018-3070</cvename>
<cvename>CVE-2018-3060</cvename>
<cvename>CVE-2018-3065</cvename>
<cvename>CVE-2018-3073</cvename>
<cvename>CVE-2018-3074</cvename>
<cvename>CVE-2018-3081</cvename>
<cvename>CVE-2018-3071</cvename>
<cvename>CVE-2018-3079</cvename>
<cvename>CVE-2018-3054</cvename>
<cvename>CVE-2018-3077</cvename>
<cvename>CVE-2018-3078</cvename>
<cvename>CVE-2018-3080</cvename>
<cvename>CVE-2018-3061</cvename>
<cvename>CVE-2018-3067</cvename>
<cvename>CVE-2018-3063</cvename>
<cvename>CVE-2018-3075</cvename>
<cvename>CVE-2018-3058</cvename>
<cvename>CVE-2018-3056</cvename>
<cvename>CVE-2018-3066</cvename>
<cvename>CVE-2018-2767</cvename>
<cvename>CVE-2018-3084</cvename>
<cvename>CVE-2018-3082</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="5786185a-9a43-11e8-b34b-6cc21735f730">
<topic>xml-security-c -- crashes on malformed KeyInfo content</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The shibboleth project reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180803.txt">
<p>
SAML messages, assertions, and metadata all commonly make use of the
XML Signature KeyInfo construct, which expresses information about
keys and certificates used in signing or encrypting XML.
</p>
<p>
The Apache Santuario XML Security for C++ library contained code
paths at risk of dereferencing null pointers when processing various
kinds of malformed KeyInfo hints typically found in signed or
encrypted XML. The usual effect is a crash, and in the case of the
Shibboleth SP software, a crash in the shibd daemon, which prevents
access to protected resources until the daemon is restarted.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180803.txt</url>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-07</entry>
</dates>
</vuln>
<vuln vid="3c2eea8c-99bf-11e8-8bee-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_1</lt></range>
<range><ge>11.1</ge><lt>11.1_12</lt></range>
<range><ge>10.4</ge><lt>10.4_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>One of the data structures that holds TCP segments uses
an inefficient algorithm to reassemble the data. This causes
the CPU time spent on segment processing to grow linearly
with the number of segments in the reassembly queue.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to send TCP traffic to
a victim system can degrade the victim system's network
performance and/or consume excessive CPU by exploiting the
inefficiency of TCP reassembly handling, with relatively
small bandwidth cost.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6922</cvename>
<freebsdsa>SA-18:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="9e2d0dcf-9926-11e8-a92d-0050562a4d7b">
<topic>py-cryptography -- tag forgery vulnerability</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<name>py36-cryptography</name>
<name>py37-cryptography</name>
<range><lt>2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Python Cryptographic Authority (PyCA) project reports:</p>
<blockquote cite="https://cryptography.io/en/latest/changelog/#v2-3">
<p>finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10903</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="06c4a79b-981d-11e8-b460-9c5c8e75236a">
<topic>cgit -- directory traversal vulnerability</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jann Horn reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html">
<p>cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html</url>
<cvename>CVE-2018-14912</cvename>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-04</entry>
</dates>
</vuln>
<vuln vid="e309a2c7-598b-4fa6-a398-bc72fbd1d167">
<topic>rubygem-doorkeeper -- token revocation vulnerability</topic>
<affects>
<package>
<name>rubygem-doorkeeper</name>
<name>rubygem-doorkeeper43</name>
<name>rubygem-doorkeeper-rails5</name>
<name>rubygem-doorkeeper-rails50</name>
<range><lt>4.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000211">
<p>Doorkeeper version 4.2.0 and later contains a Incorrect Access Control
vulnerability in Token revocation API's authorized method that can
result in Access tokens are not revoked for public OAuth apps, leaking
access until expiry.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000211</url>
<url>https://github.com/doorkeeper-gem/doorkeeper/pull/1120</url>
<cvename>CVE-2018-1000211</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-31</entry>
<modified>2018-08-03</modified>
</dates>
</vuln>
<vuln vid="ca05d9da-ac1d-4113-8a05-ffe9cd0d6160">
<topic>sinatra -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sinatra</name>
<range><ge>2.0.0</ge><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sinatra blog:</p>
<blockquote cite="http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html">
<p>Sinatra had a critical vulnerability since v2.0.0. The purpose of this
release is to fix CVE-2018-11627.</p>
<p>The vulnerability is that XSS can be executed by using illegal parameters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html</url>
<url>https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md</url>
<cvename>CVE-2018-11627</cvename>
</references>
<dates>
<discovery>2018-06-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="b4f0ad36-94a5-11e8-9007-080027ac955c">
<topic>mailman -- content spoofing with invalid list names in web UI</topic>
<affects>
<package><name>mailman</name> <range><lt>2.1.28</lt></range></package>
<package><name>mailman-with-htdig</name><range><lt>2.1.28</lt></range></package>
<package><name>ja-mailman</name> <range><lt>2.1.14.j7_6,1</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1780874">
<p>A URL with a very long text listname such as</p>
<pre>http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text</pre>
<p>will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.</p>
<p>This issue was discovered by Hammad Qureshi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/1780874</url>
<url>https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html</url>
<cvename>CVE-2018-13796</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="0822a4cf-9318-11e8-8d88-00e04c1ea73d">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>2.15.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mantis reports:</p>
<blockquote cite="https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f">
<p>Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name. Prevent the attack by sanitizing the filter name before display.</p>
<p>Ömer Cıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php. Prevent the attack by sanitizing the output
of $_SERVER['PHP_SELF'] before display.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f</url>
<url>https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a</url>
<cvename>CVE-2018-14504</cvename>
<cvename>CVE-2018-13066</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-29</entry>
<modified>2018-08-24</modified>
</dates>
</vuln>
<vuln vid="e97a8852-32dd-4291-ba4d-92711daff056">
<topic>py-bleach -- unsanitized character entities</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py36-bleach</name>
<range><ge>2.1.0</ge><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bleach developer reports:</p>
<blockquote cite="https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES">
<p>Attributes that have URI values weren't properly sanitized if the
values contained character entities. Using character entities, it
was possible to construct a URI value with a scheme that was not
allowed that would slide through unsanitized.</p>
<p>This security issue was introduced in Bleach 2.1. Anyone using
Bleach 2.1 is highly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES</url>
</references>
<dates>
<discovery>2018-03-05</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="07d04eef-d8e2-11e6-a071-001e67f15f5a">
<topic>lshell -- Shell autocomplete reveals forbidden directories</topic>
<affects>
<package>
<name>lshell</name>
<range><lt>0.9.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/109</url>
</references>
<dates>
<discovery>2015-07-25</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="f353525a-d8b8-11e6-a071-001e67f15f5a">
<topic>lshell -- Multiple security issues</topic>
<affects>
<package>
<name>lshell</name>
<range><le>0.9.18</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).</p>
<p>Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/122</url>
<url>https://github.com/ghantoos/lshell/issues/147</url>
<url>https://github.com/ghantoos/lshell/issues/149</url>
<url>https://github.com/ghantoos/lshell/issues/151</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="11dc3890-0e64-11e8-99b0-d017c2987f9a">
<topic>OpenJPEG -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.3.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenJPEG reports:</p>
<blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2017-17479+OR+CVE-2017-17480+OR+CVE-2018-5785+OR+CVE-2018-6616">
<p>Multiple vulnerabilities have been found in OpenJPEG, the
opensource JPEG 2000 codec. Please consult the CVE list for further
details.</p>
<p>CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.</p>
<p>CVE-2018-5785 was fixed in r480624.</p>
<p>CVE-2018-6616 was fixed in r489415.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
<cvename>CVE-2017-17479</cvename>
<cvename>CVE-2017-17480</cvename>
<cvename>CVE-2018-5785</cvename>
<cvename>CVE-2018-6616</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2018-07-27</entry>
<modified>2019-02-11</modified>
</dates>
</vuln>
<vuln vid="5ccbb2f8-c798-11e7-a633-009c02a2ab30">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.5_1,1</lt></range>
<range><ge>3.4,1</ge><le>3.4.1_4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been found in FFmpeg. Please refer
to CVE list for details.</p>
<p>Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch
before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed
in 3.4.1. They're listed here for completeness of the record.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392</url>
<url>http://ffmpeg.org/security.html</url>
<cvename>CVE-2017-15186</cvename>
<cvename>CVE-2017-15672</cvename>
<cvename>CVE-2017-16840</cvename>
<cvename>CVE-2017-17081</cvename>
<cvename>CVE-2018-6392</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="bfda2d80-0858-11e8-ad5c-0021ccb9e74d">
<topic>GIMP - Heap Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>2.8.22,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://www.securityfocus.com/bid/102765/references">
<p>CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=739134</url>
<cvename>CVE-2017-17786</cvename>
</references>
<dates>
<discovery>2017-12-21</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>68.0.3440.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
<p>42 security fixes in this release, including:</p>
<ul>
<li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
<li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
<li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
<li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
<li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
<li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
<li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
<li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
<li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
<li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
<li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
<li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
<li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
<li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
<li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
<li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
<li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
<li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
<li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
<li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
<li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
<li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li>
<li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
<li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
<li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
<li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
<li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
<li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
<li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
<li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
<li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
<li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
<li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4117</cvename>
<cvename>CVE-2018-6044</cvename>
<cvename>CVE-2018-6150</cvename>
<cvename>CVE-2018-6151</cvename>
<cvename>CVE-2018-6152</cvename>
<cvename>CVE-2018-6153</cvename>
<cvename>CVE-2018-6154</cvename>
<cvename>CVE-2018-6155</cvename>
<cvename>CVE-2018-6156</cvename>
<cvename>CVE-2018-6157</cvename>
<cvename>CVE-2018-6158</cvename>
<cvename>CVE-2018-6159</cvename>
<cvename>CVE-2018-6160</cvename>
<cvename>CVE-2018-6161</cvename>
<cvename>CVE-2018-6162</cvename>
<cvename>CVE-2018-6163</cvename>
<cvename>CVE-2018-6164</cvename>
<cvename>CVE-2018-6165</cvename>
<cvename>CVE-2018-6166</cvename>
<cvename>CVE-2018-6167</cvename>
<cvename>CVE-2018-6168</cvename>
<cvename>CVE-2018-6169</cvename>
<cvename>CVE-2018-6170</cvename>
<cvename>CVE-2018-6171</cvename>
<cvename>CVE-2018-6172</cvename>
<cvename>CVE-2018-6173</cvename>
<cvename>CVE-2018-6174</cvename>
<cvename>CVE-2018-6175</cvename>
<cvename>CVE-2018-6176</cvename>
<cvename>CVE-2018-6177</cvename>
<cvename>CVE-2018-6178</cvename>
<cvename>CVE-2018-6179</cvename>
<url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
<topic>curl -- SMTP send heap buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.54.1</ge><lt>7.61.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_2018-70a2.html">
<p>curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-70a2.html</url>
<cvename>CVE-2018-0500</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-27</entry>
<modified>2018-07-28</modified>
</dates>
</vuln>
<vuln vid="2da838f9-9168-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.1.0</ge><lt>11.1.2</lt></range>
<range><ge>11.0.0</ge><lt>11.0.5</lt></range>
<range><ge>2.7.0</ge><lt>10.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/">
<p>Markdown DoS</p>
<p>Information Disclosure Prometheus Metrics</p>
<p>CSRF in System Hooks</p>
<p>Persistent XSS Pipeline Tooltip</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14601</cvename>
<cvename>CVE-2018-14602</cvename>
<cvename>CVE-2018-14603</cvename>
<cvename>CVE-2018-14604</cvename>
<cvename>CVE-2018-14605</cvename>
<cvename>CVE-2018-14606</cvename>
<url>https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</url>
</references>
<dates>
<discovery>2018-07-26</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="38fec4bd-90f7-11e8-aafb-1c39475b9f84">
<topic>Fix a buffer overflow in the tiff reader</topic>
<affects>
<package>
<name>vips</name>
<range><lt>8.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvips reports:</p>
<blockquote cite="https://github.com/jcupitt/libvips/releases/tag/v8.6.5">
<p>A buffer overflow was found and fixed in the libvips code</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jcupitt/libvips/releases/tag/v8.6.5</url>
</references>
<dates>
<discovery>2018-07-22</discovery>
<entry>2018-07-26</entry>
</dates>
</vuln>
<vuln vid="efe43d2b-8f35-11e8-b9e8-dcfe074bd614">
<topic>Memory leak in different components</topic>
<affects>
<package>
<name>libsixel</name>
<range><lt>1.8.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14072">
<p>bsixel 1.8.1 has a memory leak in sixel_decoder_decode in
decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in
fromsixel.c and sixel_allocator_new in allocator.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14072</cvename>
<cvename>CVE-2018-14073</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-24</entry>
</dates>
</vuln>
<vuln vid="dc57ad48-ecbb-439b-a4d0-5869be47684e">
<topic>vlc -- Use after free vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><le>2.2.8_6,4</le></range>
</package>
<package>
<name>vlc-qt4</name>
<range><le>2.2.8_6,4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529">
<p>VideoLAN VLC media player 2.2.x is prone to a use after free
vulnerability which an attacker can leverage to execute arbitrary
code via crafted MKV files. Failed exploit attempts will likely
result in denial of service conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-11529</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529</url>
<url>http://seclists.org/fulldisclosure/2018/Jul/28</url>
<url>https://github.com/rapid7/metasploit-framework/pull/10335</url>
<url>https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368</url>
<url>https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-07-21</entry>
</dates>
</vuln>
<vuln vid="a2f35081-8a02-11e8-8fa5-4437e6ad11c4">
<topic>mutt -- remote code injection and path traversal vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin J. McCarthy reports:</p>
<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html">
<p>Fixes a remote code injection vulnerability when "subscribing"
to an IMAP mailbox, either via $imap_check_subscribed, or via the
<subscribe> function in the browser menu. Mutt was generating a
"mailboxes" command and sending that along to the muttrc parser.
However, it was not escaping "`", which executes code and inserts
the result. This would allow a malicious IMAP server to execute
arbitrary code (for $imap_check_subscribed).</p>
<p>Fixes POP body caching path traversal vulnerability.</p>
<p>Fixes IMAP header caching path traversal vulnerability.</p>
<p>CVE-2018-14349 - NO Response Heap Overflow</p>
<p>CVE-2018-14350 - INTERNALDATE Stack Overflow</p>
<p>CVE-2018-14351 - STATUS Literal Length relative write</p>
<p>CVE-2018-14352 - imap_quote_string off-by-one stack overflow</p>
<p>CVE-2018-14353 - imap_quote_string int underflow</p>
<p>CVE-2018-14354 - imap_subscribe Remote Code Execution</p>
<p>CVE-2018-14355 - STATUS mailbox header cache directory traversal</p>
<p>CVE-2018-14356 - POP empty UID NULL deref</p>
<p>CVE-2018-14357 - LSUB Remote Code Execution</p>
<p>CVE-2018-14358 - RFC822.SIZE Stack Overflow</p>
<p>CVE-2018-14359 - base64 decode Stack Overflow</p>
<p>CVE-2018-14362 - POP Message Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14362</cvename>
<url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe12ef83-8b47-11e8-96cc-001a4a7ec6be">
<topic>mutt/neomutt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>neomutt</name>
<range><lt>20180716</lt></range>
</package>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
<package>
<name>mutt14</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NeoMutt report:</p>
<blockquote cite="https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716">
<h1>Description</h1>
<h5>CVE-2018-14349</h5><p>NO Response Heap Overflow</p>
<h5>CVE-2018-14350</h5><p>INTERNALDATE Stack Overflow</p>
<h5>CVE-2018-14351</h5><p>STATUS Literal Length relative write</p>
<h5>CVE-2018-14352</h5><p>imap_quote_string off-by-one stack overflow</p>
<h5>CVE-2018-14353</h5><p>imap_quote_string int underflow</p>
<h5>CVE-2018-14354</h5><p>imap_subscribe Remote Code Execution</p>
<h5>CVE-2018-14355</h5><p>STATUS mailbox header cache directory traversal</p>
<h5>CVE-2018-14356</h5><p>POP empty UID NULL deref</p>
<h5>CVE-2018-14357</h5><p>LSUB Remote Code Execution</p>
<h5>CVE-2018-14358</h5><p>RFC822.SIZE Stack Overflow</p>
<h5>CVE-2018-14359</h5><p>base64 decode Stack Overflow</p>
<h5>CVE-2018-14360</h5><p>NNTP Group Stack Overflow</p>
<h5>CVE-2018-14361</h5><p>NNTP Write 1 where via GROUP response</p>
<h5>CVE-2018-14362</h5><p>POP Message Cache Directory Traversal</p>
<h5>CVE-2018-14363</h5><p>NNTP Header Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14360</cvename>
<cvename>CVE-2018-14361</cvename>
<cvename>CVE-2018-14362</cvename>
<cvename>CVE-2018-14363</cvename>
<url>https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-19</entry>
</dates>
</vuln>
<vuln vid="20a1881e-8a9e-11e8-bddf-d017c2ca229d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.133</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-07-18/">
<h1>Description</h1>
<h5>(High) SECURITY-897 / CVE-2018-1999001</h5>
<p>Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart </p>
<h5>(High) SECURITY-914 / CVE-2018-1999002</h5>
<p>Arbitrary file read vulnerability</p>
<h5>(Medium) SECURITY-891 / CVE-2018-1999003</h5>
<p>Unauthorized users could cancel queued builds</p>
<h5>(Medium) SECURITY-892 / CVE-2018-1999004</h5>
<p>Unauthorized users could initiate and abort agent launches</p>
<h5>(Medium) SECURITY-944 / CVE-2018-1999005</h5>
<p>Stored XSS vulnerability</p>
<h5>(Medium) SECURITY-925 / CVE-2018-1999006</h5>
<p>Unauthorized users are able to determine when a plugin was extracted from its JPI package</p>
<h5>(Medium) SECURITY-390 / CVE-2018-1999007</h5>
<p>XSS vulnerability in Stapler debug mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999001</cvename>
<cvename>CVE-2018-1999002</cvename>
<cvename>CVE-2018-1999003</cvename>
<cvename>CVE-2018-1999004</cvename>
<cvename>CVE-2018-1999005</cvename>
<cvename>CVE-2018-1999006</cvename>
<cvename>CVE-2018-1999007</cvename>
<url>https://jenkins.io/security/advisory/2018-07-18/</url>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="c6d1a8a6-8a91-11e8-be4d-005056925db4">
<topic>znc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14055">
<p>ZNC before 1.7.1-rc1 does not properly validate untrusted lines
coming from the network, allowing a non-admin user to escalate his
privilege and inject rogue values into znc.conf.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14056">
<p>ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in
a web skin name to access files outside of the intended skins
directories.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14055</cvename>
<cvename>CVE-2018-14056</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.1</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8b1a50ab-8a8e-11e8-add2-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>DoS for HTTP/2 connections by crafted requests
(CVE-2018-1333). By specially crafting HTTP/2 requests, workers
would be allocated 60 seconds longer than necessary, leading to
worker exhaustion and a denial of service. (low)</li>
<li>mod_md, DoS via Coredumps on specially crafted requests
(CVE-2018-8011). By specially crafting HTTP requests, the mod_md
challenge handler would dereference a NULL pointer and cause the
child process to segfault. This could be used to DoS the server.
(moderate)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-1333</cvename>
<cvename>CVE-2018-8011</cvename>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8fc615cc-8a66-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.4</lt></range>
<range><ge>10.8.0</ge><lt>10.8.6</lt></range>
<range><ge>8.9.0</ge><lt>10.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/">
<p>Remote Code Execution Vulnerability in GitLab Projects Import</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14364</cvename>
<url>https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</url>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="ef013039-89cd-11e8-84e9-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-7</name>
<range><lt>7.6.30</lt></range>
</package>
<package>
<name>typo3-8</name>
<range><lt>8.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-931-8717-and-7630-security-releases-published/">
<p>It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component)
is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance.
In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden
when using MD5 as the default hashing algorithm by just knowing a valid username.
Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.</p>
<p>Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact
that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored
with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way,
Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted
to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by
manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability.
In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit
has been identified so far.</p>
<p>Failing to properly dissociate system related configuration from user generated configuration,
the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation.
Basically instructions can be persisted to a form definition file that were not configured to be modified -
this applies to definitions managed using the form editor module as well as direct file upload using the regular
file list module. A valid backend user account as well as having system extension form activated are needed
in order to exploit this vulnerability.</p>
<p>It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization
when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents
to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed
to exploit this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-001/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-002/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-003/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-004/</url>
</references>
<dates>
<discovery>2018-07-12</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle</name>
<range><lt>1.60</lt></range>
</package>
<package>
<name>bouncycastle15</name>
<range><lt>1.60</lt></range>
</package>
<package>
<name>puppetserver</name>
<range><ge>0</ge></range>
</package>
<package>
<name>puppetserver5</name>
<range><lt>5.3.8</lt></range>
</package>
<package>
<name>puppetserver6</name>
<range><lt>6.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/latest_releases.html">
<p>Release 1.60 is now available for download.</p>
<p>CVE-2018-1000180: issue around primality tests for RSA key pair
generation if done using only the low-level API.</p>
<p>CVE-2018-1000613: lack of class checking in deserialization
of XMSS/XMSS^MT private keys with BDS state information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000180</cvename>
<cvename>CVE-2018-1000613</cvename>
<url>https://www.bouncycastle.org/latest_releases.html</url>
</references>
<dates>
<discovery>2018-06-30</discovery>
<entry>2018-07-15</entry>
</dates>
</vuln>
<vuln vid="bd6cf187-8710-11e8-833d-18a6f7016652">
<topic>qutebrowser -- Remote code execution due to CSRF</topic>
<affects>
<package>
<name>qutebrowser</name>
<range><ge>1.4.0</ge><lt>1.4.1</lt></range>
<range><ge>1.0.0</ge><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>qutebrowser team reports:</p>
<blockquote cite="https://blog.qutebrowser.org/cve-2018-10895-remote-code-execution-due-to-csrf-in-qutebrowser.html">
<p>Due to a CSRF vulnerability affecting the qute://settings page,
it was possible for websites to modify qutebrowser settings.
Via settings like editor.command, this possibly allowed websites
to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2018/q3/29</url>
<cvename>CVE-2018-10895</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-14</entry>
</dates>
</vuln>
<vuln vid="e78732b2-8528-11e8-9c42-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.134</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5008).</li>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-5007).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5007</cvename>
<cvename>CVE-2018-5008</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-24.html</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="1e54d140-8493-11e8-a795-0028f8d09152">
<topic>couchdb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>1.7.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://blog.couchdb.org/2018/07/10/cve-2018-8007/">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.couchdb.org/2018/07/10/cve-2018-8007/</url>
<cvename>CVE-2018-8007</cvename>
<url>https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/</url>
<cvename>CVE-2017-12636</cvename>
<cvename>CVE-2017-12635</cvename>
<url>https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2018-07-10</entry>
</dates>
</vuln>
<vuln vid="3c9b7698-84da-11e8-8c75-d8cb8abf62dd">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.3">
<p>Out-of-bounds reads when reading objects from a packfile</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.3</url>
<cvename>CVE-2018-10887</cvename>
<cvename>CVE-2018-10888</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="d1e9d8c5-839b-11e8-9610-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html">
<p>3 security fixes in this release:</p>
<ul>
<li>CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).</li>
<li>CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.</li>
<li>CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report
ed by aCaB.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html</url>
<cvename>CVE-2017-16932</cvename>
<cvename>CVE-2018-0360</cvename>
<cvename>CVE-2018-0361</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-09</entry>
</dates>
</vuln>
<vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
<topic>zziplib - multiple vulnerabilities</topic>
<affects>
<package>
<name>zziplib</name>
<range><lt>0.13.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018">
<p>17 security fixes in this release:</p>
<ul>
<li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li>
<li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li>
<li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function
in memdisk.c.</li>
<li>The zzip_mem_entry_new function in memdisk.c allows remote attackers
to cause a denial of service (out-of-bounds read and crash) via a
crafted ZIP file.</li>
<li>The prescan_entry function in fseeko.c allows remote attackers to cause
a denial of service (NULL pointer dereference and crash) via crafted
ZIP file.</li>
<li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer
dereference and crash via a crafted ZIP file.</li>
<li>seeko.c cause a denial of service (assertion failure and crash) via a
crafted ZIP file.</li>
<li>A segmentation fault caused by invalid memory access in the
zzip_disk_fread function because the size variable is not validated
against the amount of file->stored data.</li>
<li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer
function of zzip/zip.c.</li>
<li>A bus error caused by loading of a misaligned address in the
zzip_disk_findfirst function.</li>
<li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory
function.</li>
<li>An invalid memory address dereference was discovered in zzip_disk_fread
in mmapped.c.</li>
<li>A memory leak triggered in the function zzip_mem_disk_new in
memdisk.c.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5974</cvename>
<cvename>CVE-2017-5975</cvename>
<cvename>CVE-2017-5976</cvename>
<cvename>CVE-2017-5977</cvename>
<cvename>CVE-2017-5978</cvename>
<cvename>CVE-2017-5979</cvename>
<cvename>CVE-2017-5980</cvename>
<cvename>CVE-2017-5981</cvename>
<cvename>CVE-2018-6381</cvename>
<cvename>CVE-2018-6484</cvename>
<cvename>CVE-2018-6540</cvename>
<cvename>CVE-2018-6541</cvename>
<cvename>CVE-2018-6542</cvename>
<cvename>CVE-2018-6869</cvename>
<cvename>CVE-2018-7725</cvename>
<cvename>CVE-2018-7726</cvename>
<cvename>CVE-2018-7727</cvename>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url>
</references>
<dates>
<discovery>2017-03-01</discovery>
<entry>2018-07-06</entry>
</dates>
</vuln>
<vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.7,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>4.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpressdevelopers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/">
<p>Taxonomy: Improve cache handling for term queries.</p>
<p>Posts, Post Types: Clear post password cookie when logging out.</p>
<p>Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.</p>
<p>Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.</p>
<p>Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-05</discovery>
<entry>2018-07-08</entry>
</dates>
</vuln>
<vuln vid="bfd5d004-81d4-11e8-a29a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/">
<p>High risk: Image and URL MyCode Persistent XSS</p>
<p>Medium risk: Multipage Reflected XSS</p>
<p>Low risk: ACP logs XSS</p>
<p>Low risk: Arbitrary file deletion via ACP’s Settings</p>
<p>Low risk: Login CSRF</p>
<p>Low risk: Non-video content embedding via Video MyCode</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-04</discovery>
<entry>2018-07-07</entry>
</dates>
</vuln>
<vuln vid="e375ff3f-7fec-11e8-8088-28d244aee256">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.1</lt></range>
</package>
<package>
<name>libwww</name>
<range><lt>5.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063">
<p>An integer overflow during the parsing of XML using the Expat library.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233">
<p>XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat
XML Parser Library) allows attackers to put the parser in an infinite
loop using a malformed external entity definition from an external DTD.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233</url>
<url>https://libexpat.github.io/doc/cve-2017-9233/</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2018-07-05</entry>
</dates>
</vuln>
<vuln vid="ce39379f-7eb7-11e8-ab03-00bd7f19ff09">
<topic>h2o -- heap buffer overflow during logging</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marlies Ruck reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.5">
<p>Fix heap buffer overflow while trying to emit access log
- see references for full details.</p>
<p>CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
earlier allows remote attackers to execute arbitrary code or
cause a denial of service (DoS) via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0608</cvename>
<url>https://github.com/h2o/h2o/issues/1775</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.5</url>
</references>
<dates>
<discovery>2018-06-01</discovery>
<entry>2018-07-03</entry>
</dates>
</vuln>
<vuln vid="c1630aa3-7970-11e8-8634-dcfe074bd614">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>upp</name>
<range><le>11540</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-07-01</entry>
</dates>
</vuln>
<vuln vid="cd81806c-26e7-4d4a-8425-02724a2f48af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>61.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.1.19_2</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>60.0,1</ge><lt>60.1.0_1,1</lt></range>
<range><lt>52.9.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/">
<p>CVE-2018-12359: Buffer overflow using computed size of canvas element</p>
<p>CVE-2018-12360: Use-after-free when using focus()</p>
<p>CVE-2018-12361: Integer overflow in SwizzleData</p>
<p>CVE-2018-12358: Same-origin bypass using service worker and redirection</p>
<p>CVE-2018-12362: Integer overflow in SSSE3 scaler</p>
<p>CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture</p>
<p>CVE-2018-12363: Use-after-free when appending DOM nodes</p>
<p>CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins</p>
<p>CVE-2018-12365: Compromised IPC child process can list local filenames</p>
<p>CVE-2018-12371: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-12366: Invalid data handling during QCMS transformations</p>
<p>CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming</p>
<p>CVE-2018-12368: No warning when opening executable SettingContent-ms files</p>
<p>CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments</p>
<p>CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View</p>
<p>CVE-2018-5186: Memory safety bugs fixed in Firefox 61</p>
<p>CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1</p>
<p>CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5156</cvename>
<cvename>CVE-2018-5186</cvename>
<cvename>CVE-2018-5187</cvename>
<cvename>CVE-2018-5188</cvename>
<cvename>CVE-2018-12358</cvename>
<cvename>CVE-2018-12359</cvename>
<cvename>CVE-2018-12360</cvename>
<cvename>CVE-2018-12361</cvename>
<cvename>CVE-2018-12362</cvename>
<cvename>CVE-2018-12363</cvename>
<cvename>CVE-2018-12364</cvename>
<cvename>CVE-2018-12365</cvename>
<cvename>CVE-2018-12366</cvename>
<cvename>CVE-2018-12367</cvename>
<cvename>CVE-2018-12368</cvename>
<cvename>CVE-2018-12369</cvename>
<cvename>CVE-2018-12370</cvename>
<cvename>CVE-2018-12371</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/</url>
</references>
<dates>
<discovery>2018-06-26</discovery>
<entry>2018-06-26</entry>
<modified>2018-07-07</modified>
</dates>
</vuln>
<vuln vid="739948e3-78bf-11e8-b23c-080027ac955c">
<topic>mailman -- hardening against malicious listowners injecting evil HTML scripts</topic>
<affects>
<package> <name>mailman</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>mailman-with-htdig</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>ja-mailman</name> <range><lt>2.1.14.j7_5,1</lt></range> </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8">
<p>Existing protections against malicious listowners injecting evil
scripts into listinfo pages have had a few more checks added.
</p>
<p>A few more error messages have had their values HTML escaped.</p>
<p>The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
the same as one generated at the same time for a different list and
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8</url>
<url>https://www.mail-archive.com/mailman-users@python.org/</url>
<cvename>CVE-2018-0618</cvename>
</references>
<dates>
<discovery>2018-03-09</discovery> <!-- Launchpad rev. 1747 -->
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="b950a83b-789e-11e8-8545-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.1</lt></range>
<range><ge>10.8.0</ge><lt>10.8.5</lt></range>
<range><ge>4.1</ge><lt>10.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/">
<p>Wiki XSS</p>
<p>Sanitize gem updates</p>
<p>XSS in url_for(params)</p>
<p>Content injection via username</p>
<p>Activity feed publicly displaying internal project names</p>
<p>Persistent XSS in charts</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12606</cvename>
<cvename>CVE-2018-3740</cvename>
<cvename>CVE-2018-12605</cvename>
<cvename>CVE-2018-12607</cvename>
<url>https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</url>
</references>
<dates>
<discovery>2018-06-25</discovery>
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="17cb6ff3-7670-11e8-8854-6805ca0b3d42">
<topic>phpmyadmin -- remote code inclusion and XSS scripting</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-3/">
<h3>Summary</h3>
<p>XSS in Designer feature</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
Designer feature, where an attacker can deliver a
payload to a user through a specially-crafted database
name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-4/">
<h3>Summary</h3>
<p>File inclusion and remote code execution attack</p>
<h3>Description</h3>
<p>A flaw has been discovered where an attacker can include
(view and potentially execute) files on the server.</p>
<p>The vulnerability comes from a portion of code where
pages are redirected and loaded within phpMyAdmin, and an
improper test for whitelisted pages.</p>
<p>An attacker must be authenticated, except in these
situations:</p>
<ul>
<li>$cfg['AllowArbitraryServer'] = true: attacker can
specify any host he/she is already in control of, and
execute arbitrary code on phpMyAdmin</li>
<li>$cfg['ServerDefault'] = 0: this bypasses the login and
runs the vulnerable code without any authentication</li>
</ul>
<h3>Severity</h3>
<p>We consider this to be severe.</p> <h3>Mitigation
factor</h3> <p>Configuring PHP with a restrictive
`open_basedir` can greatly restrict an attacker's ability to
view files on the server. Vulnerable systems should not be
run with the phpMyAdmin directives
$cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault']
= 0</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-3/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-4/</url>
<cvename>CVE-2018-12581</cvename>
<cvename>CVE-2018-12613</cvename>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-22</entry>
</dates>
</vuln>
<vuln vid="4e07d94f-75a5-11e8-85d1-a4badb2f4699">
<topic>FreeBSD -- Lazy FPU State Restore Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A subset of Intel processors can allow a local thread
to infer data from another thread through a speculative
execution side channel when Lazy FPU state restore is
used.</p>
<h1>Impact:</h1>
<p>Any local thread can potentially read FPU state information
from other threads running on the host. This could include
cryptographic keys when the AES-NI CPU feature is present.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3665</cvename>
<freebsdsa>SA-18:07.lazyfpu</freebsdsa>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-21</entry>
</dates>
</vuln>
<vuln vid="25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba">
<topic>GraphicsMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.26,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick reports:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Multiple vulnerabilities have been found in GraphicsMagick 1.3.26
or earlier. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-7800</cvename>
<cvename>CVE-2016-7996</cvename>
<cvename>CVE-2016-7997</cvename>
<cvename>CVE-2016-9830</cvename>
<cvename>CVE-2017-6335</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-10794</cvename>
<cvename>CVE-2017-10799</cvename>
<cvename>CVE-2017-10800</cvename>
</references>
<dates>
<discovery>2017-07-04</discovery>
<entry>2018-06-18</entry>
</dates>
</vuln>
<vuln vid="3a66cb69-716f-11e8-be54-3085a9a47796">
<topic>slurm -- insecure handling of user_name and gid fields</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html">
<h1>Insecure handling of user_name and gid fields (CVE-2018-10995)</h1>
<p>While fixes are only available for the supported 17.02 and 17.11
releases, it is believed that similar vulnerabilities do affect past
versions as well. The only resolution is to upgrade Slurm to a fixed
release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html</url>
</references>
<dates>
<discovery>2018-05-30</discovery>
<entry>2018-06-16</entry>
</dates>
</vuln>
<vuln vid="45b8e2eb-7056-11e8-8fab-63ca6e0e13a2">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.14.3</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>10.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/">
<h1>Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)</h1>
<p>All versions of 8.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node server providing an http2 server to crash. This can be
accomplished by interacting with the http2 server in a manner that
triggers a cleanup bug where objects are used in native code after
they are no longer available. This has been addressed by updating
the http2 implementation. Thanks to Jordan Zebor at F5 Networks for
reporting this issue.</p>
<h1>Denial of Service, nghttp2 dependency (CVE-2018-1000168)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. Under certain conditions, a malicious client can trigger an
uninitialized read (and a subsequent segfault) by sending a
malformed ALTSVC frame. This has been addressed through an by
updating nghttp2.</p>
<h1>Denial of Service Vulnerability in TLS (CVE-2018-7162)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node process which provides an http server supporting TLS server to
crash. This can be accomplished by sending duplicate/unexpected
messages during the handshake. This vulnerability has been addressed
by updating the TLS implementation. Thanks to Jordan Zebor at F5
Networks all of his help investigating this issue with the Node.js
team.</p>
<h1>Memory exhaustion DoS on v9.x (CVE-2018-7164)</h1>
<p>Versions 9.7.0 and later are vulnerable and the severity is MEDIUM.
A bug introduced in 9.7.0 increases the memory consumed when reading
from the network into JavaScript using the net.Socket object
directly as a stream. An attacker could use this cause a denial of
service by sending tiny chunks of data in short succession. This
vulnerability was restored by reverting to the prior behaviour.</p>
<h1>Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)</h1>
<p>Calling Buffer.fill() or Buffer.alloc() with some parameters can
lead to a hang which could result in a Denial of Service. In order
to address this vulnerability, the implementations of Buffer.alloc()
and Buffer.fill() were updated so that they zero fill instead of
hanging in these cases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/</url>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-7161</cvename>
<cvename>CVE-2018-7162</cvename>
<cvename>CVE-2018-7164</cvename>
<cvename>CVE-2018-7167</cvename>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-15</entry>
</dates>
</vuln>
<vuln vid="53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec">
<topic>password-store -- GPG parsing vulnerabilities</topic>
<affects>
<package>
<name>password-store</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html">
<p>Markus Brinkmann discovered that [the] parsing of gpg command line
output with regexes isn't anchored to the beginning of the line,
which means an attacker can generate a malicious key that simply has
the verification string as part of its username.</p>
<p>This has a number of nasty consequences:</p>
<ul>
<li>an attacker who manages to write into your ~/.password-store
and also inject a malicious key into your keyring can replace
your .gpg-id key and have your passwords encrypted under
additional keys;</li>
<li>if you have extensions enabled (disabled by default), an
attacker who manages to write into your ~/.password-store and
also inject a malicious key into your keyring can replace your
extensions and hence execute code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html</url>
<cvename>CVE-2018-12356</cvename>
</references>
<dates>
<discovery>2018-06-14</discovery>
<entry>2018-06-14</entry>
</dates>
</vuln>
<vuln vid="9b5162de-6f39-11e8-818e-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495">
<p>Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0495</cvename>
<url>https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495</url>
<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt</url>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-06-13</entry>
<modified>2018-06-14</modified>
</dates>
</vuln>
<vuln vid="c82ecac5-6e3f-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Client DoS due to large DH parameter</topic>
<affects>
<package>
<name>libressl</name>
<name>libressl-devel</name>
<range><lt>2.6.5</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2o_4,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180612.txt">
<p>During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180612.txt</url>
<cvename>CVE-2018-0732</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-12</entry>
<modified>2018-07-24</modified>
</dates>
</vuln>
<vuln vid="0137167b-6dca-11e8-a671-001999f8d30b">
<topic>asterisk -- PJSIP endpoint presence disclosure when using ACL</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.21.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p> When endpoint specific ACL rules block a SIP request
they respond with a 403 forbidden. However, if an endpoint
is not identified then a 401 unauthorized response is
sent. This vulnerability just discloses which requests
hit a defined endpoint. The ACL rules cannot be bypassed
to gain access to the disclosed endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-008.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="f14ce57f-6dc8-11e8-a671-001999f8d30b">
<topic>asterisk -- Infinite loop when reading iostreams</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When connected to Asterisk via TCP/TLS if the client
abruptly disconnects, or sends a specially crafted message
then Asterisk gets caught in an infinite loop while trying
to read the data stream. Thus rendering the system as
unusable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-007.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="4cb49a23-6c89-11e8-8b33-e8e0b747a45a">
<topic>chromium -- Incorrect handling of CSP header</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html">
<p>1 security fix contributed by external researchers:</p>
<ul>
<li>[845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6148</cvename>
<url>https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-10</entry>
</dates>
</vuln>
<vuln vid="7da0417f-6b24-11e8-84cc-002590acae31">
<topic>gnupg -- unsanitized output (CVE-2018-12020)</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>gnupg1</name>
<range><lt>1.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html">
<p>GnuPG did not sanitize input file names, which may then be output to
the terminal. This could allow terminal control sequences or fake
status messages to be injected into the output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020</url>
<cvename>CVE-2018-12020</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526</url>
<cvename>CVE-2017-7526</cvename>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7">
<topic>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.0.13_5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/">
<p>A heap buffer overflow can occur in the Skia library when
rasterizing paths using a maliciously crafted SVG file
with anti-aliasing turned off. This results in a
potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-14/</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="2dde5a56-6ab1-11e8-b639-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4945).</li>
<li>This update resolves an integer overflow vulnerability that
could lead to information disclosure (CVE-2018-5000).</li>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5001).</li>
<li>This update resolves a stack-based buffer overflow vulnerability that
could lead to arbitrary code execution (CVE-2018-5002).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4945</cvename>
<cvename>CVE-2018-5000</cvename>
<cvename>CVE-2018-5001</cvename>
<cvename>CVE-2018-5002</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-19.html</url>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-07</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="2f4fd3aa-32f8-4116-92f2-68f05398348e">
<topic>bro -- multiple memory allocation issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.4 primarily fixes security issues</p>
<p>Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.</p>
<p>The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-06</entry>
</dates>
</vuln>
<vuln vid="5a1589ad-68f9-11e8-83f5-d8cb8abf62dd">
<topic>Libgit2 -- Fixing insufficient validation of submodule names</topic>
<affects>
<package>
<name>libgit2</name>
<name>py-pygit2</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.1">
<p>Insufficient validation of submodule names</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.1</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-05</entry>
</dates>
</vuln>
<vuln vid="c7a135f4-66a4-11e8-9e63-3085a9a47796">
<topic>Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235)</topic>
<affects>
<package>
<name>git</name>
<name>git-lite</name>
<range><lt>2.13.7</lt></range>
<range><ge>2.14</ge><lt>2.14.4</lt></range>
<range><ge>2.15</ge><lt>2.15.2</lt></range>
<range><ge>2.16</ge><lt>2.16.4</lt></range>
<range><ge>2.17</ge><lt>2.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://marc.info/?l=git&m=152761328506724&=2">
<ul><li>In affected versions of Git, code to sanity-check pathnames on
NTFS can result in reading out-of-bounds memory.</li>
<li>In affected versions of Git, remote code execution can
occur. With a crafted .gitmodules file, a malicious project can
execute an arbitrary script on a machine that runs "git clone
--recurse-submodules" because submodule "names" are obtained from
this file, and then appended to $GIT_DIR/modules, leading to
directory traversal with "../" in a name. Finally, post-checkout
hooks from a submodule are executed, bypassing the intended design
in which hooks are not obtained from a remote server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233</url>
<cvename>CVE-2018-11233</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-02</entry>
</dates>
</vuln>
<vuln vid="9557dc72-64da-11e8-bc32-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.8.0</ge><lt>10.8.2</lt></range>
<range><ge>10.7.0</ge><lt>10.7.5</lt></range>
<range><ge>1.0</ge><lt>10.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/">
<p>Removing public deploy keys regression</p>
<p>Users can update their password without entering current password</p>
<p>Persistent XSS - Selecting users as allowed merge request approvers</p>
<p>Persistent XSS - Multiple locations of user selection drop downs</p>
<p>include directive in .gitlab-ci.yml allows SSRF requests</p>
<p>Permissions issue in Merge Requests Create Service</p>
<p>Arbitrary assignment of project fields using "Import project"</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="7fc3e827-64a5-11e8-aedb-00224d821998">
<topic>strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388)</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html">
<ul><li>A denial-of-service vulnerability in the IKEv2 key derivation was fixed
if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as
PRF (which is not FIPS-compliant). So this should only affect very specific setups,
but in such configurations all strongSwan versions since 5.0.1 may be affected.</li>
<li>A denial-of-service vulnerability in the stroke plugin was fixed.
When reading a message from the socket the plugin did not check the received length.
Unless a group is configured, root privileges are required to access that socket,
so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html</url>
<cvename>CVE-2018-10811</cvename>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html</url>
<cvename>CVE-2018-5388</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">
<p>34 security fixes in this release, including:</p>
<ul>
<li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li>
<li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li>
<li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li>
<li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li>
<li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li>
<li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li>
<li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li>
<li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li>
<li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li>
<li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li>
<li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li>
<li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li>
<li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li>
<li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li>
<li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li>
<li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li>
<li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li>
<li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li>
<li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li>
<li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li>
<li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li>
<li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li>
<li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li>
<li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li>
<li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6123</cvename>
<cvename>CVE-2018-6124</cvename>
<cvename>CVE-2018-6125</cvename>
<cvename>CVE-2018-6126</cvename>
<cvename>CVE-2018-6127</cvename>
<cvename>CVE-2018-6128</cvename>
<cvename>CVE-2018-6129</cvename>
<cvename>CVE-2018-6130</cvename>
<cvename>CVE-2018-6131</cvename>
<cvename>CVE-2018-6132</cvename>
<cvename>CVE-2018-6133</cvename>
<cvename>CVE-2018-6134</cvename>
<cvename>CVE-2018-6135</cvename>
<cvename>CVE-2018-6136</cvename>
<cvename>CVE-2018-6137</cvename>
<cvename>CVE-2018-6138</cvename>
<cvename>CVE-2018-6139</cvename>
<cvename>CVE-2018-6140</cvename>
<cvename>CVE-2018-6141</cvename>
<cvename>CVE-2018-6142</cvename>
<cvename>CVE-2018-6143</cvename>
<cvename>CVE-2018-6144</cvename>
<cvename>CVE-2018-6145</cvename>
<cvename>CVE-2018-6147</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-30</entry>
</dates>
</vuln>
<vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind912</name>
<range><lt>9.12.1P2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01602">
<p>An error in zone database reference counting can
lead to an assertion failure if a server which is
running an affected version of BIND attempts
several transfers of a slave zone in quick
succession.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01606">
<p>A problem with the implementation of the new
serve-stale feature in BIND 9.12 can lead to
an assertion failure in rbtdb.c, even when
stale-answer-enable is off. Additionally,
problematic interaction between the serve-stale
feature and NSEC aggressive negative caching can
in some cases cause undesirable behavior from named,
such as a recursion loop or excessive logging.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5736</cvename>
<cvename>CVE-2018-5737</cvename>
<url>https://kb.isc.org/article/AA-01602</url>
<url>https://kb.isc.org/article/AA-01606</url>
</references>
<dates>
<discovery>2018-05-18</discovery>
<entry>2018-05-21</entry>
</dates>
</vuln>
<vuln vid="04fe6c8d-2a34-4009-a81e-e7a7e759b5d2">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-1000300: FTP shutdown response buffer overflow</p>
<p>curl might overflow a heap based memory buffer when closing down an
FTP connection with very long server command replies.</p>
<p>When doing FTP transfers, curl keeps a spare "closure handle" around
internally that will be used when an FTP connection gets shut down
since the original curl easy handle is then already removed.</p>
<p>FTP server response data that gets cached from the original transfer
might then be larger than the default buffer size (16 KB) allocated in
the "closure handle", which can lead to a buffer overwrite. The
contents and size of that overwrite is controllable by the server.</p>
<p>This situation was detected by an assert() in the code, but that was
of course only preventing bad stuff in debug builds. This bug is very
unlikely to trigger with non-malicious servers.</p>
<p>We are not aware of any exploit of this flaw.</p>
<p>CVE-2018-1000301: RTSP bad headers buffer over-read</p>
<p>curl can be tricked into reading data beyond the end of a heap based
buffer used to store downloaded content.</p>
<p>When servers send RTSP responses back to curl, the data starts out
with a set of headers. curl parses that data to separate it into a
number of headers to deal with those appropriately and to find the end
of the headers that signal the start of the "body" part.</p>
<p>The function that splits up the response into headers is called
Curl_http_readwrite_headers() and in situations where it can't find a
single header in the buffer, it might end up leaving a pointer pointing
into the buffer instead of to the start of the buffer which then later
on may lead to an out of buffer read when code assumes that pointer
points to a full buffer size worth of memory to use.</p>
<p>This could potentially lead to information leakage but most likely a
crash/denial of service for applications if a server triggers this flaw.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/adv_2018-82c2.html</url>
<url>https://curl.haxx.se/docs/adv_2018-b138.html</url>
<cvename>CVE-2018-1000300</cvename>
<cvename>CVE-2018-1000301</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-16</entry>
</dates>
</vuln>
<vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
<topic>wavpack -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
<p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
<p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
<p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
</blockquote>
<p>Thuan Pham reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
<p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
<p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
<p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6767</cvename>
<cvename>CVE-2018-7253</cvename>
<cvename>CVE-2018-7254</cvename>
<cvename>CVE-2018-10536</cvename>
<cvename>CVE-2018-10537</cvename>
<cvename>CVE-2018-10538</cvename>
<cvename>CVE-2018-10539</cvename>
<cvename>CVE-2018-10540</cvename>
<url>https://www.debian.org/security/2018/dsa-4125</url>
<url>https://www.debian.org/security/2018/dsa-4197</url>
<freebsdpr>228141</freebsdpr>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[835887] Critical: Chain leading to sandbox escape.
Reported by Anonymous on 2018-04-23</li>
<li>[836858] High CVE-2018-6121: Privilege Escalation in extensions</li>
<li>[836141] High CVE-2018-6122: Type confusion in V8</li>
<li>[833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17</li>
<li>[841841] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6120</cvename>
<cvename>CVE-2018-6121</cvename>
<cvename>CVE-2018-6122</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.120</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-05-09/">
<p>The agent to master security subsystem ensures that the Jenkins
master is protected from maliciously configured agents. A path
traversal vulnerability allowed agents to escape whitelisted
directories to read and write to files they should not be able to
access.</p>
<p>Black Duck Hub Plugin's API endpoint was affected by an XML
External Entity (XXE) processing vulnerability. This allowed an
attacker with Overall/Read access to have Jenkins parse a maliciously
crafted file that uses external entities for extraction of secrets
from the Jenkins master, server-side request forgery, or
denial-of-service attacks.</p>
<p>Several other lower severity issues were reported, see reference
url for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-05-09/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-10</entry>
</dates>
</vuln>
<vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.1.0_18</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.8.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
<p>CVE-2018-5183: Backport critical security fixes in Skia</p>
<p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p>
<p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p>
<p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p>
<p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p>
<p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p>
<p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p>
<p>CVE-2018-5152: WebExtensions information leak through webRequest API</p>
<p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p>
<p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p>
<p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p>
<p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p>
<p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p>
<p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p>
<p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p>
<p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p>
<p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p>
<p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p>
<p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p>
<p>CVE-2018-5176: JSON Viewer script injection</p>
<p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p>
<p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p>
<p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p>
<p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p>
<p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p>
<p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p>
<p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p>
<p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5150</cvename>
<cvename>CVE-2018-5151</cvename>
<cvename>CVE-2018-5152</cvename>
<cvename>CVE-2018-5153</cvename>
<cvename>CVE-2018-5154</cvename>
<cvename>CVE-2018-5155</cvename>
<cvename>CVE-2018-5157</cvename>
<cvename>CVE-2018-5158</cvename>
<cvename>CVE-2018-5159</cvename>
<cvename>CVE-2018-5160</cvename>
<cvename>CVE-2018-5163</cvename>
<cvename>CVE-2018-5164</cvename>
<cvename>CVE-2018-5165</cvename>
<cvename>CVE-2018-5166</cvename>
<cvename>CVE-2018-5167</cvename>
<cvename>CVE-2018-5168</cvename>
<cvename>CVE-2018-5169</cvename>
<cvename>CVE-2018-5172</cvename>
<cvename>CVE-2018-5173</cvename>
<cvename>CVE-2018-5174</cvename>
<cvename>CVE-2018-5175</cvename>
<cvename>CVE-2018-5176</cvename>
<cvename>CVE-2018-5177</cvename>
<cvename>CVE-2018-5178</cvename>
<cvename>CVE-2018-5180</cvename>
<cvename>CVE-2018-5181</cvename>
<cvename>CVE-2018-5182</cvename>
<cvename>CVE-2018-5183</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
<topic>kamailio - buffer overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A specially crafted REGISTER message with a malformed branch or
From tag triggers an off-by-one heap-based buffer overflow in the
tmx_check_pretran function in modules/tmx/tmx_pretran.c</p>
</body>
</description>
<references>
<cvename>CVE-2018-8828</cvename>
<url>https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/</url>
<url>https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow</url>
</references>
<dates>
<discovery>2018-02-10</discovery>
<entry>2018-05-06</entry>
</dates>
</vuln>
<vuln vid="7b5a8e3b-52cc-11e8-8c7a-9c5c8e75236a">
<topic>wget -- cookie injection vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Harry Sintonen of F-Secure Corporation reports:</p>
<blockquote cite="https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt">
<p>GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt</url>
<cvename>CVE-2018-0494</cvename>
<freebsdpr>ports/228071</freebsdpr>
</references>
<dates>
<discovery>2018-04-26</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="9558d49c-534c-11e8-8177-d43d7ef03aa6">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.171</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4944).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4944</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-16.html</url>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="521ce804-52fd-11e8-9123-a4badb2f4699">
<topic>FreeBSD -- Mishandling of x86 debug exceptions</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_10</lt></range>
<range><ge>10.4</ge><lt>10.4_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The MOV SS and POP SS instructions inhibit debug exceptions
until the instruction boundary following the next instruction.
If that instruction is a system call or similar instruction
that transfers control to the operating system, the debug
exception will be handled in the kernel context instead of
the user context.</p>
<h1>Impact:</h1>
<p>An authenticated local attacker may be able to read
sensitive data in kernel memory, control low-level operating
system functions, or may panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2018-8897</cvename>
<freebsdsa>SA-18:06.debugreg</freebsdsa>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="8719b935-8bae-41ad-92ba-3c826f651219">
<topic>python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>python release notes:</p>
<blockquote cite="https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst">
<p>Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst</url>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<cvename>CVE-2018-1060</cvename>
<cvename>CVE-2018-1061</cvename>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-05-05</entry>
</dates>
</vuln>
<vuln vid="83a548b5-4fa5-11e8-9a8e-001e2a3f778d">
<topic>KWallet-PAM -- Access to privileged files</topic>
<affects>
<package>
<name>plasma5-kwallet-pam</name>
<range><lt>5.12.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Community reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20180503-1.txt">
<p>
kwallet-pam was doing file writing and permission changing
as root that with correct timing and use of carefully
crafted symbolic links could allow a non privileged user
to become the owner of any file on the system.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20180503-1.txt</url>
</references>
<dates>
<discovery>2018-05-04</discovery>
<entry>2018-05-04</entry>
</dates>
</vuln>
<vuln vid="89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.58</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-004">
<p>A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
This potentially allows attackers to exploit multiple attack vectors on a Drupal site,
which could result in the site being compromised. This vulnerability is related to
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002.
Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-004</url>
</references>
<dates>
<discovery>2018-04-25</discovery>
<entry>2018-05-03</entry>
</dates>
</vuln>
<vuln vid="9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.7.0</ge><lt>10.7.2</lt></range>
<range><ge>10.6.0</ge><lt>10.6.5</lt></range>
<range><ge>9.5.0</ge><lt>10.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released">
<p>Persistent XSS in Move Issue using project namespace</p>
<p>Download Archive allowing unauthorized private repo access</p>
<p>Mattermost Updates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10379</cvename>
<url>https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released</url>
</references>
<dates>
<discovery>2018-04-30</discovery>
<entry>2018-05-01</entry>
</dates>
</vuln>
<vuln vid="006bee4e-4c49-11e8-9c32-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.139</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
<p>3 security fixes in this release:</p>
<ul>
<li>[831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12</li>
<li>[837635] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6118</cvename>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2018-04-12</discovery>
<entry>2018-04-30</entry>
</dates>
</vuln>
<vuln vid="499f6b41-58db-4f98-b8e7-da8c18985eda">
<topic>quassel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.5</lt></range>
</package>
<package>
<name>quassel-core</name>
<range><lt>0.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="https://bugs.gentoo.org/653834">
<p>quasselcore: corruption of heap metadata caused by qdatastream
leading to preauth remote code execution.</p>
<ul>
<li>Severity: high, by default the server port is publicly open
and the address can be requested using the /WHOIS command of IRC
protocol.</li>
<li>Description: In Qdatastream protocol each object is prepended
with 4 bytes for the object size, this can be used to trigger
allocation errors.</li>
</ul>
<p>quasselcore DDOS</p>
<ul>
<li>Severity: low, only impacts unconfigured quasselcore
instances.</li>
<li>Description: A login attempt causes a NULL pointer dereference
when the database is not initialized.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.gentoo.org/653834</url>
<url>https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e</url>
<url>https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b</url>
</references>
<dates>
<discovery>2018-04-24</discovery>
<entry>2018-04-26</entry>
</dates>
</vuln>
<vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
<p>62 security fixes in this release:</p>
<ul>
<li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
<li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
<li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
<li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
<li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
<li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
<li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
<li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
<li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
<li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
<li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
<li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
<li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
<li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
<li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
<li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
<li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
<li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
<li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
<li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
<li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
<li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
<li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
<li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
<li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
<li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
<li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
<li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
<li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
<li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
<li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
<li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
<li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
<li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2018-6085</cvename>
<cvename>CVE-2018-6086</cvename>
<cvename>CVE-2018-6087</cvename>
<cvename>CVE-2018-6088</cvename>
<cvename>CVE-2018-6089</cvename>
<cvename>CVE-2018-6090</cvename>
<cvename>CVE-2018-6091</cvename>
<cvename>CVE-2018-6092</cvename>
<cvename>CVE-2018-6093</cvename>
<cvename>CVE-2018-6094</cvename>
<cvename>CVE-2018-6095</cvename>
<cvename>CVE-2018-6096</cvename>
<cvename>CVE-2018-6097</cvename>
<cvename>CVE-2018-6098</cvename>
<cvename>CVE-2018-6099</cvename>
<cvename>CVE-2018-6100</cvename>
<cvename>CVE-2018-6101</cvename>
<cvename>CVE-2018-6102</cvename>
<cvename>CVE-2018-6103</cvename>
<cvename>CVE-2018-6104</cvename>
<cvename>CVE-2018-6105</cvename>
<cvename>CVE-2018-6106</cvename>
<cvename>CVE-2018-6107</cvename>
<cvename>CVE-2018-6108</cvename>
<cvename>CVE-2018-6109</cvename>
<cvename>CVE-2018-6110</cvename>
<cvename>CVE-2018-6111</cvename>
<cvename>CVE-2018-6112</cvename>
<cvename>CVE-2018-6113</cvename>
<cvename>CVE-2018-6114</cvename>
<cvename>CVE-2018-6115</cvename>
<cvename>CVE-2018-6116</cvename>
<cvename>CVE-2018-6117</cvename>
<cvename>CVE-2018-6084</cvename>
</references>
<dates>
<discovery>2017-04-10</discovery>
<entry>2018-04-24</entry>
</dates>
</vuln>
<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released">
<ul>
<li>Defend against Bellcore glitch attacks by verifying the results
of RSA private key operations.</li>
<li>Fix implementation of the truncated HMAC extension. The
previous implementation allowed an offline 2^80 brute force
attack on the HMAC key of a single, uninterrupted connection
(with no resumption of the session).</li>
<li>Reject CRLs containing unsupported critical extensions. Found
by Falko Strenzke and Evangelos Karatsiolis.</li>
<li>Fix a buffer overread in ssl_parse_server_key_exchange() that
could cause a crash on invalid input.</li>
<li>Fix a buffer overread in ssl_parse_server_psk_hint() that could
cause a crash on invalid input.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released</url>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-04-23</entry>
</dates>
</vuln>
<vuln vid="57aec168-453e-11e8-8777-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.35</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.33</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.15</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.22</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html">
<p>MySQL Multiple Flaws Let Remote Authenticated Users Access and
Modify Data, Remote and Local Users Deny Service, and Local Users
Access Data and Gain Elevated Privileges</p>
<ul>
<li>A local user can exploit a flaw in the Replication component
to gain elevated privileges [CVE-2018-2755].</li>
<li>A remote authenticated user can exploit a flaw in the GIS
Extension component to cause denial of service conditions
[CVE-2018-2805].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2782,
CVE-2018-2784, CVE-2018-2819].</li>
<li>A remote authenticated user can exploit a flaw in the Security
Privileges component to cause denial of service conditions
[CVE-2018-2758, CVE-2018-2818].</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to cause denial of service conditions
[CVE-2018-2817].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to cause denial of service conditions [CVE-2018-2775,
CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781,
CVE-2018-2816].</li>
<li>A remote user can exploit a flaw in the Client programs
component to cause denial of service conditions [CVE-2018-2761,
CVE-2018-2773].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to partially modify data and cause denial of service
conditions [CVE-2018-2786, CVE-2018-2787].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to partially modify data and cause denial of service
conditions [CVE-2018-2812].</li>
<li>A local user can exploit a flaw in the Cluster ndbcluster/plugin
component to cause denial of service conditions [CVE-2018-2877].
</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2759,
CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].</li>
<li>A remote authenticated user can exploit a flaw in the DML
component to cause denial of service conditions [CVE-2018-2839].
</li>
<li>A remote authenticated user can exploit a flaw in the
Performance Schema component to cause denial of service conditions
[CVE-2018-2846].</li>
<li>A remote authenticated user can exploit a flaw in the Pluggable
Auth component to cause denial of service conditions
[CVE-2018-2769].</li>
<li>A remote authenticated user can exploit a flaw in the Group
Replication GCS component to cause denial of service conditions
[CVE-2018-2776].</li>
<li>A local user can exploit a flaw in the Connection component to
cause denial of service conditions [CVE-2018-2762].</li>
<li>A remote authenticated user can exploit a flaw in the Locking
component to cause denial of service conditions [CVE-2018-2771].
</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to partially access data [CVE-2018-2813].</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html</url>
<cvename>CVE-2018-2755</cvename>
<cvename>CVE-2018-2805</cvename>
<cvename>CVE-2018-2782</cvename>
<cvename>CVE-2018-2784</cvename>
<cvename>CVE-2018-2819</cvename>
<cvename>CVE-2018-2758</cvename>
<cvename>CVE-2018-2817</cvename>
<cvename>CVE-2018-2775</cvename>
<cvename>CVE-2018-2780</cvename>
<cvename>CVE-2018-2761</cvename>
<cvename>CVE-2018-2786</cvename>
<cvename>CVE-2018-2787</cvename>
<cvename>CVE-2018-2812</cvename>
<cvename>CVE-2018-2877</cvename>
<cvename>CVE-2018-2759</cvename>
<cvename>CVE-2018-2766</cvename>
<cvename>CVE-2018-2777</cvename>
<cvename>CVE-2018-2810</cvename>
<cvename>CVE-2018-2818</cvename>
<cvename>CVE-2018-2839</cvename>
<cvename>CVE-2018-2778</cvename>
<cvename>CVE-2018-2779</cvename>
<cvename>CVE-2018-2781</cvename>
<cvename>CVE-2018-2816</cvename>
<cvename>CVE-2018-2846</cvename>
<cvename>CVE-2018-2769</cvename>
<cvename>CVE-2018-2776</cvename>
<cvename>CVE-2018-2762</cvename>
<cvename>CVE-2018-2771</cvename>
<cvename>CVE-2018-2813</cvename>
<cvename>CVE-2018-2773</cvename>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-21</entry>
</dates>
</vuln>
<vuln vid="be38245e-44d9-11e8-a292-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<range><lt>4.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">
<p>Don't treat localhost as same host by default.</p>
<p>Use safe redirects when redirecting the login page if SSL is forced.</p>
<p>Make sure the version string is correctly escaped for use in generator tags.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-04-03</discovery>
<entry>2018-04-20</entry>
</dates>
</vuln>
<vuln vid="ac7da39b-4405-11e8-afbe-6805ca0b3d42">
<topic>phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.8.0</ge><lt>4.8.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-2/">
<h3>Summary</h3>
<p>CSRF vulnerability allowing arbitrary SQL execution</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible for an attacker to execute arbitrary SQL
commands.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-2/</url>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="33174280-43fa-11e8-aad5-6cf0497db129">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal security team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2018-003">
<p>CKEditor, a third-party JavaScript library included in Drupal
core, has fixed a cross-site scripting (XSS) vulnerability. The
vulnerability stemmed from the fact that it was possible to execute
XSS inside CKEditor when using the image2 plugin (which Drupal 8
core also uses).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2018-003</url>
</references>
<dates>
<discovery>2018-04-18</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="8f353420-4197-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Cache timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o_2,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180416.txt">
<p>The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180416.txt</url>
<cvename>CVE-2018-0737</cvename>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="a9e466e8-4144-11e8-a292-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/psa-2018-001">
<p>CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6,
and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because
of an issue affecting multiple subsystems with default or common module configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7600</cvename>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="41c96ffd-29a6-4dcc-9a88-65f5038fa6eb">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.4</lt></range>
<range><ge>5.26.0</ge><lt>5.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>perldelta:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.2">
<p>CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom
(regcomp.c)</p>
<p>A crafted regular expression could cause a heap buffer write overflow,
with control over the bytes written. [perl #132227]</p>
<p>CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)</p>
<p>Matching a crafted locale dependent regular expression could cause a
heap buffer read overflow and potentially information disclosure. [perl
#132063]</p>
<p>CVE-2018-6913: heap-buffer-overflow in S_pack_rec</p>
<p>pack() could cause a heap buffer write overflow with a large item
count. [perl #131844]</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.2</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.4</url>
<cvename>CVE-2018-6797</cvename>
<cvename>CVE-2018-6798</cvename>
<cvename>CVE-2018-6913</cvename>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-04-15</entry>
</dates>
</vuln>
<vuln vid="974a6d32-3fda-11e8-aea4-001b216d295b">
<topic>ipsec-tools -- remotely exploitable computational-complexity attack</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Foggia via NetBSD GNATS reports:</p>
<blockquote cite="https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682">
<p>The ipsec-tools racoon daemon contains a remotely exploitable computational
complexity attack when parsing and storing isakmp fragments. The implementation
permits a remote attacker to exhaust computational resources on the remote endpoint
by repeatedly sending isakmp fragment packets in a particular order such that
the worst-case computational complexity is realized in the algorithm utilized
to determine if reassembly of the fragments can take place.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682</url>
<cvename>CVE-2016-10396</cvename>
</references>
<dates>
<discovery>2016-12-02</discovery>
<entry>2018-04-14</entry>
</dates>
</vuln>
<vuln vid="1fccb25e-8451-438c-a2b9-6a021e4d7a31">
<topic>nghttp2 -- Denial of service due to NULL pointer dereference</topic>
<affects>
<package>
<name>libnghttp2</name>
<name>nghttp2</name>
<range><ge>1.10.0</ge><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 blog:</p>
<blockquote cite="https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/">
<p>If ALTSVC frame is received by libnghttp2 and it is larger than it can
accept, the pointer field which points to ALTSVC frame payload is left
NULL. Later libnghttp2 attempts to access another field through the
pointer, and gets segmentation fault.</p>
<p>ALTSVC frame is defined by RFC 7838.</p>
<p>The largest frame size libnghttp2 accept is by default 16384 bytes.</p>
<p>Receiving ALTSVC frame is disabled by default. Application has to
enable it explicitly by calling
nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).</p>
<p>Transmission of ALTSVC is always enabled, and it does not cause this
vulnerability.</p>
<p>ALTSVC frame is expected to be sent by server, and received by client
as defined in RFC 7838.</p>
<p>Client and server are both affected by this vulnerability if the
reception of ALTSVC frame is enabled. As written earlier, it is useless
to enable reception of ALTSVC frame on server side. So, server is
generally safe unless application accidentally enabled the reception of
ALTSVC frame.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="48894ca9-3e6f-11e8-92f0-f0def167eeea">
<topic>roundcube -- IMAP command injection vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><le>1.3.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://roundcube.net/news/2018/04/11/security-update-1.3.6">
<p>This update primarily fixes a recently discovered IMAP-cmd-injection
vulnerability caused by insufficient input validation within
the archive plugin.
Details about the vulnerability are published under CVE-2018-9846.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-9846</cvename>
<url>https://roundcube.net/news/2018/04/11/security-update-1.3.6</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.115</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
<p>The Jenkins CLI sent different error responses for commands with
view and agent arguments depending on the existence of the specified
views or agents to unauthorized users. This allowed attackers to
determine whether views or agents with specified names exist.</p>
<p>The Jenkins CLI now returns the same error messages to unauthorized
users independent of the existence of specified view or agent
names</p>
<p>Some JavaScript confirmation dialogs included the item name in an
unsafe manner, resulting in a possible cross-site scripting
vulnerability exploitable by users with permission to create or
configure items.</p>
<p>JavaScript confirmation dialogs that include the item name now
properly escape it, so it can be safely displayed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-04-11/</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-12</entry>
</dates>
</vuln>
<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.140</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4932).</li>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-4933,
CVE-2018-4934).</li>
<li>This update resolves out-of-bounds write vulnerabilities that
could lead to remote code execution (CVE-2018-4935,
CVE-2018-4937).</li>
<li>This update resolves a heap overflow vulnerability that
could lead to information disclosure (CVE-2018-4936).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4932</cvename>
<cvename>CVE-2018-4933</cvename>
<cvename>CVE-2018-4934</cvename>
<cvename>CVE-2018-4935</cvename>
<cvename>CVE-2018-4936</cvename>
<cvename>CVE-2018-4937</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-08.html</url>
</references>
<dates>
<discovery>2018-04-10</discovery>
<entry>2018-04-10</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="085a087b-3897-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.6.0</ge><lt>10.6.3</lt></range>
<range><ge>10.5.0</ge><lt>10.5.7</lt></range>
<range><ge>8.6</ge><lt>10.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/">
<p>Confidential issue comments in Slack, Mattermost, and webhook integrations.</p>
<p>Persistent XSS in milestones data-milestone-id.</p>
<p>Persistent XSS in filename of merge request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</url>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="c0c5afef-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- ipsec crash or denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The length field of the option header does not count the
size of the option header itself. This causes a problem
when the length is zero, the count is then incremented by
zero, which causes an infinite loop.</p>
<p>In addition there are pointer/offset mistakes in the
handling of IPv4 options.</p>
<h1>Impact:</h1>
<p>A remote attacker who is able to send an arbitrary packet,
could cause the remote target machine to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6918</cvename>
<freebsdsa>SA-18:05.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="a5cf3ecd-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- vt console memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation of user-provided font parameters
can result in an integer overflow, leading to the use of
arbitrary kernel memory as glyph data. Characters that
reference this data can be displayed on the screen, effectively
disclosing kernel memory.</p>
<h1>Impact:</h1>
<p>Unprivileged users may be able to access privileged
kernel data.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6917</cvename>
<freebsdsa>SA-18:04.vt</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="cdb4d962-34f9-11e8-92db-080027907385">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.11</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.5</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=367938">
<p>Unauthenticated users can trigger custom messages to admin via
paypal enrol script.</p>
<p>Suspended users with OAuth 2 authentication method can still log in to
the site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1081</cvename>
<cvename>CVE-2018-1082</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=367938</url>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-31</entry>
</dates>
</vuln>
<vuln vid="eb69bcf2-18ef-4aa2-bb0c-83b263364089">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.7,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.4,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/">
<p>CVE-2017-17742: HTTP response splitting in WEBrick</p>
<p>If a script accepts an external input and outputs it without
modification as a part of HTTP responses, an attacker can use newline
characters to deceive the clients that the HTTP response header is
stopped at there, and can inject fake HTTP responses after the newline
characters to show malicious contents to the clients.</p>
<p>CVE-2018-6914: Unintentional file and directory creation with
directory traversal in tempfile and tmpdir</p>
<p>Dir.mktmpdir method introduced by tmpdir library accepts the prefix
and the suffix of the directory which is created as the first parameter.
The prefix can contain relative directory specifiers "../", so this
method can be used to target any directory. So, if a script accepts an
external input as the prefix, and the targeted directory has
inappropriate permissions or the ruby process has inappropriate
privileges, the attacker can create a directory or a file at any
directory.</p>
<p>CVE-2018-8777: DoS by large request in WEBrick</p>
<p>If an attacker sends a large request which contains huge HTTP headers,
WEBrick try to process it on memory, so the request causes the
out-of-memory DoS attack.</p>
<p>CVE-2018-8778: Buffer under-read in String#unpack</p>
<p>String#unpack receives format specifiers as its parameter, and can
be specified the position of parsing the data by the specifier @. If a
big number is passed with @, the number is treated as the negative
value, and out-of-buffer read is occurred. So, if a script accepts an
external input as the argument of String#unpack, the attacker can read
data on heaps.</p>
<p>CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
UNIXServer and UNIXSocket</p>
<p>UNIXServer.open accepts the path of the socket to be created at the
first parameter. If the path contains NUL (\0) bytes, this method
recognize that the path is completed before the NUL bytes. So, if a
script accepts an external input as the argument of this method, the
attacker can make the socket file in the unintentional path. And,
UNIXSocket.open also accepts the path of the socket to be created at
the first parameter without checking NUL bytes like UNIXServer.open.
So, if a script accepts an external input as the argument of this
method, the attacker can accepts the socket file in the unintentional
path.</p>
<p>CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
in Dir</p>
<p>Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
target directory as their parameter. If the parameter contains NUL (\0)
bytes, these methods recognize that the path is completed before the
NUL bytes. So, if a script accepts an external input as the argument of
these methods, the attacker can make the unintentional directory
traversal.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</url>
<cvename>CVE-2017-17742</cvename>
<cvename>CVE-2018-6914</cvename>
<cvename>CVE-2018-8777</cvename>
<cvename>CVE-2018-8778</cvename>
<cvename>CVE-2018-8779</cvename>
<cvename>CVE-2018-8780</cvename>
</references>
<dates>
<discovery>2018-03-28</discovery>
<entry>2018-03-29</entry>
</dates>
</vuln>
<vuln vid="5a9bbb6e-32d3-11e8-a769-6daaba161086">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.9.0</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/">
<h1>Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)</h1>
<p>Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.</p>
<h1>'path' module regular expression denial of service (CVE-2018-7158)</h1>
<p>The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.</p>
<h1>Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)</h1>
<p>The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/</url>
<cvename>CVE-2018-7158</cvename>
<cvename>CVE-2018-7159</cvename>
<cvename>CVE-2018-7160</cvename>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="1ce95bc7-3278-11e8-b527-00012e582166">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><ge>2.16.6</ge><lt>2.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKit team reports many vulnerabilities.</p>
<p>Please reference the CVE/URL list for details.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0008.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0009.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0010.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0001.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0002.html</url>
<cvename>CVE-2017-7087</cvename>
<cvename>CVE-2017-7089</cvename>
<cvename>CVE-2017-7090</cvename>
<cvename>CVE-2017-7091</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7093</cvename>
<cvename>CVE-2017-7095</cvename>
<cvename>CVE-2017-7096</cvename>
<cvename>CVE-2017-7098</cvename>
<cvename>CVE-2017-7100</cvename>
<cvename>CVE-2017-7102</cvename>
<cvename>CVE-2017-7104</cvename>
<cvename>CVE-2017-7107</cvename>
<cvename>CVE-2017-7109</cvename>
<cvename>CVE-2017-7111</cvename>
<cvename>CVE-2017-7117</cvename>
<cvename>CVE-2017-7120</cvename>
<cvename>CVE-2017-13783</cvename>
<cvename>CVE-2017-13784</cvename>
<cvename>CVE-2017-13785</cvename>
<cvename>CVE-2017-13788</cvename>
<cvename>CVE-2017-13791</cvename>
<cvename>CVE-2017-13792</cvename>
<cvename>CVE-2017-13794</cvename>
<cvename>CVE-2017-13795</cvename>
<cvename>CVE-2017-13796</cvename>
<cvename>CVE-2017-13798</cvename>
<cvename>CVE-2017-13802</cvename>
<cvename>CVE-2017-13803</cvename>
<cvename>CVE-2017-7156</cvename>
<cvename>CVE-2017-7157</cvename>
<cvename>CVE-2017-13856</cvename>
<cvename>CVE-2017-13866</cvename>
<cvename>CVE-2017-13870</cvename>
<cvename>CVE-2017-5753</cvename>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2018-4088</cvename>
<cvename>CVE-2018-4089</cvename>
<cvename>CVE-2018-4096</cvename>
<cvename>CVE-2017-7153</cvename>
<cvename>CVE-2017-7160</cvename>
<cvename>CVE-2017-7161</cvename>
<cvename>CVE-2017-7165</cvename>
<cvename>CVE-2017-13884</cvename>
<cvename>CVE-2017-13885</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="3ae21918-31e3-11e8-927b-e8e0b747a45a">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.181</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[823553] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="b7cff5a9-31cc-11e8-8f07-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180327.txt">
<ul><li>Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)<br/>
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180327.txt</url>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2018-03-27</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="dc0c201c-31da-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.5.0</ge><lt>10.5.6</lt></range>
<range><ge>10.4.0</ge><lt>10.4.6</lt></range>
<range><ge>8.3</ge><lt>10.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/">
<h1>SSRF in services and web hooks</h1>
<p>There were multiple server-side request forgery issues in the Services feature.
An attacker could make requests to servers within the same network of the GitLab
instance. This could lead to information disclosure, authentication bypass, or
potentially code execution. This issue has been assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8801">CVE-2018-8801</a>.</p>
<h1>Gitlab Auth0 integration issue</h1>
<p>There was an issue with the GitLab <code>omniauth-auth0</code> configuration
which resulted in the Auth0 integration signing in the wrong users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8801</cvename>
<url>https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
<modified>2018-04-07</modified>
</dates>
</vuln>
<vuln vid="23f59689-0152-42d3-9ade-1658d6380567">
<topic>mozilla -- use-after-free in compositor</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.3,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>52.7.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>52.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/">
<h1>CVE-2018-5148: Use-after-free in compositor</h1>
<p>A use-after-free vulnerability can occur in the
compositor during certain graphics operations when a raw
pointer is used instead of a reference counted one. This
results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5148</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-10/</url>
</references>
<dates>
<discovery>2018-03-26</discovery>
<entry>2018-03-27</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="81946ace-6961-4488-a164-22d58ebc8d66">
<topic>rails-html-sanitizer -- possible XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSS-Security list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2018/03/22/4">
<p>There is a possible XSS vulnerability in rails-html-sanitizer. The gem
allows non-whitelisted attributes to be present in sanitized output
when input with specially-crafted HTML fragments, and these attributes
can lead to an XSS attack on target applications.</p>
<p>This issue is similar to CVE-2018-8048 in Loofah.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/22/4</url>
<cvename>CVE-2018-3741</cvename>
</references>
<dates>
<discovery>2018-03-22</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="f38187e7-2f6e-11e8-8f07-b499baebfeaf">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.30</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd reports:</p>
<blockquote cite="https://www.apache.org/dist/httpd/CHANGES_2.4.33">
<p>Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig
enabled (CVE-2017-15710)</p>
<p>mod_session: CGI-like applications that intend to read from
mod_session's 'SessionEnv ON' could be fooled into reading
user-supplied data instead. (CVE-2018-1283)</p>
<p>mod_cache_socache: Fix request headers parsing to avoid a possible
crash with specially crafted input data. (CVE-2018-1303)</p>
<p>core: Possible crash with excessively long HTTP request headers.
Impractical to exploit with a production build and production
LogLevel. (CVE-2018-1301)</p>
<p>core: Configure the regular expression engine to match '$' to the
end of the input string only, excluding matching the end of any
embedded newline characters. Behavior can be changed with new
directive 'RegexDefaultOptions'. (CVE-2017-15715)</p>
<p>mod_auth_digest: Fix generation of nonce values to prevent replay
attacks across servers using a common Digest domain. This change
may cause problems if used with round robin load balancers.
(CVE-2018-1312)</p>
<p>mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.apache.org/dist/httpd/CHANGES_2.4.33</url>
<cvename>CVE-2017-15710</cvename>
<cvename>CVE-2018-1283</cvename>
<cvename>CVE-2018-1303</cvename>
<cvename>CVE-2018-1301</cvename>
<cvename>CVE-2017-15715</cvename>
<cvename>CVE-2018-1312</cvename>
<cvename>CVE-2018-1302</cvename>
</references>
<dates>
<discovery>2018-03-23</discovery>
<entry>2018-03-24</entry>
<modified>2018-03-27</modified>
</dates>
</vuln>
<vuln vid="d50a50a2-2f3e-11e8-86f8-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/">
<p>Medium risk: Tasks Local File Inclusion</p>
<p>Medium risk: Forum Password Check Bypass</p>
<p>Low risk: Admin Permissions Group Title XSS</p>
<p>Low risk: Attachment types file extension XSS</p>
<p>Low risk: Moderator Tools XSS</p>
<p>Low risk: Security Questions XSS</p>
<p>Low risk: Settings Management XSS</p>
<p>Low risk: Templates Set Name XSS</p>
<p>Low risk: Usergroup Promotions XSS</p>
<p>Low risk: Warning Types XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="6d52bda1-2e54-11e8-a68f-485b3931c969">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.22.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-22</entry>
</dates>
</vuln>
<vuln vid="39a30e0a-0c34-431b-9dce-b87cab02412a">
<topic>Sanitize -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sanitize</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sanitize release:</p>
<blockquote cite="https://github.com/rgrove/sanitize/releases">
<p>Fixed an HTML injection vulnerability that could allow XSS.</p>
<p>When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2,
a specially crafted HTML fragment can cause libxml2 to generate
improperly escaped output, allowing non-whitelisted attributes to be
used on whitelisted elements.</p>
<p>Sanitize now performs additional escaping on affected attributes to
prevent this.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rgrove/sanitize/releases</url>
<url>https://github.com/rgrove/sanitize/issues/176</url>
<cvename>CVE-2018-3740</cvename>
</references>
<dates>
<discovery>2018-03-19</discovery>
<entry>2018-03-21</entry>
</dates>
</vuln>
<vuln vid="ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/144">
<p>This issue has been created for public disclosure of an XSS / code
injection vulnerability that was responsibly reported by the Shopify
Application Security Team.</p>
<p>Loofah allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/144</url>
<cvename>CVE-2018-8048</cvename>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-20</entry>
</dates>
</vuln>
<vuln vid="b3edc7d9-9af5-4daf-88f1-61f68f4308c2">
<topic>Jupyter Notebook -- vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py34-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<range><lt>5.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768">
<p>In Jupyter Notebook before 5.4.1, a maliciously forged notebook file
can bypass sanitization to execute JavaScript in the notebook context.
Specifically, invalid HTML is 'fixed' by jQuery after sanitization,
making it dangerous.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768</url>
<cvename>CVE-2018-8768</cvename>
</references>
<dates>
<discovery>2018-03-18</discovery>
<entry>2018-03-19</entry>
</dates>
</vuln>
<vuln vid="928d5c59-2a5a-11e8-a712-0025908740c2">
<topic>SquirrelMail -- post-authentication access privileges</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><le>20170705</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Grunow reports:</p>
<blockquote cite="https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/">
<p> An attacker able to exploit this vulnerability can extract files
of the server the application is running on. This may include
configuration files, log files and additionally all files that are
readable for all users on the system. This issue is
post-authentication. That means an attacker would need valid
credentials for the application to log in or needs to exploit an
additional vulnerability of which we are not aware of at this point
of time.</p>
<p>An attacker would also be able to delete files on the system, if
the user running the application has the rights to do so.</p>
<p>Does this issue affect me?</p>
<p>Likely yes, if you are using Squirrelmail. We checked the latest
development version, which is 1.5.2-svn and the latest version
available for download at this point of time, 1.4.22. Both contain
the vulnerable code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/17/2</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-8741</url>
<cvename>CVE-2018-8741</cvename>
</references>
<dates>
<discovery>2017-05-21</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="b3e04661-2a0a-11e8-9e63-3085a9a47796">
<topic>slurm-wlm -- SQL Injection attacks against SlurmDBD</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000006.html">
<p>Several issues were discovered with incomplete sanitization of
user-provided text strings, which could potentially lead to SQL
injection attacks against SlurmDBD itself. Such exploits could lead to a
loss of accounting data, or escalation of user privileges on the cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7033</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-7033</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="64ee858e-e035-4bb4-9c77-2468963dddb8">
<topic>libvorbis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14632">
<p>Xiph.Org libvorbis 1.3.5 allows Remote Code Execution
upon freeing uninitialized memory in the function
vorbis_analysis_headerout() in info.c when
vi->channels<=0, a similar issue to Mozilla bug
550184.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14633">
<p>In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read
vulnerability exists in the function mapping0_forward() in
mapping0.c, which may lead to DoS when operating on a
crafted audio file with vorbis_analysis().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14632</cvename>
<cvename>CVE-2017-14633</cvename>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
</dates>
</vuln>
<vuln vid="7943794f-707f-4e31-9fea-3bbf1ddcedc1">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
<package>
<name>libtremor</name>
<range><lt>1.2.1.s20180316</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>59.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/">
<h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1>
<p>An out of bounds memory write while processing Vorbis
audio data was reported through the Pwn2Own contest.</p>
<h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1>
<p>The libtremor library has the same flaw as
CVE-2018-5146. This library is used by Firefox in place of
libvorbis on Android and ARM platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5146</cvename>
<cvename>CVE-2018-5147</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-08/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-09/</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="2aa9967c-27e0-11e8-9ae1-080027ac955c">
<topic>e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.44.0</lt></range>
</package>
<package>
<name>e2fsprogs-libblkid</name>
<range><lt>1.44.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0">
<p>Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.</p>
</blockquote>
</body>
</description>
<references>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="74daa370-2797-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- Speculative Execution Vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A number of issues relating to speculative execution
were found last year and publicly announced January 3rd.
Two of these, known as Meltdown and Spectre V2, are addressed
here.</p>
<p>CVE-2017-5754 (Meltdown) - ------------------------</p>
<p>This issue relies on an affected CPU speculatively
executing instructions beyond a faulting instruction. When
this happens, changes to architectural state are not
committed, but observable changes may be left in micro-
architectural state (for example, cache). This may be used
to infer privileged data.</p>
<p>CVE-2017-5715 (Spectre V2) - --------------------------</p>
<p>Spectre V2 uses branch target injection to speculatively
execute kernel code at an address under the control of an
attacker.</p>
<h1>Impact:</h1>
<p>An attacker may be able to read secret data from the
kernel or from a process when executing untrusted code (for
example, in a web browser).</p>
</body>
</description>
<references>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2017-5754</cvename>
<freebsdsa>SA-18:03.speculative_execution</freebsdsa>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="dca7ced0-2796-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- ipsec validation and use-after-free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_7</lt></range>
<range><ge>10.3</ge><lt>10.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a lack of strict checking, an attacker from a
trusted host can send a specially constructed IP packet
that may lead to a system crash.</p>
<p>Additionally, a use-after-free vulnerability in the AH
handling code could cause unpredictable results.</p>
<h1>Impact:</h1>
<p>Access to out of bounds or freed mbuf data can lead to
a kernel panic or other unpredictable results.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6916</cvename>
<freebsdsa>SA-18:01.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="313078e3-26e2-11e8-9920-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4919).</li>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2018-4920).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4919</cvename>
<cvename>CVE-2018-4920</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-05.html</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c71cdc95-3c18-45b7-866a-af28b59aabb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/">
<p>CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList</p>
<p>CVE-2018-5128: Use-after-free manipulating editor selection ranges</p>
<p>CVE-2018-5129: Out-of-bounds write with malformed IPC messages</p>
<p>CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption</p>
<p>CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources</p>
<p>CVE-2018-5132: WebExtension Find API can search privileged pages</p>
<p>CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized</p>
<p>CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions</p>
<p>CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts</p>
<p>CVE-2018-5136: Same-origin policy violation with data: URL shared workers</p>
<p>CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources</p>
<p>CVE-2018-5138: Android Custom Tab address spoofing through long domain names</p>
<p>CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol</p>
<p>CVE-2018-5141: DOS attack through notifications Push API</p>
<p>CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs</p>
<p>CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar</p>
<p>CVE-2018-5126: Memory safety bugs fixed in Firefox 59</p>
<p>CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5125</cvename>
<cvename>CVE-2018-5126</cvename>
<cvename>CVE-2018-5127</cvename>
<cvename>CVE-2018-5128</cvename>
<cvename>CVE-2018-5129</cvename>
<cvename>CVE-2018-5130</cvename>
<cvename>CVE-2018-5131</cvename>
<cvename>CVE-2018-5132</cvename>
<cvename>CVE-2018-5133</cvename>
<cvename>CVE-2018-5134</cvename>
<cvename>CVE-2018-5135</cvename>
<cvename>CVE-2018-5136</cvename>
<cvename>CVE-2018-5137</cvename>
<cvename>CVE-2018-5138</cvename>
<cvename>CVE-2018-5140</cvename>
<cvename>CVE-2018-5141</cvename>
<cvename>CVE-2018-5142</cvename>
<cvename>CVE-2018-5143</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-07/</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
<modified>2018-03-16</modified>
</dates>
</vuln>
<vuln vid="fb26f78a-26a9-11e8-a1c2-00505689d4ae">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba44</name>
<range><lt>4.4.17</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.16</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.14</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1050.html">
<p>Missing null pointer checks may crash the external
print server process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1057.html">
<p>On a Samba 4 AD DC any authenticated user can change
other user's passwords over LDAP, including the
passwords of administrative users and service accounts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1050.html</url>
<cvename>CVE-2018-1050</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1057.html</url>
<cvename>CVE-2018-1057</cvename>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c2f107e1-2493-11e8-b3e8-001cc0382b2f">
<topic>mbed TLS (PolarSSL) -- remote code execution</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.0</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01">
<ul>
<li>When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet can be used to selectively
corrupt 6 bytes on the peer's heap, potentially leading to a
crash or remote code execution. This can be triggered remotely
from either side in both TLS and DTLS.</li>
<li>When RSASSA-PSS signature verification is enabled, sending a
maliciously constructed certificate chain can be used to cause a
buffer overflow on the peer's stack, potentially leading to crash
or remote code execution. This can be triggered remotely from
either side in both TLS and DTLS.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01</url>
<cvename>CVE-2018-0487</cvename>
<cvename>CVE-2018-0488</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-03-10</entry>
</dates>
</vuln>
<vuln vid="555af074-22b9-11e8-9799-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.146</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">
<p>45 security fixes in this release:</p>
<ul>
<li>[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02</li>
<li>[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12</li>
<li>[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31</li>
<li>[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30</li>
<li>[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07</li>
<li>[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03</li>
<li>[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01</li>
<li>[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08</li>
<li>[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25</li>
<li>[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23</li>
<li>[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01</li>
<li>[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20</li>
<li>[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06</li>
<li>[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03</li>
<li>[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24</li>
<li>[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26</li>
<li>[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10</li>
<li>[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24</li>
<li>[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05</li>
<li>[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24</li>
<li>[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21</li>
<li>[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6062</cvename>
<cvename>CVE-2018-6057</cvename>
<cvename>CVE-2018-6063</cvename>
<cvename>CVE-2018-6064</cvename>
<cvename>CVE-2018-6065</cvename>
<cvename>CVE-2018-6066</cvename>
<cvename>CVE-2018-6067</cvename>
<cvename>CVE-2018-6069</cvename>
<cvename>CVE-2018-6070</cvename>
<cvename>CVE-2018-6071</cvename>
<cvename>CVE-2018-6072</cvename>
<cvename>CVE-2018-6073</cvename>
<cvename>CVE-2018-6074</cvename>
<cvename>CVE-2018-6075</cvename>
<cvename>CVE-2018-6076</cvename>
<cvename>CVE-2018-6077</cvename>
<cvename>CVE-2018-6078</cvename>
<cvename>CVE-2018-6079</cvename>
<cvename>CVE-2018-6080</cvename>
<cvename>CVE-2018-6081</cvename>
<cvename>CVE-2018-6082</cvename>
<cvename>CVE-2018-6083</cvename>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2018-03-08</entry>
</dates>
</vuln>
<vuln vid="c5ab620f-4576-4ad5-b51f-93e4fec9cd0e">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)</p>
<p>wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)</p>
<p>wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)</p>
<p>wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)</p>
<p>wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)</p>
<p>wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)</p>
<p>wnpa-sec-2018-11. Pcapng file parser crash.</p>
<p>wnpa-sec-2018-12. IPMI dissector crash.</p>
<p>wnpa-sec-2018-13. SIGCOMP dissector crash.</p>
<p>wnpa-sec-2018-14. NBAP dissector crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-05.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-06.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-07.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-08.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-09.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-10.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-11.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-14.html</url>
<cvename>CVE-2018-7320</cvename>
<cvename>CVE-2018-7321</cvename>
<cvename>CVE-2018-7322</cvename>
<cvename>CVE-2018-7323</cvename>
<cvename>CVE-2018-7324</cvename>
<cvename>CVE-2018-7325</cvename>
<cvename>CVE-2018-7326</cvename>
<cvename>CVE-2018-7327</cvename>
<cvename>CVE-2018-7328</cvename>
<cvename>CVE-2018-7329</cvename>
<cvename>CVE-2018-7330</cvename>
<cvename>CVE-2018-7331</cvename>
<cvename>CVE-2018-7332</cvename>
<cvename>CVE-2018-7333</cvename>
<cvename>CVE-2018-7334</cvename>
<cvename>CVE-2018-7335</cvename>
<cvename>CVE-2018-7336</cvename>
<cvename>CVE-2018-7337</cvename>
<cvename>CVE-2018-7417</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-03-04</entry>
</dates>
</vuln>
<vuln vid="2040c7f5-1e3a-11e8-8ae9-0050569f0b83">
<topic>isc-dhcp -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp44-server</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp44-client</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp43-server</name>
<range><le>4.3.6</le></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<range><le>4.3.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01565">
<p>Failure to properly bounds check a buffer used for processing
DHCP options allows a malicious server (or an entity
masquerading as a server) to cause a buffer overflow (and
resulting crash) in dhclient by sending a response containing a
specially constructed options section.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01567">
<p>A malicious client which is allowed to send very large amounts
of traffic (billions of packets) to a DHCP server can eventually
overflow a 32-bit reference counter, potentially causing dhcpd
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5732</cvename>
<cvename>CVE-2018-5733</cvename>
<url>https://kb.isc.org/article/AA-01565</url>
<url>https://kb.isc.org/article/AA-01567</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-03-02</entry>
</dates>
</vuln>
<vuln vid="30704aba-1da4-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds reads</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/317">
<p>CVE-2017-14245 (Medium): An out of bounds read in the function
d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of
the NAN and INFINITY floating-point values.</p>
<p>CVE-2017-14246 (Medium): An out of bounds read in the function
d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of the
NAN and INFINITY floating-point values.</p>
</blockquote>
<p>my123px on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/344">
<p>CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14245.</p>
<p>CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14246.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14245</cvename>
<cvename>CVE-2017-14246</cvename>
<url>https://github.com/erikd/libsndfile/issues/317</url>
<cvename>CVE-2017-17456</cvename>
<cvename>CVE-2017-17457</cvename>
<url>https://github.com/erikd/libsndfile/issues/344</url>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="2b386075-1d9c-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo, Gentoo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(buffer overflow and application crash) or possibly have unspecified
other impact via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(invalid read and application crash) via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(heap-based buffer over-read and application crash) via a crafted audio
file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/">
<p>CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile
1.0.28 allows remote attackers to cause a denial of service (buffer
over-read and application crash) via a crafted audio file.</p>
</blockquote>
<p>manxorist on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/292">
<p>CVE-2017-12562 (High): Heap-based Buffer Overflow in the
psf_binheader_writef function in common.c in libsndfile through
1.0.28 allows remote attackers to cause a denial of service
(application crash) or possibly have unspecified other impact.</p>
</blockquote>
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/318">
<p>CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero
error exists in the function double64_init() in double64.c, which
may lead to DoS when playing a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8361</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/232</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-8362</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/231</url>
<url>https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808</url>
<cvename>CVE-2017-8363</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/233</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<url>https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8</url>
<cvename>CVE-2017-8365</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/</url>
<url>https://github.com/erikd/libsndfile/issues/230</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-12562</cvename>
<url>https://github.com/erikd/libsndfile/issues/292/</url>
<url>https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8</url>
<cvename>CVE-2017-14634</cvename>
<url>https://github.com/erikd/libsndfile/issues/318</url>
<url>https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="e3eeda2e-1d67-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.22</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.17</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.12</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.8</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1834/">
<ul>
<li>CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path</url>
<cvename>CVE-2018-1058</cvename>
</references>
<dates>
<discovery>2018-03-01</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="6a449a37-1570-11e8-8e00-000c294a5758">
<topic>strongswan - Insufficient input validation in RSASSA-PSS signature parser</topic>
<affects>
<package>
<name>strongswan</name>
<range><eq>5.6.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that
was caused by insufficient input validation. One of the configurable
parameters in algorithm identifier structures for RSASSA-PSS signatures is the
mask generation function (MGF). Only MGF1 is currently specified for this
purpose. However, this in turn takes itself a parameter that specifies the
underlying hash function. strongSwan's parser did not correctly handle the
case of this parameter being absent, causing an undefined data read.
his vulnerability has been registered as CVE-2018-6459.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6459</cvename>
<url>https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-19</entry>
</dates>
</vuln>
<vuln vid="004debf9-1d16-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds read memory access</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Laurent Delosieres, Secunia Research at Flexera Software reports:</p>
<blockquote cite="https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/">
<p>Secunia Research has discovered a vulnerability in libsndfile, which can be
exploited by malicious people to disclose potentially sensitive information.
The vulnerability is caused due to an error in the "aiff_read_chanmap()" function
(src/aiff.c), which can be exploited to cause an out-of-bounds read memory access
via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28.
Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6892</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6892</url>
<url>https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/</url>
<url>https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="af485ef4-1c58-11e8-8477-d05099c0ae8c">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_6</lt></range>
<range><ge>10.3</ge><lt>10.3_27</lt></range>
</package>
<package>
<name>ntp</name>
<range><lt>4.2.8p11</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S">
<p>The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.</p>
<p>This release addresses five security issues in ntpd:</p>
<ul>
<li>LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil
vulnerability: ephemeral association attack</li>
<li>INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909:
ctl_getitem(): buffer read overrun leads to undefined
behavior and information leak</li>
<li>LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple
authenticated ephemeral associations</li>
<li>LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved
symmetric mode cannot recover from bad state</li>
<li>LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909:
Unauthenticated packet can reset authenticated interleaved
association</li>
</ul>
<p>one security issue in ntpq:</p>
<ul>
<li>MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909:
ntpq:decodearr() can write beyond its buffer limit</li>
</ul>
<p>and provides over 33 bugfixes and 32 other improvements.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2018-7182</cvename>
<cvename>CVE-2018-7170</cvename>
<cvename>CVE-2018-7184</cvename>
<cvename>CVE-2018-7185</cvename>
<cvename>CVE-2018-7183</cvename>
<freebsdsa>SA-18:02.ntp</freebsdsa>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S</url>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-28</entry>
<modified>2018-03-14</modified>
</dates>
</vuln>
<vuln vid="abfc932e-1ba8-11e8-a944-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.167</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release:</p>
<ul>
<li>[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6056</cvename>
<url>https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2018-01-26</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
<li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
<li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
<li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
2017-08-09</li>
<li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
<li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
<li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
<li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
<li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
<li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
<li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
<li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
<li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
<li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
<li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
<li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
<li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
<li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
<li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
<li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6031</cvename>
<cvename>CVE-2018-6032</cvename>
<cvename>CVE-2018-6033</cvename>
<cvename>CVE-2018-6034</cvename>
<cvename>CVE-2018-6035</cvename>
<cvename>CVE-2018-6036</cvename>
<cvename>CVE-2018-6037</cvename>
<cvename>CVE-2018-6038</cvename>
<cvename>CVE-2018-6039</cvename>
<cvename>CVE-2018-6040</cvename>
<cvename>CVE-2018-6041</cvename>
<cvename>CVE-2018-6042</cvename>
<cvename>CVE-2018-6043</cvename>
<cvename>CVE-2018-6045</cvename>
<cvename>CVE-2018-6046</cvename>
<cvename>CVE-2018-6047</cvename>
<cvename>CVE-2018-6048</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2018-6049</cvename>
<cvename>CVE-2018-6050</cvename>
<cvename>CVE-2018-6051</cvename>
<cvename>CVE-2018-6052</cvename>
<cvename>CVE-2018-6053</cvename>
<cvename>CVE-2018-6054</cvename>
<url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
<topic>tomcat -- Security constraints ignored or applied too late</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.84</le></range>
<range><ge>8.0.0</ge><le>8.0.49</le></range>
<range><ge>8.5.0</ge><le>8.5.27</le></range>
<range><ge>9.0.0</ge><le>9.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781@%3Cannounce.tomcat.apache.org%3E">
<p>Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.</p>
</blockquote>
<blockquote cite="https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E">
<p>The URL pattern of "" (the empty string) which exactly maps to the
context root was not correctly handled when used as part of a security
constraint definition. This caused the constraint to be ignored. It was,
therefore, possible for unauthorised users to gain access to web
application resources that should have been protected. Only security
constraints with a URL pattern of the empty string were affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://tomcat.apache.org/security-9.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
<cvename>CVE-2018-1304</cvename>
<cvename>CVE-2018-1305</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="22438240-1bd0-11e8-a2ec-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.4</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180227.txt">
<p>
Shibboleth SP software vulnerable to additional data forgery flaws
</p>
<p>
The XML processing performed by the Service Provider software has
been found to be vulnerable to new flaws similar in nature to the
one addressed in an advisory last month.
</p>
<p>
These bugs involve the use of other XML constructs rather than
entity references, and therefore required additional mitigation once
discovered. As with the previous issue, this flaw allows for
changes to an XML document that do not break a digital signature but
can alter the user data passed through to applications behind the SP
and result in impersonation attacks and exposure of protected
information.
</p>
<p>
As before, the use of XML Encryption is a significant mitigation,
but we have not dismissed the possibility that attacks on the
Response "envelope" may be possible, in both the original and this
new case. No actual attacks of this nature are known, so deployers
should prioritize patching systems that expect to handle unencrypted
SAML assertions.
</p>
<p>
An updated version of XMLTooling-C (V1.6.4) is available that
protects against these new attacks, and should help prevent similar
vulnerabilities in the future.
</p>
<p>
Unlike the previous case, these bugs are NOT prevented by any
existing Xerces-C parser version on any platform and cannot be
addressed by any means other than the updated XMLTooling-C library.
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180227.txt</url>
<cvename>CVE-2018-0489</cvename>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="57580fcc-1a61-11e8-97e0-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-001">
<p>CVE-2017-6926: Comment reply form allows access to restricted content</p>
<p>CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete</p>
<p>CVE-2017-6928: Private file access bypass - Moderately Critical</p>
<p>CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical</p>
<p>CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions</p>
<p>CVE-2017-6931: Settings Tray access bypass</p>
<p>CVE-2017-6932: External link injection on 404 pages when linking to the current page</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6926</cvename>
<cvename>CVE-2017-6927</cvename>
<cvename>CVE-2017-6928</cvename>
<cvename>CVE-2017-6929</cvename>
<cvename>CVE-2017-6930</cvename>
<cvename>CVE-2017-6931</cvename>
<cvename>CVE-2017-6932</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-25</entry>
</dates>
</vuln>
<vuln vid="d9fe59ea-1940-11e8-9eb8-5404a68ad561">
<topic>cvs -- Remote code execution via ssh command injection</topic>
<affects>
<package>
<name>cvs</name>
<range><lt>1.20120905_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hank Leininger reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html">
<p>Bugs in Git, Subversion, and Mercurial were just announced and patched
which allowed arbitrary local command execution if a malicious name was
used for the remote server, such as starting with - to pass options to
the ssh client:
git clone ssh://-oProxyCommand=some-command...
CVS has a similar problem with the -d option:</p>
<p>Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10</url>
<cvename>CVE-2017-12836</cvename>
<freebsdpr>ports/226088</freebsdpr>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2018-02-24</entry>
</dates>
</vuln>
<vuln vid="289269f1-0def-11e8-99b0-d017c2987f9a">
<topic>LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.4.5</lt></range>
<range><ge>6.0.0</ge><lt>6.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibreOffice reports:</p>
<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/">
<p>LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file
URL (e.g file://) which can be used to inject local files into the
spreadsheet without warning the user. Subsequent formulas can operate on
that inserted data and construct a remote URL whose path leaks the local
data to a remote attacker.</p>
<p>In later versions of LibreOffice without this flaw, WEBSERVICE has now
been limited to accessing http and https URLs along with bringing
WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.</p>
<p><strong>Note:</strong> This vulnerability has been identified upstream
as CVE-2018-1055, but NVD/Mitre are advising it's a reservation
duplicate of CVE-2018-6871 which should be used instead.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/</url>
<url>https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure</url>
<cvename>CVE-2018-6871</cvename>
<freebsdpr>ports/225797</freebsdpr>
</references>
<dates>
<discovery>2018-02-09</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="d5b6d151-1887-11e8-94f7-9c5c8e75236a">
<topic>squid -- Vulnerable to Denial of Service attack</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.27_3</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Louis Dion-Marcil reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_1.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses.</p>
<p>This problem allows a remote server delivering certain ESI
response syntax to trigger a denial of service for all clients
accessing the Squid service.</p>
<p>Due to unrelated changes Squid-3.5 has become vulnerable to some
regular ESI server responses also triggering this issue.</p>
<p>This problem is limited to the Squid custom ESI parser.
Squid built to use libxml2 or libexpat XML parsers do not have
this problem.</p>
</blockquote>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_2.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses or downloading
intermediate CA certificates.</p>
<p>This problem allows a remote client delivering certain HTTP
requests in conjunction with certain trusted server responses to
trigger a denial of service for all clients accessing the Squid
service.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_1.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_2.txt</url>
<cvename>CVE-2018-1000024</cvename>
<cvename>CVE-2018-1000027</cvename>
<url>https://www.debian.org/security/2018/dsa-4122</url>
<freebsdpr>ports/226138</freebsdpr>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="933654ce-17b8-11e8-90b8-001999f8d30b">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-004 - When processing a SUBSCRIBE request the
res_pjsip_pubsub module stores the accepted formats present
in the Accept headers of the request. This code did not
limit the number of headers it processed despite having
a fixed limit of 32. If more than 32 Accept headers were
present the code would write outside of its memory and
cause a crash.</p>
<p>AST-2018-005 - A crash occurs when a number of
authenticated INVITE messages are sent over TCP or TLS
and then the connection is suddenly closed. This issue
leads to a segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-004.html</url>
<cvename>CVE-2018-7284</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2018-005.html</url>
<cvename>CVE-2018-7286</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
<modified>2018-06-12</modified>
</dates>
</vuln>
<vuln vid="f9f5c5a2-17b5-11e8-90b8-001999f8d30b">
<topic>asterisk and pjsip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-002 - By crafting an SDP message with an
invalid media format description Asterisk crashes when
using the pjsip channel driver because pjproject's sdp
parsing algorithm fails to catch the invalid media format
description.</p>
<p>AST-2018-003 - By crafting an SDP message body with
an invalid fmtp attribute Asterisk crashes when using the
pjsip channel driver because pjproject's fmtp retrieval
function fails to check if fmtp value is empty (set empty
if previously parsed as invalid).</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-002.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2018-003.html</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="261ca31c-179f-11e8-b8b9-6805ca0b3d42">
<topic>phpMyAdmin -- self XSS in central columns feature</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-1/">
<h3>Summary</h3>
<p>Self XSS in central columns feature</p>
<h3>Description</h3>
<p>A self-cross site scripting (XSS) vulnerability has been
reported relating to the central columns feature.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>A valid token must be used in the attack</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-1/</url>
<cvename>CVE-2018-7260</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="86291013-16e6-11e8-ae9f-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.1.0</ge><le>10.2.7</le></range>
<range><ge>10.3.0</ge><le>10.3.6</le></range>
<range><ge>10.4.0</ge><le>10.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/">
<h1>SnippetFinder information disclosure</h1>
<p>The GitLab SnippetFinder component contained an information disclosure
which allowed access to snippets restricted to Only team members or
configured as disabled. The issue is now resolved in the latest version.</p>
<h1>LDAP API authorization issue</h1>
<p>An LDAP API endpoint contained an authorization vulnerability which
unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
the latest release.</p>
<h1>Persistent XSS mermaid markdown</h1>
<p>The mermaid markdown feature contained a persistent XSS issue that is now
resolved in the latest release.</p>
<h1>Insecure direct object reference Todo API</h1>
<p>The Todo API was vulnerable to an insecure direct object reference issue
which resulted in an information disclosure of confidential data.</p>
<h1>GitHub import access control issue</h1>
<p>An improper access control weakness issue was discovered in the GitHub
import feature. The issue allowed an attacker to create projects under other
accounts which they shouldn't have access to. The issue is now resolved in
the latest version.</p>
<h1>Protected variables information disclosure</h1>
<p>The CI jobs protected tag feature contained a vulnerability which
resulted in an information disclosure of protected variables. The issue is
now resolved in the latest release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</url>
</references>
<dates>
<discovery>2018-02-07</discovery>
<entry>2018-02-21</entry>
</dates>
</vuln>
<vuln vid="7afc5e56-156d-11e8-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_02.txt">
<p>Use after free when server is disconnected during netsplits.
Found by Joseph Bisch.</p>
<p>Use after free when SASL messages are received in unexpected order.
Found by Joseph Bisch.</p>
<p>Null pointer dereference when an “empty” nick has been observed by
Irssi. Found by Joseph Bisch.</p>
<p>When the number of windows exceed the available space, Irssi would
crash due to Null pointer dereference. Found by Joseph Bisch.</p>
<p>Certain nick names could result in out of bounds access when printing
theme strings. Found by Oss-Fuzz.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_02.txt</url>
<cvename>CVE-2018-7054</cvename>
<cvename>CVE-2018-7053</cvename>
<cvename>CVE-2018-7052</cvename>
<cvename>CVE-2018-7051</cvename>
<cvename>CVE-2018-7050</cvename>
<freebsdpr>ports/226001</freebsdpr>
</references>
<dates>
<discovery>2018-02-15</discovery>
<entry>2018-02-19</entry>
<modified>2018-02-22</modified>
</dates>
</vuln>
<vuln vid="a183acb5-1414-11e8-9542-002590acae31">
<topic>p5-Mojolicious -- cookie-handling vulnerability</topic>
<affects>
<package>
<name>p5-Mojolicious</name>
<range><lt>7.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream commit:</p>
<blockquote cite="https://github.com/kraih/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149">
<p>Vulnerabilities existed in cookie handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/kraih/mojo/issues/1185</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-17</entry>
</dates>
</vuln>
<vuln vid="22283b8c-13c5-11e8-a861-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.13</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.12/">
<p>A CSRF vulnerability in report.cgi would allow a third-party site
to extract confidential information from a bug the victim had access to.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5123</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1433400</url>
</references>
<dates>
<discovery>2018-02-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="044cff62-ed8b-4e72-b102-18a7d58a669f">
<topic>bro -- integer overflow allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philippe Antoine of Catena cyber:</p>
<blockquote cite="http://blog.bro.org/2018/02/bro-253-released-security-update.html">
<p>This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2018/02/bro-253-released-security-update.html</url>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="ad2eeab6-ca68-4f06-9325-1937b237df60">
<topic>consul -- vulnerability in embedded DNS library</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Consul developers report:</p>
<blockquote cite="https://github.com/hashicorp/consul/issues/3859">
<p>A flaw was found in the embedded DNS library used in consul which
may allow a denial of service attack. Consul was updated to include
the fixed version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/consul/issues/3859</url>
<url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018</url>
<url>https://github.com/miekg/dns/pull/631</url>
<url>https://github.com/miekg/dns/issues/627</url>
<cvename>CVE-2017-15133</cvename>
</references>
<dates>
<discovery>2018-01-17</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="746d04dc-507e-4450-911f-4c41e48bb07a">
<topic>bro -- out of bounds write allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Meier:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000458">
<p>Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2017/10/bro-252-242-release-security-update.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="e15a22ce-f16f-446b-9ca7-6859350c2e75">
<topic>quagga -- several security issues</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quagga reports:</p>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-0543.txt">
<p>The Quagga BGP daemon, bgpd, does not properly bounds
check the data sent with a NOTIFY to a peer, if an attribute
length is invalid. Arbitrary data from the bgpd process
may be sent over the network to a peer and/or it may crash.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1114.txt">
<p>The Quagga BGP daemon, bgpd, can double-free memory
when processing certain forms of UPDATE message, containing
cluster-list and/or unknown attributes.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1550.txt">
<p>The Quagga BGP daemon, bgpd, can overrun internal BGP
code-to-string conversion tables used for debug by 1
pointer value, based on input.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1975.txt">
<p>The Quagga BGP daemon, bgpd, can enter an infinite
loop if sent an invalid OPEN message by a configured peer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.quagga.net/security/Quagga-2018-0543.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1114.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1550.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1975.txt</url>
<cvename>CVE-2018-5378</cvename>
<cvename>CVE-2018-5379</cvename>
<cvename>CVE-2018-5380</cvename>
<cvename>CVE-2018-5381</cvename>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="6f0b0cbf-1274-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541732">
<p>CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()"
function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
buffer overflow and subsequently cause a crash.</p>
<p>CVE-2017-5801: An error within the "LibRaw::unpack()" function
(src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.</p>
<p>CVE-2017-5802: An error within the "kodak_radc_load_raw()" function
(internal/dcraw_common.cpp) related to the "buf" variable can be exploited
to cause an out-of-bounds read memory access and subsequently cause a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541732</url>
<cvename>CVE-2018-5800</cvename>
<cvename>CVE-2018-5801</cvename>
<cvename>CVE-2018-5802</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="c60804f1-126f-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541583">
<p>CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()"
function (dcraw_common.cpp) can be exploited to cause a heap-based buffer
overflow and subsequently cause a crash via a specially crafted TIFF image.</p>
<p>CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function
(internal/dcraw_common.cpp) can be exploited to cause an invalid read
memory access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541583</url>
<cvename>CVE-2017-16909</cvename>
<cvename>CVE-2017-16910</cvename>
</references>
<dates>
<discovery>2017-12-04</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="1a75c84a-11c8-11e8-83e7-485b3931c969">
<topic>bitmessage -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bitmessage</name>
<range><le>0.6.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitmessage developers report:</p>
<blockquote cite="https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3">
<p>A remote code execution vulnerability has been spotted in use
against some users running PyBitmessage v0.6.2. The cause was
identified and a fix has been added and released as 0.6.3.2. (Will be
updated if/when CVE will be available.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3</url>
<url>https://bitmessage.org/wiki/Main_Page</url>
</references>
<dates>
<discovery>2018-02-13</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="5d374fbb-bae3-45db-afc0-795684ac7353">
<topic>jenkins -- Path traversal vulnerability allows access to files outside plugin resources</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.106</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.89.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-02-14/">
<p>Jenkins did not properly prevent specifying relative paths that
escape a base directory for URLs accessing plugin resource files. This
allowed users with Overall/Read permission to download files from the
Jenkins master they should not have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-02-14/</url>
<url>https://jenkins.io/blog/2018/02/14/security-updates/</url>
<cvename>CVE-2018-6356</cvename>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="279f682c-0e9e-11e8-83e7-485b3931c969">
<topic>bchunk -- access violation near NULL on destination operand and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15955">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near
NULL on destination operand" and crash when processing a malformed CUE
(.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15955</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15955</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="8ba2819c-0e9d-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow (with invalid free) and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15954">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer
overflow (with a resultant invalid free) and crash when processing a
malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15954</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15954</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="1ec1c59b-0e98-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15953">
<p>bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow
and crash when processing a malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15953</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15953</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="a8f25565-109e-11e8-8d41-97657151f8c2">
<topic>uwsgi -- a stack-based buffer overflow</topic>
<affects>
<package>
<name>uwsgi</name>
<range><lt>2.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Uwsgi developers report:</p>
<blockquote cite="http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html">
<p>It was discovered that the uwsgi_expand_path function in utils.c in
Unbit uWSGI, an application container server, has a stack-based buffer
overflow via a large directory length that can cause a
denial-of-service (application crash) or stack corruption.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html</url>
<url>https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html</url>
<cvename>CVE-2018-6758</cvename>
</references>
<dates>
<discovery>2018-02-06</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="0fe70bcd-2ce3-46c9-a64b-4a7da097db07">
<topic>python -- possible integer overflow vulnerability</topic>
<affects>
<package>
<name>python34</name>
<range><lt>3.4.8</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python issue:</p>
<blockquote cite="https://bugs.python.org/issue30657">
<p>There is a possible integer overflow in PyString_DecodeEscape
function of the file stringobject.c, which can be abused to gain
a heap overflow, possibly leading to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue30657</url>
<url>https://docs.python.org/3.4/whatsnew/changelog.html</url>
<url>https://docs.python.org/3.5/whatsnew/changelog.html</url>
<cvename>CVE-2017-1000158</cvename>
</references>
<dates>
<discovery>2017-06-03</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="aa743ee4-0f16-11e8-8fd2-10bf48e1088e">
<topic>electrum -- JSONRPC vulnerability</topic>
<affects>
<package>
<name>electrum-py36</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
<package>
<name>electrum2</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6353">
<p>JSONRPC vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6353</cvename>
<url>https://github.com/spesmilo/electrum-docs/blob/master/cve.rst</url>
<url>https://bitcointalk.org/index.php?topic=2702103.0</url>
</references>
<dates>
<discovery>2018-01-27</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="e4dd787e-0ea9-11e8-95f2-005056925db4">
<topic>libtorrent -- remote DoS</topic>
<affects>
<package>
<name>libtorrent</name>
<range><lt>0.13.6_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X-cela reports:</p>
<blockquote cite="https://github.com/rakshasa/libtorrent/pull/99">
<p>Calls into build_benocde that use %zu could crash on 64 bit
machines due to the size change of size_t. Someone can force
READ_ENC_IA to fail allowing an internal_error to be thrown
and bring down the client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rakshasa/libtorrent/pull/99</url>
<freebsdpr>ports/224664</freebsdpr>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="316b3c3e-0e98-11e8-8d41-97657151f8c2">
<topic>exim -- a buffer overflow vulnerability, remote code execution</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.90.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers report:</p>
<blockquote cite="https://exim.org/static/doc/security/CVE-2018-6789.txt">
<p>There is a buffer overflow in base64d(), if some pre-conditions are met.
Using a handcrafted message, remote code execution seems to be possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/security/CVE-2018-6789.txt</url>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49">
<topic>p7zip-codec-rar -- insufficient error handling</topic>
<affects>
<package>
<name>p7zip-codec-rar</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">
<p>Insufficient exception handling in the method
NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip
can lead to multiple memory corruptions within the PPMd code,
alows remote attackers to cause a denial of service (segmentation
fault) or execute arbitrary code via a crafted RAR archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5996</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49">
<topic>p7zip -- heap-based buffer overflow</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">
<p>Heap-based buffer overflow in the
NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before
18.00 and p7zip allows remote attackers to cause a denial of
service (out-of-bounds write) or potentially execute arbitrary
code via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-17969</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>
<url>https://marc.info/?l=bugtraq&=151782582216805&=2</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a">
<topic>mpv -- arbitrary code execution via crafted website</topic>
<affects>
<package>
<name>mpv</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mpv developers report:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">
<p>mpv through 0.28.0 allows remote attackers to execute arbitrary code
via a crafted web site, because it reads HTML documents containing
VIDEO elements, and accepts arbitrary URLs in a src attribute without
a protocol whitelist in player/lua/ytdl_hook.lua. For example, an
av://lavfi:ladspa=file= URL signifies that the product should call
dlopen on a shared object file located at an arbitrary local pathname.
The issue exists because the product does not consider that youtube-dl
can provide a potentially unsafe URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mpv-player/mpv/issues/5456</url>
<cvename>CVE-2018-6360</cvename>
</references>
<dates>
<discovery>2018-01-28</discovery>
<entry>2018-02-09</entry>
<modified>2018-02-11</modified>
</dates>
</vuln>
<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a">
<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><le>2.1.14.j7_3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://www.mail-archive.com/mailman-users@python.org/msg70478.html">
<p>An XSS vulnerability in the user options CGI could allow a crafted URL
to execute arbitrary javascript in a user's browser. A related issue
could expose information on a user's options page without requiring
login.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/mailman-users@python.org/msg70478.html</url>
<cvename>CVE-2018-5950</cvename>
</references>
<dates>
<discovery>2018-01-20</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="c602c791-0cf4-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.21</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.16</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.11</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.7</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1829/">
<ul>
<li>CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)</li>
<li>CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1052</cvename>
<cvename>CVE-2018-1053</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="b38e8150-0535-11e8-96ab-0800271d4b9c">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><le>4.0.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="https://www.debian.org/security/2018/dsa-4100">
<p>Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9935</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2704</url>
<cvename>CVE-2017-18013</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2770</url>
<bid>225544</bid>
</references>
<dates>
<discovery>2017-06-22</discovery>
<entry>2018-01-29</entry>
</dates>
</vuln>
<vuln vid="756a8631-0b84-11e8-a986-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.161</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html">
<ul>
<li>This update resolves use-after-free vulnerabilities that
could lead to remote code execution (CVE-2018-4877,
CVE-2018-4878).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4877</cvename>
<cvename>CVE-2018-4878</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa18-01.html</url>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-03.html</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="f5524753-67b1-4c88-8114-29c2d258b383">
<topic>mini_httpd,thttpd -- Buffer overflow in htpasswd</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.28</lt></range>
</package>
<package>
<name>thttpd</name>
<range><lt>2.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alessio Santoru reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17663">
<p>Buffer overflow in htpasswd.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/199.html</url>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="3746de31-0a1a-11e8-83e7-485b3931c969">
<topic>shadowsocks-libev -- command injection via shell metacharacters</topic>
<affects>
<package>
<name>shadowsocks-libev</name>
<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924">
<p>Improper parsing allows command injection via shell metacharacters in
a JSON configuration request received via 127.0.0.1 UDP traffic.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15924</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2018-02-05</entry>
</dates>
</vuln>
<vuln vid="5044bd23-08cb-11e8-b08f-00012e582166">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5122</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-03</entry>
</dates>
</vuln>
<vuln vid="d696473f-9f32-42c5-a106-bf4536fb1f74">
<topic>Django -- information leakage</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.10</lt></range>
</package>
<package>
<name>py27-django20</name>
<name>py34-django20</name>
<name>py35-django20</name>
<name>py36-django20</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.10/">
<p>CVE-2018-6188: Information leakage in AuthenticationForm</p>
<p>A regression in Django 1.11.8 made AuthenticationForm run its
confirm_login_allowed() method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
confirm_login_allowed() raises. If confirm_login_allowed() isn't
overridden, an attacker enter an arbitrary username and see if that user
has been set to is_active=False. If confirm_login_allowed() is
overridden, more sensitive details could be leaked.</p>
<p>This issue is fixed with the caveat that AuthenticationForm can no
longer raise the "This account is inactive." error if the authentication
backend rejects inactive users (the default authentication backend,
ModelBackend, has done that since Django 1.10). This issue will be
revisited for Django 2.1 as a fix to address the caveat will likely be too
invasive for inclusion in older versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.10/</url>
<url>https://docs.djangoproject.com/en/2.0/releases/2.0.2/</url>
<cvename>CVE-2018-6188</cvename>
</references>
<dates>
<discovery>2018-02-01</discovery>
<entry>2018-02-02</entry>
</dates>
</vuln>
<vuln vid="e72d5bf5-07a0-11e8-8248-0021ccb9e74d">
<topic>w3m - multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20180125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tatsuya Kinoshita reports:</p>
<blockquote cite="https://github.com/tats/w3m/commit/01d41d49b273a8cc75b27c6ab42291b46004fc0c">
<p>CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().</p>
<p>CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().</p>
<p>CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628</url>
<cvename>CVE-2018-6196</cvename>
<cvename>CVE-2018-6197</cvename>
<cvename>CVE-2018-6198</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-02-01</entry>
<modified>2018-02-03</modified>
</dates>
</vuln>
<vuln vid="103bf96a-6211-45ab-b567-1555ebb3a86a">
<topic>firefox -- Arbitrary code execution through unsanitized browser UI</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/">
<p>Mozilla developer <strong>Johann Hofmann</strong> reported that
unsanitized output in the browser UI can lead to arbitrary
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1432966</url>
</references>
<dates>
<discovery>2018-01-29</discovery>
<entry>2018-01-29</entry>
<modified>2018-01-31</modified>
</dates>
</vuln>
<vuln vid="2cceb80e-c482-4cfd-81b3-2088d2c0ad53">
<topic>gcab -- stack overflow</topic>
<affects>
<package>
<name>gcab</name>
<range><lt>0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5345">
<p>A stack-based buffer overflow within GNOME gcab through
0.7.4 can be exploited by malicious attackers to cause a
crash or, potentially, execute arbitrary code via a
crafted .cab file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5345</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html</url>
<cvename>CVE-2018-5345</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-27</entry>
</dates>
</vuln>
<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
<topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
<affects>
<package>
<name>dovecot</name>
<range><gt>2.0</gt><le>2.2.33.2_3</le></range>
<range><ge>2.3</ge><le>2.3.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Pedro Sampaio reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
<p>A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
SASL authentication results in a memory leak in Dovecot auth client
used by login processes. The leak has impact in high performance
configuration where same login processes are reused and can cause the
process to crash due to memory exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15132</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
<url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-26</entry>
<modified>2018-02-01</modified>
</dates>
</vuln>
<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.58.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000007">
<p>libcurl 7.1 through 7.57.0 might accidentally leak authentication
data to third parties. When asked to send custom headers in its HTTP
requests, libcurl will send that set of headers first to the host in
the initial URL but also, if asked to follow redirects and a 30X HTTP
response code is returned, to the host mentioned in URL in the
`Location:` response header value. Sending the same set of headers to
subsequest hosts is in particular a problem for applications that pass
on custom `Authorization:` headers, as this header often contains
privacy sensitive information or data that could allow others to
impersonate the libcurl-using client's request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-b3bf.html</url>
<cvename>CVE-2018-1000007</cvename>
</references>
<dates>
<discovery>2018-01-24</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="b464f61b-84c7-4e1c-8ad4-6cf9efffd025">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.99.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html">
<p>Join us as we welcome ClamAV 0.99.3 to the family!.</p>
<p>This release is a security release and is recommended for
all ClamAV users.</p>
<p>CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities</p>
<p>CVE-2017-12375 ClamAV Buffer Overflow Vulnerability</p>
<p>CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname
Vulnerability</p>
<p>CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability</p>
<p>CVE-2017-12378 ClamAV Buffer Over Read Vulnerability</p>
<p>CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument
Vulnerability</p>
<p>CVE-2017-12380 ClamAV Null Dereference Vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html</url>
<cvename>CVE-2017-12374</cvename>
<cvename>CVE-2017-12375</cvename>
<cvename>CVE-2017-12376</cvename>
<cvename>CVE-2017-12377</cvename>
<cvename>CVE-2017-12378</cvename>
<cvename>CVE-2017-12379</cvename>
<cvename>CVE-2017-12380</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="a891c5b4-3d7a-4de9-9c71-eef3fd698c77">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.63</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.6.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/">
<p>CVE-2018-5091: Use-after-free with DTMF timers</p>
<p>CVE-2018-5092: Use-after-free in Web Workers</p>
<p>CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing</p>
<p>CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory</p>
<p>CVE-2018-5095: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-5097: Use-after-free when source document is manipulated during XSLT</p>
<p>CVE-2018-5098: Use-after-free while manipulating form input elements</p>
<p>CVE-2018-5099: Use-after-free with widget listener</p>
<p>CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory</p>
<p>CVE-2018-5101: Use-after-free with floating first-letter style elements</p>
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5103: Use-after-free during mouse event handling</p>
<p>CVE-2018-5104: Use-after-free during font face manipulation</p>
<p>CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts</p>
<p>CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker</p>
<p>CVE-2018-5107: Printing process will follow symlinks for local file access</p>
<p>CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs</p>
<p>CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution</p>
<p>CVE-2018-5110: Cursor can be made invisible on OS X</p>
<p>CVE-2018-5111: URL spoofing in addressbar through drag and drop</p>
<p>CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel</p>
<p>CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow</p>
<p>CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts</p>
<p>CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs</p>
<p>CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access</p>
<p>CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right</p>
<p>CVE-2018-5118: Activity Stream images can attempt to load local content through file:</p>
<p>CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers</p>
<p>CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
<p>CVE-2018-5090: Memory safety bugs fixed in Firefox 58</p>
<p>CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5089</cvename>
<cvename>CVE-2018-5090</cvename>
<cvename>CVE-2018-5091</cvename>
<cvename>CVE-2018-5092</cvename>
<cvename>CVE-2018-5093</cvename>
<cvename>CVE-2018-5094</cvename>
<cvename>CVE-2018-5095</cvename>
<cvename>CVE-2018-5097</cvename>
<cvename>CVE-2018-5098</cvename>
<cvename>CVE-2018-5099</cvename>
<cvename>CVE-2018-5100</cvename>
<cvename>CVE-2018-5101</cvename>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5103</cvename>
<cvename>CVE-2018-5104</cvename>
<cvename>CVE-2018-5105</cvename>
<cvename>CVE-2018-5106</cvename>
<cvename>CVE-2018-5107</cvename>
<cvename>CVE-2018-5108</cvename>
<cvename>CVE-2018-5109</cvename>
<cvename>CVE-2018-5110</cvename>
<cvename>CVE-2018-5111</cvename>
<cvename>CVE-2018-5112</cvename>
<cvename>CVE-2018-5113</cvename>
<cvename>CVE-2018-5114</cvename>
<cvename>CVE-2018-5115</cvename>
<cvename>CVE-2018-5116</cvename>
<cvename>CVE-2018-5117</cvename>
<cvename>CVE-2018-5118</cvename>
<cvename>CVE-2018-5119</cvename>
<cvename>CVE-2018-5121</cvename>
<cvename>CVE-2018-5122</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-03/</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-23</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="24a82876-002e-11e8-9a95-0cc47a02c232">
<topic>powerdns-recursor -- insufficient validation of DNSSEC signatures</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html">
<p>An issue has been found in the DNSSEC validation component of
PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3
record to be used to wrongfully prove the non-existence of a RR
below the owner name of that record. This would allow an attacker in
position of man-in-the-middle to send a NXDOMAIN answer for a name
that does exist.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000003</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html</url>
</references>
<dates>
<discovery>2018-01-22</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="e264e74e-ffe0-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[788453] High CVE-2017-15429: UXSS in V8. Reported by
Anonymous on 2017-11-24</li>
<li>[794792] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15429</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="1d951e85-ffdb-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by
Ned Williamson on 2017-10-26</li>
<li>[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-09-06</li>
<li>[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by
Anonymous on 2017-09-11</li>
<li>[765921] High CVE-2017-15410: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-16</li>
<li>[770148] High CVE-2017-15411: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-29</li>
<li>[727039] High CVE-2017-15412: Use after free in libXML. Reported by
Nick Wellnhofer on 2017-05-27</li>
<li>[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19</li>
<li>[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.
Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15</li>
<li>[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by
Ned Williamson on 2017-10-28</li>
<li>[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.
Reported by Max May on 2017-03-07</li>
<li>[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15</li>
<li>[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.
Reported by Jun Kokatsu on 2017-10-31</li>
<li>[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23</li>
<li>[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13</li>
<li>[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.
Reported by jinmo123 on 2017-01-11</li>
<li>[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
Reported by Greg Hudson on 2017-10-25</li>
<li>[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by
Khalil Zhani on 2017-08-16</li>
<li>[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-08-17</li>
<li>[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18</li>
<li>[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.
Reported by Junaid Farhan on 2017-09-26</li>
<li>[792099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15407</cvename>
<cvename>CVE-2017-15408</cvename>
<cvename>CVE-2017-15409</cvename>
<cvename>CVE-2017-15410</cvename>
<cvename>CVE-2017-15411</cvename>
<cvename>CVE-2017-15412</cvename>
<cvename>CVE-2017-15413</cvename>
<cvename>CVE-2017-15415</cvename>
<cvename>CVE-2017-15416</cvename>
<cvename>CVE-2017-15417</cvename>
<cvename>CVE-2017-15418</cvename>
<cvename>CVE-2017-15419</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2017-15422</cvename>
<cvename>CVE-2017-15430</cvename>
<cvename>CVE-2017-15423</cvename>
<cvename>CVE-2017-15424</cvename>
<cvename>CVE-2017-15425</cvename>
<cvename>CVE-2017-15426</cvename>
<cvename>CVE-2017-15427</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-12-06</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="82894193-ffd4-11e7-8b91-e8e0b747a45a">
<topic>chromium -- out of bounds read</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[782145] High CVE-2017-15428: Out of bounds read in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15428</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="8d3bae09-fd28-11e7-95f2-005056925db4">
<topic>unbound -- vulnerability in the processing of wildcard synthesized NSEC records</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound reports:</p>
<blockquote cite="https://unbound.net/downloads/CVE-2017-15105.txt">
<p>We discovered a vulnerability in the processing of wildcard synthesized
NSEC records. While synthesis of NSEC records is allowed by RFC4592,
these synthesized owner names should not be used in the NSEC processing.
This does, however, happen in Unbound 1.6.7 and earlier versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://unbound.net/downloads/CVE-2017-15105.txt</url>
<cvename>CVE-2017-15105</cvename>
<freebsdpr>ports/225313</freebsdpr>
</references>
<dates>
<discovery>2017-10-08</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="8e89a89a-fd15-11e7-bdf6-00e04c1ea73d">
<topic>phpbb3 -- multiple issues</topic>
<affects>
<package>
<name>phpbb3</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpbb developers reports:</p>
<blockquote cite="https://wiki.phpbb.com/Release_Highlights/3.2.2">
<p>Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.</p>
<p>Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.</p>
<p>Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.</p>
<p>Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.</p>
<p>Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.phpbb.com/Release_Highlights/3.2.2</url>
</references>
<dates>
<discovery>2018-01-07</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="e3445736-fd01-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.34</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.31</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.13</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.21</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL">
<p>Not all vulnerabilities are relevant for all flavors/versions of the
servers and clients</p>
<ul>
<li>Vulnerability allows low privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640,
CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703,
Partition: CVE-2018-2562.</li>
<li>Vulnerability allows high privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576,
CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema:
CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600,
CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication:
CVE-2018-2647.</li>
<li>Vulnerability allows a low or high privileged attacker with network
access via multiple protocols to compromise MySQL Server with
unauthorized creation, deletion, modification or access to data/
critical data. InnoDB: CVE-2018-2612, Performance Schema:
CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/library/mariadb-5559-release-notes/</url>
<cvename>CVE-2018-2562</cvename>
<cvename>CVE-2018-2565</cvename>
<cvename>CVE-2018-2573</cvename>
<cvename>CVE-2018-2576</cvename>
<cvename>CVE-2018-2583</cvename>
<cvename>CVE-2018-2586</cvename>
<cvename>CVE-2018-2590</cvename>
<cvename>CVE-2018-2591</cvename>
<cvename>CVE-2018-2600</cvename>
<cvename>CVE-2018-2612</cvename>
<cvename>CVE-2018-2622</cvename>
<cvename>CVE-2018-2640</cvename>
<cvename>CVE-2018-2645</cvename>
<cvename>CVE-2018-2646</cvename>
<cvename>CVE-2018-2647</cvename>
<cvename>CVE-2018-2665</cvename>
<cvename>CVE-2018-2667</cvename>
<cvename>CVE-2018-2668</cvename>
<cvename>CVE-2018-2696</cvename>
<cvename>CVE-2018-2703</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="c04dc18f-fcde-11e7-bdf6-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/">
<p>JavaScript errors that prevented saving posts in Firefox have been fixed.</p>
<p>The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.</p>
<p>Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="65fab89f-2231-46db-8541-978f4e87f32a">
<topic>gitlab -- Remote code execution on project import</topic>
<affects>
<package>
<name>gitlab</name>
<range><lt>10.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab developers report:</p>
<blockquote cite="https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/">
<p>Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for
GitLab Community Edition (CE) and Enterprise Edition (EE).</p>
<p>These versions contain a number of important security fixes,
including two that prevent remote code execution, and we strongly
recommend that all GitLab installations be upgraded to one of these
versions immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/</url>
<cvename>CVE-2017-0915</cvename>
<cvename>CVE-2018-3710</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-17</entry>
</dates>
</vuln>
<vuln vid="3e5b8bd3-0c32-452f-a60e-beab7b762351">
<topic>transmission-daemon -- vulnerable to dns rebinding attacks</topic>
<affects>
<package>
<name>transmission-daemon</name>
<range><le>2.92_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://bugs.chromium.org/p/project-zero/issues/detail?id=1447">
<p>The transmission bittorrent client uses a client/server
architecture, the user interface is the client which communicates
to the worker daemon using JSON RPC requests.</p>
<p>As with all HTTP RPC schemes like this, any website can send
requests to the daemon listening on localhost with XMLHttpRequest(),
but the theory is they will be ignored because clients must prove
they can read and set a specific header, X-Transmission-Session-Id.
Unfortunately, this design doesn't work because of an attack called
"DNS rebinding". Any website can simply create a dns name that they
are authorized to communicate with, and then make it resolve to
localhost.</p>
<p>Exploitation is simple, you could set script-torrent-done-enabled
and run any command, or set download-dir to /home/user/ and then
upload a torrent for .bashrc.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1447</url>
<url>https://github.com/transmission/transmission/pull/468</url>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2018-01-14</entry>
</dates>
</vuln>
<vuln vid="3dbe9492-f7b8-11e7-a12d-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.3</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180112.txt">
<p>
Shibboleth SP software vulnerable to forged user attribute data
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180112.txt</url>
<cvename>CVE-2018-0486</cvename>
</references>
<dates>
<discovery>2018-01-12</discovery>
<entry>2018-01-12</entry>
</dates>
</vuln>
<vuln vid="9c016563-f582-11e7-b33c-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-01.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-4871).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4871</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-01.html</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-09</entry>
</dates>
</vuln>
<vuln vid="4055aee5-f4c6-11e7-95f2-005056925db4">
<topic>awstats -- remote code execution</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501">
<p>Awstats version 7.6 and earlier is vulnerable to a path traversal
flaw in the handling of the "config" and "migrate" parameters resulting
in unauthenticated remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501</url>
<cvename>CVE-2017-1000501</cvename>
<freebsdpr>ports/225007</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-08</entry>
</dates>
</vuln>
<vuln vid="a3764767-f31e-11e7-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_01.txt">
<p>When the channel topic is set without specifying a sender, Irssi
may dereference NULL pointer. Found by Joseph Bisch.</p>
<p>When using incomplete escape codes, Irssi may access data beyond
the end of the string. Found by Joseph Bisch.</p>
<p>A calculation error in the completion code could cause a heap
buffer overflow when completing certain strings.
Found by Joseph Bisch.</p>
<p>When using an incomplete variable argument, Irssi may access data
beyond the end of the string. Found by Joseph Bisch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_01.txt</url>
<cvename>CVE-2018-5205</cvename>
<cvename>CVE-2018-5206</cvename>
<cvename>CVE-2018-5207</cvename>
<cvename>CVE-2018-5208</cvename>
<freebsdpr>ports/224954</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-06</entry>
</dates>
</vuln>
<vuln vid="8429711b-76ca-474e-94a0-6b980f1e2d47">
<topic>mozilla -- Speculative execution side-channel attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>57.0.4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/">
<p><strong>Jann Horn</strong> of Google Project Zero
Security reported that speculative execution performed
by modern CPUs could leak information through a timing
side-channel attack. Microsoft Vulnerability Research
extended this attack to browser JavaScript engines and
demonstrated that code on a malicious web page could
read data from other web sites (violating the
same-origin policy) or private data from the browser
itself.</p>
<p>Since this new class of attacks involves measuring
precise time intervals, as a parti al, short-term,
mitigation we are disabling or reducing the precision of
several time sources in Firefox. The precision of
<code>performance.now()</code> has been reduced from 5μs
to 20μs, and the <code>SharedArrayBuffer</code> feature
has been disabled because it can be used to construct a
high-resolution timer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-01/</url>
</references>
<dates>
<discovery>2018-01-04</discovery>
<entry>2018-01-05</entry>
</dates>
</vuln>
<vuln vid="cebd05d6-ed7b-11e7-95f2-005056925db4">
<topic>OTRS -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>5.0.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can request special URLs
from OTRS which can lead to the execution of shell commands with the
permissions of the web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as a customer can use the ticket search
form to disclose internal article information of their customer tickets.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can manipulate form
parameters and execute arbitrary shell commands with the permissions of the
OTRS or web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/">
<p>An attacker can send a specially prepared email to an OTRS system. If this
system has cookie support disabled, and a logged in agent clicks a link in this
email, the session information could be leaked to external systems, allowing the
attacker to take over the agent’s session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16664</cvename>
<cvename>CVE-2017-16854</cvename>
<cvename>CVE-2017-16921</cvename>
<freebsdpr>ports/224729</freebsdpr>
<url>https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/</url>
</references>
<dates>
<discovery>2017-11-21</discovery>
<entry>2017-12-30</entry>
</dates>
</vuln>
<vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
<topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
<affects>
<package>
<name>bouncycastle</name>
<range><lt>1.59</lt></range>
</package>
<package>
<name>bouncycastle15</name>
<range><lt>1.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.59</p>
<p>CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS
when RSA key exchange is negotiated. This potentially affected
BCJSSE servers and any other TLS servers configured to use JCE
for the underlying crypto - note the two TLS implementations
using the BC lightweight APIs are not affected by this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-13098</cvename>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-29</entry>
</dates>
</vuln>
<vuln vid="6a09c80e-6ec7-442a-bc65-d72ce69fd887">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
<p>CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9</p>
<p>CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin</p>
<p>CVE-2017-7847: Local path string can be leaked from RSS feed</p>
<p>CVE-2017-7848: RSS Feed vulnerable to new line Injection</p>
<p>CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7829</cvename>
<cvename>CVE-2017-7845</cvename>
<cvename>CVE-2017-7846</cvename>
<cvename>CVE-2017-7847</cvename>
<cvename>CVE-2017-7848</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-30/</url>
</references>
<dates>
<discovery>2017-12-22</discovery>
<entry>2017-12-25</entry>
</dates>
</vuln>
<vuln vid="63eb2b11-e802-11e7-a58c-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF/CSRF vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-9/">
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful database operations such as
deleting records, dropping/truncating tables etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-9/</url>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
<topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For
those messages, if the header was not present and using
the PJSIP channel driver, it would cause Asterisk to
crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication
is enabled a user would have to first be authorized before
reaching the crash point.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
<cvename>CVE-2017-17850</cvename>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
<topic>MariaDB -- unspecified vulnerability</topic>
<affects>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.30</lt></range>
</package>
<package>
<name>mariadb102-client</name>
<range><lt>10.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/library/mariadb-10130-release-notes/">
<p>Fixes for the following security vulnerabilities:
CVE-2017-15365</p>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/library/mariadb-10130-release-notes/</url>
<cvename>CVE-2017-15365</cvename>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="72fff788-e561-11e7-8097-0800271d4b9c">
<topic>rsync -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rsync</name>
<range><ge>3.1.2</ge><le>3.1.2_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeriko One reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548">
<p>The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433">
<p>The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434">
<p>The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2017/dsa-4068</url>
<cvename>CVE-2017-16548</cvename>
<cvename>CVE-2017-17433</cvename>
<cvename>CVE-2017-17434</cvename>
<freebsdpr>ports/224477</freebsdpr>
</references>
<dates>
<discovery>2017-12-17</discovery>
<entry>2017-12-20</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="dd644964-e10e-11e7-8097-0800271d4b9c">
<topic>ruby -- Command injection vulnerability in Net::FTP</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0,1</ge><lt>2.2.9,1</lt></range>
<range><ge>2.3.0,1</ge><lt>2.3.6,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Etienne Stalmans from the Heroku product security team reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/">
<p>There is a command injection vulnerability in Net::FTP bundled with Ruby.</p>
<p><code>Net::FTP#get</code>, <code>getbinaryfile</code>, <code>gettextfile</code>, <code>put</code>, <code>putbinaryfile</code>, and <code>puttextfile</code> use <code>Kernel#open</code> to open a local file. If the <code>localfile</code> argument starts with the pipe character <code>"|"</code>, the command following the pipe character is executed. The default value of <code>localfile</code> is <code>File.basename(remotefile)</code>, so malicious FTP servers could cause arbitrary command execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/</url>
<cvename>CVE-2017-17405</cvename>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="8cf25a29-e063-11e7-9b2c-001e672571bc">
<topic>rubygem-passenger -- arbitrary file read vulnerability</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.10</ge><lt>5.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phusion reports:</p>
<blockquote cite="https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/">
<p>The cPanel Security Team discovered a vulnerability in Passenger
that allows users to list the contents of arbitrary files on the
system. CVE-2017-16355 has been assigned to this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/</url>
<cvename>CVE-2017-16355</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-12-18</entry>
</dates>
</vuln>
<vuln vid="08a125f3-e35a-11e7-a293-54e1ad3d6335">
<topic>libXfont -- permission bypass when opening files through symlinks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8">
<p>A non-privileged X client can instruct X server running under root
to open any file by creating own directory with "fonts.dir",
"fonts.alias" or any font file being a symbolic link to any other
file in the system. X server will then open it. This can be issue
with special files such as /dev/watchdog.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8</url>
<cvename>CVE-2017-16611</cvename>
</references>
<dates>
<discovery>2017-11-25</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="3b9590a1-e358-11e7-a293-54e1ad3d6335">
<topic>libXfont -- multiple memory leaks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.3</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608">
<p>If a pattern contains '?' character, any character in the string
is skipped, even if it is '\0'. The rest of the matching then reads
invalid memory.</p>
</blockquote>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902906bcd">
<p>Without the checks a malformed PCF file can cause the library to
make atom from random heap memory that was behind the `strings`
buffer. This may crash the process or leak information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd</url>
<cvename>CVE-2017-13720</cvename>
<cvename>CVE-2017-13722</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
<topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
<affects>
<package>
<name>libXcursor</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
<p>It is possible to trigger heap overflows due to an integer
overflow while parsing images and a signedness issue while
parsing comments.</p>
<p>The integer overflow occurs because the chosen limit 0x10000
for dimensions is too large for 32 bit systems, because each pixel
takes 4 bytes. Properly chosen values allow an overflow which in
turn will lead to less allocated memory than needed for subsequent
reads.</p>
<p>The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows
the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to
allocate less memory than needed for subsequent reads.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q4/339</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
<cvename>CVE-2017-16612</cvename>
</references>
<dates>
<discovery>2017-11-28</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
<topic>global -- gozilla vulnerability</topic>
<affects>
<package>
<name>global</name>
<range><ge>4.8.6</ge><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531">
<p>gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching
the program specified by the BROWSER environment variable, which might
allow remote attackers to conduct argument-injection attacks via a crafted
URL.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531</url>
<url>http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html</url>
<cvename>CVE-2017-17531</cvename>
</references>
<dates>
<discovery>2017-12-11</discovery>
<entry>2017-12-16</entry>
</dates>
</vuln>
<vuln vid="7136e6b7-e1b3-11e7-a4d3-000c292ee6b8">
<topic>jenkins -- Two startup race conditions</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.95</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.89.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Jenkins project reports:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-12-14/">
<p>A race condition during Jenkins startup could result in the wrong
order of execution of commands during initialization.</p>
<p>On Jenkins 2.81 and newer, including LTS 2.89.1, this could in
rare cases (we estimate less than 20% of new instances) result in
failure to initialize the setup wizard on the first startup.</p>
<p>There is a very short window of time after startup during which
Jenkins may no longer show the "Please wait while Jenkins is
getting ready to work" message, but Cross-Site Request Forgery
(CSRF) protection may not yet be effective.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-12-14/</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-15</entry>
</dates>
</vuln>
<vuln vid="bea84a7a-e0c9-11e7-b4f3-11baa0c2df21">
<topic>node.js -- Data Confidentiality/Integrity Vulnerability, December 2017</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.12.2</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.9.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/">
<h1>Data Confidentiality/Integrity Vulnerability - CVE-2017-15896</h1>
<p>Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.</p>
<h1>Uninitialized buffer vulnerability - CVE-2017-15897</h1>
<p>Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.</p>
<h1>Also included in OpenSSL update - CVE 2017-3738</h1>
<p>Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/</url>
<cvename>CVE-2017-15896</cvename>
<cvename>CVE-2017-15897</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.2.0</ge><le>10.0.6</le></range>
<range><ge>10.1.0</ge><le>10.1.4</le></range>
<range><ge>10.2.0</ge><le>10.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
<h1>User without access to private Wiki can see it on the project page</h1>
<p>Matthias Burtscher reported that it was possible for a user to see a
private Wiki on the project page without having the corresponding
permission.</p>
<h1>E-mail address disclosure through member search fields</h1>
<p>Hugo Geoffroy reported via HackerOne that it was possible to find out the
full e-mail address of any user by brute-forcing the member search
field.</p>
<h1>Groups API leaks private projects</h1>
<p>An internal code review discovered that users were able to list private
projects they had no access to by using the Groups API.</p>
<h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
<p>Sylvain Heiniger reported via HackerOne that it was possible for
arbitrary JavaScript code to be executed when editing a comment.</p>
<h1>Issue API allows any user to create a new issue even when issues are
restricted or disabled</h1>
<p>Mohammad Hasbini reported that any user could create a new issues in a
project even when issues were disabled or restricted to team members in the
project settings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
<topic>tor -- Use-after-free in onion service v2</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Torproject.org reports:</p>
<blockquote cite="https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516">
<ul>
<li>TROVE-2017-009: Replay-cache ineffective for v2 onion services</li>
<li>TROVE-2017-010: Remote DoS attack against directory authorities</li>
<li>TROVE-2017-011: An attacker can make Tor ask for a password</li>
<li>TROVE-2017-012: Relays can pick themselves in a circuit path</li>
<li>TROVE-2017-013: Use-after-free in onion service v2</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516</url>
<cvename>CVE-2017-8819</cvename>
</references>
<dates>
<discovery>2017-12-01</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="4a67450a-e044-11e7-accc-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in RTCP Stack</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If a compound RTCP packet is received containing more
than one report (for example a Receiver Report and a
Sender Report) the RTCP stack will incorrectly store
report information outside of allocated memory potentially
causing a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-012.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="76e59f55-4f7a-4887-bcb0-11604004163a">
<topic>libxml2 -- Multiple Issues</topic>
<affects>
<package>
<name>libxml2</name>
<range><le>2.9.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxml2 developers report:</p>
<p>The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.</p>
<p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.</p>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=775200</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98599</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98556</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98601</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98568</url>
<cvename>CVE-2017-8872</cvename>
<cvename>CVE-2017-9047</cvename>
<cvename>CVE-2017-9048</cvename>
<cvename>CVE-2017-9049</cvename>
<cvename>CVE-2017-9050</cvename>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="9f7a0f39-ddc0-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_6</lt></range>
<range><ge>10.4</ge><lt>10.4_5</lt></range>
<range><ge>10.3</ge><lt>10.3_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Invoking SSL_read()/SSL_write() while in an error state
causes data to be passed without being decrypted/encrypted
directly from the SSL/TLS record layer.</p>
<p>In order to exploit this issue an application bug would
have to be present that resulted in a call to
SSL_read()/SSL_write() being issued after having already
received a fatal error. [CVE-2017-3737]</p>
<p>There is an overflow bug in the x86_64 Montgomery
multiplication procedure used in exponentiation with 1024-bit
moduli. This only affects processors that support the AVX2
but not ADX extensions like Intel Haswell (4th generation).
[CVE-2017-3738] This bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Applications with incorrect error handling may inappropriately
pass unencrypted data. [CVE-2017-3737]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected and analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH1024 are considered just feasible
(although very difficult) because most of the work necessary
to deduce information about a private key may be performed
offline. The amount of resources required for such an attack
would be very significant and likely only accessible to a
limited number of attackers. However, for an attack on TLS
to be meaningful, the server would have to share the DH1024
private key among multiple clients, which is no longer an
option since CVE-2016-0701. [CVE-2017-3738]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
<freebsdsa>SA-17:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-12-09</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="4b228e69-22e1-4019-afd0-8aa716d0ec0b">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)</p>
<p>wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)</p>
<p>wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-47.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-48.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-49.html</url>
<cvename>CVE-2017-17083</cvename>
<cvename>CVE-2017-17084</cvename>
<cvename>CVE-2017-17085</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="3bb451fc-db64-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><gt>1.0.2</gt><lt>1.0.2n</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171207.txt">
<ul><li>Read/write after SSL object in error state (CVE-2017-3737)<br/>
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
state" mechanism. The intent was that if a fatal error occurred
during a handshake then OpenSSL would move into the error state and
would immediately fail if you attempted to continue the handshake.
This works as designed for the explicit handshake functions
(SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
a bug it does not work correctly if SSL_read() or SSL_write() is
called directly. In that scenario, if the handshake fails then a
fatal error will be returned in the initial function call. If
SSL_read()/SSL_write() is subsequently called by the application for
the same SSL object then it will succeed and the data is passed
without being decrypted/encrypted directly from the SSL/TLS record
layer.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. No EC
algorithms are affected. Analysis suggests that attacks against
RSA and DSA as a result of this defect would be very difficult to
perform and are not believed likely. Attacks against DH1024 are
considered just feasible, because most of the work necessary to
deduce information about a private key may be performed offline.
The amount of resources required for such an attack would be
significant. However, for an attack on TLS to be meaningful, the
server would have to share the DH1024 private key among multiple
clients, which is no longer an option since CVE-2016-0701.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171207.txt</url>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-07</discovery>
<entry>2017-12-07</entry>
</dates>
</vuln>
<vuln vid="9442a811-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_5</lt></range>
<range><ge>11.0</ge><lt>11.0_16</lt></range>
<range><ge>10.4</ge><lt>10.4_4</lt></range>
<range><ge>10.3</ge><lt>10.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If an X.509 certificate has a malformed IPAddressFamily
extension, OpenSSL could do a one-byte buffer overread.
[CVE-2017-3735]</p>
<p>There is a carry propagating bug in the x86_64 Montgomery
squaring procedure. This only affects processors that support
the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th
generation) and later or AMD Ryzen. [CVE-2017-3736] This
bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Application using OpenSSL may display erroneous certificate
in text format. [CVE-2017-3735]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected, analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH are considered just feasible (although
very difficult) because most of the work necessary to deduce
information about a private key may be performed offline.
The amount of resources required for such an attack would
be very significant and likely only accessible to a limited
number of attackers. An attacker would additionally need
online access to an unpatched system using the target private
key in a scenario with persistent DH parameters and a private
key that is shared between multiple clients. [CVE-2017-3736]</p>
</body>
</description>
<references>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
<freebsdsa>SA-17:11.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="759059ac-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Information leak in kldstat(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel does not properly clear the memory of the
kld_file_stat structure before filling the data. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information from
the kernel stack is possible.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack can be observed in
userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1088</cvename>
<freebsdsa>SA-17:10.kldstat</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="5b1463dd-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- POSIX shm allows jails to access global namespace</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Named paths are globally scoped, meaning a process located
in one jail can read and modify the content of POSIX shared
memory objects created by a process in another jail or the
host system.</p>
<h1>Impact:</h1>
<p>A malicious user that has access to a jailed system is
able to abuse shared memory by injecting malicious content
in the shared memory region. This memory region might be
executed by applications trusting the shared memory, like
Squid.</p>
<p>This issue could lead to a Denial of Service or local
privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1087</cvename>
<freebsdsa>SA-17:09.shm</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="34a3f9b5-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Not all information in the struct ptrace_lwpinfo is
relevant for the state of any thread, and the kernel does
not fill the irrelevant bytes or short strings. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information of the
kernel stack of the thread is possible from the debugger.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack of the thread using
ptrace(PT_LWPINFO) call can be observed in userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1086</cvename>
<freebsdsa>SA-17:08.ptrace</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="1f8de723-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- WPA2 protocol vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_2</lt></range>
<range><ge>11.0</ge><lt>11.0_13</lt></range>
<range><ge>10.4</ge><lt>10.4_1</lt></range>
<range><ge>10.3</ge><lt>10.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was found in how a number of implementations
can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK,
or IGTK) by replaying a specific frame that is used to
manage the keys.</p>
<h1>Impact:</h1>
<p>Such reinstallation of the encryption key can result in
two different types of vulnerabilities: disabling replay
protection and significantly reducing the security of
encryption to the point of allowing frames to be decrypted
or some parts of the keys to be determined by an attacker
depending on which cipher is used.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1307</cvename>
<cvename>CVE-2017-1308</cvename>
<freebsdsa>SA-17:07.wpa</freebsdsa>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="b7e23050-2d5d-4e61-9b48-62e89db222ca">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>57.0,1</ge><lt>57.0.1,1</lt></range>
<range><lt>56.0.2_11,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.s20171130</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/">
<p>CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data</p>
<p>CVE-2017-7844: Visited history information leak through SVG image</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7843</cvename>
<cvename>CVE-2017-7844</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-27/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-05</entry>
</dates>
</vuln>
<vuln vid="17133e7e-d764-11e7-b5af-a4badb2f4699">
<topic>varnish -- information disclosure vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><lt>4.1.9</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00002.html">
<p>A wrong if statement in the varnishd source code means that
synthetic objects in stevedores which over-allocate, may leak up to page
size of data from a malloc(3) memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00002.html</url>
<cvename>CVE-2017-8807</cvename>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="addad6de-d752-11e7-99bf-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/">
<p>High risk: Language file headers RCE</p>
<p>Low risk: Language Pack Properties XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
<p>Use a properly generated hash for the newbloguser key instead of a determinate substring.</p>
<p>Add escaping to the language attributes used on html elements.</p>
<p>Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.</p>
<p>Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-01</entry>
</dates>
</vuln>
<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
<topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If the chan_skinny (AKA SCCP protocol) channel driver
is flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests
of any kind.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
<cvename>CVE-2017-17090</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-01</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote DoS attack in BDAT processing</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
<cvename>CVE-2017-16944</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-30</entry>
</dates>
</vuln>
<vuln vid="a66f9be2-d519-11e7-9866-c85b763a2f96">
<topic>xrdp -- local user can cause a denial of service</topic>
<affects>
<package>
<name>xrdp-devel</name>
<range><le>0.9.3,1</le></range>
<range><gt>0.9.3_1,1</gt><le>0.9.4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp reports:</p>
<blockquote cite="https://github.com/neutrinolabs/xrdp/pull/958">
<p>The scp_v0s_accept function in the session manager uses an untrusted integer as a write length,
which allows local users to cause a denial of service (buffer overflow and application crash)
or possibly have unspecified other impact via a crafted input stream.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16927</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="301a01b7-d50e-11e7-ac58-b499baebfeaf">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.21.0</ge><lt>7.57.0</lt></range>
</package>
<package>
<name>linux-c7-curl</name>
<range><ge>7.21.0</ge><lt>7.29.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/changes.html">
<ul><li>NTLM buffer overflow via integer overflow
(CVE-2017-8816)<br/>libcurl contains a buffer overrun flaw
in the NTLM authentication code.
The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up
the lengths of the user name + password (= SUM) and multiplies
the sum by two (= SIZE) to figure out how large storage to
allocate from the heap.</li>
<li>FTP wildcard out of bounds read (CVE-2017-8817)<br/>
libcurl contains a read out of bounds flaw in the FTP wildcard
function.
libcurl's FTP wildcard matching feature, which is enabled with
the CURLOPT_WILDCARDMATCH option can use a built-in wildcard
function or a user provided one. The built-in wildcard function
has a flaw that makes it not detect the end of the pattern
string if it ends with an open bracket ([) but instead it will
continue reading the heap beyond the end of the URL buffer that
holds the wildcard.</li>
<li>SSL out of buffer access (CVE-2017-8818)<br/>
libcurl contains an out boundary access flaw in SSL related code.
When allocating memory for a connection (the internal struct
called connectdata), a certain amount of memory is allocated at
the end of the struct to be used for SSL related structs. Those
structs are used by the particular SSL library libcurl is built
to use. The application can also tell libcurl which specific SSL
library to use if it was built to support more than one.
</li></ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/changes.html</url>
<cvename>CVE-2017-8816</cvename>
<cvename>CVE-2017-8817</cvename>
<cvename>CVE-2017-8818</cvename>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-11-29</entry>
<modified>2017-12-11</modified>
</dates>
</vuln>
<vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
<topic>borgbackup -- remote users can override repository restrictions</topic>
<affects>
<package>
<name>py34-borgbackup</name>
<name>py35-borgbackup</name>
<name>py36-borgbackup</name>
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BorgBackup reports:</p>
<blockquote cite="https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27">
<p>Incorrect implementation of access controls allows remote users to
override repository restrictions in Borg servers. A user able to
access a remote Borg SSH server is able to circumvent access controls
post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases
1.0.x are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15914</cvename>
<url>https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="6056bf68-f570-4e70-b740-b9f606971283">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7840</cvename>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-28</entry>
</dates>
</vuln>
<vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote code execution, deny of service in BDAT</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-27</entry>
</dates>
</vuln>
<vuln vid="7761288c-d148-11e7-87e5-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>myBB Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/">
<p>High risk: Installer RCE on configuration file write</p>
<p>High risk: Language file headers RCE</p>
<p>Medium risk: Installer XSS</p>
<p>Medium risk: Mod CP Edit Profile XSS</p>
<p>Low risk: Insufficient moderator permission check in delayed moderation tools</p>
<p>Low risk: Announcements HTML filter bypass</p>
<p>Low risk: Language Pack Properties XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-07</discovery>
<entry>2017-11-24</entry>
</dates>
</vuln>
<vuln vid="50127e44-7b88-4ade-8e12-5d57320823f1">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.8</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html">
<p>Directory traversal vulnerability in minion id validation in SaltStack.
Allows remote minions with incorrect credentials to authenticate to a
master via a crafted minion ID. Credit for discovering the security flaw
goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists
because of an incomplete fix for CVE-2017-12791.</p>
<p>Remote Denial of Service with a specially crafted authentication request.
Credit for discovering the security flaw goes to: Julian Brost
(julian@0x4a42.net)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14695</cvename>
<cvename>CVE-2017-14696</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html</url>
<url>https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html</url>
<url>https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d</url>
<url>https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b</url>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="ef3423e4-d056-11e7-a52c-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Security: Fixed a potential object injection in Cache Library 'apc'
driver when save() is used with $raw = TRUE.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-09-25</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="288f7cee-ced6-11e7-8ae9-0050569f0b83">
<topic>procmail -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>procmail</name>
<range><lt>3.22_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://www.debian.org/security/2017/dsa-4041">
<p>A remote attacker could use a flaw to cause formail to crash,
resulting in a denial of service or data loss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16844</cvename>
<url>https://www.debian.org/security/2017/dsa-4041</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511</url>
</references>
<dates>
<discovery>2017-11-16</discovery>
<entry>2017-11-21</entry>
<modified>2017-12-08</modified>
</dates>
</vuln>
<vuln vid="bf266183-cec7-11e7-af2d-2047478f2f70">
<topic>frr -- BGP Mishandled attribute length on Error</topic>
<affects>
<package>
<name>frr</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FRR reports:</p>
<blockquote cite="https://frrouting.org/community/security/cve-2017-15865.html">
<p>BGP Mishandled attribute length on Error</p>
<p>A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE
packet can leak information from the BGP daemon and cause a denial of
service by crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15865</cvename>
<url>https://frrouting.org/community/security/cve-2017-15865.html</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-21</entry>
</dates>
</vuln>
<vuln vid="db570002-ce06-11e7-804e-c85b763a2f96">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti reports:</p>
<blockquote cite="https://www.cacti.net/release_notes.php?version=1.1.28">
<p>Changelog</p>
<p>issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions</p>
<p>issue#1066: CVE-2017-16660 in remote_agent.php logging function</p>
<p>issue#1066: CVE-2017-16661 in view log file</p>
<p>issue#1071: CVE-2017-16785 in global_session.php Reflection XSS</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16641</cvename>
<cvename>CVE-2017-16660</cvename>
<cvename>CVE-2017-16661</cvename>
<cvename>CVE-2017-16785</cvename>
<url>https://sourceforge.net/p/cacti/mailman/message/36122745/</url>
</references>
<dates>
<discovery>2017-11-01</discovery>
<entry>2017-11-20</entry>
</dates>
</vuln>
<vuln vid="298829e2-ccce-11e7-92e4-000c29649f92">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.3</lt></range>
</package>
<package>
<name>mediawiki128</name>
<range><lt>1.28.2</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><lt>1.29.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html">
<p>security fixes:</p>
<p>T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.</p>
<p>T165846: BotPasswords doesn't throttle login attempts.</p>
<p>T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.</p>
<p>T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.</p>
<p>T176247: It's possible to mangle HTML via raw message parameter expansion.</p>
<p>T125163: id attribute on headlines allow raw.</p>
<p>T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.</p>
<p>T119158: Language converter: unsafe attribute injection via glossary rules.</p>
<p>T180488: api.log contains passwords in plaintext wasn't correctly fixed.</p>
<p>T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8808</cvename>
<cvename>CVE-2017-8809</cvename>
<cvename>CVE-2017-8810</cvename>
<cvename>CVE-2017-8811</cvename>
<cvename>CVE-2017-8812</cvename>
<cvename>CVE-2017-8814</cvename>
<cvename>CVE-2017-8815</cvename>
<cvename>CVE-2017-0361</cvename>
<cvename>CVE-2017-9841</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-19</entry>
</dates>
</vuln>
<vuln vid="52f10525-caff-11e7-b590-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.187</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html">
<ul>
<li>These updates resolve out-of-bounds read vulnerabilities that
could lead to remote code execution (CVE-2017-3112,
CVE-2017-3114, CVE-2017-11213).</li>
<li>These updates resolve use after free vulnerabilities that
could lead to remote code execution (CVE-2017-11215,
CVE-2017-11225).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3112</cvename>
<cvename>CVE-2017-3114</cvename>
<cvename>CVE-2017-11213</cvename>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-33.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-16</entry>
</dates>
</vuln>
<vuln vid="b4b7ec7d-ca27-11e7-a12d-6cc21735f730">
<topic>shibboleth2-sp -- "Dynamic" metadata provider plugin issue</topic>
<affects>
<package>
<name>shibboleth2-sp</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Internet2 community reports:</p>
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20171115.txt">
<p>
The Shibboleth Service Provider software includes a MetadataProvider
plugin with the plugin type "Dynamic" to obtain metadata on demand
from a query server, in place of the more typical mode of
downloading aggregates separately containing all of the metadata to
load.
</p><p>
All the plugin types rely on MetadataFilter plugins to perform
critical security checks such as signature verification, enforcement
of validity periods, and other checks specific to deployments.
</p><p>
Due to a coding error, the "Dynamic" plugin fails to configure
itself with the filters provided to it and thus omits whatever
checks they are intended to perform, which will typically leave
deployments vulnerable to active attacks involving the substitution
of metadata if the network path to the query service is
compromised.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.internet2.edu/secadv/secadv_20171115.txt</url>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-11-15</entry>
</dates>
</vuln>
<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
bug 1384615, 1386490, 1393840, 1403716 -->
<range><lt>56.0.2_10,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
<p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
<p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
<p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
<p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
<p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p>
<p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
<p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
<p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p>
<p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
<p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7826</cvename>
<cvename>CVE-2017-7827</cvename>
<cvename>CVE-2017-7828</cvename>
<cvename>CVE-2017-7830</cvename>
<cvename>CVE-2017-7831</cvename>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7833</cvename>
<cvename>CVE-2017-7834</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7836</cvename>
<cvename>CVE-2017-7837</cvename>
<cvename>CVE-2017-7838</cvename>
<cvename>CVE-2017-7839</cvename>
<cvename>CVE-2017-7840</cvename>
<cvename>CVE-2017-7842</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-14</entry>
</dates>
</vuln>
<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
<topic>rubygem-geminabox -- XSS vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-16792">
<p>Stored cross-site scripting (XSS) vulnerability in "geminabox"
(Gem in a Box) before 0.13.10 allows attackers to inject arbitrary
web script via the "homepage" value of a ".gemspec" file, related
to views/gem.erb and views/index.erb.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-16792</url>
<cvename>CVE-2017-16792</cvename>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2017-11-13</entry>
</dates>
</vuln>
<vuln vid="795ccee1-c7ed-11e7-ad7d-001e2a3f778d">
<topic>konversation -- crash in IRC message parsing</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20171112-1.txt">
<p>Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15923</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923</url>
<url>https://www.kde.org/info/security/advisory-20171112-1.txt</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2017-11-12</entry>
</dates>
</vuln>
<vuln vid="f622608c-c53c-11e7-a633-009c02a2ab30">
<topic>roundcube -- file disclosure vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651">
<p>Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before
1.3.3 allows unauthorized access to arbitrary files on the host's filesystem,
including configuration files, as exploited in the wild in November 2017.
The attacker must be able to authenticate at the target system with a valid
username/password as the attack requires an active session.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/roundcube/roundcubemail/issues/6026</url>
<url>https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10</url>
<cvename>CVE-2017-16651</cvename>
<freebsdpr>ports/223557</freebsdpr>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-11</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="f8e72cd4-c66a-11e7-bb17-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC.
Reported by Ned Williamson on 2017-10-24</li>
<li>[776677] High CVE-2017-15399: Use after free in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15398</cvename>
<cvename>CVE-2017-15399</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-10</entry>
</dates>
</vuln>
<vuln vid="1f02af5d-c566-11e7-a12d-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.24</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.20</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.15</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.10</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.6</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1801/">
<ul>
<li>CVE-2017-15098: Memory disclosure in JSON functions</li>
<li>CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to
enforce SELECT privileges</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15099</cvename>
<cvename>CVE-2017-15098</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="1c2a9d76-9d98-43c3-8f5d-8c059b104d99">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.89</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.73.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99574">
<p>Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.</p>
<p>Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-11-08/</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="be261737-c535-11e7-8da5-001999f8d30b">
<topic>asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.5.0</ge><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A memory leak occurs when an Asterisk pjsip session
object is created and that call gets rejected before the
session itself is fully established. When this happens
the session object never gets destroyed. This then leads
to file descriptors and RTP ports being leaked as well.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-011.html</url>
<cvename>CVE-2017-16672</cvename>
</references>
<dates>
<discovery>2017-10-15</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="ab04cb0b-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
for Party B on a CDR. Thus, it is possible for someone
to use an arbitrarily large string and write past the end
of the user field storage buffer. The earlier AST-2017-001
advisory for the CDR user field overflow was for the Party
A buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-010.html</url>
<cvename>CVE-2017-16671</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="19b052c9-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>By carefully crafting invalid values in the Cseq and
the Via header port, pjprojects packet parsing code can
create strings larger than the buffer allocated to hold
them. This will usually cause Asterisk to crash immediately.
The packets do not have to be authenticated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-009.html</url>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-11-09</entry>
<modified>2017-11-15</modified>
</dates>
</vuln>
<vuln vid="f40f07aa-c00f-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2m,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171102.txt">
<p>bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)<br/>
Severity: Moderate<br/>
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No EC algorithms are affected. Analysis suggests that
attacks against RSA and DSA as a result of this defect would be
very difficult to perform and are not believed likely. Attacks
against DH are considered just feasible (although very difficult)
because most of the work necessary to deduce information about a
private key may be performed offline.</p>
<p>Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)<br/>
Severity: Low<br/>
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has
not previously been included in a release due to its low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171102.txt</url>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
</references>
<dates>
<discovery>2017-11-02</discovery>
<entry>2017-11-02</entry>
</dates>
</vuln>
<vuln vid="cee3d12f-bf41-11e7-bced-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/">
<p>WordPress versions 4.8.2 and earlier are affected by an issue
where $wpdb->prepare() can create unexpected and unsafe queries
leading to potential SQL injection (SQLi). WordPress core is not
directly vulnerable to this issue, but we've added hardening to
prevent plugins and themes from accidentally causing a vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/</url>
</references>
<dates>
<discovery>2017-10-31</discovery>
<entry>2017-11-01</entry>
</dates>
</vuln>
<vuln vid="4684a426-774d-4390-aa19-b8dd481c4c94">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.9</le></range>
<range><ge>2.4.0</ge><le>2.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/101228">
<p>In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.</p>
<p>In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.</p>
<p>In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101227</url>
<url>http://www.securityfocus.com/bid/101228</url>
<url>http://www.securityfocus.com/bid/101229</url>
<url>http://www.securityfocus.com/bid/101235</url>
<url>http://www.securityfocus.com/bid/101240</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080</url>
<url>https://code.wireshark.org/review/23470</url>
<url>https://code.wireshark.org/review/23537</url>
<url>https://code.wireshark.org/review/23591</url>
<url>https://code.wireshark.org/review/23635</url>
<url>https://code.wireshark.org/review/23663</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-42.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-43.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-44.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-45.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-46.html</url>
<cvename>CVE-2017-15189</cvename>
<cvename>CVE-2017-15190</cvename>
<cvename>CVE-2017-15191</cvename>
<cvename>CVE-2017-15192</cvename>
<cvename>CVE-2017-15193</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-30</entry>
</dates>
</vuln>
<vuln vid="de7a2b32-bd7d-11e7-b627-d43d7e971a1b">
<topic>PHP -- denial of service attack</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.32</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.25</lt></range>
</package>
<package>
<name>php71</name>
<range><lt>7.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-3">
<p>The PHP development team announces the immediate availability of PHP
5.6.32. This is a security release. Several security bugs were fixed in this
release. All PHP 5.6 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-1">
<p>The PHP development team announces the immediate availability of PHP
7.0.25. This is a security release. Several security bugs were fixed in this
release. All PHP 7.0 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-27-1">
<p>The PHP development team announces the immediate availability of PHP
7.1.11. This is a bugfix release, with several bug fixes included. All PHP
7.1 users are encouraged to upgrade to this version. </p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-10-26-3</url>
<url>http://php.net/archive/2017.php#id2017-10-26-1</url>
<url>http://php.net/archive/2017.php#id2017-10-27-1</url>
<cvename>CVE-2016-1283</cvename>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-30</entry>
<modified>2017-11-14</modified>
</dates>
</vuln>
<vuln vid="3cd46257-bbc5-11e7-a3bc-e8e0b747a45a">
<topic>chromium -- Stack overflow in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[770452] High CVE-2017-15396: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
<li>[770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15396</cvename>
<cvename>CVE-2017-15406</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-28</entry>
<modified>2018-01-23</modified>
</dates>
</vuln>
<vuln vid="d77ceb8c-bb13-11e7-8357-3065ec6f3643">
<topic>wget -- Heap overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba</url>
<cvename>CVE-2017-13090</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="09849e71-bb12-11e7-8357-3065ec6f3643">
<topic>wget -- Stack overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f</url>
<cvename>CVE-2017-13089</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="d7d1cc94-b971-11e7-af3a-f1035dd0da62">
<topic>Node.js -- remote DOS security vulnerability</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.8.0</lt></range>
</package>
<package>
<name>node6</name>
<range><ge>6.10.2</ge><lt>6.11.5</lt></range>
</package>
<package>
<name>node4</name>
<range><ge>4.8.2</ge><lt>4.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2017-dos/">
<p>Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/oct-2017-dos/</url>
<cvename>CVE-2017-14919</cvename>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="418c172b-b96f-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>2.8.0</ge><le>9.4.6</le></range>
<range><ge>9.5.0</ge><le>9.5.8</le></range>
<range><ge>10.0.0</ge><le>10.0.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/">
<h1>Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization
filter</h1>
<p>Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS)
vulnerability in the GitLab markdown sanitization filter. The sanitization
filter was not properly stripping invalid characters from URL schemes and
was therefore vulnerable to persistent XSS attacks anywhere Markdown was
supported.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in search bar</h1>
<p>Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the
issue search bar. Usernames were not being properly HTML escaped inside the
author filter would could allow arbitrary script execution.</p>
<h1>Open redirect in repository git redirects</h1>
<p>Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an
open redirect vulnerability when redirecting requests for repository names
that include the git extension. GitLab was not properly removing dangerous
parameters from the params field before redirecting which could allow an
attacker to redirect users to arbitrary hosts.</p>
<h1>Username changes could leave repositories behind</h1>
<p>An internal code review discovered that a bug in the code that moves
repositories during a username change could potentially leave behind
projects, allowing an attacker who knows the previous username to
potentially steal the contents of repositories on instances that are not
configured with hashed namespaces.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="27229c67-b8ff-11e7-9f79-ac9e174be3af">
<topic>Apache OpenOffice -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1810071_1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openofffice project reports:</p>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-3157.html">
<h1>CVE-2017-3157: Arbitrary file disclosure in Calc and Writer</h1>
<p>By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.</p>
<p>The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-9806.html">
<h1>CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor</h1>
<p>A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12607.html">
<h1>CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter</h1>
<p>A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12608.html">
<h1>CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles</h1>
<p>A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openoffice.org/security/cves/CVE-2017-3157.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-9806.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12607.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12608.html</url>
<cvename>CVE-2017-3157</cvename>
<cvename>CVE-2017-9806</cvename>
<cvename>CVE-2017-12607</cvename>
<cvename>CVE-2017-12608</cvename>
</references>
<dates>
<discovery>2016-09-11</discovery>
<entry>2017-10-24</entry>
<modified>2017-10-26</modified>
</dates>
</vuln>
<vuln vid="143ec3d6-b7cf-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.20</ge><lt>7.56.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171023.html">
<p>libcurl contains a buffer overrun flaw in the IMAP handler.<br/>
An IMAP FETCH response line indicates the size of the returned data,
in number of bytes. When that response says the data is zero bytes,
libcurl would pass on that (non-existing) data with a pointer and
the size (zero) to the deliver-data function.<br/>
libcurl's deliver-data function treats zero as a magic number and
invokes strlen() on the data to figure out the length. The strlen()
is called on a heap based buffer that might not be zero terminated
so libcurl might read beyond the end of it into whatever memory lies
after (or just crash) and then deliver that to the application as if
it was actually downloaded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171023.html</url>
<cvename>CVE-2017-1000257</cvename>
</references>
<dates>
<discovery>2017-10-23</discovery>
<entry>2017-10-23</entry>
</dates>
</vuln>
<vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
<topic>h2o -- DoS in workers</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
<p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
see references for full details.</p>
<p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
<p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10868</cvename>
<cvename>CVE-2017-10869</cvename>
<url>https://github.com/h2o/h2o/issues/1459</url>
<url>https://github.com/h2o/h2o/issues/1460</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_10.txt">
<p>When installing themes with unterminated colour formatting
sequences, Irssi may access data beyond the end of the string.</p>
<p>While waiting for the channel synchronisation, Irssi may
incorrectly fail to remove destroyed channels from the query list,
resulting in use after free conditions when updating the state later
on.</p>
<p>Certain incorrectly formatted DCC CTCP messages could cause NULL
pointer dereference.</p>
<p>Overlong nicks or targets may result in a NULL pointer dereference
while splitting the message.</p>
<p>In certain cases Irssi may fail to verify that a Safe channel ID
is long enough, causing reads beyond the end of the string.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_10.txt</url>
<cvename>CVE-2017-15721</cvename>
<cvename>CVE-2017-15722</cvename>
<cvename>CVE-2017-15723</cvename>
<cvename>CVE-2017-15227</cvename>
<cvename>CVE-2017-15228</cvename>
<freebsdpr>ports/223169</freebsdpr>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-22</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="a692bffe-b6ad-11e7-a1c2-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html">
<p>35 security fixes in this release, including:</p>
<ul>
<li>[762930] High CVE-2017-5124: UXSS with MHTML. Reported by
Anonymous on 2017-09-07</li>
<li>[749147] High CVE-2017-5125: Heap overflow in Skia. Reported by
Anonymous on 2017-07-26</li>
<li>[760455] High CVE-2017-5126: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-08-30</li>
<li>[765384] High CVE-2017-5127: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-09-14</li>
<li>[765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by
Omair on 2017-09-14</li>
<li>[765495] High CVE-2017-5129: Use after free in WebAudio. Reported by
Omair on 2017-09-15</li>
<li>[718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05</li>
<li>[722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by
Pranjal Jumde on 2017-05-14</li>
<li>[744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by
Anonymous on 2017-07-16</li>
<li>[762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by
Aleksandar Nikolic of Cisco Talos on 2017-09-05</li>
<li>[752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03</li>
<li>[756040] Medium CVE-2017-15387: Content security bypass. Reported by
Jun Kokatsu on 2017-08-16</li>
<li>[756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17</li>
<li>[739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-07-06</li>
<li>[750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by
Haosheng Wang on 2017-07-28</li>
<li>[598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by
Joao Lucas Melo Brasio on 2016-03-28</li>
<li>[714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
Reported by Xiaoyin Liu on 2017-04-22</li>
<li>[732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by
Svyat Mitin on 2017-06-13</li>
<li>[745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by
Sam on 2017-07-18</li>
<li>[759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by
Johannes Bergman on 2017-08-28</li>
<li>[775550] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5124</cvename>
<cvename>CVE-2017-5125</cvename>
<cvename>CVE-2017-5126</cvename>
<cvename>CVE-2017-5127</cvename>
<cvename>CVE-2017-5128</cvename>
<cvename>CVE-2017-5129</cvename>
<cvename>CVE-2017-5132</cvename>
<cvename>CVE-2017-5130</cvename>
<cvename>CVE-2017-5131</cvename>
<cvename>CVE-2017-5133</cvename>
<cvename>CVE-2017-15386</cvename>
<cvename>CVE-2017-15387</cvename>
<cvename>CVE-2017-15388</cvename>
<cvename>CVE-2017-15389</cvename>
<cvename>CVE-2017-15390</cvename>
<cvename>CVE-2017-15391</cvename>
<cvename>CVE-2017-15392</cvename>
<cvename>CVE-2017-15393</cvename>
<cvename>CVE-2017-15394</cvename>
<cvename>CVE-2017-15395</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-21</entry>
</dates>
</vuln>
<vuln vid="e1cb9dc9-daa9-44db-adde-e94d900e2f7f">
<topic>cacti -- Cross Site Scripting issue</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti developers report:</p>
<blockquote cite=" https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd">
<p>The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securitytracker.com/id/1039569</url>
<url>https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd</url>
<url>https://github.com/Cacti/cacti/issues/1010</url>
<cvename>CVE-2017-15194</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="b95e5674-b4d6-11e7-b895-0cc47a494882">
<topic>arj -- multiple vulnerabilities</topic>
<affects>
<package>
<name>arj</name>
<range><lt>3.10.22_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several vulnerabilities: symlink directory traversal, absolute path directory
traversal and buffer overflow were discovered in the arj archiver.</p>
</body>
</description>
<references>
<cvename>CVE-2015-0556</cvename>
<cvename>CVE-2015-0557</cvename>
<cvename>CVE-2015-2782</cvename>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="3f3837cc-48fb-4414-aa46-5b1c23c9feae">
<topic>krb5 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-devel</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-115</name>
<range><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.6</lt></range>
</package>
<package>
<name>krb5-113</name>
<range><lt>1.14.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8599">
<p>CVE-2017-11368:</p>
<p>In MIT krb5 1.7 and later, an authenticated attacker can cause an
assertion failure in krb5kdc by sending an invalid S4U2Self or
S4U2Proxy request.</p>
</blockquote>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598">
<p>CVE-2017-11462:</p>
<p>RFC 2744 permits a GSS-API implementation to delete an existing
security context on a second or subsequent call to gss_init_sec_context()
or gss_accept_sec_context() if the call results in an error.
This API behavior has been found to be dangerous, leading to the
possibility of memory errors in some callers. For safety, GSS-API
implementations should instead preserve existing security contexts
on error until the caller deletes them.</p>
<p>All versions of MIT krb5 prior to this change may delete acceptor
contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through
1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts
on error.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11368</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599</url>
<url>https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11462</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598</url>
<url>https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf</url>
<cvename>CVE-2017-11368</cvename>
<cvename>CVE-2017-11462</cvename>
</references>
<dates>
<discovery>2017-07-14</discovery>
<entry>2017-10-18</entry>
</dates>
</vuln>
<vuln vid="c41bedfd-b3f9-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.33</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.29</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.10</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.20</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL</url>
<cvename>CVE-2017-10155</cvename>
<cvename>CVE-2017-10379</cvename>
<cvename>CVE-2017-10384</cvename>
<cvename>CVE-2017-10276</cvename>
<cvename>CVE-2017-10167</cvename>
<cvename>CVE-2017-10378</cvename>
<cvename>CVE-2017-10277</cvename>
<cvename>CVE-2017-10203</cvename>
<cvename>CVE-2017-10283</cvename>
<cvename>CVE-2017-10313</cvename>
<cvename>CVE-2017-10296</cvename>
<cvename>CVE-2017-10311</cvename>
<cvename>CVE-2017-10320</cvename>
<cvename>CVE-2017-10314</cvename>
<cvename>CVE-2017-10227</cvename>
<cvename>CVE-2017-10279</cvename>
<cvename>CVE-2017-10294</cvename>
<cvename>CVE-2017-10165</cvename>
<cvename>CVE-2017-10284</cvename>
<cvename>CVE-2017-10286</cvename>
<cvename>CVE-2017-10268</cvename>
<cvename>CVE-2017-10365</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2017-10-18</entry>
<modified>2017-12-23</modified>
</dates>
</vuln>
<vuln vid="ab881a74-c016-4e6d-9f7d-68c8e7cedafb">
<topic>xorg-server -- Multiple Issues</topic>
<affects>
<package>
<name>xorg-server</name>
<range><le>1.18.4_6,1</le></range>
<range><ge>1.19.0,1</ge><le>1.19.3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xorg-server developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99546">
<p>In the X.Org X server before 2017-06-19, a user authenticated to
an X Session could crash or execute code in the context of the X
Server by exploiting a stack overflow in the endianness conversion
of X Events.</p>
<p>Uninitialized data in endianness conversion in the XEvent handling
of the X.Org X Server before 2017-06-19 allowed authenticated
malicious users to access potentially privileged data from the X
server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99546</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455</url>
<url>http://www.securityfocus.com/bid/99543</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced</url>
<cvename>CVE-2017-10971</cvename>
<cvename>CVE-2017-10972</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-10-17</entry>
<modified>2018-05-20</modified>
</dates>
</vuln>
<vuln vid="a73518da-b2fa-11e7-98ef-d43d7ef03aa6">
<topic>Flash Player -- Remote code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-32.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2017-11292).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11292</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-32.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="d670a953-b2a1-11e7-a633-009c02a2ab30">
<topic>WPA packet number reuse with replayed messages and key reinstallation</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><le>2.6_1</le></range>
</package>
<package>
<name>hostapd</name>
<range><le>2.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wpa_supplicant developers report:</p>
<blockquote cite="http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt">
<p>A vulnerability was found in how a number of implementations can be
triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
replaying a specific frame that is used to manage the keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt</url>
<url>https://www.kb.cert.org/vuls/id/228519</url>
<cvename>CVE-2017-13077</cvename>
<cvename>CVE-2017-13078</cvename>
<cvename>CVE-2017-13079</cvename>
<cvename>CVE-2017-13080</cvename>
<cvename>CVE-2017-13081</cvename>
<cvename>CVE-2017-13082</cvename>
<cvename>CVE-2017-13084</cvename>
<cvename>CVE-2017-13086</cvename>
<cvename>CVE-2017-13087</cvename>
<cvename>CVE-2017-13088</cvename>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="b0628e53-092a-4037-938b-29805a7cd31b">
<topic>mercurial -- multiple issues</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mercurial developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100290">
<p>Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository</p>
<p>Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
<topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
<p>An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
<p>An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
<cvename>CVE-2017-2923</cvename>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
<cvename>CVE-2017-2924</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
<topic>FFmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.4</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ffmpeg.org/security.html</url>
<cvename>CVE-2017-14054</cvename>
<cvename>CVE-2017-14055</cvename>
<cvename>CVE-2017-14056</cvename>
<cvename>CVE-2017-14057</cvename>
<cvename>CVE-2017-14058</cvename>
<cvename>CVE-2017-14059</cvename>
<cvename>CVE-2017-14169</cvename>
<cvename>CVE-2017-14170</cvename>
<cvename>CVE-2017-14171</cvename>
<cvename>CVE-2017-14222</cvename>
<cvename>CVE-2017-14223</cvename>
<cvename>CVE-2017-14225</cvename>
<cvename>CVE-2017-14767</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="7274e0cc-575f-41bc-8619-14a41b3c2ad0">
<topic>xorg-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_2,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_2,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Jackson reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002814.html">
<p>One regression fix since 1.19.4 (mea culpa), and fixes for
CVEs 2017-12176 through 2017-12187.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002814.html</url>
<cvename>CVE-2017-12176</cvename>
<cvename>CVE-2017-12177</cvename>
<cvename>CVE-2017-12178</cvename>
<cvename>CVE-2017-12179</cvename>
<cvename>CVE-2017-12180</cvename>
<cvename>CVE-2017-12181</cvename>
<cvename>CVE-2017-12182</cvename>
<cvename>CVE-2017-12183</cvename>
<cvename>CVE-2017-12184</cvename>
<cvename>CVE-2017-12185</cvename>
<cvename>CVE-2017-12186</cvename>
<cvename>CVE-2017-12187</cvename>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
<topic>solr -- Code execution via entity expansion</topic>
<affects>
<package>
<name>apache-solr</name>
<range><ge>5.1</ge><le>6.6.1</le></range>
<range><ge>7.0.0</ge><lt>7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Solr developers report:</p>
<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
<p>Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.</p>
<p>Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
<url>https://marc.info/?l=apache-announce&m=150786685013286</url>
<cvename>CVE-2017-12629</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-10-13</entry>
<modified>2017-10-16</modified>
</dates>
</vuln>
<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.83</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.73.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-10-11/">
<p>A total of 11 issues are reported, please see reference URL for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-10-11/</url>
</references>
<dates>
<discovery>2017-10-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="da70d472-af59-11e7-ace2-f8b156b439c5">
<topic>xen-kernel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-237.html</url>
<url>http://xenbits.xen.org/xsa/advisory-238.html</url>
<url>http://xenbits.xen.org/xsa/advisory-239.html</url>
<url>http://xenbits.xen.org/xsa/advisory-240.html</url>
<url>http://xenbits.xen.org/xsa/advisory-241.html</url>
<url>http://xenbits.xen.org/xsa/advisory-242.html</url>
<url>http://xenbits.xen.org/xsa/advisory-243.html</url>
<url>http://xenbits.xen.org/xsa/advisory-244.html</url>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-12</entry>
</dates>
</vuln>
<vuln vid="e71fd9d3-af47-11e7-a633-009c02a2ab30">
<topic>nss -- Use-after-free in TLS 1.2 generating handshake hashes</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.32</ge><lt>3.32.1</lt></range>
<range><ge>3.28</ge><lt>3.28.6</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
<package>
<name>linux-c7-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805">
<p>During TLS 1.2 exchanges, handshake hashes are generated which
point to a message buffer. This saved data is used for later
messages but in some cases, the handshake transcript can
exceed the space available in the current buffer, causing the
allocation of a new buffer. This leaves a pointer pointing to
the old, freed buffer, resulting in a use-after-free when
handshake hashes are then calculated afterwards. This can
result in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805</url>
<url>https://hg.mozilla.org/projects/nss/rev/2d7b65b72290</url>
<url>https://hg.mozilla.org/projects/nss/rev/d3865e2957d0</url>
<cvename>CVE-2017-7805</cvename>
</references>
<dates>
<discovery>2017-08-04</discovery>
<entry>2017-10-12</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="15a62f22-098a-443b-94e2-2d26c375b993">
<topic>osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer</topic>
<affects>
<package>
<name>libosip2</name>
<range><le>5.0.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>osip developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/97644">
<p>In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/97644</url>
<url>https://savannah.gnu.org/support/index.php?109265</url>
<cvename>CVE-2017-7853</cvename>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="b84dbd94-e894-4c91-b8cd-d328537b1b2b">
<topic>ncurses -- multiple issues</topic>
<affects>
<package>
<name>ncurses</name>
<range><le>6.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ncurses developers reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1484285">
<p>There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484274</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484276</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484284</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484285</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484287</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484290</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484291</url>
<cvename>CVE-2017-13728</cvename>
<cvename>CVE-2017-13729</cvename>
<cvename>CVE-2017-13730</cvename>
<cvename>CVE-2017-13731</cvename>
<cvename>CVE-2017-13732</cvename>
<cvename>CVE-2017-13733</cvename>
<cvename>CVE-2017-13734</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="9164f51e-ae20-11e7-a633-009c02a2ab30">
<topic>Python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS">
<p>Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-5300</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
</references>
<dates>
<discovery>2017-08-26</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="1257718e-be97-458a-9744-d938b592db42">
<topic>node -- access to unintended files</topic>
<affects>
<package>
<name>node</name>
<range><ge>8.5.0</ge><lt>8.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/101056">
<p>Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101056</url>
<cvename>CVE-2017-14849</cvename>
</references>
<dates>
<discovery>2017-09-27</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="af61b271-9e47-4db0-a0f6-29fb032236a3">
<topic>zookeeper -- Denial Of Service</topic>
<affects>
<package>
<name>zookeeper</name>
<range><lt>3.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zookeeper developers report:</p>
<blockquote cite="https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E">
<p>Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E</url>
<cvename>CVE-2017-5637</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="9b5a905f-e556-452f-a00c-8f070a086181">
<topic>libtiff -- Improper Input Validation</topic>
<affects>
<package>
<name>libtiff</name>
<range><le>4.0.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100524">
<p>There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
<p>There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2727</url>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2728</url>
<url>http://www.securityfocus.com/bid/100524</url>
<cvename>CVE-2017-13726</cvename>
<cvename>CVE-2017-13727</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="2c8bd00d-ada2-11e7-82af-8dbff7d75206">
<topic>rubygems -- deserialization vulnerability</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security mailing list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/10/10/2">
<p>There is a possible unsafe object desrialization vulnerability in
RubyGems. It is possible for YAML deserialization of gem specifications
to bypass class white lists. Specially crafted serialized objects can
possibly be used to escalate to remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/10/10/2</url>
<url>http://blog.rubygems.org/2017/10/09/2.6.14-released.html</url>
<cvename>CVE-2017-0903</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="4f8ffb9c-f388-4fbd-b90f-b3131559d888">
<topic>xorg-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_1,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_1,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002809.html">
<p>X.Org thanks Michal Srb of SuSE for finding these issues
and bringing them to our attention, Julien Cristau of
Debian for getting the fixes integrated, and Adam Jackson
of Red Hat for publishing the release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002809.html</url>
<cvename>CVE-2017-13721</cvename>
<cvename>CVE-2017-13723</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-09</entry>
</dates>
</vuln>
<vuln vid="c0dae634-4820-4505-850d-b1c975d0f67d">
<topic>tomcat -- Remote Code Execution</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.81</le></range>
<range><ge>8.0.0</ge><le>8.0.46</le></range>
<range><ge>8.5.0</ge><le>8.5.22</le></range>
<range><ge>9.0.0</ge><lt>9.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tomcat developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100954">
<p>When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100954</url>
<url>https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E</url>
<cvename>CVE-2017-12617</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-06</entry>
</dates>
</vuln>
<vuln vid="ccace707-a8d8-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171004.html">
<p>FTP PWD response parser out of bounds read</p>
<p>libcurl may read outside of a heap allocated buffer when doing FTP.</p>
<p>When libcurl connects to an FTP server and successfully logs in
(anonymous or not), it asks the server for the current directory with
the PWD command. The server then responds with a 257 response containing
the path, inside double quotes. The returned path name is then kept by
libcurl for subsequent uses.</p>
<p>Due to a flaw in the string parser for this directory name, a directory
name passed like this but without a closing double quote would lead to
libcurl not adding a trailing NUL byte to the buffer holding the name.
When libcurl would then later access the string, it could read beyond
the allocated heap buffer and crash or wrongly access data beyond the
buffer, thinking it was part of the path.</p>
<p>A malicious server could abuse this fact and effectively prevent
libcurl-based clients to work with it - the PWD command is always issued
on new FTP connections and the mistake has a high chance of causing a
segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171004.html</url>
<cvename>CVE-2017-1000254</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-04</entry>
</dates>
</vuln>
<vuln vid="6ed5c5e3-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSH Denial of Service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_1</lt></range>
<range><ge>11.0</ge><lt>11.0_12</lt></range>
<range><ge>10.3</ge><lt>10.3_21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is no limit on the password length.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause an affected SSH
server to use excessive amount of CPU by sending very long
passwords, when PasswordAuthentication is enabled by the
system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6515</cvename>
<freebsdsa>SA-17:06.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="420243e9-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- heimdal KDC-REP service name validation vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_11</lt></range>
<range><ge>10.3</ge><lt>10.3_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in the Heimdal implementation
that used an unauthenticated, plain-text version of the
KDC-REP service name found in a ticket.</p>
<h1>Impact:</h1>
<p>An attacker who has control of the network between a
client and the service it talks to will be able to impersonate
the service, allowing a successful man-in-the-middle (MITM)
attack that circumvents the mutual authentication.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1110</cvename>
<freebsdsa>SA-17:05.heimdal</freebsdsa>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf">
<topic>dnsmasq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.78,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">
<ul>
<li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this
commit overflow was unrestricted.</li>
<li>CVE-2017-14492: Heap based overflow.</li>
<li>CVE-2017-14493: Stack Based overflow.</li>
<li>CVE-2017-14494: Information Leak</li>
<li>CVE-2017-14495: Lack of free()</li>
<li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading
to a huge memcpy.</li>
<li>CVE-2017-13704: Crash on large DNS query</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>
<cvename>CVE-2017-14491</cvename>
<cvename>CVE-2017-14492</cvename>
<cvename>CVE-2017-14493</cvename>
<cvename>CVE-2017-14494</cvename>
<cvename>CVE-2017-14495</cvename>
<cvename>CVE-2017-14496</cvename>
<cvename>CVE-2017-13704</cvename>
</references>
<dates>
<discovery>2017-10-02</discovery>
<entry>2017-10-02</entry>
</dates>
</vuln>
<vuln vid="33888815-631e-4bba-b776-a9b46fe177b5">
<topic>phpmyfaq -- multiple issues</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><le>2.9.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.exploit-db.com/exploits/42761/">
<p>Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.</p>
<p>Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.exploit-db.com/exploits/42761/</url>
<url>https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86</url>
<cvename>CVE-2017-14618</cvename>
<cvename>CVE-2017-14619</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="a48d4478-e23f-4085-8ae4-6b3a7b6f016b">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100912">
<p>Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.</p>
<p>Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.</p>
<p>Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.</p>
<p>Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.</p>
<p>Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100912</url>
<url>https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/</url>
<url>https://core.trac.wordpress.org/changeset/41393</url>
<url>https://core.trac.wordpress.org/changeset/41395</url>
<url>https://core.trac.wordpress.org/changeset/41397</url>
<url>https://core.trac.wordpress.org/changeset/41412</url>
<url>https://core.trac.wordpress.org/changeset/41448</url>
<url>https://core.trac.wordpress.org/changeset/41457</url>
<url>https://wpvulndb.com/vulnerabilities/8911</url>
<url>https://wpvulndb.com/vulnerabilities/8912</url>
<url>https://wpvulndb.com/vulnerabilities/8913</url>
<url>https://wpvulndb.com/vulnerabilities/8914</url>
<cvename>CVE-2017-14718</cvename>
<cvename>CVE-2017-14719</cvename>
<cvename>CVE-2017-14720</cvename>
<cvename>CVE-2017-14721</cvename>
<cvename>CVE-2017-14722</cvename>
<cvename>CVE-2017-14724</cvename>
<cvename>CVE-2017-14726</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="1098a15b-b0f6-42b7-b5c7-8a8646e8be07">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>56.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>CVE-2017-7793: Use-after-free with Fetch API</p>
<p>CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode</p>
<p>CVE-2017-7818: Use-after-free during ARIA array manipulation</p>
<p>CVE-2017-7819: Use-after-free while resizing images in design mode</p>
<p>CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE</p>
<p>CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes</p>
<p>CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files</p>
<p>CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings</p>
<p>CVE-2017-7813: Integer truncation in the JavaScript parser</p>
<p>CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces</p>
<p>CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations</p>
<p>CVE-2017-7816: WebExtensions can load about: URLs in extension UI</p>
<p>CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction</p>
<p>CVE-2017-7823: CSP sandbox directive did not create a unique origin</p>
<p>CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV</p>
<p>CVE-2017-7820: Xray wrapper bypass with new tab and web console</p>
<p>CVE-2017-7811: Memory safety bugs fixed in Firefox 56</p>
<p>CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7793</cvename>
<cvename>CVE-2017-7805</cvename>
<cvename>CVE-2017-7810</cvename>
<cvename>CVE-2017-7811</cvename>
<cvename>CVE-2017-7812</cvename>
<cvename>CVE-2017-7813</cvename>
<cvename>CVE-2017-7814</cvename>
<cvename>CVE-2017-7815</cvename>
<cvename>CVE-2017-7816</cvename>
<cvename>CVE-2017-7817</cvename>
<cvename>CVE-2017-7818</cvename>
<cvename>CVE-2017-7819</cvename>
<cvename>CVE-2017-7820</cvename>
<cvename>CVE-2017-7821</cvename>
<cvename>CVE-2017-7822</cvename>
<cvename>CVE-2017-7823</cvename>
<cvename>CVE-2017-7824</cvename>
<cvename>CVE-2017-7825</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/</url>
</references>
<dates>
<discovery>2017-09-28</discovery>
<entry>2017-09-29</entry>
<modified>2017-10-03</modified>
</dates>
</vuln>
<vuln vid="43a1b8f9-3451-4f3c-b4fc-730c0f5876c1">
<topic>sam2p -- multiple issues</topic>
<affects>
<package>
<name>sam2p</name>
<range><lt>0.49.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sam2p developers report:</p>
<blockquote cite="https://github.com/pts/sam2p/issues/14">
<p>In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.</p>
<p>In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.</p>
<p>In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.</p>
<p>In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.</p>
<p>Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.</p>
<p>In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pts/sam2p/issues/14</url>
<cvename>CVE-2017-14628</cvename>
<cvename>CVE-2017-14629</cvename>
<cvename>CVE-2017-14630</cvename>
<cvename>CVE-2017-14631</cvename>
<cvename>CVE-2017-14636</cvename>
<cvename>CVE-2017-14637</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="02bee9ae-c5d1-409b-8a79-983a88861509">
<topic>libraw -- Out-of-bounds Read</topic>
<affects>
<package>
<name>libraw</name>
<range><le>0.18.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21">
<p>In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21</url>
<url>https://github.com/LibRaw/LibRaw/issues/101</url>
<cvename>CVE-2017-14608</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8">
<topic>OpenVPN -- out-of-bounds write in legacy key-method 1</topic>
<affects>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.18</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
</package>
<package>
<name>openvpn</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
<range><lt>2.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steffan Karger reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2017-12166">
<p>The bounds check in read_key() was performed after using the value,
instead of before. If 'key-method 1' is used, this allowed an
attacker to send a malformed packet to trigger a stack buffer
overflow. [...]</p>
<p>Note that 'key-method 1' has been replaced by 'key method 2' as the
default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
deprecated in 2.4 and marked for removal in 2.5. This should limit
the amount of users impacted by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/CVE-2017-12166</url>
<url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html</url>
<cvename>CVE-2017-12166</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="16fb4f83-a2ab-11e7-9c14-009c02a2ab30">
<topic>ImageMagick -- denial of service via a crafted font file</topic>
<affects>
<package>
<name>ImageMagick7</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick</name>
<range><le>6.9.8.9_1</le></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><le>6.9.8.9_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741">
<p>The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/771</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d</url>
<cvename>CVE-2017-14741</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="58fafead-cd13-472f-a9bd-d0173ba1b04c">
<topic>libofx -- exploitable buffer overflow</topic>
<affects>
<package>
<name>libofx</name>
<range><le>0.9.11_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100828">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100828</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317</url>
<cvename>CVE-2017-2816</cvename>
</references>
<dates>
<discovery>2017-09-13</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="3b776502-f601-44e0-87cd-b63f1b9ae42a">
<topic>sugarcrm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sugarcrm</name>
<range><le>6.5.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sugarcrm developers report:</p>
<blockquote cite="https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/">
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/</url>
<cvename>CVE-2017-14508</cvename>
<cvename>CVE-2017-14509</cvename>
<cvename>CVE-2017-14510</cvename>
</references>
<dates>
<discovery>2017-09-17</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="b2952517-07e5-4d19-8850-21c5b7e0623f">
<topic>libzip -- denial of service</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>1.1.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/">
<p>The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/</url>
<url>https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5</url>
<cvename>CVE-2017-14107</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="10214bda-0902-4e3b-a2f9-9a68ef206a73">
<topic>libbson -- Denial of Service</topic>
<affects>
<package>
<name>libbson</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mongodb developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100825">
<p>In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100825</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489355</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489356</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489362</url>
<cvename>CVE-2017-14227</cvename>
</references>
<dates>
<discovery>2017-09-09</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="eb03d642-6724-472d-b038-f2bf074e1fc8">
<topic>tcpdump -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tcpdump developers report:</p>
<blockquote cite="http://www.tcpdump.org/tcpdump-changes.txt">
<p>Too many issues to detail, see CVE references for details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11541</cvename>
<cvename>CVE-2017-11542</cvename>
<cvename>CVE-2017-11543</cvename>
<cvename>CVE-2017-12893</cvename>
<cvename>CVE-2017-12894</cvename>
<cvename>CVE-2017-12895</cvename>
<cvename>CVE-2017-12896</cvename>
<cvename>CVE-2017-12897</cvename>
<cvename>CVE-2017-12898</cvename>
<cvename>CVE-2017-12899</cvename>
<cvename>CVE-2017-12900</cvename>
<cvename>CVE-2017-12901</cvename>
<cvename>CVE-2017-12902</cvename>
<cvename>CVE-2017-12985</cvename>
<cvename>CVE-2017-12986</cvename>
<cvename>CVE-2017-12987</cvename>
<cvename>CVE-2017-12988</cvename>
<cvename>CVE-2017-12989</cvename>
<cvename>CVE-2017-12990</cvename>
<cvename>CVE-2017-12991</cvename>
<cvename>CVE-2017-12992</cvename>
<cvename>CVE-2017-12993</cvename>
<cvename>CVE-2017-12994</cvename>
<cvename>CVE-2017-12995</cvename>
<cvename>CVE-2017-12996</cvename>
<cvename>CVE-2017-12997</cvename>
<cvename>CVE-2017-12998</cvename>
<cvename>CVE-2017-12999</cvename>
<cvename>CVE-2017-13000</cvename>
<cvename>CVE-2017-13001</cvename>
<cvename>CVE-2017-13002</cvename>
<cvename>CVE-2017-13003</cvename>
<cvename>CVE-2017-13004</cvename>
<cvename>CVE-2017-13005</cvename>
<cvename>CVE-2017-13006</cvename>
<cvename>CVE-2017-13007</cvename>
<cvename>CVE-2017-13008</cvename>
<cvename>CVE-2017-13009</cvename>
<cvename>CVE-2017-13010</cvename>
<cvename>CVE-2017-13011</cvename>
<cvename>CVE-2017-13012</cvename>
<cvename>CVE-2017-13013</cvename>
<cvename>CVE-2017-13014</cvename>
<cvename>CVE-2017-13015</cvename>
<cvename>CVE-2017-13016</cvename>
<cvename>CVE-2017-13017</cvename>
<cvename>CVE-2017-13018</cvename>
<cvename>CVE-2017-13019</cvename>
<cvename>CVE-2017-13020</cvename>
<cvename>CVE-2017-13021</cvename>
<cvename>CVE-2017-13022</cvename>
<cvename>CVE-2017-13023</cvename>
<cvename>CVE-2017-13024</cvename>
<cvename>CVE-2017-13025</cvename>
<cvename>CVE-2017-13026</cvename>
<cvename>CVE-2017-13027</cvename>
<cvename>CVE-2017-13028</cvename>
<cvename>CVE-2017-13029</cvename>
<cvename>CVE-2017-13030</cvename>
<cvename>CVE-2017-13031</cvename>
<cvename>CVE-2017-13032</cvename>
<cvename>CVE-2017-13033</cvename>
<cvename>CVE-2017-13034</cvename>
<cvename>CVE-2017-13035</cvename>
<cvename>CVE-2017-13036</cvename>
<cvename>CVE-2017-13037</cvename>
<cvename>CVE-2017-13038</cvename>
<cvename>CVE-2017-13039</cvename>
<cvename>CVE-2017-13040</cvename>
<cvename>CVE-2017-13041</cvename>
<cvename>CVE-2017-13042</cvename>
<cvename>CVE-2017-13043</cvename>
<cvename>CVE-2017-13044</cvename>
<cvename>CVE-2017-13045</cvename>
<cvename>CVE-2017-13046</cvename>
<cvename>CVE-2017-13047</cvename>
<cvename>CVE-2017-13048</cvename>
<cvename>CVE-2017-13049</cvename>
<cvename>CVE-2017-13050</cvename>
<cvename>CVE-2017-13051</cvename>
<cvename>CVE-2017-13052</cvename>
<cvename>CVE-2017-13053</cvename>
<cvename>CVE-2017-13054</cvename>
<cvename>CVE-2017-13055</cvename>
<cvename>CVE-2017-13687</cvename>
<cvename>CVE-2017-13688</cvename>
<cvename>CVE-2017-13689</cvename>
<cvename>CVE-2017-13690</cvename>
<cvename>CVE-2017-13725</cvename>
</references>
<dates>
<discovery>2017-07-22</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d9f96741-47bd-4426-9aba-8736c0971b24">
<topic>libraw -- buffer overflow</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100866">
<p>LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100866</url>
<url>https://github.com/LibRaw/LibRaw/issues/100</url>
<cvename>CVE-2017-14348</cvename>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="4cd857d9-26d2-4417-b765-69701938f9e0">
<topic>libraw -- denial of service and remote code execution</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/issues/99">
<p>A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/issues/99</url>
<cvename>CVE-2017-14265</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="a60a2e95-acba-4b11-bc32-ffb47364e07d">
<topic>libgd -- Denial of servica via double free</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libgd developers report:</p>
<blockquote cite="http://www.debian.org/security/2017/dsa-3961">
<p>Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.debian.org/security/2017/dsa-3961</url>
<url>https://github.com/libgd/libgd/issues/381</url>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.5</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/</url>
<cvename>CVE-2017-6362</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="5033e2fc-98ec-4ef5-8e0b-87cfbbc73081">
<topic>php-gd and gd -- Buffer over-read into uninitialized memory</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-gd</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers report:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=74435">
<p>The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=74435</url>
<cvename>CVE-2017-7890</cvename>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d843a984-7f22-484f-ba81-483ddbe30dc3">
<topic>ledger -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ledger</name>
<range><le>3.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100543">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.</p>
<p>An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100543</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303</url>
<url>http://www.securityfocus.com/bid/100546</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304</url>
<cvename>CVE-2017-2808</cvename>
<cvename>CVE-2017-2807</cvename>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="7801b1e1-99b4-42ac-ab22-7646235e7c16">
<topic>aacplusenc -- denial of service</topic>
<affects>
<package>
<name>aacplusenc</name>
<range><le>0.17.5_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/">
<p>DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/</url>
<url>https://github.com/teknoraver/aacplusenc/issues/1</url>
<cvename>CVE-2017-14181</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="478d4102-2319-4026-b3b2-a57c48f159ac">
<topic>ansible -- information disclosure flaw</topic>
<affects>
<package>
<name>ansible</name>
<range><le>2.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible/issues/22505">
<p>Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ansible/ansible/issues/22505</url>
<cvename>CVE-2017-7473</cvename>
</references>
<dates>
<discovery>2017-07-21</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="b63421b6-a1e0-11e7-ac58-b499baebfeaf">
<topic>weechat -- crash in logger plugin</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WeeChat reports:</p>
<blockquote cite="https://weechat.org/news/98/20170923-Version-1.9.1-security-release/">
<p>security problem: a crash can happen in logger plugin when
converting date/time specifiers in file mask.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/news/98/20170923-Version-1.9.1-security-release/</url>
<cvename>CVE-2017-14727</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="d9e82328-a129-11e7-987e-4f174049b30a">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.3</lt></range>
<range><ge>5.26.0</ge><lt>5.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.1#Security">
<p>CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows</p>
<p>A possible stack buffer overflow in the %ENV code on Windows has been
fixed by removing the buffer completely since it was superfluous anyway.</p>
<p>CVE-2017-12837: Heap buffer overflow in regular expression compiler</p>
<p>Compiling certain regular expression patterns with the case-insensitive
modifier could cause a heap buffer overflow and crash perl. This has now
been fixed.</p>
<p>CVE-2017-12883: Buffer over-read in regular expression parser</p>
<p>For certain types of syntax error in a regular expression pattern, the
error message could either contain the contents of a random, possibly
large, chunk of memory, or could crash perl. This has now been fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.3</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.1</url>
<cvename>CVE-2017-12814</cvename>
<cvename>CVE-2017-12837</cvename>
<cvename>CVE-2017-12883</cvename>
</references>
<dates>
<discovery>2017-09-19</discovery>
<entry>2017-09-24</entry>
</dates>
</vuln>
<vuln vid="917e5519-9fdd-11e7-8b58-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by
Jordan Rabet, Microsoft Offensive Security Research and Microsoft
ChakraCore team on 2017-09-14</li>
<li>[752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by
Choongwoo Han of Naver Corporation on 2017-08-04</li>
<li>[767508] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5121</cvename>
<cvename>CVE-2017-5122</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-22</entry>
</dates>
</vuln>
<vuln vid="c2ea3b31-9d75-11e7-bb13-001999f8d30b">
<topic>asterisk -- RTP/RTCP information leak</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.3</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>This is a follow up advisory to AST-2017-005.</p>
<p>Insufficient RTCP packet validation could allow reading
stale buffer contents and when combined with the "nat"
and "symmetric_rtp" options allow redirecting where
Asterisk sends the next RTCP report.</p>
<p>The RTP stream qualification to learn the source address
of media always accepted the first RTP packet as the new
source and allowed what AST-2017-005 was mitigating. The
intent was to qualify a series of packets before accepting
the new source address.</p>
<p>The RTP/RTCP stack will now validate RTCP packets before processing them.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-008.html</url>
<cvename>CVE-2017-14099</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="95b01379-9d52-11e7-a25c-471bafc3262f">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0</ge><lt>2.2.8</lt></range>
<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby blog:</p>
<blockquote cite="https://www.ruby-lang.org/en/security/">
<p>CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf</p>
<p>If a malicious format string which contains a precious specifier (*)
is passed and a huge minus value is also passed to the specifier,
buffer underrun may be caused. In such situation, the result may
contains heap, or the Ruby interpreter may crash.</p>
<p>CVE-2017-10784: Escape sequence injection vulnerability in the Basic
authentication of WEBrick</p>
<p>When using the Basic authentication of WEBrick, clients can pass an
arbitrary string as the user name. WEBrick outputs the passed user name
intact to its log, then an attacker can inject malicious escape
sequences to the log and dangerous control characters may be executed
on a victim’s terminal emulator.</p>
<p>This vulnerability is similar to a vulnerability already fixed, but
it had not been fixed in the Basic authentication.</p>
<p>CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode</p>
<p>If a malicious string is passed to the decode method of OpenSSL::ASN1,
buffer underrun may be caused and the Ruby interpreter may crash.</p>
<p>CVE-2017-14064: Heap exposure vulnerability in generating JSON</p>
<p>The generate method of JSON module optionally accepts an instance of
JSON::Ext::Generator::State class. If a malicious instance is passed,
the result may include contents of heap.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/security/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/</url>
<cvename>CVE-2017-0898</cvename>
<cvename>CVE-2017-10784</cvename>
<cvename>CVE-2017-14033</cvename>
<cvename>CVE-2017-14064</cvename>
</references>
<dates>
<discovery>2017-09-14</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="2bffdf2f-9d45-11e7-a25c-471bafc3262f">
<topic>rubygem-geminabox -- XSS & CSRF vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gem in a box XSS vulenrability - CVE-2017-14506:</p>
<blockquote cite="https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html">
<p>Malicious attacker create GEM file with crafted homepage value
(gem.homepage in .gemspec file) includes XSS payload.</p>
<p>The attacker access geminabox system and uploads the gem file
(or uses CSRF/SSRF attack to do so).</p>
<p>From now on, any user access Geminabox web server, executes the
malicious XSS payload, that will delete any gems on the server,
and won't let users use the geminabox anymore. (make victim's
browser crash or redirect them to other hosts).</p>
</blockquote>
</body>
</description>
<references>
<url>https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html</url>
<cvename>CVE-2017-14506</cvename>
<cvename>CVE-2017-14683</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
<modified>2017-09-27</modified>
</dates>
</vuln>
<vuln vid="76b085e2-9d33-11e7-9260-000c292ee6b8">
<topic>Apache -- HTTP OPTIONS method can leak server memory</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27_1</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Fuzzing Project reports:</p>
<blockquote cite="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html">
<p>Apache httpd allows remote attackers to read secret data from
process memory if the Limit directive can be set in a user's
.htaccess file, or if httpd.conf has certain misconfigurations,
aka Optionsbleed. This affects the Apache HTTP Server through
2.2.34 and 2.4.x through 2.4.27. The attacker sends an
unauthenticated OPTIONS HTTP request when attempting to read
secret data. This is a use-after-free issue and thus secret data
is not always sent, and the specific data depends on many factors
including configuration. Exploitation with .htaccess can be
blocked with a patch to the ap_limit_section function in
server/core.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-9798</url>
<cvename>CVE-2017-9798</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>1.0.0</ge><le>9.3.10</le></range>
<range><ge>9.4.0</ge><le>9.4.5</le></range>
<range><ge>9.5.0</ge><le>9.5.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2016-4738</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-14</entry>
</dates>
</vuln>
<vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-28.html">
<ul>
<li>These updates resolve memory corruption vulnerabilities that
could lead to remote code execution (CVE-2017-11281,
CVE-2017-11282).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11281</cvename>
<cvename>CVE-2017-11282</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-28.html</url>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-12</entry>
</dates>
</vuln>
<vuln vid="47e2e52c-975c-11e7-942d-5404a68a61a2">
<topic>emacs -- enriched text remote code execution vulnerability</topic>
<affects>
<package>
<name>emacs25</name>
<name>emacs-nox11</name>
<range><lt>25.3,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<range><lt>26.0.50.20170912,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Eggert reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/422">
<p>Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.</p>
<p>When Emacs renders MIME text/enriched data (Internet RFC 1896), it
is vulnerable to arbitrary code execution. Since Emacs-based mail
clients decode "Content-Type: text/enriched", this code is exploitable
remotely. This bug affects GNU Emacs versions 19.29 through 25.2.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/422</url>
<url>https://bugs.gnu.org/28350</url>
</references>
<dates>
<discovery>2017-09-04</discovery>
<entry>2017-09-12</entry>
<modified>2017-09-13</modified>
</dates>
</vuln>
<vuln vid="f9f76a50-9642-11e7-ab09-080027b00c2e">
<topic>cyrus-imapd -- broken "other users" behaviour</topic>
<affects>
<package>
<name>cyrus-imapd30</name>
<range><ge>3.0.0</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.0.4 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html">
<p>Fixed Issue #2132: Broken "Other Users" behaviour</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14230</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230</url>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-10</entry>
</dates>
</vuln>
<vuln vid="aaab03be-932d-11e7-92d8-4b26fc968492">
<topic>Django -- possible XSS in traceback section of technical 500 debug page</topic>
<affects>
<package>
<name>py27-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.8</lt></range>
</package>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django blog:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/sep/05/security-releases/">
<p>In older versions, HTML autoescaping was disabled in a portion of the template
for the technical 500 debug page. Given the right circumstances, this allowed a
cross-site scripting attack. This vulnerability shouldn't affect most production
sites since you shouldn't run with DEBUG = True (which makes this page accessible)
in your production settings.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12794</cvename>
<url>https://www.djangoproject.com/weblog/2017/sep/05/security-releases/</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">
<p>22 security fixes in this release, including:</p>
<ul>
<li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
<li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
Tobias Klein on 2017-07-10</li>
<li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
Anonymous on 2017-07-20</li>
<li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
<li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
Marco Giovannini on 2017-07-17</li>
<li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
Anonymous on 2017-08-28</li>
<li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
Tobias Klein on 2017-07-04</li>
<li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
<li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
Anonymous on 2017-05-22</li>
<li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
Xiaoyin Liu on 2017-05-05</li>
<li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5111</cvename>
<cvename>CVE-2017-5112</cvename>
<cvename>CVE-2017-5113</cvename>
<cvename>CVE-2017-5114</cvename>
<cvename>CVE-2017-5115</cvename>
<cvename>CVE-2017-5116</cvename>
<cvename>CVE-2017-5117</cvename>
<cvename>CVE-2017-5118</cvename>
<cvename>CVE-2017-5119</cvename>
<cvename>CVE-2017-5120</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699">
<cancelled/>
</vuln>
<vuln vid="5a1f1a86-8f4c-11e7-b5af-a4badb2f4699">
<topic>gdk-pixbuf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gtk-pixbuf2</name>
<range><lt>2.36.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html">
<ul>
<li><p>An exploitable integer overflow vulnerability exists in
the tiff_image_parse functionality.</p></li>
<li><p>An exploitable heap-overflow vulnerability exists in
the gdk_pixbuf__jpeg_image_load_increment functionality.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html</url>
<cvename>CVE-2017-2862</cvename>
<cvename>CVE-2017-2870</cvename>
</references>
<dates>
<discovery>2017-08-30</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
<topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
<cvename>CVE-2017-14098</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
<topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.2</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2017-005 - A change was made to the strict RTP
support in the RTP stack to better tolerate late media
when a reinvite occurs. When combined with the symmetric
RTP support this introduced an avenue where media could
be hijacked. Instead of only learning a new address when
expected the new code allowed a new source address to be
learned at all times.</p>
<p>AST-2017-006 - The app_minivm module has an "externnotify"
program configuration option that is executed by the
MinivmNotify dialplan application. The application uses
the caller-id name and number as part of a built string
passed to the OS shell for interpretation and execution.
Since the caller-id name and number can come from an
untrusted source, a crafted caller-id name or number
allows an arbitrary shell command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
<cvename>CVE-2017-14099</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
<cvename>CVE-2017-14100</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379">
<p>Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0379</cvename>
<url>https://eprint.iacr.org/2017/806</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379</url>
</references>
<dates>
<discovery>2017-08-27</discovery>
<entry>2017-08-30</entry>
</dates>
</vuln>
<vuln vid="3f6de636-8cdb-11e7-9c71-f0def1fd7ea2">
<topic>rubygems -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Official blog of RubyGems reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/">
<p>The following vulnerabilities have been reported: a DNS request
hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS
vulnerability in the query command, and a vulnerability in the gem
installer that allowed a malicious gem to overwrite arbitrary
files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/</url>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-08-29</entry>
</dates>
</vuln>
<vuln vid="7d7e05fb-64da-435a-84fb-4061493b89b9">
<topic>kanboard -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.0.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chbi reports:</p>
<blockquote cite="https://kanboard.net/news/version-1.0.46">
<p>an authenticated standard user could reset the password of another
user (including admin) by altering form data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kanboard.net/news/version-1.0.46</url>
<cvename>CVE-2017-12850</cvename>
<cvename>CVE-2017-12851</cvename>
</references>
<dates>
<discovery>2017-08-15</discovery>
<entry>2017-08-26</entry>
</dates>
</vuln>
<vuln vid="eca2d861-76f4-42ed-89d2-23a2cb396c87">
<topic>poppler -- multiple denial of service issues</topic>
<affects>
<package>
<name>poppler</name>
<range><lt>0.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Poppler developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99241/discuss">
<p>Poppler is prone to a stack-based buffer-overflow
vulnerability.</p>
<p>Successful exploits may allow attackers to crash the affected
application, resulting in denial-of-service condition. Due to the
nature of this issue, arbitrary code execution may be possible but
this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99241/discuss</url>
<cvename>CVE-2017-9865</cvename>
<cvename>CVE-2017-9775</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-08-24</entry>
</dates>
</vuln>
<vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b">
<topic>phpmailer -- XSS in code example and default exeception handler</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24">
<p>Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The
code_generator.phps example did not filter user input prior to output. This
file is distributed with a .phps extension, so it it not normally executable
unless it is explicitly renamed, so it is safe by default. There was also an
undisclosed potential XSS vulnerability in the default exception handler
(unused by default). Patches for both issues kindly provided by Patrick
Monnerat of the Fedora Project.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url>
<cvename>CVE-2017-11503</cvename>
</references>
<dates>
<discovery>2017-07-27</discovery>
<entry>2017-08-23</entry>
</dates>
</vuln>
<vuln vid="3531141d-a708-477c-954a-2a0549e49ca9">
<topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.7</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html">
<p>Correct a flaw in minion id validation which could allow certain
minions to authenticate to a master despite not having the correct
credentials. To exploit the vulnerability, an attacker must create a
salt-minion with an ID containing characters that will cause a
directory traversal.
Credit for discovering the security flaw goes to: Vernhk@qq.com</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12791</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html</url>
<url>https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html</url>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="198d82f3-8777-11e7-950a-e8e0b747a45a">
<topic>dnsdist -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsdist</name>
<range><lt>1.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://dnsdist.org/security-advisories/index.html">
<p>The first issue can lead to a denial of service on 32-bit if a backend
sends crafted answers, and the second to an alteration of dnsdist's ACL
if the API is enabled, writable and an authenticated user is tricked
into visiting a crafted website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7069</cvename>
<cvename>CVE-2017-7557</cvename>
<url>https://dnsdist.org/security-advisories/index.html</url>
</references>
<dates>
<discovery>2017-08-21</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="01a197ca-67f1-11e7-a266-28924a333806">
<topic>evince and atril -- command injection vulnerability in CBT handler</topic>
<affects>
<package>
<name>evince</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>evince-lite</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>atril</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
<package>
<name>atril-lite</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=784630">
<p>The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.</p>
<p>The same vulnerability affects atril, the Evince fork.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=784630</url>
<url>https://github.com/mate-desktop/atril/issues/257</url>
<cvename>CVE-2017-1000083</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="e1de77e8-c45e-48d7-8866-5a6f943046de">
<topic>SquirrelMail -- post-authentication remote code execution</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>20170705</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquirrelMail developers report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2017/Apr/81">
<p>SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN)
allows post-authentication remote code execution via a sendmail.cf
file that is mishandled in a popen call. It's possible to exploit this
vulnerability to execute arbitrary shell commands on the remote
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="6876b163-8708-11e7-8568-e8e0b747a45a">
<topic>pspp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pspp</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Details reports:</p>
<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html">
<ul>
<li>There is an Integer overflow in the hash_int function of the libpspp library
in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).</li>
<li>There is a NULL Pointer Dereference in the function ll_insert() of the libpspp
library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).</li>
<li>There is an illegal address access in the function output_hex() in data/data-out.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).</li>
<li>There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).</li>
<li>There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).</li>
<li>There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10791</cvename>
<cvename>CVE-2017-10792</cvename>
<cvename>CVE-2017-12958</cvename>
<cvename>CVE-2017-12959</cvename>
<cvename>CVE-2017-12960</cvename>
<cvename>CVE-2017-12961</cvename>
<url>https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html</url>
</references>
<dates>
<discovery>2017-08-18</discovery>
<entry>2017-08-22</entry>
<modified>2017-08-30</modified>
</dates>
</vuln>
<vuln vid="473b6a9e-8493-11e7-b24b-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-004">
<p>CVE-2017-6923: Views - Access Bypass - Moderately Critical</p>
<p>CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica</p>
<p>CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6923</cvename>
<cvename>CVE-2017-6924</cvename>
<cvename>CVE-2017-6925</cvename>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-19</entry>
</dates>
</vuln>
<vuln vid="8e7bbddd-8338-11e7-867f-b499baebfeaf">
<topic>libsoup -- stack based buffer overflow</topic>
<affects>
<package>
<name>libsoup</name>
<range><lt>2.52.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Mueller reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/304">
<p>libsoup is susceptible to a stack based buffer overflow
attack when using chunked encoding. Regardless of libsoup
being used as a server or client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/304</url>
<cvename>CVE-2017-2885</cvename>
</references>
<dates>
<discovery>2017-08-17</discovery>
<entry>2017-08-17</entry>
<modified>2017-08-20</modified>
</dates>
</vuln>
<vuln vid="5df8bd95-8290-11e7-93af-005056925db4">
<topic>Zabbix -- Remote code execution</topic>
<affects>
<package>
<name>zabbix2-server</name>
<name>zabbix2-proxy</name>
<range><le>2.0.20</le></range>
</package>
<package>
<name>zabbix22-server</name>
<name>zabbix22-proxy</name>
<range><lt>2.2.19</lt></range>
</package>
<package>
<name>zabbix3-server</name>
<name>zabbix3-proxy</name>
<range><lt>3.0.10</lt></range>
</package>
<package>
<name>zabbix32-server</name>
<name>zabbix32-proxy</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824">
<p>An exploitable code execution vulnerability exists in the trapper command
functionality of Zabbix Server 2.4.X. A specially crafted set of packets
can cause a command injection resulting in remote code execution. An attacker
can make requests from an active Zabbix Proxy to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2824</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824</url>
<url>https://support.zabbix.com/browse/ZBX-12349</url>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-08-16</entry>
</dates>
</vuln>
<vuln vid="c9460380-81e3-11e7-93af-005056925db4">
<topic>Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests</topic>
<affects>
<package>
<name>py27-supervisor</name>
<range><lt>3.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mnaberez reports:</p>
<blockquote cite="https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606">
<p>supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket.
The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been
enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been
found where an authenticated client can send a malicious XML-RPC request to supervisord that
will run arbitrary shell commands on the server. The commands will be run as the same user as
supervisord. Depending on how supervisord has been configured, this may be root.</p>
<p>This vulnerability can only be exploited by an authenticated client or if supervisord has been
configured to run an HTTP server without authentication. If authentication has not been enabled,
supervisord will log a message at the critical level every time it starts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://supervisord.org/changes.html</url>
<url>https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606</url>
<cvename>CVE-2017-11610</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-08-15</entry>
</dates>
</vuln>
<vuln vid="79bbec7e-8141-11e7-b5af-a4badb2f4699">
<topic>FreeRadius -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="http://freeradius.org/security/fuzzer-2017.html">
<p>Multiple vulnerabilities found via fuzzing:
FR-GV-201 (v2,v3) Read / write overflow in make_secret()
FR-GV-202 (v2) Write overflow in rad_coalesce()
FR-GV-203 (v2) DHCP - Memory leak in decode_tlv()
FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode()
FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options()
FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
FR-GV-207 (v2) Zero-length malloc in data2vp()
FR-GV-301 (v3) Write overflow in data2vp_wimax()
FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
FR-GV-305 (v3) Decode 'signed' attributes correctly
FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data
FR-AD-002 (v3) String lifetime issues in rlm_python
FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security/fuzzer-2017.html</url>
</references>
<dates>
<discovery>2017-06-17</discovery>
<entry>2017-08-14</entry>
</dates>
</vuln>
<vuln vid="1d33cdee-7f6b-11e7-a9b5-3debb10a6871">
<topic>Mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial Release Notes:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29">
<p>CVE-2017-1000115</p>
<p>Mercurial's symlink auditing was incomplete prior to 4.3, and could be
abused to write to files outside the repository.</p>
<p>CVE-2017-1000116</p>
<p>Mercurial was not sanitizing hostnames passed to ssh, allowing shell
injection attacks on clients by specifying a hostname starting with
-oProxyCommand. This is also present in Git (CVE-2017-1000117) and
Subversion (CVE-2017-9800), so please patch those tools as well if you
have them installed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-12</entry>
</dates>
</vuln>
<vuln vid="6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc">
<topic>subversion -- Arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
</package>
<package>
<name>subversion-static</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
<p>A Subversion client sometimes connects to URLs provided by the repository.
This happens in two primary cases: during 'checkout', 'export', 'update', and
'switch', when the tree being downloaded contains svn:externals properties;
and when using 'svnsync sync' with one URL argument.</p>
<p>A maliciously constructed svn+ssh:// URL would cause Subversion clients to
run an arbitrary shell command. Such a URL could be generated by a malicious
server, by a malicious user committing to a honest server (to attack another
user of that server's repositories), or by a proxy server.</p>
<p>The vulnerability affects all clients, including those that use file://,
http://, and plain (untunneled) svn://.</p>
<p>An exploit has been tested.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2017-9800-advisory.txt</url>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- two vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>7.9.0</ge><le>8.17.8</le></range>
<range><ge>9.0.0</ge><le>9.0.12</le></range>
<range><ge>9.1.0</ge><le>9.1.9</le></range>
<range><ge>9.2.0</ge><le>9.2.9</le></range>
<range><ge>9.3.0</ge><le>9.3.9</le></range>
<range><ge>9.4.0</ge><le>9.4.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/">
<h1>Remote Command Execution in git client</h1>
<p>An external code review performed by Recurity-Labs identified a remote
command execution vulnerability in git that could be exploited via the "Repo
by URL" import option in GitLab. The command line git client was not
properly escaping command line arguments in URLs using the SSH protocol
before invoking the SSH client. A specially crafted URL could be used to
execute arbitrary shell commands on the GitLab server.<br/>
To fully patch this vulnerability two fixes were needed. The Omnibus
versions of GitLab contain a patched git client. For source users who may
still be running an older version of git, GitLab now also blocks import URLs
containing invalid host and usernames.<br/>
This issue has been assigned CVE-2017-12426.</p>
<h1>Improper sanitization of GitLab export files on import</h1>
<p>GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a
patch for a critical directory traversal vulnerability in the GitLab export
feature that could be exploited by including symlinks in the export file and
then re-importing it to a GitLab instance. This vulnerability was patched by
checking for and removing symlinks in these files on import.<br/>
Recurity-Labs also determined that this fix did not properly remove symlinks for
hidden files. Though not as dangerous as the original vulnerability hidden file
symlinks could still be used to steal copies of git repositories belonging to
other users if the path to the git repository was known by the attacker. An
updated fix has been included in these releases that properly removes all
symlinks.<br/>
This import option was not made available to non-admin users until GitLab
8.13.0.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url>
<cvename>CVE-2017-12426</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.22</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.18</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.8</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1772/">
<ul>
<li>CVE-2017-7546: Empty password accepted in some authentication
methods</li>
<li>CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords
to users lacking server privileges</li>
<li>CVE-2017-7548: lo_put() function ignores ACLs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7546</cvename>
<cvename>CVE-2017-7547</cvename>
<cvename>CVE-2017-7548</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.151</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3085).</li>
<li>These updates resolve type confusion vulnerability that
could lead to remote code execution (CVE-2017-3106).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3085</cvename>
<cvename>CVE-2017-3106</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-23.html</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="69cfa386-7cd0-11e7-867f-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.55.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>FILE buffer read out of bounds</li>
<li>TFTP sends more than buffer size</li>
<li>URL globbing out of bounds read</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2017-1000099</cvename>
<cvename>CVE-2017-1000100</cvename>
<cvename>CVE-2017-1000101</cvename>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="c1265e85-7c95-11e7-93af-005056925db4">
<topic>Axis2 -- Security vulnerability on dependency Apache Commons FileUpload</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html">
<p>The commons-fileupload dependency has been updated to a version that fixes
CVE-2016-1000031 (AXIS2-5853).</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5853</url>
<url>https://issues.apache.org/jira/browse/FILEUPLOAD-279</url>
<cvename>CVE-2016-1000031</cvename>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="555b244e-6b20-4546-851f-d8eb7d6c1ffa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>55.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7753</cvename>
<cvename>CVE-2017-7779</cvename>
<cvename>CVE-2017-7780</cvename>
<cvename>CVE-2017-7781</cvename>
<cvename>CVE-2017-7782</cvename>
<cvename>CVE-2017-7783</cvename>
<cvename>CVE-2017-7784</cvename>
<cvename>CVE-2017-7785</cvename>
<cvename>CVE-2017-7786</cvename>
<cvename>CVE-2017-7787</cvename>
<cvename>CVE-2017-7788</cvename>
<cvename>CVE-2017-7789</cvename>
<cvename>CVE-2017-7790</cvename>
<cvename>CVE-2017-7791</cvename>
<cvename>CVE-2017-7792</cvename>
<cvename>CVE-2017-7794</cvename>
<cvename>CVE-2017-7796</cvename>
<cvename>CVE-2017-7797</cvename>
<cvename>CVE-2017-7798</cvename>
<cvename>CVE-2017-7799</cvename>
<cvename>CVE-2017-7800</cvename>
<cvename>CVE-2017-7801</cvename>
<cvename>CVE-2017-7802</cvename>
<cvename>CVE-2017-7803</cvename>
<cvename>CVE-2017-7804</cvename>
<cvename>CVE-2017-7806</cvename>
<cvename>CVE-2017-7807</cvename>
<cvename>CVE-2017-7808</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
</dates>
</vuln>
<vuln vid="9245681c-7c3c-11e7-b5af-a4badb2f4699">
<topic>sqlite3 -- heap-buffer overflow</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937">
<p>A heap-buffer overflow (sometimes a crash) can arise when
running a SQL request on malformed sqlite3 databases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937</url>
<cvename>CVE-2017-10989</cvename>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="88a77ad8-77b1-11e7-b5af-a4badb2f4699">
<topic>Varnish -- Denial of service vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><ge>4.0.1</ge><lt>4.0.5</lt></range>
<range><ge>4.1.0</ge><lt>4.1.8</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.0.1</lt></range>
<range><ge>5.1.0</ge><lt>5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phk reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00001.html">
<p>A wrong if statement in the varnishd source code means that
particular invalid requests from the client can trigger an assert.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00001.html</url>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-08-02</entry>
</dates>
</vuln>
<vuln vid="7d138476-7710-11e7-88a1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>60.0.3112.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html">
<p>40 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5091</cvename>
<cvename>CVE-2017-5092</cvename>
<cvename>CVE-2017-5093</cvename>
<cvename>CVE-2017-5094</cvename>
<cvename>CVE-2017-5095</cvename>
<cvename>CVE-2017-5096</cvename>
<cvename>CVE-2017-5097</cvename>
<cvename>CVE-2017-5098</cvename>
<cvename>CVE-2017-5099</cvename>
<cvename>CVE-2017-5100</cvename>
<cvename>CVE-2017-5101</cvename>
<cvename>CVE-2017-5102</cvename>
<cvename>CVE-2017-5103</cvename>
<cvename>CVE-2017-5104</cvename>
<cvename>CVE-2017-7000</cvename>
<cvename>CVE-2017-5105</cvename>
<cvename>CVE-2017-5106</cvename>
<cvename>CVE-2017-5107</cvename>
<cvename>CVE-2017-5108</cvename>
<cvename>CVE-2017-5109</cvename>
<cvename>CVE-2017-5110</cvename>
<url>https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-07-25</discovery>
<entry>2017-08-01</entry>
</dates>
</vuln>
<vuln vid="f86d0e5d-7467-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php</topic>
<affects>
<package>
<name>cacti</name>
<range><eq>1.1.13</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/867">
<p>Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti
1.1.13 allows remote authenticated users to inject arbitrary web script
or HTML via specially crafted HTTP Referer headers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/867</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.14</url>
<cvename>CVE-2017-11691</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-29</entry>
</dates>
</vuln>
<vuln vid="770d7e91-72af-11e7-998a-08606e47f965">
<topic>proftpd -- user chroot escape vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418">
<p>ProFTPD ... controls whether the home directory of a user could
contain a symbolic link through the AllowChrootSymlinks
configuration option, but checks only the last path component when
enforcing AllowChrootSymlinks. Attackers with local access could
bypass the AllowChrootSymlinks control by replacing a path
component (other than the last one) with a symbolic link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url>
<cvename>CVE-2017-7418</cvename>
</references>
<dates>
<discovery>2017-03-06</discovery>
<entry>2017-07-27</entry>
</dates>
</vuln>
<vuln vid="76d80b33-7211-11e7-998a-08606e47f965">
<topic>jabberd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99511/discuss">
<p>JabberD is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication
mechanism and perform unauthorized actions. This may lead to
further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032</url>
<url>http://www.securityfocus.com/bid/99511</url>
<cvename>CVE-2017-10807</cvename>
</references>
<dates>
<discovery>2017-07-03</discovery>
<entry>2017-07-26</entry>
</dates>
</vuln>
<vuln vid="0f66b901-715c-11e7-ad1f-bcaec565249c">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webkit gtk team reports:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2017-0006.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0006.html</url>
<cvename>CVE-2017-7006</cvename>
<cvename>CVE-2017-7011</cvename>
<cvename>CVE-2017-7012</cvename>
<cvename>CVE-2017-7018</cvename>
<cvename>CVE-2017-7019</cvename>
<cvename>CVE-2017-7020</cvename>
<cvename>CVE-2017-7030</cvename>
<cvename>CVE-2017-7034</cvename>
<cvename>CVE-2017-7037</cvename>
<cvename>CVE-2017-7038</cvename>
<cvename>CVE-2017-7039</cvename>
<cvename>CVE-2017-7040</cvename>
<cvename>CVE-2017-7041</cvename>
<cvename>CVE-2017-7042</cvename>
<cvename>CVE-2017-7043</cvename>
<cvename>CVE-2017-7046</cvename>
<cvename>CVE-2017-7048</cvename>
<cvename>CVE-2017-7049</cvename>
<cvename>CVE-2017-7052</cvename>
<cvename>CVE-2017-7055</cvename>
<cvename>CVE-2017-7056</cvename>
<cvename>CVE-2017-7059</cvename>
<cvename>CVE-2017-7061</cvename>
<cvename>CVE-2017-7064</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-07-25</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="8745c67e-7dd1-4165-96e2-fcf9da2dc5b5">
<topic>gsoap -- remote code execution via via overflow</topic>
<affects>
<package>
<name>gsoap</name>
<range><lt>2.8.47</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Senrio reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99868/discuss">
<p>Genivia gSOAP is prone to a stack-based buffer-overflow
vulnerability because it fails to properly bounds check user-supplied
data before copying it into an insufficiently sized buffer.</p>
<p>A remote attacker may exploit this issue to execute arbitrary code
in the context of the affected device. Failed attempts will likely
cause a denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99868/discuss</url>
<url>http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions</url>
<url>http://blog.senr.io/devilsivy.html</url>
<url>https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29</url>
<url>https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29</url>
<cvename>CVE-2017-9765</cvename>
</references>
<dates>
<discovery>2017-07-18</discovery>
<entry>2017-07-25</entry>
</dates>
</vuln>
<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.0.0</ge><le>8.17.6</le></range>
<range><ge>9.0.0</ge><le>9.0.10</le></range>
<range><ge>9.1.0</ge><le>9.1.7</le></range>
<range><ge>9.2.0</ge><le>9.2.7</le></range>
<range><ge>9.3.0</ge><le>9.3.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
<cvename>CVE-2017-11438</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-20</entry>
<modified>2017-08-15</modified>
</dates>
</vuln>
<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.32</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.26</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.6</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.19</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL</url>
<cvename>CVE-2017-3529</cvename>
<cvename>CVE-2017-3633</cvename>
<cvename>CVE-2017-3634</cvename>
<cvename>CVE-2017-3635</cvename>
<cvename>CVE-2017-3636</cvename>
<cvename>CVE-2017-3637</cvename>
<cvename>CVE-2017-3638</cvename>
<cvename>CVE-2017-3639</cvename>
<cvename>CVE-2017-3640</cvename>
<cvename>CVE-2017-3641</cvename>
<cvename>CVE-2017-3642</cvename>
<cvename>CVE-2017-3643</cvename>
<cvename>CVE-2017-3644</cvename>
<cvename>CVE-2017-3645</cvename>
<cvename>CVE-2017-3646</cvename>
<cvename>CVE-2017-3647</cvename>
<cvename>CVE-2017-3648</cvename>
<cvename>CVE-2017-3649</cvename>
<cvename>CVE-2017-3650</cvename>
<cvename>CVE-2017-3651</cvename>
<cvename>CVE-2017-3652</cvename>
<cvename>CVE-2017-3653</cvename>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-07-19</entry>
<modified>2017-08-12</modified>
</dates>
</vuln>
<vuln vid="08a2df48-6c6a-11e7-9b01-2047478f2f70">
<topic>collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>marcinguy reports:</p>
<blockquote cite="https://github.com/collectd/collectd/issues/2174">
<p>After sending this payload, collectd seems to be entering endless while()
loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/collectd/collectd/issues/2174</url>
<cvename>CVE-2017-7401</cvename>
</references>
<dates>
<discovery>2017-02-13</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="e6ccaf8a-6c63-11e7-9b01-2047478f2f70">
<topic>strongswan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.4.0</ge><le>5.5.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2017/05/30/strongswan-5.5.3-released.html">
<ul>
<li>RSA public keys passed to the gmp plugin aren't validated sufficiently
before attempting signature verification, so that invalid input might
lead to a floating point exception. [CVE-2017-9022]</li>
<li>ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
parsing X.509 certificates with extensions that use such types. This
could lead to infinite looping of the thread parsing a specifically crafted certificate.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html</url>
<cvename>CVE-2017-9022</cvename>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html</url>
<cvename>CVE-2017-9023</cvename>
</references>
<dates>
<discovery>2017-05-30</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="c7e8e955-6c61-11e7-9b01-2047478f2f70">
<cancelled superseded="e6ccaf8a-6c63-11e7-9b01-2047478f2f70"/>
</vuln>
<vuln vid="dc3c66e8-6a18-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in link.php</topic>
<affects>
<package>
<name>cacti</name>
<range><ge>1.0.0</ge><lt>1.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/838">
<p>Cross-site scripting (XSS) vulnerability in link.php in Cacti<br/>
1.1.12 allows remote anonymous users to inject arbitrary web<br/>
script or HTML via the id parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/838</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.13</url>
<cvename>CVE-2017-10970</cvename>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-17</entry>
</dates>
</vuln>
<vuln vid="457ce015-67fa-11e7-867f-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>important: Read after free in mod_http2 (CVE-2017-9789)<br/>
When under stress, closing many connections, the HTTP/2 handling
code would sometimes access memory after it has been freed,
resulting in potentially erratic behaviour.</p>
<p>important: Uninitialized memory reflection in mod_auth_digest
(CVE-2017-9788)<br/>The value placeholder in [Proxy-]Authorization
headers of type 'Digest' was not initialized or reset before or
between successive key=value assignments. by mod_auth_digest.<br/>
Providing an initial key with no '=' assignment could reflect
the stale value of uninitialized pool memory used by the prior
request, leading to leakage of potentially confidential
information, and a segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2017-9789</cvename>
<cvename>CVE-2017-9788</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="a03e043a-67f1-11e7-beff-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3080).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to remote code execution (CVE-2017-3099).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to memory address disclosure (CVE-2017-3100).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3080</cvename>
<cvename>CVE-2017-3099</cvename>
<cvename>CVE-2017-3100</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-21.html</url>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="85851e4f-67d9-11e7-bc37-00505689d4ae">
<topic>samba -- Orpheus Lyre mutual authentication validation bypass</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.15</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.12</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-11103.html">
<p>A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by
returning malicious replication or authorization data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-11103.html</url>
<cvename>CVE-2017-11103</cvename>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="3eff66c5-66c9-11e7-aa1d-3d2e663cef42">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.1.4</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.8.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Updates are now available for all active Node.js release lines as
well as the 7.x line. These include the fix for the high severity
vulnerability identified in the initial announcement, one additional
lower priority Node.js vulnerability in the 4.x release line, as well
as some lower priority fixes for Node.js dependencies across the
current release lines.</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">
<h2>Constant Hashtable Seeds (CVE pending)</h2>
<p>Node.js was susceptible to hash flooding remote DoS attacks as the
HashTable seed was constant across a given released version of
Node.js. This was a result of building with V8 snapshots enabled by
default which caused the initially randomized seed to be overwritten
on startup. Thanks to Jann Horn of Google Project Zero for reporting
this vulnerability.</p>
<p>This is a high severity vulnerability and applies to all active
release lines (4.x, 6.x, 8.x) as well as the 7.x line.</p>
<h2>http.get with numeric authorization options creates uninitialized
buffers</h2>
<p>Application code that allows the auth field of the options object
used with http.get() to be set to a number can result in an
uninitialized buffer being created/used as the authentication
string.</p>
<p>This is a low severity defect and only applies to the 4.x release
line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/</url>
</references>
<dates>
<discovery>2017-06-27</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="b28adc5b-6693-11e7-ad43-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in an integer overflow</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.5.6</ge><lt>1.12.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.5.6</ge><lt>1.13.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html">
<p>A security issue was identified in nginx range filter. A specially
crafted request might result in an integer overflow and incorrect
processing of ranges, potentially resulting in sensitive information
leak (CVE-2017-7529).</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html</url>
<cvename>CVE-2017-7529</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-11</entry>
</dates>
</vuln>
<vuln vid="aaedf196-6436-11e7-8b49-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Form Validation Library rule valid_email could be bypassed if
idn_to_ascii() is available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="31001c6b-63e7-11e7-85aa-a4badb2f4699">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_07.txt">
<p>When receiving messages with invalid time stamps, Irssi
would try to dereference a NULL pointer.</p>
<p>While updating the internal nick list, Irssi may
incorrectly use the GHashTable interface and free the nick while
updating it. This will then result in use-after-free conditions on each
access of the hash table.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_07.txt</url>
<cvename>CVE-2017-10965</cvename>
<cvename>CVE-2017-10966</cvename>
<freebsdpr>ports/220544</freebsdpr>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="b396cf6c-62e6-11e7-9def-b499baebfeaf">
<topic>oniguruma -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevhtp</name>
<range><lt>1.2.14</lt></range>
</package>
<package>
<name>oniguruma4</name>
<range><lt>4.7.2</lt></range>
</package>
<package>
<name>oniguruma5</name>
<range><lt>5.9.7</lt></range>
</package>
<package>
<name>oniguruma6</name>
<range><lt>6.4.0</lt></range>
</package>
<package>
<name>php56-mbstring</name>
<range><lt>5.6.31</lt></range>
</package>
<package>
<name>php70-mbstring</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-mbstring</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php">
<ul>
<li>A stack out-of-bounds read occurs in match_at() during regular
expression searching. A logical error involving order of validation
and access in match_at() could result in an out-of-bounds read from
a stack buffer (CVE-2017-9224).</li>
<li>A heap out-of-bounds write or read occurs in next_state_val()
during regular expression compilation. Octal numbers larger than 0xff
are not handled correctly in fetch_token() and fetch_token_in_cc().
A malformed regular expression containing an octal number in the form
of '\700' would produce an invalid code point value larger than 0xff
in next_state_val(), resulting in an out-of-bounds write memory
corruption (CVE-2017-9226).</li>
<li>A stack out-of-bounds read occurs in mbc_enc_len() during regular
expression searching. Invalid handling of reg->dmin in
forward_search_range() could result in an invalid pointer dereference,
as an out-of-bounds read from a stack buffer (CVE-2017-9227).</li>
<li>A heap out-of-bounds write occurs in bitset_set_range() during
regular expression compilation due to an uninitialized variable from
an incorrect state transition. An incorrect state transition in
parse_char_class() could create an execution path that leaves a
critical local variable uninitialized until it's used as an index,
resulting in an out-of-bounds write memory corruption (CVE-2017-9228).</li>
<li>A SIGSEGV occurs in left_adjust_char_head() during regular expression
compilation. Invalid handling of reg->dmax in forward_search_range() could
result in an invalid pointer dereference, normally as an immediate
denial-of-service condition (CVE-2017-9228).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php</url>
<cvename>CVE-2017-9224</cvename>
<cvename>CVE-2017-9226</cvename>
<cvename>CVE-2017-9227</cvename>
<cvename>CVE-2017-9228</cvename>
<cvename>CVE-2017-9228</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-07</entry>
<modified>2018-01-04</modified>
</dates>
</vuln>
<vuln vid="4fc2df49-6279-11e7-be0f-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-003">
<p>CVE-2017-6920: PECL YAML parser unsafe object handling.</p>
<p>CVE-2017-6921: File REST resource does not properly validate</p>
<p>CVE-2017-6922: Files uploaded by anonymous users into a private
file system can be accessed by other anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6920</cvename>
<cvename>CVE-2017-6921</cvename>
<cvename>CVE-2017-6922</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-07-06</entry>
</dates>
</vuln>
<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
<topic>Dropbear -- two vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2017.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Fix double-free in server TCP listener cleanup A double-free in
the server could be triggered by an authenticated user if dropbear
is running with -a (Allow connections to forwarded ports from any
host) This could potentially allow arbitrary code execution as root
by an authenticated user.</p>
<p>Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2017-9078</cvename>
<cvename>CVE-2017-9079</cvename>
</references>
<dates>
<discovery>2017-05-18</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
<topic>smarty3 -- shell injection in math</topic>
<affects>
<package>
<name>smarty3</name>
<range><lt>3.1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The smarty project reports:</p>
<blockquote cite="https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt">
<p>bugfix {math} shell injection vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="ed3bf433-5d92-11e7-aa14-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on RSA secret keys</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html">
<p>Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7526</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html</url>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="85ebfa0c-5d8d-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.0.0</ge><le>9.0.9</le></range>
<range><ge>9.1.0</ge><le>9.1.6</le></range>
<range><ge>9.2.0</ge><le>9.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2">
<topic>tor -- security regression</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.0.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.3.1.4.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">
<p>Tor 0.3.0.9 fixes a path selection bug that would allow a client
to use a guard that was in the same network family as a chosen exit
relay. This is a security regression; all clients running earlier
versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or
0.3.1.4-alpha.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>
<url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>
<url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>
<cvename>CVE-2017-0377</cvename>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- Privilege escalation via multiple memory leaks</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.89_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualsys reports:</p>
<blockquote cite="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">
<p>
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="00e4050b-56c1-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- DoS vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><gt>2.3.0</gt><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The second vulnerability (CVE-2017-9773) is a DOS vulnerability.
This only affects Horde installations that do not have a configured image
handling backend, and thus use the "Null" image driver. It is exploitable by
a logged in user clicking on a maliciously crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9773</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="a7003121-56bf-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- remote code execution vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><ge>2.0.0</ge><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The fist vulnerability (CVE-2017-9774) is a Remote Code Execution
vulnerability and is exploitable by a logged in user sending a
maliciously crafted GET request to the Horde server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9774</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="9f65d382-56a4-11e7-83e3-080027ef73ec">
<topic>OpenVPN -- several vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.17</lt></range>
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243">
<p>In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In
the process he found several vulnerabilities and reported them to
the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.</p>
<p>This is a list of fixed important vulnerabilities:</p>
<ul>
<li>Remotely-triggerable ASSERT() on malformed IPv6 packet</li>
<li>Pre-authentication remote crash/information disclosure for clients</li>
<li>Potential double-free in --x509-alt-username</li>
<li>Remote-triggerable memory leaks</li>
<li>Post-authentication remote DoS when using the --x509-track option</li>
<li>Null-pointer dereference in establish_http_proxy_passthru()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243</url>
<cvename>CVE-2017-7508</cvename>
<cvename>CVE-2017-7512</cvename>
<cvename>CVE-2017-7520</cvename>
<cvename>CVE-2017-7521</cvename>
<cvename>CVE-2017-7522</cvename>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="0c2db2aa-5584-11e7-9a7d-b499baebfeaf">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><lt>2.2.33</lt></range>
</package>
<package>
<name>apache24</name>
<range><lt>2.4.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):<br/>
Use of the ap_get_basic_auth_pw() by third-party modules outside
of the authentication phase may lead to authentication requirements
being bypassed.</li>
<li>mod_ssl Null Pointer Dereference (CVE-2017-3169):<br/>mod_ssl may
dereference a NULL pointer when third-party modules
call ap_hook_process_connection() during an HTTP request to an HTTPS
port.</li>
<li>mod_http2 Null Pointer Dereference (CVE-2017-7659):<br/> A maliciously
constructed HTTP/2 request could cause mod_http2 to dereference a NULL
pointer and crash the server process.</li>
<li>ap_find_token() Buffer Overread (CVE-2017-7668):<br/>The HTTP strict
parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token
list parsing, which allows ap_find_token() to search past the end of its
input string. By maliciously crafting a sequence of request headers, an
attacker may be able to cause a segmentation fault, or to force
ap_find_token() to return an incorrect value.</li>
<li>mod_mime Buffer Overread (CVE-2017-7679):<br/>mod_mime can read one
byte past the end of a buffer when sending a malicious Content-Type
response header.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<url>https://httpd.apache.org/security/vulnerabilities_22.html</url>
<cvename>CVE-2017-3167</cvename>
<cvename>CVE-2017-3169</cvename>
<cvename>CVE-2017-7659</cvename>
<cvename>CVE-2017-7668</cvename>
<cvename>CVE-2017-7679</cvename>
</references>
<dates>
<discovery>2017-06-20</discovery>
<entry>2017-06-20</entry>
</dates>
</vuln>
<vuln vid="f53dd5cc-527f-11e7-a772-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.104</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by
Ned Williamson on 2017-05-22</li>
<li>[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by
Xiling Gong of Tencent Security Platform Department on 2017-06-06</li>
<li>[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by
Michal Bentkowski on 2017-04-21</li>
<li>[732498] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5087</cvename>
<cvename>CVE-2017-5088</cvename>
<cvename>CVE-2017-5089</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-16</entry>
</dates>
</vuln>
<vuln vid="9314058e-5204-11e7-b712-b1a44a034d72">
<topic>cURL -- URL file scheme drive letter buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.53.0</ge><lt>7.54.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170614.html">
<p>When libcurl is given either</p>
<p>1. a file: URL that doesn't use two slashes following the colon, or</p>
<p>2. is told that file is the default scheme to use for URLs without scheme</p>
<p>... and the given path starts with a drive letter and libcurl is built for
Windows or DOS, then libcurl would copy the path with a wrong offset, so that
the end of the given path would write beyond the malloc buffer. Up to seven
bytes too much.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9502</cvename>
<url>https://curl.haxx.se/docs/adv_20170614.html</url>
</references>
<dates>
<discovery>2017-06-14</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="7a92e958-5207-11e7-8d7c-6805ca0b3d42">
<topic>rt and dependent modules -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.13_1</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.1_1</lt></range>
</package>
<package>
<name>p5-RT-Authen-ExternalAuth</name>
<range><ge>0.9</ge><lt>0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html</url>
<cvename>CVE-2015-7686</cvename>
<cvename>CVE-2016-6127</cvename>
<cvename>CVE-2017-5361</cvename>
<cvename>CVE-2017-5943</cvename>
<cvename>CVE-2017-5944</cvename>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="cd944b3f-51f6-11e7-b7b2-001c25e46b1d">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html">
<ul>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3075, CVE-2017-3081,
CVE-2017-3083, CVE-2017-3084).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-3076, CVE-2017-3077,
CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3075</cvename>
<cvename>CVE-2017-3076</cvename>
<cvename>CVE-2017-3077</cvename>
<cvename>CVE-2017-3078</cvename>
<cvename>CVE-2017-3079</cvename>
<cvename>CVE-2017-3081</cvename>
<cvename>CVE-2017-3082</cvename>
<cvename>CVE-2017-3083</cvename>
<cvename>CVE-2017-3084</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-17.html</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="6cec1b0a-da15-467d-8691-1dea392d4c8d">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>54.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5470</cvename>
<cvename>CVE-2017-5471</cvename>
<cvename>CVE-2017-5472</cvename>
<cvename>CVE-2017-7749</cvename>
<cvename>CVE-2017-7750</cvename>
<cvename>CVE-2017-7751</cvename>
<cvename>CVE-2017-7752</cvename>
<cvename>CVE-2017-7754</cvename>
<cvename>CVE-2017-7755</cvename>
<cvename>CVE-2017-7756</cvename>
<cvename>CVE-2017-7757</cvename>
<cvename>CVE-2017-7758</cvename>
<cvename>CVE-2017-7759</cvename>
<cvename>CVE-2017-7760</cvename>
<cvename>CVE-2017-7761</cvename>
<cvename>CVE-2017-7762</cvename>
<cvename>CVE-2017-7763</cvename>
<cvename>CVE-2017-7764</cvename>
<cvename>CVE-2017-7765</cvename>
<cvename>CVE-2017-7766</cvename>
<cvename>CVE-2017-7767</cvename>
<cvename>CVE-2017-7768</cvename>
<cvename>CVE-2017-7778</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-13</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="bce47c89-4d3f-11e7-8080-a4badb2f4699">
<topic>roundcube -- arbitrary password resets</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11">
<p>Roundcube Webmail allows arbitrary password resets by
authenticated users. The problem is caused by an improperly restricted
exec call in the virtualmin and sasl drivers of the password plugin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11</url>
<cvename>CVE-2017-8114</cvename>
</references>
<dates>
<discovery>2017-04-28</discovery>
<entry>2017-06-09</entry>
</dates>
</vuln>
<vuln vid="b33fb1e0-4c37-11e7-afeb-0011d823eebd">
<topic>GnuTLS -- Denial of service vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2017-4">
<p>It was found using the TLS fuzzer tools that decoding a status
response TLS extension with valid contents could lead to a crash
due to a null pointer dereference. The issue affects GnuTLS server
applications.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2017-4</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="165e8951-4be0-11e7-a539-0050569f7e80">
<topic>irssi -- remote DoS</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joseph Bisch reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_06.txt">
<p>When receiving a DCC message without source nick/host, Irssi would
attempt to dereference a NULL pointer.</p>
<p>When receiving certain incorrectly quoted DCC files, Irssi would
try to find the terminating quote one byte before the allocated
memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9468</cvename>
<cvename>CVE-2017-9469</cvename>
<url>https://irssi.org/security/irssi_sa_2017_06.txt</url>
</references>
<dates>
<discovery>2017-06-06</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">
<p>30 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5070</cvename>
<cvename>CVE-2017-5071</cvename>
<cvename>CVE-2017-5072</cvename>
<cvename>CVE-2017-5073</cvename>
<cvename>CVE-2017-5074</cvename>
<cvename>CVE-2017-5075</cvename>
<cvename>CVE-2017-5086</cvename>
<cvename>CVE-2017-5076</cvename>
<cvename>CVE-2017-5077</cvename>
<cvename>CVE-2017-5078</cvename>
<cvename>CVE-2017-5079</cvename>
<cvename>CVE-2017-5080</cvename>
<cvename>CVE-2017-5081</cvename>
<cvename>CVE-2017-5082</cvename>
<cvename>CVE-2017-5083</cvename>
<cvename>CVE-2017-5085</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-06-05</discovery>
<entry>2017-06-06</entry>
</dates>
</vuln>
<vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f">
<topic>ansible -- Input validation flaw in jinja2 templating system</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/cve-2017-7481">
<p>An input validation flaw was found in Ansible, where it fails to
properly mark lookup-plugin results as unsafe. If an attacker could
control the results of lookup() calls, they could inject Unicode
strings to be parsed by the jinja2 templating system, result in
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/cve-2017-7481</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-06-02</entry>
</dates>
</vuln>
<vuln vid="738e8ae1-46dd-11e7-a539-0050569f7e80">
<topic>duo -- Two-factor authentication bypass</topic>
<affects>
<package>
<name>duo</name>
<range><lt>1.9.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The duo security team reports:</p>
<blockquote cite="https://duo.com/labs/psa/duo-psa-2017-002">
<p>An untrusted user may be able to set the http_proxy variable to
an invalid address. If this happens, this will trigger the
configured 'failmode' behavior, which defaults to safe. Safe
mode causes the authentication to report a success.</p>
</blockquote>
</body>
</description>
<references>
<url>https://duo.com/labs/psa/duo-psa-2017-002</url>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="673dce46-46d0-11e7-a539-0050569f7e80">
<topic>FreeRADIUS -- TLS resumption authentication bypass</topic>
<affects>
<package>
<name>freeradius</name>
<name>freeradius2</name>
<name>freeradius3</name>
<range><lt>3.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Winter reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/342">
<p>The TLS session cache in FreeRADIUS before 3.0.14 fails to
reliably prevent resumption of an unauthenticated session, which
allows remote attackers (such as malicious 802.1X supplicants) to
bypass authentication via PEAP or TTLS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9148</cvename>
<url>http://freeradius.org/security.html</url>
<url>http://seclists.org/oss-sec/2017/q2/342</url>
<url>http://www.securityfocus.com/bid/98734</url>
</references>
<dates>
<discovery>2017-02-03</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699">
<topic>heimdal -- bypass of capath policy</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>7.1.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Viktor Dukhovni reports:</p>
<blockquote cite="https://www.h5l.org/advisories.html?show=2017-04-13">
<p>Commit f469fc6 (2010-10-02) inadvertently caused the
previous hop realm to not be added to the transit path of issued
tickets. This may, in some cases, enable bypass of capath policy in
Heimdal versions 1.5 through 7.2. Note, this may break sites that rely
on the bug. With the bug some incomplete [capaths] worked, that should
not have. These may now break authentication in some cross-realm
configurations. (CVE-2017-6594)</p>
</blockquote>
</body>
</description>
<references>
<url>CVE-2017-6594</url>
<freebsdpr>ports/219657</freebsdpr>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-31</entry>
</dates>
</vuln>
<vuln vid="51d1282d-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- ipfilter(4) fragment handling panic</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_10</lt></range>
<range><ge>10.3</ge><lt>10.3_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>ipfilter(4), capable of stateful packet inspection, using
the "keep state" or "keep frags" rule options, will not
only maintain the state of connections, such as TCP streams
or UDP communication, it also maintains the state of
fragmented packets. When a packet fragments are received
they are cached in a hash table (and linked list). When a
fragment is received it is compared with fragments already
cached in the hash table for a match. If it does not match
the new entry is used to create a new entry in the hash
table. If on the other hand it does match, unfortunately
the wrong entry is freed, the entry in the hash table. This
results in use after free panic (and for a brief moment
prior to the panic a memory leak due to the wrong entry
being freed).</p>
<h1>Impact:</h1>
<p>Carefully feeding fragments that are allowed to pass by
an ipfilter(4) firewall can be used to cause a panic followed
by reboot loop denial of service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1081</cvename>
<freebsdsa>SA-17:04.ipfilter</freebsdsa>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="3c0237f5-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_9</lt></range>
<range><ge>10.3</ge><lt>10.3_18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6464]</p>
<p>A vulnerability was found in NTP, in the parsing of
packets from the DPTS Clock. [CVE-2017-6462]</p>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6463]</p>
<p>A vulnerability was found in NTP, affecting the origin
timestamp check function. [CVE-2016-9042]</p>
<h1>Impact:</h1>
<p>A remote, authenticated attacker could cause ntpd to
crash by sending a crafted message. [CVE-2017-6463,
CVE-2017-6464]</p>
<p>A malicious device could send crafted messages, causing
ntpd to crash. [CVE-2017-6462]</p>
<p>An attacker able to spoof messages from all of the
configured peers could send crafted packets to ntpd, causing
later replies from those peers to be discarded, resulting
in denial of service. [CVE-2016-9042]</p>
</body>
</description>
<references>
<cvename>CVE-2016-9042</cvename>
<cvename>CVE-2017-6462</cvename>
<cvename>CVE-2017-6463</cvename>
<cvename>CVE-2017-6464</cvename>
<freebsdsa>SA-17:03.ntp</freebsdsa>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="ec6aeb8e-41e4-11e7-aa00-5404a68ad561">
<topic>vlc -- remote code execution via crafted subtitles</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.6,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.6,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point research team reports:</p>
<blockquote cite="http://blog.checkpoint.com/2017/05/23/hacked-in-translation/">
<p>Remote code execution via crafted subtitles</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2017/05/23/hacked-in-translation/</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="803879e9-4195-11e7-9b08-080027ef73ec">
<topic>OpenEXR -- multiple remote code execution and denial of service vulnerabilities</topic>
<affects>
<package>
<name>OpenEXR</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/05/12/5">
<p>[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).</p>
<ul>
<li>CVE-2017-9110
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9111
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9112
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9113
In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9114
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9115
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9116
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/05/12/5</url>
<cvename>CVE-2017-9110</cvename>
<cvename>CVE-2017-9111</cvename>
<cvename>CVE-2017-9112</cvename>
<cvename>CVE-2017-9113</cvename>
<cvename>CVE-2017-9114</cvename>
<cvename>CVE-2017-9115</cvename>
<cvename>CVE-2017-9116</cvename>
<url>https://github.com/openexr/openexr/issues/232</url>
</references>
<dates>
<discovery>2017-01-12</discovery>
<entry>2017-05-25</entry>
</dates>
</vuln>
<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4_2,1</lt></range>
<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://nvd.nist.gov/vuln/search/results?query=ImageMagick">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?query=ImageMagick</url>
<cvename>CVE-2017-5506</cvename>
<cvename>CVE-2017-5507</cvename>
<cvename>CVE-2017-5508</cvename>
<cvename>CVE-2017-5509</cvename>
<cvename>CVE-2017-5510</cvename>
<cvename>CVE-2017-5511</cvename>
<cvename>CVE-2017-6497</cvename>
<cvename>CVE-2017-6498</cvename>
<cvename>CVE-2017-6499</cvename>
<cvename>CVE-2017-6500</cvename>
<cvename>CVE-2017-6501</cvename>
<cvename>CVE-2017-6502</cvename>
<cvename>CVE-2017-7275</cvename>
<cvename>CVE-2017-7606</cvename>
<cvename>CVE-2017-7619</cvename>
<cvename>CVE-2017-7941</cvename>
<cvename>CVE-2017-7942</cvename>
<cvename>CVE-2017-7943</cvename>
<cvename>CVE-2017-8343</cvename>
<cvename>CVE-2017-8344</cvename>
<cvename>CVE-2017-8345</cvename>
<cvename>CVE-2017-8346</cvename>
<cvename>CVE-2017-8347</cvename>
<cvename>CVE-2017-8348</cvename>
<cvename>CVE-2017-8349</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-8351</cvename>
<cvename>CVE-2017-8352</cvename>
<cvename>CVE-2017-8353</cvename>
<cvename>CVE-2017-8354</cvename>
<cvename>CVE-2017-8355</cvename>
<cvename>CVE-2017-8356</cvename>
<cvename>CVE-2017-8357</cvename>
<cvename>CVE-2017-8765</cvename>
<cvename>CVE-2017-8830</cvename>
<cvename>CVE-2017-9141</cvename>
<cvename>CVE-2017-9142</cvename>
<cvename>CVE-2017-9143</cvename>
<cvename>CVE-2017-9144</cvename>
</references>
<dates>
<discovery>2017-03-05</discovery>
<entry>2017-05-25</entry>
<modified>2017-05-29</modified>
</dates>
</vuln>
<vuln vid="6f4d96c0-4062-11e7-b291-b499baebfeaf">
<topic>samba -- remote code execution vulnerability</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.14</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.10</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-7494.html">
<p>Remote code execution from a writable share.</p>
<p>All versions of Samba from 3.5.0 onwards are vulnerable to a remote
code execution vulnerability, allowing a malicious client to upload
a shared library to a writable share, and then cause the server to
load and execute it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-7494.html</url>
<cvename>CVE-2017-7494</cvename>
</references>
<dates>
<discovery>2017-05-24</discovery>
<entry>2017-05-24</entry>
</dates>
</vuln>
<vuln vid="f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4462">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where not correctly validated user
input, NULL pointer dereference, and incorrect access control
may lead to denial of service or potential escalation of
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0350</cvename>
<cvename>CVE-2017-0351</cvename>
<cvename>CVE-2017-0352</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4462</url>
</references>
<dates>
<discovery>2017-05-15</discovery>
<entry>2017-05-23</entry>
</dates>
</vuln>
<vuln vid="da1d5d2e-3eca-11e7-8861-0018fe623f2b">
<topic>miniupnpc -- integer signedness error</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><lt>2.0.20170509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tintinweb reports:</p>
<blockquote cite="https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798">
<p>An integer signedness error was found in miniupnp's miniwget
allowing an unauthenticated remote entity typically located on the
local network segment to trigger a heap corruption or an access
violation in miniupnp's http response parser when processing a
specially crafted chunked-encoded response to a request for the
xml root description url.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8798</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-05-22</entry>
</dates>
</vuln>
<vuln vid="a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d">
<topic>Wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.7.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/05/wordpress-4-7-5/">
<p>WordPress versions 4.7.4 and earlier are affected by six security issues</p>
<ul>
<li>Insufficient redirect validation in the HTTP class.</li>
<li>Improper handling of post meta data values in the XML-RPC API.</li>
<li>Lack of capability checks for post meta data in the XML-RPC API.</li>
<li>A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/05/wordpress-4-7-5/</url>
</references>
<dates>
<discovery>2017-05-16</discovery>
<entry>2017-05-21</entry>
</dates>
</vuln>
<vuln vid="fab87bff-3ce5-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Memory exhaustion on short SCCP packets</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote memory exhaustion can be triggered by sending
an SCCP packet to Asterisk system with "chan_skinny"
enabled that is larger than the length of the SCCP header
but smaller than the packet length specified in the header.
The loop that reads the rest of the packet doesn't detect
that the call to read() returned end-of-file before the
expected number of bytes and continues infinitely. The
"partial data" message logging in that tight loop causes
Asterisk to exhaust all available memory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-004.html</url>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="0537afa3-3ce0-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Buffer Overrun in PJSIP transaction layer</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.6_1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote crash can be triggered by sending a SIP packet
to Asterisk with a specially crafted CSeq header and a
Via header with no branch parameter. The issue is that
the PJSIP RFC 2543 transaction key generation algorithm
does not allocate a large enough buffer. By overrunning
the buffer, the memory allocation table becomes corrupted,
leading to an eventual crash.</p>
<p>The multi-part body parser in PJSIP contains a logical
error that can make certain multi-part body parts attempt
to read memory from outside the allowed boundaries. A
specially-crafted packet can trigger these invalid reads
and potentially induce a crash.</p>
<p>This issues is in PJSIP, and so the issue can be fixed
without performing an upgrade of Asterisk at all. However,
we are releasing a new version of Asterisk with the bundled
PJProject updated to include the fix.</p>
<p>If you are running Asterisk with chan_sip, this issue
does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2017-003.html</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="3c2549b3-3bed-11e7-a9f0-a4badb296695">
<topic>Joomla3 -- SQL Injection</topic>
<affects>
<package>
<name>joomla3</name>
<range><eq>3.7.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports:</p>
<blockquote cite="https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html">
<p>Inadequate filtering of request data leads to a SQL Injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8917</cvename>
<url>https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html</url>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-18</entry>
</dates>
</vuln>
<vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.6.0</ge><le>8.17.5</le></range>
<range><ge>9.0.0</ge><le>9.0.6</le></range>
<range><ge>9.1.0</ge><le>9.1.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url>
</references>
<dates>
<discovery>2017-05-08</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.7.0</ge><le>8.15.7</le></range>
<range><ge>8.16.0</ge><le>8.16.7</le></range>
<range><ge>8.17.0</ge><le>8.17.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
<h1>Information Disclosure in Issue and Merge Request Trackers</h1>
<p>During an internal code review a critical vulnerability in the GitLab
Issue and Merge Request trackers was discovered. This vulnerability could
allow a user with access to assign ownership of an issue or merge request to
another user to disclose that user's private token, email token, email
address, and encrypted OTP secret. Reporter-level access to a GitLab project
is required to exploit this flaw.</p>
<h1>SSRF when importing a project from a Repo by URL</h1>
<p>GitLab instances that have enabled project imports using "Repo by URL"
were vulnerable to Server-Side Request Forgery attacks. By specifying a
project import URL of localhost an attacker could target services that are
bound to the local interface of the server. These services often do not
require authentication. Depending on the service an attacker might be able
craft an attack using the project import request URL.</p>
<h1>Links in Environments tab vulnerable to tabnabbing</h1>
<p>edio via HackerOne reported that user-configured Environment links
include target=_blank but do not also include rel: noopener
noreferrer. Anyone clicking on these links may therefore be subjected to
tabnabbing attacks where a link back to the requesting page is maintained
and can be manipulated by the target server.</p>
<h1>Accounts with email set to "Do not show on profile" have addresses
exposed in public atom feed</h1>
<p>Several GitLab users reported that even with "Do not show on profile"
configured for their email addresses those addresses were still being leaked
in Atom feeds if they commented on a public project.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0882</cvename>
<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-03-20</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="4a088d67-3af2-11e7-9d75-c86000169601">
<topic>freetype2 -- buffer overflows</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Lemberg reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html">
<p>CVE-2017-8105, CVE-2017-8287: Older FreeType versions have
out-of-bounds writes caused by heap-based buffer overflows
related to Type 1 fonts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html</url>
<cvename>CVE-2017-8105</cvename>
<cvename>CVE-2017-8287</cvename>
</references>
<dates>
<discovery>2017-05-17</discovery>
<entry>2017-05-17</entry>
</dates>
</vuln>
<vuln vid="04cc7bd2-3686-11e7-aa64-080027ef73ec">
<topic>OpenVPN -- two remote denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.15</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn23</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn23-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://openvpn.net/index.php/open-source/downloads.html">
<p>OpenVPN v2.4.0 was audited for security vulnerabilities independently by
Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by
Private Internet Access) between December 2016 and April 2017. The
primary findings were two remote denial-of-service vulnerabilities.
Fixes to them have been backported to v2.3.15.</p>
<p>An authenticated client can do the 'three way handshake'
(P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet
is the first that is allowed to carry payload. If that payload is
too big, the OpenVPN server process will stop running due to an
ASSERT() exception. That is also the reason why servers using
tls-auth/tls-crypt are protected against this attack - the P_CONTROL
packet is only accepted if it contains the session ID we specified,
with a valid HMAC (challenge-response). (CVE-2017-7478)</p>
<p>An authenticated client can cause the server's the packet-id
counter to roll over, which would lead the server process to hit an
ASSERT() and stop running. To make the server hit the ASSERT(), the
client must first cause the server to send it 2^32 packets (at least
196 GB).</p>
</blockquote>
</body>
</description>
<references>
<url>https://openvpn.net/index.php/open-source/downloads.html</url>
<cvename>CVE-2017-7478</cvename>
<cvename>CVE-2017-7479</cvename>
<url>https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits</url>
<url>https://ostif.org/?p=870&preview=true</url>
<url>https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="414c18bf-3653-11e7-9550-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-client</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-client</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-client</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-client</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-client</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1746/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2017-7484: selectivity estimators bypass SELECT privilege
checks.
</li>
<li>CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
</li>
<li>CVE-2017-7486: pg_user_mappings view discloses foreign server
passwords. This applies to new databases, see the release notes for
the procedure to apply the fix to an existing database.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="0baee383-356c-11e7-b9a9-50e549ebab6c">
<topic>kauth: Local privilege escalation</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.30_4</lt></range>
</package>
<package>
<name>kf5-kauth</name>
<range><lt>5.33.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170510-1.txt">
<p>KAuth contains a logic flaw in which the service invoking dbus
is not properly checked.
This allows spoofing the identity of the caller and with some
carefully crafted calls can lead to gaining root from an
unprivileged account.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8422</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2017/05/10/3</mlist>
<url>https://www.kde.org/info/security/advisory-20170510-1.txt</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-10</entry>
</dates>
</vuln>
<vuln vid="57600032-34fe-11e7-8965-bcaec524bf84">
<topic>libetpan -- null dereference vulnerability in MIME parsing component</topic>
<affects>
<package>
<name>libetpan</name>
<range><lt>1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rwhitworth reports:</p>
<blockquote cite="https://github.com/dinhviethoa/libetpan/issues/274">
<p>I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the
mime-parse test program. Is fixing these crashes something you're
interested in? The input files can be found here:
https://github.com/rwhitworth/libetpan-fuzz/.
The files can be executed as ./mime-parse id_filename to cause
seg faults.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8825</cvename>
<url>http://cve.circl.lu/cve/CVE-2017-8825</url>
</references>
<dates>
<discovery>2017-04-29</discovery>
<entry>2017-05-09</entry>
</dates>
</vuln>
<vuln vid="92e345d0-304d-11e7-8359-e8e0b747a45a">
<topic>chromium -- race condition vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>58.0.3029.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html">
<p>1 security fix in this release:</p>
</blockquote>
<ul>
<li>[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to
Philipp Hancke</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2017-5068</cvename>
<url>https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-05-02</discovery>
<entry>2017-05-03</entry>
</dates>
</vuln>
<vuln vid="a8c8001b-216c-11e7-80aa-005056925db4">
<topic>dovecot -- Dovecot DoS when passdb dict was used for authentication</topic>
<affects>
<package>
<name>dovecot</name>
<name>dovecot2</name>
<range><gt>2.2.25_6</gt><lt>2.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2017-April/000341.html">
<p>passdb/userdb dict: Don't double-expand %variables in keys. If dict
was used as the authentication passdb, using specially crafted
%variables in the username could be used to cause DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2669</cvename>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000341.html</mlist>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000342.html</mlist>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2017-04-30</entry>
</dates>
</vuln>
<vuln vid="24673ed7-2bf3-11e7-b291-b499baebfeaf">
<topic>LibreSSL -- TLS verification vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Jakub Jirutka reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/145">
<p>LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
SSL_get_verify_result is relied upon for a later check of a
verification result, in a use case where a user-provided verification
callback returns 1, as demonstrated by acceptance of invalid
certificates by nginx.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q2/145</url>
<url>https://github.com/libressl-portable/portable/issues/307</url>
<cvename>CVE-2017-8301</cvename>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-04-28</entry>
</dates>
</vuln>
<vuln vid="631c4710-9be5-4a80-9310-eb2847fe24dd">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.57</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.46.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-04-26/">
<h1>Description</h1>
<h5>SECURITY-412 through SECURITY-420 / CVE-2017-1000356</h5>
<p>CSRF: Multiple vulnerabilities</p>
<h5>SECURITY-429 / CVE-2017-1000353</h5>
<p>CLI: Unauthenticated remote code execution</p>
<h5>SECURITY-466 / CVE-2017-1000354</h5>
<p>CLI: Login command allowed impersonating any Jenkins user</p>
<h5>SECURITY-503 / CVE-2017-1000355</h5>
<p>XStream: Java crash when trying to instantiate void/Void</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-1000356</cvename>
<cvename>CVE-2017-1000353</cvename>
<cvename>CVE-2017-1000354</cvename>
<cvename>CVE-2017-1000355</cvename>
<url>https://jenkins.io/security/advisory/2017-04-26/</url>
</references>
<dates>
<discovery>2017-04-26</discovery>
<entry>2017-04-27</entry>
</dates>
</vuln>
<vuln vid="df0144fb-295e-11e7-970f-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a header injection vulnerability in common function
set_status_header() under Apache (thanks to Guillermo Caminer from
Flowgate).</p>
<p>Fixed byte-safety issues in Encrypt Library (DEPRECATED) when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in Encryption Library when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in compatibility functions
password_hash(), hash_pbkdf2() when mbstring.func_overload is
enabled.</p>
<p>Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv()
with MCRYPT_DEV_URANDOM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-04-25</entry>
</dates>
</vuln>
<vuln vid="81433129-2916-11e7-ad3e-00e04c1ea73d">
<topic>weechat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Common Vulnerabilities and Exposures:</p>
<blockquote cite="https://weechat.org/download/security/">
<p>WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to
the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes
function during quote removal, with a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/download/security/</url>
<cvename>CVE-2017-8073</cvename>
</references>
<dates>
<discovery>2017-04-23</discovery>
<entry>2017-04-24</entry>
</dates>
</vuln>
<vuln vid="1455c86c-26c2-11e7-9daa-6cf0497db129">
<topic>drupal8 -- Drupal Core - Critical - Access Bypass</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-002">
<p>CVE-2017-6919: Access bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6919</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="95a74a48-2691-11e7-9e2d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>58.0.3029.81</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to
Guang Gong of Alpha Team, Qihoo 360</li>
<li>[694382] High CVE-2017-5058: Heap use after free in Print Preview.
Credit to Khalil Zhani</li>
<li>[684684] High CVE-2017-5059: Type confusion in Blink. Credit to
SkyLined working with Trend Micro's Zero Day Initiative</li>
<li>[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to
Xudong Zheng</li>
<li>[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to
Haosheng Wang (@gnehsoah)</li>
<li>[702896] Medium CVE-2017-5062: Use after free in Chrome Apps.
Credit to anonymous</li>
<li>[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to
Sweetchip</li>
<li>[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to
Wadih Matar</li>
<li>[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to
Khalil Zhani</li>
<li>[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking.
Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen
(ICTT, Xidian University)</li>
<li>[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to
Khalil Zhani</li>
<li>[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to
Michael Reizelman</li>
<li>[713205] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5057</cvename>
<cvename>CVE-2017-5058</cvename>
<cvename>CVE-2017-5059</cvename>
<cvename>CVE-2017-5060</cvename>
<cvename>CVE-2017-5061</cvename>
<cvename>CVE-2017-5062</cvename>
<cvename>CVE-2017-5063</cvename>
<cvename>CVE-2017-5064</cvename>
<cvename>CVE-2017-5065</cvename>
<cvename>CVE-2017-5066</cvename>
<cvename>CVE-2017-5067</cvename>
<cvename>CVE-2017-5069</cvename>
<url>https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="607f8b57-7454-42c6-a88a-8706f327076d">
<topic>icu -- multiple vulnerabilities</topic>
<affects>
<package>
<name>icu</name>
<range><lt>58.2_2,1</lt></range>
</package>
<package>
<name>linux-c6-icu</name>
<name>linux-c7-icu</name>
<range><lt>59.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7867">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_setNativeIndex*
function.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7868">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_moveIndex32*
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7867</cvename>
<cvename>CVE-2017-7868</cvename>
<url>http://bugs.icu-project.org/trac/changeset/39671</url>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-04-20</entry>
<modified>2017-05-04</modified>
</dates>
</vuln>
<vuln vid="2a96e498-3234-4950-a9ad-419bc84a839d">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<name>linux-f8-tiff</name>
<name>linux-f10-tiff</name>
<name>linux-c6-tiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-5225">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5225</cvename>
<cvename>CVE-2017-7592</cvename>
<cvename>CVE-2017-7593</cvename>
<cvename>CVE-2017-7594</cvename>
<cvename>CVE-2017-7595</cvename>
<cvename>CVE-2017-7596</cvename>
<cvename>CVE-2017-7597</cvename>
<cvename>CVE-2017-7598</cvename>
<cvename>CVE-2017-7599</cvename>
<cvename>CVE-2017-7600</cvename>
<cvename>CVE-2017-7601</cvename>
<cvename>CVE-2017-7602</cvename>
<url>https://github.com/vadz/libtiff/commit/5c080298d59e</url>
<url>https://github.com/vadz/libtiff/commit/48780b4fcc42</url>
<url>https://github.com/vadz/libtiff/commit/d60332057b95</url>
<url>https://github.com/vadz/libtiff/commit/2ea32f7372b6</url>
<url>https://github.com/vadz/libtiff/commit/8283e4d1b7e5</url>
<url>https://github.com/vadz/libtiff/commit/47f2fb61a3a6</url>
<url>https://github.com/vadz/libtiff/commit/3cfd62d77c2a</url>
<url>https://github.com/vadz/libtiff/commit/3144e57770c1</url>
<url>https://github.com/vadz/libtiff/commit/0a76a8c765c7</url>
<url>https://github.com/vadz/libtiff/commit/66e7bd595209</url>
</references>
<dates>
<discovery>2017-04-01</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="d44129d6-b22e-4e9c-b200-6a46e8bd3e60">
<topic>libsamplerate -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsamplerate</name>
<name>linux-c6-libsamplerate</name>
<name>linux-c7-libsamplerate</name>
<range><lt>0.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7697">
<p>In libsamplerate before 0.1.9, a buffer over-read
occurs in the calc_output_single function in src_sinc.c
via a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7697</cvename>
<url>https://github.com/erikd/libsamplerate/commit/c3b66186656d</url>
</references>
<dates>
<discovery>2017-04-11</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="5a97805e-93ef-4dcb-8d5e-dbcac263bfc2">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7585">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a stack-based buffer overflow via a specially crafted
FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7586">
<p>In libsndfile before 1.0.28, an error in the
"header_read()" function (common.c) when handling ID3 tags
can be exploited to cause a stack-based buffer overflow
via a specially crafted FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7741">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with write memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7742">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with read memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7585</cvename>
<cvename>CVE-2017-7586</cvename>
<cvename>CVE-2017-7741</cvename>
<cvename>CVE-2017-7742</cvename>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
<url>https://github.com/erikd/libsndfile/commit/708e996c87c5</url>
<url>https://github.com/erikd/libsndfile/commit/f457b7b5ecfe</url>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
</references>
<dates>
<discovery>2017-04-07</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="3e2e9b44-25ce-11e7-a175-939b30e0836d">
<topic>cURL -- TLS session resumption client cert bypass (again)</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.54.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170419.html">
<p>libcurl would attempt to resume a TLS session even if the client
certificate had changed. That is unacceptable since a server by
specification is allowed to skip the client certificate check on
resume, and may instead use the old identity which was established
by the previous certificate (or no certificate).</p>
<p>libcurl supports by default the use of TLS session id/ticket to
resume previous TLS sessions to speed up subsequent TLS handshakes.
They are used when for any reason an existing TLS connection
couldn't be kept alive to make the next handshake faster.</p>
<p>This flaw is a regression and identical to CVE-2016-5419 reported
on August 3rd 2016, but affecting a different version range.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7468</cvename>
<url>https://curl.haxx.se/docs/adv_20170419.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
<topic>graphite2 -- out-of-bounds write with malicious font</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.9_1</lt></range>
</package>
<package>
<name>linux-c7-graphite2</name>
<range><lt>1.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write in the Graphite 2 library
triggered with a maliciously crafted Graphite font. This
results in a potentially exploitable crash. This issue was
fixed in the Graphite 2 library as well as Mozilla
products.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5436</cvename>
<url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-04-20</modified>
</dates>
</vuln>
<vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
<topic>libevent -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevent</name>
<name>libevent2</name>
<name>linux-c6-libevent2</name>
<name>linux-c7-libevent</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
<p>CVE-2016-10195: The name_parse function in evdns.c in
libevent before 2.1.6-beta allows remote attackers to have
unspecified impact via vectors involving the label_len
variable, which triggers an out-of-bounds stack read.</p>
<p>CVE-2016-10196: Stack-based buffer overflow in the
evutil_parse_sockaddr_port function in evutil.c in libevent
before 2.1.6-beta allows attackers to cause a denial of
service (segmentation fault) via vectors involving a long
string in brackets in the ip_as_string argument.</p>
<p>CVE-2016-10197: The search_make_new function in evdns.c
in libevent before 2.1.6-beta allows attackers to cause a
denial of service (out-of-bounds read) via an empty
hostname.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10195</cvename>
<cvename>CVE-2016-10196</cvename>
<cvename>CVE-2016-10197</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
<url>https://github.com/libevent/libevent/issues/317</url>
<url>https://github.com/libevent/libevent/issues/318</url>
<url>https://github.com/libevent/libevent/issues/332</url>
<url>https://github.com/libevent/libevent/issues/335</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-f10-nss</name>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><ge>3.30</ge><lt>3.30.1</lt></range>
<range><ge>3.29</ge><lt>3.29.5</lt></range>
<range><ge>3.22</ge><lt>3.28.4</lt></range>
<range><lt>3.21.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write during Base64 decoding operation
in the Network Security Services (NSS) library due to
insufficient memory being allocated to the buffer. This
results in a potentially exploitable crash. The NSS library
has been updated to fix this issue to address this issue and
Firefox 53 has been updated with NSS version 3.29.5.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>A flaw in DRBG number generation within the Network
Security Services (NSS) library where the internal state V
does not correctly carry bits over. The NSS library has been
updated to fix this issue to address this issue and Firefox
53 has been updated with NSS version 3.29.5.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5462</cvename>
<url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
<url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>53.0_2,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.1.0_2,1</lt></range>
<range><lt>45.9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.1.0,2</lt></range>
<range><lt>45.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5433</cvename>
<cvename>CVE-2017-5435</cvename>
<cvename>CVE-2017-5436</cvename>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5459</cvename>
<cvename>CVE-2017-5466</cvename>
<cvename>CVE-2017-5434</cvename>
<cvename>CVE-2017-5432</cvename>
<cvename>CVE-2017-5460</cvename>
<cvename>CVE-2017-5438</cvename>
<cvename>CVE-2017-5439</cvename>
<cvename>CVE-2017-5440</cvename>
<cvename>CVE-2017-5441</cvename>
<cvename>CVE-2017-5442</cvename>
<cvename>CVE-2017-5464</cvename>
<cvename>CVE-2017-5443</cvename>
<cvename>CVE-2017-5444</cvename>
<cvename>CVE-2017-5446</cvename>
<cvename>CVE-2017-5447</cvename>
<cvename>CVE-2017-5465</cvename>
<cvename>CVE-2017-5448</cvename>
<cvename>CVE-2017-5437</cvename>
<cvename>CVE-2017-5454</cvename>
<cvename>CVE-2017-5455</cvename>
<cvename>CVE-2017-5456</cvename>
<cvename>CVE-2017-5469</cvename>
<cvename>CVE-2017-5445</cvename>
<cvename>CVE-2017-5449</cvename>
<cvename>CVE-2017-5450</cvename>
<cvename>CVE-2017-5451</cvename>
<cvename>CVE-2017-5462</cvename>
<cvename>CVE-2017-5463</cvename>
<cvename>CVE-2017-5467</cvename>
<cvename>CVE-2017-5452</cvename>
<cvename>CVE-2017-5453</cvename>
<cvename>CVE-2017-5458</cvename>
<cvename>CVE-2017-5468</cvename>
<cvename>CVE-2017-5430</cvename>
<cvename>CVE-2017-5429</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="d9e01c35-2531-11e7-b291-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.31</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.23</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.36</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html">
<p>This Critical Patch Update contains 39 new security fixes for
Oracle MySQL. 11 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html</url>
<cvename>CVE-2017-3308</cvename>
<cvename>CVE-2017-3309</cvename>
<cvename>CVE-2017-3450</cvename>
<cvename>CVE-2017-3599</cvename>
<cvename>CVE-2017-3329</cvename>
<cvename>CVE-2017-3600</cvename>
<cvename>CVE-2017-3331</cvename>
<cvename>CVE-2017-3453</cvename>
<cvename>CVE-2017-3452</cvename>
<cvename>CVE-2017-3454</cvename>
<cvename>CVE-2017-3455</cvename>
<cvename>CVE-2017-3305</cvename>
<cvename>CVE-2017-3460</cvename>
<cvename>CVE-2017-3456</cvename>
<cvename>CVE-2017-3458</cvename>
<cvename>CVE-2017-3457</cvename>
<cvename>CVE-2017-3459</cvename>
<cvename>CVE-2017-3463</cvename>
<cvename>CVE-2017-3462</cvename>
<cvename>CVE-2017-3461</cvename>
<cvename>CVE-2017-3464</cvename>
<cvename>CVE-2017-3465</cvename>
<cvename>CVE-2017-3467</cvename>
<cvename>CVE-2017-3468</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="c6861494-1ffb-11e7-934d-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P8</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P8</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P5</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2017.03.25</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01465/0">
<p>A query with a specific set of characteristics could
cause a server using DNS64 to encounter an assertion
failure and terminate.</p>
<p>An attacker could deliberately construct a query,
enabling denial-of-service against a server if it
was configured to use the DNS64 feature and other
preconditions were met.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01466/0">
<p>Mistaken assumptions about the ordering of records in
the answer section of a response containing CNAME or
DNAME resource records could lead to a situation in
which named would exit with an assertion failure when
processing a response in which records occurred in an
unusual order.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01471/0">
<p>named contains a feature which allows operators to
issue commands to a running server by communicating
with the server process over a control channel,
using a utility program such as rndc.</p>
<p>A regression introduced in a recent feature change
has created a situation under which some versions of
named can be caused to exit with a REQUIRE assertion
failure if they are sent a null command string.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3136</cvename>
<cvename>CVE-2017-3137</cvename>
<cvename>CVE-2017-3138</cvename>
<url>https://kb.isc.org/article/AA-01465/0</url>
<url>https://kb.isc.org/article/AA-01466/0</url>
<url>https://kb.isc.org/article/AA-01471/0</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-04-13</entry>
<modified>2017-04-13</modified>
</dates>
</vuln>
<vuln vid="e48355d7-1548-11e7-8611-0090f5f2f347">
<topic>id Tech 3 -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ioquake3</name>
<range><lt>1.36_16</lt></range>
</package>
<package>
<name>ioquake3-devel</name>
<range><lt>g2930</lt></range>
</package>
<package>
<name>iourbanterror</name>
<range><lt>4.3.2,1</lt></range>
</package>
<package>
<name>openarena</name>
<range><lt>0.8.8.s1910_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The content auto-download of id Tech 3 can be used to deliver
maliciously crafted content, that triggers downloading of
further content and loading and executing it as native code
with user credentials. This affects ioquake3, ioUrbanTerror,
OpenArena, the original Quake 3 Arena and other forks.</p>
</body>
</description>
<references>
<cvename>CVE-2017-6903</cvename>
<url>https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-04-07</entry>
</dates>
</vuln>
<vuln vid="90becf7c-1acf-11e7-970f-002590263bf5">
<topic>xen-kernel -- broken check in memory_exchange() permits PV guest breakout</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>The XSA-29 fix introduced an insufficient check on XENMEM_exchange
input, allowing the caller to drive hypervisor memory accesses
outside of the guest provided input/output arrays.</p>
<p>A malicious or buggy 64-bit PV guest may be able to access all of
system memory, allowing for all of privilege escalation, host
crashes, and information leaks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7228</cvename>
<url>https://xenbits.xen.org/xsa/advisory-212.html</url>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-06</entry>
</dates>
</vuln>
<vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf">
<topic>cURL -- potential memory disclosure</topic>
<affects>
<package>
<name>curl</name>
<range><ge>6.5</ge><lt>7.53.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170403.html">
<p>There were two bugs in curl's parser for the command line option
--write-out (or -w for short) that would skip the end of string
zero byte if the string ended in a % (percent) or \ (backslash),
and it would read beyond that buffer in the heap memory and it
could then potentially output pieces of that memory to the
terminal or the target file etc..</p>
<p>This flaw only exists in the command line tool.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170403.html</url>
<cvename>CVE-2017-7407</cvename>
</references>
<dates>
<discovery>2017-04-03</discovery>
<entry>2017-04-05</entry>
<modified>2017-04-06</modified>
</dates>
</vuln>
<vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<name>py36-django</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<name>py36-django18</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<name>py36-django19</name>
<range><lt>1.9.13</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django team reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/apr/04/security-releases/">
<p>These release addresses two security issues detailed below. We
encourage all users of Django to upgrade as soon as possible.</p>
<ul>
<li>Open redirect and possible XSS attack via user-supplied numeric
redirect URLs</li>
<li>Open redirect vulnerability in django.views.static.serve()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2017/apr/04/security-releases/</url>
<cvename>CVE-2017-7233</cvename>
<cvename>CVE-2017-7234</cvename>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="356b02e9-1954-11e7-9608-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
on a CDR. Thus, it is possible for someone to use an
arbitrarily large string and write past the end of the
user field storage buffer. This allows the possibility
of remote code injection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-001.html</url>
<url>https://issues.asterisk.org/jira/browse/ASTERISK-26897</url>
</references>
<dates>
<discovery>2017-03-27</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="057e6616-1885-11e7-bb4d-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.39</lt></range>
</package>
<package>
<name>nvidia-driver-340</name>
<range><lt>340.102</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4398">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where multiple integer overflows,
improper access control, and improper validation of a user
input may cause a denial of service or potential escalation
of privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0309</cvename>
<cvename>CVE-2017-0310</cvename>
<cvename>CVE-2017-0311</cvename>
<cvename>CVE-2017-0318</cvename>
<cvename>CVE-2017-0321</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4398</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="7cf058d8-158d-11e7-ba2c-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.133</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[698622] Critical CVE-2017-5055: Use after free in printing. Credit to
Wadih Matar</li>
<li>[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to
Nicolas Trippar of Zimperium zLabs</li>
<li>[662767] High CVE-2017-5052: Bad cast in Blink. Credit to
JeongHoon Shin</li>
<li>[705445] High CVE-2017-5056: Use after free in Blink. Credit to
anonymous</li>
<li>[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to
Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5055</cvename>
<cvename>CVE-2017-5054</cvename>
<cvename>CVE-2017-5052</cvename>
<cvename>CVE-2017-5056</cvename>
<cvename>CVE-2017-5053</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2017-03-29</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="47873d72-14eb-11e7-970f-002590263bf5">
<topic>xen-tools -- xenstore denial of service via repeated update</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>Unprivileged guests may be able to stall progress of the control
domain or driver domain, possibly leading to a Denial of Service
(DoS) of the entire host.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-206.html</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="68611303-149e-11e7-b9bb-6805ca0b3d42">
<topic>phpMyAdmin -- bypass 'no password' restriction</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-8/">
<h3>Summary</h3>
<p>Bypass $cfg['Servers'][$i]['AllowNoPassword']</p>
<h3>Description</h3>
<p>A vulnerability was discovered where the restrictions
caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are
bypassed under certain PHP versions. This can allow the
login of users who have no password set even if the
administrator has set $cfg['Servers'][$i]['AllowNoPassword']
to false (which is also the default).</p>
<p>This behavior depends on the PHP version used (it seems
PHP 5 is affected, while PHP 7.0 is not).</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>Set a password for all users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-8/</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-29</entry>
</dates>
</vuln>
<vuln vid="04bc4e23-9a70-42cb-9fec-3613632d34bc">
<cancelled superseded="967b852b-1e28-11e6-8dd3-002590263bf5"/>
</vuln>
<vuln vid="2826317b-10ec-11e7-944e-000c292e4fd8">
<topic>samba -- symlink race allows access outside share definition</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><le>4.3.13</le></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.12</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.7</lt></range>
</package>
<package>
<name>samba46</name>
<range><ge>4.6.0</ge><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-2619.html">
<p>A time-of-check, time-of-use race condition
can allow clients to access non-exported parts
of the file system via symlinks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-2619.html</url>
<cvename>CVE-2017-2619</cvename>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-03-24</entry>
</dates>
</vuln>
<vuln vid="af19ecd0-0f6a-11e7-970f-002590263bf5">
<topic>xen-tools -- Cirrus VGA Heap overflow via display refresh</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-211.html">
<p>A privileged user within the guest VM can cause a heap overflow in
the device model process, potentially escalating their privileges to
that of the device model process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9603</cvename>
<url>http://xenbits.xen.org/xsa/advisory-211.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-23</entry>
</dates>
</vuln>
<vuln vid="06f931c0-0be0-11e7-b4bf-5404a68ad561">
<topic>irssi -- use-after-free potential code execution</topic>
<affects>
<package>
<name>irssi</name>
<range><gt>0.8.21,1</gt><lt>1.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The irssi project reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_03.txt">
<p>Use after free while producing list of netjoins (CWE-416).
This issue was found and reported to us by APic.
This issue usually leads to segmentation faults.
Targeted code execution should be difficult.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_03.txt</url>
<cvename>CVE-2017-7191</cvename>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="7c27192f-0bc3-11e7-9940-b499baebfeaf">
<topic>mysql -- denial of service vulnerability</topic>
<affects>
<package>
<name>mariadb55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/02/11/11">
<p>C client library for MySQL (libmysqlclient.so) has
use-after-free defect which can cause crash of applications
using that MySQL client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/02/11/11</url>
<cvename>CVE-2017-3302</cvename>
</references>
<dates>
<discovery>2017-01-27</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="5f453b69-abab-4e76-b6e5-2ed0bafcaee3">
<topic>firefox -- integer overflow in createImageBitmap()</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/">
<p>An integer overflow in createImageBitmap() was reported
through the Pwn2Own contest. The fix for this vulnerability
disables the experimental extensions to the
createImageBitmap API. This function runs in the content
sandbox, requiring a second vulnerability to compromise a
user's computer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5428</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-08/</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="df45b4bd-0b7f-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.9</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/news/#p1408104">
<p>In addition to a number of bug fixes and small improvements,
security vulnerabilities have been discovered and fixed. We highly
recommend that you upgrade your sites as soon as possible.
Upgrading should be very straightforward. As per our usual policy,
admins of all registered Moodle sites will be notified of security
issue details directly via email and we'll publish details more
widely in a week.</p>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/news/#p1408104</url>
</references>
<dates>
<discovery>2017-03-13</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="f72d98d1-0b7e-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.8</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.4</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-17-0001: System file inclusion when adding own preset
file in Boost theme</p></li>
<li><p>MSA-17-0002: Incorrect sanitation of attributes in forums
</p></li>
<li><p>MSA-17-0003: PHPMailer vulnerability in no-reply address
</p></li>
<li><p>MSA-17-0004: XSS in assignment submission page</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2576</cvename>
<cvename>CVE-2017-2578</cvename>
<cvename>CVE-2016-10045</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2017-01-17</discovery>
<entry>2017-03-18</entry>
<modified>2020-06-24</modified>
</dates>
</vuln>
<vuln vid="2730c668-0b1c-11e7-8d52-6cf0497db129">
<topic>drupal8 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-2017-001">
<p>CVE-2017-6377: Editor module incorrectly checks access to inline private files</p>
<p>CVE-2017-6379: Some admin paths were not protected with a CSRF token</p>
<p>CVE-2017-6381: Remote code execution</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6377</cvename>
<cvename>CVE-2017-6379</cvename>
<cvename>CVE-2017-6381</cvename>
<url>https://www.drupal.org/SA-2017-001</url>
</references>
<dates>
<discovery>2017-03-15</discovery>
<entry>2017-03-17</entry>
</dates>
</vuln>
<vuln vid="9b973e97-0a99-11e7-ace7-080027ef73ec">
<topic>PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html">
<p>Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
overflow bug in the ssh_agent_channel_data function which processes
messages sent by remote SSH clients to a forwarded agent connection. [...]</p>
<p>This bug is only exploitable at all if you have enabled SSH
agent forwarding, which is turned off by default. Moreover, an
attacker able to exploit this bug would have to have already be able
to connect to the Unix-domain socket representing the forwarded
agent connection. Since any attacker with that capability would
necessarily already be able to generate signatures with your agent's
stored private keys, you should in normal circumstances be defended
against this vulnerability by the same precautions you and your
operating system were already taking to prevent untrusted people
from accessing your SSH agent.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html</url>
<cvename>CVE-2017-6542</cvename>
</references>
<dates>
<discovery>2017-01-29</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="4ffb633c-0a3b-11e7-a9f2-0011d823eebd">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>25.0.0.127</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html">
<ul>
<li>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2017-2997).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-2998, CVE-2017-2999).</li>
<li>These updates resolve a random number generator vulnerability
used for constant blinding that could lead to information
disclosure (CVE-2017-3000).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3001, CVE-2017-3002,
CVE-2017-3003).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2997</cvename>
<cvename>CVE-2017-2998</cvename>
<cvename>CVE-2017-2999</cvename>
<cvename>CVE-2017-3000</cvename>
<cvename>CVE-2017-3001</cvename>
<cvename>CVE-2017-3002</cvename>
<cvename>CVE-2017-3003</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-07.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="f41e3e54-076b-11e7-a9f2-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.4.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01">
<ul>
<li>If a malicious peer supplies a certificate with a specially
crafted secp224k1 public key, then an attacker can cause the
server or client to attempt to free block of memory held on
stack. Depending on the platform, this could result in a Denial
of Service (client crash) or potentially could be exploited to
allow remote code execution with the same privileges as the host
application.</li>
<li>If the client and the server both support MD5 and the client
can be tricked to authenticate to a malicious server, then the
malicious server can impersonate the client. To launch this man
in the middle attack, the adversary has to compute a
chosen-prefix MD5 collision in real time. This is very expensive
computationally, but can be practical. Depending on the
platform, this could result in a Denial of Service (client crash)
or potentially could be exploited to allow remote code execution
with the same privileges as the host application.</li>
<li>A bug in the logic of the parsing of a PEM encoded Certificate
Revocation List in mbedtls_x509_crl_parse() can result in an
infinite loop. In versions before 1.3.10 the same bug results in
an infinite recursion stack overflow that usually crashes the
application. Methods and means of acquiring the CRLs is not part
of the TLS handshake and in the strict TLS setting this
vulnerability cannot be triggered remotely. The vulnerability
cannot be triggered unless the application explicitly calls
mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM
formatted CRL of untrusted origin. In which case the
vulnerability can be exploited to launch a denial of service
attack against the application.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01</url>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5030</cvename>
<cvename>CVE-2017-5031</cvename>
<cvename>CVE-2017-5032</cvename>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2017-5034</cvename>
<cvename>CVE-2017-5035</cvename>
<cvename>CVE-2017-5036</cvename>
<cvename>CVE-2017-5037</cvename>
<cvename>CVE-2017-5039</cvename>
<cvename>CVE-2017-5040</cvename>
<cvename>CVE-2017-5041</cvename>
<cvename>CVE-2017-5033</cvename>
<cvename>CVE-2017-5042</cvename>
<cvename>CVE-2017-5038</cvename>
<cvename>CVE-2017-5043</cvename>
<cvename>CVE-2017-5044</cvename>
<cvename>CVE-2017-5045</cvename>
<cvename>CVE-2017-5046</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-03-09</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><ge>1.51</ge><lt>1.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.56</p>
<p>2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/215507</freebsdpr>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="41fe4724-06a2-11e7-8e3e-5453ed2e2b49">
<topic>kde-runtime -- kdesu: displayed command truncated by unicode string terminator</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.14.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160930-1.txt">
<p>A maliciously crafted command line for kdesu can result in the
user only seeing part of the commands that will actually get executed
as super user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7787</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2016/09/29/7</mlist>
<url>https://www.kde.org/info/security/advisory-20160930-1.txt</url>
</references>
<dates>
<discovery>2016-09-30</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="e550fc62-069a-11e7-8e3e-5453ed2e2b49">
<topic>kdepimlibs -- directory traversal on KTNEF</topic>
<affects>
<package>
<name>kdepimlibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170227-1.txt">
<p>A directory traversal issue was found in KTNEF which can be
exploited by tricking a user into opening a malicious winmail.dat
file. The issue allows to write files with the permission of the user
opening the winmail.dat file during extraction.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170227-1.txt</url>
</references>
<dates>
<discovery>2017-02-27</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="f714d8ab-028e-11e7-8042-50e549ebab6c">
<topic>kio: Information Leak when accessing https when using a malicious PAC file</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.29_10</lt></range>
</package>
<package>
<name>kf5-kio</name>
<range><lt>5.31.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170228-1.txt">
<p>Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.</p>
<p>This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).</p>
<p>This attack can be carried out remotely (over the LAN) since proxy settings
allow "Detect Proxy Configuration Automatically".
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170228-1.txt</url>
</references>
<dates>
<discovery>2017-02-28</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">
<p>WordPress versions 4.7.2 and earlier are affected by six security issues.</p>
<ul>
<li>Cross-site scripting (XSS) via media file metadata.</li>
<li>Control characters can trick redirect URL validation.</li>
<li>Unintended files can be deleted by administrators using the
plugin deletion functionality.</li>
<li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li>
<li>Cross-site scripting (XSS) via taxonomy term names.</li>
<li>Cross-site request forgery (CSRF) in Press This leading to
excessive use of server resources.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>
<url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.0,1</lt></range>
<range><lt>45.8.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.0,2</lt></range>
<range><lt>45.8.0_1,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0_1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5400</cvename>
<cvename>CVE-2017-5401</cvename>
<cvename>CVE-2017-5402</cvename>
<cvename>CVE-2017-5403</cvename>
<cvename>CVE-2017-5404</cvename>
<cvename>CVE-2017-5406</cvename>
<cvename>CVE-2017-5407</cvename>
<cvename>CVE-2017-5410</cvename>
<cvename>CVE-2017-5411</cvename>
<cvename>CVE-2017-5409</cvename>
<cvename>CVE-2017-5408</cvename>
<cvename>CVE-2017-5412</cvename>
<cvename>CVE-2017-5413</cvename>
<cvename>CVE-2017-5414</cvename>
<cvename>CVE-2017-5415</cvename>
<cvename>CVE-2017-5416</cvename>
<cvename>CVE-2017-5417</cvename>
<cvename>CVE-2017-5425</cvename>
<cvename>CVE-2017-5426</cvename>
<cvename>CVE-2017-5427</cvename>
<cvename>CVE-2017-5418</cvename>
<cvename>CVE-2017-5419</cvename>
<cvename>CVE-2017-5420</cvename>
<cvename>CVE-2017-5405</cvename>
<cvename>CVE-2017-5421</cvename>
<cvename>CVE-2017-5422</cvename>
<cvename>CVE-2017-5399</cvename>
<cvename>CVE-2017-5398</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-05/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-06/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="71ebbc50-01c1-11e7-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an XSS vulnerability in Security Library method xss_clean().
</p>
<p>Fixed a possible file inclusion vulnerability in Loader Library
method vars().</p>
<p>Fixed a possible remote code execution vulnerability in the Email
Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane
from NamePros).</p>
<p>Added protection against timing side-channel attacks in Security
Library method csrf_verify().</p>
<p>Added protection against BREACH attacks targeting the CSRF token
field generated by Form Helper function form_open().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="7b35a77a-0151-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20170111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ikiwiki reports:</p>
<blockquote cite="https://ikiwiki.info/security/#index48h2">
<p>The ikiwiki maintainers discovered further flaws similar to
CVE-2016-9646 in the passwordauth plugin's use of
CGI::FormBuilder, with a more serious impact:</p>
<p>An attacker who can log in to a site with a password can log in as
a different and potentially more privileged user.</p>
<p>An attacker who can create a new account can set arbitrary fields
in the user database for that account</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0356</cvename>
<url>https://ikiwiki.info/security/#index48h2</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="5ed094a0-0150-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20161229</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026">
<p>ikiwiki 3.20161219 does not properly check if a revision changes
the access permissions for a page on sites with the git and
recentchanges plugins and the CGI interface enabled, which allows
remote attackers to revert certain changes by leveraging permissions
to change the page before the revision was made.</p>
</blockquote>
<blockquote cite="https://ikiwiki.info/security/#index47h2">
<p>When CGI::FormBuilder->field("foo") is called in list context
(and in particular in the arguments to a subroutine that takes named
arguments), it can return zero or more values for foo from the CGI
request, rather than the expected single value. This breaks the
usual Perl parsing convention for named arguments, similar to
CVE-2014-1572 in Bugzilla (which was caused by a similar API design
issue in CGI.pm).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10026</cvename>
<cvename>CVE-2016-9645</cvename>
<cvename>CVE-2016-9646</cvename>
<url>https://ikiwiki.info/security/#index46h2</url>
<url>https://ikiwiki.info/security/#index47h2</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="f4eb9a25-fde0-11e6-9ad0-b8aeed92ecc4">
<topic>potrace -- multiple memory failure</topic>
<affects>
<package>
<name>potrace</name>
<range><lt>1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>potrace reports:</p>
<blockquote cite="https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/">
<p>CVE-2016-8685: invalid memory access in findnext</p>
<p>CVE-2016-8686: memory allocation failure</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/</url>
<cvename>CVE-2016-8685</cvename>
<cvename>CVE-2016-8686</cvename>
</references>
<dates>
<discovery>2016-10-15</discovery>
<entry>2017-02-28</entry>
</dates>
</vuln>
<vuln vid="765d165b-fbfe-11e6-aae7-5404a68ad561">
<topic>MPD -- buffer overflows in http output</topic>
<affects>
<package>
<name>musicpd</name>
<range><lt>0.20.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MPD project reports:</p>
<blockquote cite="http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5">
<p>httpd: fix two buffer overflows in IcyMetaData length calculation</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5</url>
</references>
<dates>
<discovery>2017-02-18</discovery>
<entry>2017-02-26</entry>
</dates>
</vuln>
<vuln vid="311e4b1c-f8ee-11e6-9940-b499baebfeaf">
<topic>cURL -- ocsp status validation error</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.53.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170222.html">
<p>SSL_VERIFYSTATUS ignored<br/>
curl and libcurl support "OCSP stapling", also known as the TLS
Certificate Status Request extension (using the
CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this
feature, it uses that TLS extension to ask for a fresh proof of
the server's certificate's validity. If the server doesn't support
the extension, or fails to provide said proof, curl is expected to
return an error.<br/>
Due to a coding mistake, the code that checks for a test success or
failure, ends up always thinking there's valid proof, even when
there is none or if the server doesn't support the TLS extension in
question. Contrary to how it used to function and contrary to how
this feature is documented to work.<br/>
This could lead to users not detecting when a server's certificate
goes invalid or otherwise be mislead that the server is in a better
shape than it is in reality.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170222.html</url>
<cvename>CVE-2017-2629</cvename>
</references>
<dates>
<discovery>2017-02-22</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="8cbd9c08-f8b9-11e6-ae1b-002590263bf5">
<topic>xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-209.html">
<p>In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo fails to check whether the specified
memory region is safe. A malicious guest administrator can cause
an out of bounds memory write, very likely exploitable as a
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2620</cvename>
<url>http://xenbits.xen.org/xsa/advisory-209.html</url>
</references>
<dates>
<discovery>2017-02-21</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="786a7d87-f826-11e6-9436-14dae9d5a9d2">
<topic>fbsdmon -- information disclosure vulnerability</topic>
<affects>
<package>
<name>fbsdmon</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Somers reports:</p>
<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099">
<p>The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-02-21</entry>
</dates>
</vuln>
<vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561">
<topic>wavpack -- multiple invalid memory reads</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Bryant reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">
<p>global buffer overread in read_code / read_words.c</p>
<p>heap out of bounds read in WriteCaffHeader / caff.c</p>
<p>heap out of bounds read in unreorder_channels / wvunpack.c</p>
<p>heap oob read in read_new_config_info / open_utils.c</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>
<cvename>CVE-2016-10169</cvename>
<cvename>CVE-2016-10170</cvename>
<cvename>CVE-2016-10171</cvename>
<cvename>CVE-2016-10172</cvename>
<url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-02-18</entry>
</dates>
</vuln>
<vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448">
<topic>optipng -- multiple vulnerabilities</topic>
<affects>
<package>
<name>optipng</name>
<range><lt>0.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7802">
<p>ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2191">
<p>The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3981">
<p>Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3982">
<p>Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7802</cvename>
<cvename>CVE-2016-2191</cvename>
<cvename>CVE-2016-3981</cvename>
<cvename>CVE-2016-3982</cvename>
</references>
<dates>
<discovery>2015-10-09</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
<topic>openssl -- crash on handshake</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
<p>Severity: High<br/>
During a renegotiation handshake if the Encrypt-Then-Mac
extension is negotiated where it was not in the original
handshake (or vice-versa) then this can cause OpenSSL to
crash (dependent on ciphersuite). Both clients and servers
are affected.<br/>
This issue does not affect OpenSSL version 1.0.2.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170216.txt</url>
<cvename>CVE-2017-3733</cvename>
</references>
<dates>
<discovery>2017-02-16</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
<topic>diffoscope -- arbitrary file write</topic>
<affects>
<package>
<name>py34-diffoscope</name>
<name>py35-diffoscope</name>
<name>py36-diffoscope</name>
<range><ge>67</ge><lt>76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ximin Luo reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
<p>[v67] introduced a security hole where diffoscope may write to
arbitrary locations on disk depending on the contents of an
untrusted archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0359</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723</url>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-14</entry>
<modified>2017-02-16</modified>
</dates>
</vuln>
<vuln vid="7f9b696f-f11b-11e6-b50e-5404a68ad561">
<topic>ffmpeg -- heap overflow in lavf/mov.c</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.2.4,1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 3.2.4 fixes the following vulnerabilities:
CVE-2017-5024, CVE-2017-5025</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5024</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2017-5025</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-02-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="79bbb8f8-f049-11e6-8a6a-bcaec565249c">
<topic>gtk-vnc -- bounds checking vulnerabilities</topic>
<affects>
<package>
<name>gtk-vnc</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html">
<p>CVE-2017-5884 - fix bounds checking for RRE, hextile and
copyrect encodings</p>
<p>CVE-2017-5885 - fix color map index bounds checking.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html</url>
<cvename>CVE-2017-5884</cvename>
<cvename>CVE-2017-5885</cvename>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="a73aba9a-effe-11e6-ae1b-002590263bf5">
<topic>xen-tools -- oob access in cirrus bitblt copy</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-208.html">
<p>When doing bitblt copy backwards, qemu should negate the blit
width. This avoids an oob access before the start of video
memory.</p>
<p>A malicious guest administrator can cause an out of bounds memory
access, possibly leading to information disclosure or privilege
escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2615</cvename>
<url>http://xenbits.xen.org/xsa/advisory-208.html</url>
</references>
<dates>
<discovery>2017-02-10</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="fb74eacc-ec8a-11e6-bc8a-0011d823eebd">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.7</lt></range>
</package>
<package>
<name>linux-c6-libtiff</name>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_5</lt></range>
</package>
<package>
<name>linux-c7-libtiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff project reports:</p>
<blockquote cite="http://simplesystems.org/libtiff/v4.0.7.html">
<p>Multiple flaws have been discovered in libtiff library and
utilities.</p>
</blockquote>
</body>
</description>
<references>
<url>http://simplesystems.org/libtiff/v4.0.7.html</url>
<cvename>CVE-2016-9533</cvename>
<cvename>CVE-2016-9534</cvename>
<cvename>CVE-2016-9535</cvename>
<cvename>CVE-2015-8870</cvename>
<cvename>CVE-2016-5652</cvename>
<cvename>CVE-2016-9540</cvename>
<cvename>CVE-2016-9537</cvename>
<cvename>CVE-2016-9536</cvename>
</references>
<dates>
<discovery>2016-11-19</discovery>
<entry>2017-02-06</entry>
</dates>
</vuln>
<vuln vid="2b63e964-eb04-11e6-9ac1-a4badb2f4699">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wdollman reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=21611">
<p>The value of the view_type parameter on the
view_all_bug_page.php page is not encoded before being displayed on the
page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mantisbt.org/bugs/view.php?id=21611</url>
<cvename>CVE-2016-6837</cvename>
<freebsdpr>ports/216662</freebsdpr>
</references>
<dates>
<discovery>2016-08-15</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="b4ecf774-eb01-11e6-9ac1-a4badb2f4699">
<topic>guile2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>guile2</name>
<range><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludovic Courtès reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/10/11/1">
<p>The REPL server is vulnerable to
the HTTP inter-protocol attack</p>
<p>The ‘mkdir’ procedure of GNU Guile, an implementation of
the Scheme programming language, temporarily changed the process’ umask
to zero. During that time window, in a multithreaded application, other
threads could end up creating files with insecure permissions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/10/11/1</url>
<url>http://www.openwall.com/lists/oss-security/2016/10/12/2</url>
<cvename>CVE-2016-8605</cvename>
<cvename>CVE-2016-8606</cvename>
<freebsdpr>ports/216663</freebsdpr>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="c6932dd4-eaff-11e6-9ac1-a4badb2f4699">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html">
<p>A buffer overflow error was found in the POSIX unit's procedures
process-execute and process-spawn.</p>
<p>Additionally, a memory leak existed in this code, which would be
triggered when an error is raised during argument and environment
processing.</p>
</blockquote>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-12/msg00000.html">
<p>Irregex versions before 0.9.6 contain a resource exhaustion
vulnerability: when compiling deeply nested regexes containing the
"+" operator due to exponential expansion behaviour.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html</url>
<cvename>CVE-2016-6830</cvename>
<cvename>CVE-2016-6831</cvename>
<cvename>CVE-2016-9954</cvename>
<freebsdpr>ports/216661</freebsdpr>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2017-02-04</entry>
<modified>2017-03-05</modified>
</dates>
</vuln>
<vuln vid="a130bd8c-eafe-11e6-9ac1-a4badb2f4699">
<topic>libebml -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libebml</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mortiz Bunkus reports:</p>
<blockquote cite="https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html">
<p>Multiple invalid memory accesses vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html</url>
<cvename>CVE-2015-8789</cvename>
<cvename>CVE-2015-8790</cvename>
<cvename>CVE-2015-8791</cvename>
<freebsdpr>ports/216659</freebsdpr>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="5b1631dc-eafd-11e6-9ac1-a4badb2f4699">
<topic>freeimage -- code execution vulnerability</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0189/">
<p>An exploitable out-of-bounds write vulnerability exists in
the XMP image handling functionality of the FreeImage library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0189/</url>
<cvename>CVE-2016-5684</cvename>
<freebsdpr>ports/216657</freebsdpr>
</references>
<dates>
<discovery>2016-10-03</discovery>
<entry>2017-02-04</entry>
<modified>2018-04-14</modified>
</dates>
</vuln>
<vuln vid="5a9b3d70-48e2-4267-b196-83064cb14fe0">
<topic>shotwell -- failure to encrypt authentication</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.24.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jens Georg reports:</p>
<blockquote cite="https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html">
<p>I have just released Shotwell 0.24.5 and 0.25.4 which turn
on HTTPS encryption all over the publishing plugins.</p>
<p>Users using Tumblr and Yandex.Fotki publishing are strongly
advised to change their passwords and reauthenticate Shotwell
to those services after upgrade.</p>
<p>Users of Picasa and Youtube publishing are strongly advised
to reauthenticate (Log out and back in) Shotwell to those
services after upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="5cfa9d0c-73d7-4642-af4f-28fbed9e9404">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.32.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2598</cvename>
<cvename>CVE-2017-2599</cvename>
<cvename>CVE-2017-2600</cvename>
<cvename>CVE-2011-4969</cvename>
<cvename>CVE-2017-2601</cvename>
<cvename>CVE-2015-0886</cvename>
<cvename>CVE-2017-2602</cvename>
<cvename>CVE-2017-2603</cvename>
<cvename>CVE-2017-2604</cvename>
<cvename>CVE-2017-2605</cvename>
<cvename>CVE-2017-2606</cvename>
<cvename>CVE-2017-2607</cvename>
<cvename>CVE-2017-2608</cvename>
<cvename>CVE-2017-2609</cvename>
<cvename>CVE-2017-2610</cvename>
<cvename>CVE-2017-2611</cvename>
<cvename>CVE-2017-2612</cvename>
<cvename>CVE-2017-2613</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01</url>
</references>
<dates>
<discovery>2017-02-01</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
<p>WordPress versions 4.7.1 and earlier are affected by three security
issues:</p>
<ul>
<li>The user interface for assigning taxonomy terms in Press This is
shown to users who do not have permissions to use it.</li>
<li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
unsafe data. WordPress core is not directly vulnerable to this
issue, but we’ve added hardening to prevent plugins and
themes from accidentally causing a vulnerability.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered in the
posts list table.</li>
<li>An unauthenticated privilege escalation vulnerability was
discovered in a REST API endpoint.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5610</cvename>
<cvename>CVE-2017-5611</cvename>
<cvename>CVE-2017-5612</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
<url>https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/</url>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-29</entry>
</dates>
</vuln>
<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
<topic>nfsen -- remote command execution</topic>
<affects>
<package>
<name>nfsen</name>
<range><lt>1.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Haag reports:</p>
<blockquote cite="https://sourceforge.net/p/nfsen/mailman/message/35623845/">
<p>A remote attacker with access to the web interface to
execute arbitrary commands on the host operating system.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/nfsen/mailman/message/35623845/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-27</entry>
</dates>
</vuln>
<vuln vid="4b9ca994-e3d9-11e6-813d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>56.0.2924.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html">
<p>51 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5007</cvename>
<cvename>CVE-2017-5006</cvename>
<cvename>CVE-2017-5008</cvename>
<cvename>CVE-2017-5010</cvename>
<cvename>CVE-2017-5011</cvename>
<cvename>CVE-2017-5009</cvename>
<cvename>CVE-2017-5012</cvename>
<cvename>CVE-2017-5013</cvename>
<cvename>CVE-2017-5014</cvename>
<cvename>CVE-2017-5015</cvename>
<cvename>CVE-2017-5019</cvename>
<cvename>CVE-2017-5016</cvename>
<cvename>CVE-2017-5017</cvename>
<cvename>CVE-2017-5018</cvename>
<cvename>CVE-2017-2020</cvename>
<cvename>CVE-2017-2021</cvename>
<cvename>CVE-2017-2022</cvename>
<cvename>CVE-2017-2023</cvename>
<cvename>CVE-2017-2024</cvename>
<cvename>CVE-2017-2025</cvename>
<cvename>CVE-2017-2026</cvename>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-01-26</entry>
</dates>
</vuln>
<vuln vid="d455708a-e3d3-11e6-9940-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2k,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0d</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_8</lt></range>
<range><ge>10.3</ge><lt>10.3_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170126.txt">
<ul>
<li>Truncated packet could crash via OOB read (CVE-2017-3731)</li>
<li>Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)</li>
<li>BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170126.txt</url>
<cvename>CVE-2016-7055</cvename>
<cvename>CVE-2017-3730</cvename>
<cvename>CVE-2017-3731</cvename>
<cvename>CVE-2017-3732</cvename>
<freebsdsa>SA-17:02.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-26</entry>
<modified>2017-05-26</modified>
</dates>
</vuln>
<vuln vid="e60169c4-aa86-46b0-8ae2-0d81f683df09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>51.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.48</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5373</cvename>
<cvename>CVE-2017-5374</cvename>
<cvename>CVE-2017-5375</cvename>
<cvename>CVE-2017-5376</cvename>
<cvename>CVE-2017-5377</cvename>
<cvename>CVE-2017-5378</cvename>
<cvename>CVE-2017-5379</cvename>
<cvename>CVE-2017-5380</cvename>
<cvename>CVE-2017-5381</cvename>
<cvename>CVE-2017-5382</cvename>
<cvename>CVE-2017-5383</cvename>
<cvename>CVE-2017-5384</cvename>
<cvename>CVE-2017-5385</cvename>
<cvename>CVE-2017-5386</cvename>
<cvename>CVE-2017-5387</cvename>
<cvename>CVE-2017-5388</cvename>
<cvename>CVE-2017-5389</cvename>
<cvename>CVE-2017-5390</cvename>
<cvename>CVE-2017-5391</cvename>
<cvename>CVE-2017-5392</cvename>
<cvename>CVE-2017-5393</cvename>
<cvename>CVE-2017-5394</cvename>
<cvename>CVE-2017-5395</cvename>
<cvename>CVE-2017-5396</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-02/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="7721562b-e20a-11e6-b2e2-6805ca0b3d42">
<topic>phpMyAdmin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-1/">
<p>Open redirect</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-2/">
<p>php-gettext code execution</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-3/">
<p>DOS vulnerability in table editing</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-4/">
<p>CSS injection in themes</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-5/">
<p>Cookie attribute injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-6/">
<p>SSRF in replication</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-7/">
<p>DOS in replication status</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-1</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-2</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-3</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-4</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-5</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-6</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-7</url>
<cvename>CVE-2015-8980</cvename>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="a4b7def1-e165-11e6-9d84-90e2ba9881c8">
<topic>Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability</topic>
<affects>
<package>
<name>intel-nvmupdate</name>
<range><lt>5.05</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel Corporation reports:</p>
<blockquote cite="https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr">
<p>A security vulnerability in the Intel(R) Ethernet Controller X710
and Intel(R) Ethernet Controller XL710 family of products
(Fortville) has been found in the Non-Volatile Flash Memory (NVM)
image.</p>
</blockquote>
</body>
</description>
<references>
<url>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr</url>
<cvename>CVE-2016-8106</cvename>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-23</entry>
</dates>
</vuln>
<vuln vid="709e025a-de8b-11e6-a9a5-b499baebfeaf">
<topic>PHP -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-2">
<p>The PHP development team announces the immediate availability of
PHP 7.0.15. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-3">
<p>The PHP development team announces the immediate availability of
PHP 5.6.30. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-01-19-2</url>
<url>http://php.net/archive/2017.php#id2017-01-19-3</url>
</references>
<dates>
<discovery>2017-01-19</discovery>
<entry>2017-01-19</entry>
<modified>2017-01-20</modified>
</dates>
</vuln>
<vuln vid="57facd35-ddf6-11e6-915d-001b3856973b">
<topic>icoutils -- check_offset overflow on 64-bit systems</topic>
<affects>
<package>
<name>icoutils</name>
<range><lt>0.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Choongwoo Han reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/38">
<p>An exploitable crash exists in the wrestool utility on 64-bit systems
where the result of subtracting two pointers exceeds the size of int.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5208</cvename>
<cvename>CVE-2017-5331</cvename>
<cvename>CVE-2017-5332</cvename>
<cvename>CVE-2017-5333</cvename>
<url>http://seclists.org/oss-sec/2017/q1/38</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-19</entry>
</dates>
</vuln>
<vuln vid="4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.35</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">
<p>No further details have been provided in the Critical Patch Update</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</url>
<cvename>CVE-2016-8318</cvename>
<cvename>CVE-2017-3312</cvename>
<cvename>CVE-2017-3258</cvename>
<cvename>CVE-2017-3273</cvename>
<cvename>CVE-2017-3244</cvename>
<cvename>CVE-2017-3257</cvename>
<cvename>CVE-2017-3238</cvename>
<cvename>CVE-2017-3256</cvename>
<cvename>CVE-2017-3291</cvename>
<cvename>CVE-2017-3265</cvename>
<cvename>CVE-2017-3251</cvename>
<cvename>CVE-2017-3313</cvename>
<cvename>CVE-2017-3243</cvename>
<cvename>CVE-2016-8327</cvename>
<cvename>CVE-2017-3317</cvename>
<cvename>CVE-2017-3318</cvename>
<cvename>CVE-2017-3319</cvename>
<cvename>CVE-2017-3320</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2017-01-18</entry>
<modified>2017-03-14</modified>
</dates>
</vuln>
<vuln vid="e3200958-dd6c-11e6-ae1b-002590263bf5">
<topic>powerdns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.11</lt></range>
<range><ge>4.0.0</ge><lt>4.0.2</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.4</lt></range>
<range><ge>4.0.0</ge><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/">
<p>2016-02: Crafted queries can cause abnormal CPU usage</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/">
<p>2016-03: Denial of service via the web server</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/">
<p>2016-04: Insufficient validation of TSIG signatures</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/">
<p>2016-05: Crafted zone record can cause a denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7068</cvename>
<cvename>CVE-2016-7072</cvename>
<cvename>CVE-2016-7073</cvename>
<cvename>CVE-2016-7074</cvename>
<cvename>CVE-2016-2120</cvename>
<freebsdpr>ports/216135</freebsdpr>
<freebsdpr>ports/216136</freebsdpr>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/</url>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2017-01-18</entry>
</dates>
</vuln>
<vuln vid="4af92a40-db33-11e6-ae1b-002590263bf5">
<topic>groovy -- remote execution of untrusted code/DoS vulnerability</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Groovy project reports:</p>
<blockquote cite="http://groovy-lang.org/security.html">
<p>When an application with Groovy on classpath uses standard Java
serialization mechanisms, e.g. to communicate between servers or to
store local data, it is possible for an attacker to bake a special
serialized object that will execute code directly when deserialized.
All applications which rely on serialization and do not isolate the
code which deserializes objects are subject to this vulnerability.
This is similar to CVE-2015-3253 but this exploit involves extra
wrapping of objects and catching of exceptions which are now safe
guarded against.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6814</cvename>
<url>http://groovy-lang.org/security.html</url>
</references>
<dates>
<discovery>2016-09-20</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="6aa956fb-d97f-11e6-a071-001e67f15f5a">
<topic>RabbitMQ -- Authentication vulnerability</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><ge>3.0.0</ge><lt>3.5.8</lt></range>
<range><ge>3.6.0</ge><lt>3.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotal.io reports:</p>
<blockquote cite="https://pivotal.io/security/cve-2016-9877">
<p>MQTT (MQ Telemetry Transport) connection authentication with a
username/password pair succeeds if an existing username is
provided but the password is omitted from the connection
request. Connections that use TLS with a client-provided
certificate are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9877</cvename>
<url>https://pivotal.io/security/cve-2016-9877</url>
<url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="b180d1fb-dac6-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/">
<p>WordPress versions 4.7 and earlier are affected by eight security
issues...</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5487</cvename>
<cvename>CVE-2017-5488</cvename>
<cvename>CVE-2017-5489</cvename>
<cvename>CVE-2017-5490</cvename>
<cvename>CVE-2017-5491</cvename>
<cvename>CVE-2017-5492</cvename>
<cvename>CVE-2017-5493</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/14/6</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html">
<p>Local security vulnerability in 'Server: Packaging' sub component.</p>
</blockquote>
</body>
</description>
<references>
<bid>93617</bid>
<cvename>CVE-2016-5625</cvename>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html</url>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2017-01-14</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-client</name>
<name>mariadb55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<name>mariadb100-server</name>
<range><lt>10.0.28</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<name>mariadb101-server</name>
<range><lt>10.1.18</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-client</name>
<name>percona55-server</name>
<range><lt>5.5.51.38.2</lt></range>
</package>
<package>
<name>percona56-client</name>
<name>percona56-server</name>
<range><lt>5.6.32.78.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MySQL project reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
<ul>
<li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
sub component.</li>
<li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
certain permissions to gain privileges by leveraging use of my_copystat
by REPAIR TABLE to repair a MyISAM table.</li>
<li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
logging, allows local users with access to the mysql account to gain
root privileges via a symlink attack on error logs and possibly other
files.</li>
<li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
component.</li>
<li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
component.</li>
<li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
sub component.</li>
<li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
component.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
<cvename>CVE-2016-3492</cvename>
<cvename>CVE-2016-5616</cvename>
<cvename>CVE-2016-5617</cvename>
<cvename>CVE-2016-5624</cvename>
<cvename>CVE-2016-5626</cvename>
<cvename>CVE-2016-5629</cvename>
<cvename>CVE-2016-6663</cvename>
<cvename>CVE-2016-6664</cvename>
<cvename>CVE-2016-8283</cvename>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2017-01-14</entry>
</dates>
</vuln>
<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
<topic>Ansible -- Command execution on Ansible controller from host</topic>
<affects>
<package>
<name>ansible</name>
<range><gt>1.9.6_1</gt><lt>2.2.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Computest reports:</p>
<blockquote cite="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
<p>Computest found and exploited several issues
that allow a compromised host to execute commands
on the Ansible controller and thus gain access
to other hosts controlled by that controller.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9587</cvename>
<url>https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt</url>
<url>https://lwn.net/Articles/711357/</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.22</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>2017.01.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/95328/discuss">
<p>PHPMailer is prone to an local information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information
that may aid in launching further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/95328/discuss</url>
<cvename>CVE-2017-5223</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="d4c7e9a9-d893-11e6-9b4d-d050996490d0">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P5</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P5</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.12.28</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01439/0">
<p>A malformed query response received by a recursive
server in response to a query of RTYPE ANY could
trigger an assertion failure while named is attempting
to add the RRs in the query response to the cache.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01440/0">
<p>Depending on the type of query and the EDNS options
in the query they receive, DNSSEC-enabled authoritative
servers are expected to include RRSIG and other RRsets
in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries
for DS and other RRsets.
Whether DNSSEC-validating or not, an error in processing
malformed query responses that contain DNSSEC-related
RRsets that are inconsistent with other RRsets in the
same query response can trigger an assertion failure.
Although the combination of properties which triggers
the assertion should not occur in normal traffic, it
is potentially possible for the assertion to be triggered
deliberately by an attacker sending a specially-constructed
answer.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01441/0">
<p>An unusually-formed answer containing a DS resource
record could trigger an assertion failure. While the
combination of properties which triggers the assertion
should not occur in normal traffic, it is potentially
possible for the assertion to be triggered deliberately
by an attacker sending a specially-constructed answer
having the required properties.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01442/0">
<p>An error in handling certain queries can cause an
assertion failure when a server is using the
nxdomain-redirect feature to cover a zone for which
it is also providing authoritative service.
A vulnerable server could be intentionally stopped
by an attacker if it was using a configuration that
met the criteria for the vulnerability and if the
attacker could cause it to accept a query that
possessed the required attributes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9131</cvename>
<cvename>CVE-2016-9147</cvename>
<cvename>CVE-2016-9444</cvename>
<cvename>CVE-2016-9778</cvename>
<url>https://kb.isc.org/article/AA-01439/0</url>
<url>https://kb.isc.org/article/AA-01440/0</url>
<url>https://kb.isc.org/article/AA-01441/0</url>
<url>https://kb.isc.org/article/AA-01442/0</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="2c948527-d823-11e6-9171-14dae9d210b8">
<topic>FreeBSD -- OpenSSH multiple vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_7</lt></range>
<range><ge>10.3</ge><lt>10.3_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ssh-agent(1) agent supports loading a PKCS#11 module
from outside a trusted whitelist. An attacker can request
loading of a PKCS#11 module across forwarded agent-socket.
[CVE-2016-10009]</p>
<p>When privilege separation is disabled, forwarded Unix
domain sockets would be created by sshd(8) with the privileges
of 'root' instead of the authenticated user. [CVE-2016-10010]</p>
<h1>Impact:</h1>
<p>A remote attacker who have control of a forwarded
agent-socket on a remote system and have the ability to
write files on the system running ssh-agent(1) agent can
run arbitrary code under the same user credential. Because
the attacker must already have some control on both systems,
it is relatively hard to exploit this vulnerability in a
practical attack. [CVE-2016-10009]</p>
<p>When privilege separation is disabled (on FreeBSD,
privilege separation is enabled by default and has to be
explicitly disabled), an authenticated attacker can potentially
gain root privileges on systems running OpenSSH server.
[CVE-2016-10010]</p>
</body>
</description>
<references>
<cvename>CVE-2016-10009</cvename>
<cvename>CVE-2016-10010</cvename>
<freebsdsa>SA-17:01.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-13</modified>
</dates>
</vuln>
<vuln vid="7caebe30-d7f1-11e6-a9a5-b499baebfeaf">
<topic>openssl -- timing attack vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.4_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.5.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cesar Pereida Garcia reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/52">
<p>The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
versions and forks is vulnerable to timing attacks when signing with the
standardized elliptic curve P-256 despite featuring constant-time curve
operations and modular inversion. A software defect omits setting the
BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
the BN_mod_inverse method and therefore resulting in a cache-timing attack
vulnerability.<br/>
A malicious user with local access can recover ECDSA P-256 private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q1/52</url>
<cvename>CVE-2016-7056</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-11</modified>
</dates>
</vuln>
<vuln vid="2a7bdc56-d7a3-11e6-ae1b-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>24.0.0.194</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html">
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2017-2938).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2017-2932, CVE-2017-2936,
CVE-2017-2937).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2017-2927, CVE-2017-2933,
CVE-2017-2934, CVE-2017-2935).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928,
CVE-2017-2930, CVE-2017-2931).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2925</cvename>
<cvename>CVE-2017-2926</cvename>
<cvename>CVE-2017-2927</cvename>
<cvename>CVE-2017-2928</cvename>
<cvename>CVE-2017-2930</cvename>
<cvename>CVE-2017-2931</cvename>
<cvename>CVE-2017-2932</cvename>
<cvename>CVE-2017-2933</cvename>
<cvename>CVE-2017-2934</cvename>
<cvename>CVE-2017-2935</cvename>
<cvename>CVE-2017-2936</cvename>
<cvename>CVE-2017-2937</cvename>
<cvename>CVE-2017-2938</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-02.html</url>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
</dates>
</vuln>
<vuln vid="ab804e60-d693-11e6-9171-14dae9d210b8">
<topic>moinmoin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Waldmann reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES">
<ul>
<li><p>fix XSS in AttachFile view (multifile related) CVE-2016-7148</p></li>
<li><p>fix XSS in GUI editor's attachment dialogue CVE-2016-7146</p></li>
<li><p>fix XSS in GUI editor's link dialogue CVE-2016-9119</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES</url>
<cvename>CVE-2016-7148</cvename>
<cvename>CVE-2016-7146</cvename>
<cvename>CVE-2016-9119</cvename>
<freebsdpr>ports/214937</freebsdpr>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="64be967a-d379-11e6-a071-001e67f15f5a">
<topic>libvncserver -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvnc server reports:</p>
<blockquote cite="https://github.com/LibVNC/libvncserver/pull/137">
<p>Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibVNC/libvncserver/pull/137</url>
<cvename>CVE-2016-9941</cvename>
<cvename>CVE-2016-9942</cvename>
<freebsdpr>ports/215805</freebsdpr>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="83041ca7-d690-11e6-9171-14dae9d210b8">
<topic>libdwarf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libdwarf</name>
<range><lt>20161124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Christian Rebischke reports:</p>
<blockquote cite="https://lwn.net/Articles/708092/">
<p>libdwarf is vulnerable to multiple issues including
arbitrary code execution, information disclosure and denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lwn.net/Articles/708092/</url>
<cvename>CVE-2016-5027</cvename>
<cvename>CVE-2016-5028</cvename>
<cvename>CVE-2016-5029</cvename>
<cvename>CVE-2016-5030</cvename>
<cvename>CVE-2016-5031</cvename>
<cvename>CVE-2016-5032</cvename>
<cvename>CVE-2016-5033</cvename>
<cvename>CVE-2016-5035</cvename>
<cvename>CVE-2016-5037</cvename>
<cvename>CVE-2016-5040</cvename>
<cvename>CVE-2016-5041</cvename>
<cvename>CVE-2016-5043</cvename>
<cvename>CVE-2016-5044</cvename>
<cvename>CVE-2016-7510</cvename>
<cvename>CVE-2016-7511</cvename>
<cvename>CVE-2016-8679</cvename>
<cvename>CVE-2016-8680</cvename>
<cvename>CVE-2016-8681</cvename>
<cvename>CVE-2016-9275</cvename>
<cvename>CVE-2016-9276</cvename>
<cvename>CVE-2016-9480</cvename>
<cvename>CVE-2016-9558</cvename>
</references>
<dates>
<discovery>2016-12-04</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="03532a19-d68e-11e6-9171-14dae9d210b8">
<topic>lynx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lynx</name>
<range><lt>2.8.8.2_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote>
<p>Lynx is vulnerable to POODLE by still supporting vulnerable
version of SSL. Lynx is also vulnerable to URL attacks by incorrectly
parsing hostnames ending with an '?'.</p>
</blockquote>
</body>
</description>
<references>
<url>https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch</url>
<url>https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch</url>
<cvename>CVE-2014-3566</cvename>
<cvename>CVE-2016-9179</cvename>
<freebsdpr>ports/215464</freebsdpr>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="91e039ed-d689-11e6-9171-14dae9d210b8">
<topic>hdf5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hdf5</name>
<range><lt>1.10.0</lt></range>
</package>
<package>
<name>hdf5-18</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos Security reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/11/hdf5-vulns.html">
<ul>
<li><p>CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/11/hdf5-vulns.html</url>
<cvename>CVE-2016-4330</cvename>
<cvename>CVE-2016-4331</cvename>
<cvename>CVE-2016-4332</cvename>
<cvename>CVE-2016-4333</cvename>
</references>
<dates>
<discovery>2016-11-17</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e1ff4c5e-d687-11e6-9171-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>py27-django16</name>
<name>py33-django16</name>
<name>py34-django16</name>
<name>py35-django16</name>
<range><ge>0</ge></range>
</package>
<package>
<name>drupal6</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2017-01-06</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="c218873d-d444-11e6-84ef-f0def167eeea">
<topic>Use-After-Free Vulnerability in pcsc-lite</topic>
<affects>
<package>
<name>pcsc-lite</name>
<range><ge>1.6.0</ge><lt>1.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu on Openwall mailing-list reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/03/2">
<p>The issue allows a local attacker to cause a Denial of Service,
but can potentially result in Privilege Escalation since
the daemon is running as root. while any local user can
connect to the Unix socket.
Fixed by patch which is released with hpcsc-lite 1.8.20.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10109</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/03/2</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-06</entry>
<modified>2017-01-10</modified>
</dates>
</vuln>
<vuln vid="0c5369fc-d671-11e6-a9a5-b499baebfeaf">
<topic>GnuTLS -- Memory corruption vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="http://www.gnutls.org/news.html#2017-01-09">
<ul>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted OpenPGP certificate could lead
to heap and stack overflows. (GNUTLS-SA-2017-2)</li>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted X.509 certificate with Proxy
Certificate Information extension present could lead to a
double free. (GNUTLS-SA-2017-1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/news.html#2017-01-09</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-2</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-1</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- information disclosure vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.49</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.74</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
<p>Important: Information Disclosure CVE-2016-8745</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8745</cvename>
<freebsdpr>ports/215865</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
</references>
<dates>
<discovery>2017-01-05</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.48</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.73</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
<p>Important: Remote Code Execution CVE-2016-8735</p>
<p>Important: Information Disclosure CVE-2016-6816</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8735</cvename>
<cvename>CVE-2016-6816</cvename>
<freebsdpr>ports/214599</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.47</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.72</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
<p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p>
<p>Low: Security Manager Bypass CVE-2016-6796</p>
<p>Low: System Property Disclosure CVE-2016-6794</p>
<p>Low: Security Manager Bypass CVE-2016-5018</p>
<p>Low: Timing Attack CVE-2016-0762</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6797</cvename>
<cvename>CVE-2016-6796</cvename>
<cvename>CVE-2016-6794</cvename>
<cvename>CVE-2016-5018</cvename>
<cvename>CVE-2016-0762</cvename>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
<topic>Irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>0.8.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_01.txt">
<p>Five vulnerabilities have been located in Irssi</p>
<ul>
<li>A NULL pointer dereference in the nickcmp function found by
Joseph Bisch. (CWE-690)</li>
<li>Use after free when receiving invalid nick message (Issue #466,
CWE-146)</li>
<li>Out of bounds read in certain incomplete control codes found
by Joseph Bisch. (CWE-126)</li>
<li>Out of bounds read in certain incomplete character sequences
found by Hanno Böck and independently by J. Bisch. (CWE-126)</li>
<li>Out of bounds read when Printing the value '%['. Found by
Hanno Böck. (CWE-126)</li>
</ul>
<p>These issues may result in denial of service (remote crash).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5193</cvename>
<cvename>CVE-2017-5194</cvename>
<cvename>CVE-2017-5195</cvename>
<cvename>CVE-2017-5196</cvename>
<cvename>CVE-2017-5356</cvename>
<freebsdpr>ports/215800</freebsdpr>
<url>https://irssi.org/security/irssi_sa_2017_01.txt</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-05</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="496160d3-d3be-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a number of new vulnerabilities in Security Library method
xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="5e439ee7-d3bd-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an SQL injection in the ‘odbc’ database driver.</p>
<p>Updated set_realpath() Path Helper function to filter-out php://
wrapper inputs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="eafa3aec-211b-4dd4-9b8a-a664a3f0917a">
<topic>w3m -- multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20170102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple remote code execution and denial of service conditions present.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/452</url>
<url>http://seclists.org/oss-sec/2016/q4/516</url>
<cvename>CVE-2016-9422</cvename>
<cvename>CVE-2016-9423</cvename>
<cvename>CVE-2016-9424</cvename>
<cvename>CVE-2016-9425</cvename>
<cvename>CVE-2016-9426</cvename>
<cvename>CVE-2016-9428</cvename>
<cvename>CVE-2016-9429</cvename>
<cvename>CVE-2016-9430</cvename>
<cvename>CVE-2016-9431</cvename>
<cvename>CVE-2016-9432</cvename>
<cvename>CVE-2016-9433</cvename>
<cvename>CVE-2016-9434</cvename>
<cvename>CVE-2016-9435</cvename>
<cvename>CVE-2016-9436</cvename>
<cvename>CVE-2016-9437</cvename>
<cvename>CVE-2016-9438</cvename>
<cvename>CVE-2016-9439</cvename>
<cvename>CVE-2016-9440</cvename>
<cvename>CVE-2016-9441</cvename>
<cvename>CVE-2016-9442</cvename>
<cvename>CVE-2016-9443</cvename>
<cvename>CVE-2016-9622</cvename>
<cvename>CVE-2016-9623</cvename>
<cvename>CVE-2016-9624</cvename>
<cvename>CVE-2016-9625</cvename>
<cvename>CVE-2016-9626</cvename>
<cvename>CVE-2016-9627</cvename>
<cvename>CVE-2016-9628</cvename>
<cvename>CVE-2016-9629</cvename>
<cvename>CVE-2016-9630</cvename>
<cvename>CVE-2016-9631</cvename>
<cvename>CVE-2016-9632</cvename>
<cvename>CVE-2016-9633</cvename>
</references>
<dates>
<discovery>2016-11-03</discovery>
<entry>2017-01-01</entry>
<modified>2017-01-09</modified>
</dates>
</vuln>
<vuln vid="d0b12952-cb86-11e6-906f-0cc47a065786">
<topic>h2o -- Use-after-free vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.0.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazuho Oku reports:</p>
<blockquote cite="https://github.com/h2o/h2o/issues?q=label%3Avulnerability">
<p>A use-after-free vulnerability exists in H2O up to and including
version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
mount DoS attacks and / or information theft.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/releases/tag/v2.0.5</url>
<url>https://github.com/h2o/h2o/issues/1144</url>
</references>
<dates>
<discovery>2016-09-09</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="1b61ecef-cdb9-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point reports:</p>
<blockquote cite="http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/">
<p>... discovered 3 fresh and previously unknown vulnerabilities
(CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7
unserialize mechanism.</p>
<p>The first two vulnerabilities allow attackers to take full control
over servers, allowing them to do anything they want with the
website, from spreading malware to defacing it or stealing customer
data.</p>
<p>The last vulnerability generates a Denial of Service attack which
basically hangs the website, exhausts its memory consumption, and
shuts it down.</p>
<p>The PHP security team issued fixes for two of the vulnerabilities
on the 13th of October and 1st of December.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/</url>
<cvename>CVE-2016-7478</cvename>
<cvename>CVE-2016-7479</cvename>
<cvename>CVE-2016-7480</cvename>
</references>
<dates>
<discovery>2016-12-27</discovery>
<entry>2016-12-29</entry>
<modified>2017-01-04</modified>
</dates>
</vuln>
<vuln vid="6972668d-cdb7-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.14">
<ul>
<li>Use After Free Vulnerability in unserialize() (CVE-2016-9936)</li>
<li>Invalid read when wddx decodes empty boolean element
(CVE-2016-9935)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.14</url>
<cvename>CVE-2016-9935</cvename>
<cvename>CVE-2016-9936</cvename>
</references>
<dates>
<discovery>2016-12-08</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="3c4693de-ccf7-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.20</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>29.12.2016.04.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
<p>The first patch of the vulnerability CVE-2016-10033 was incomplete.
This advisory demonstrates the bypass of the patch. The bypass allows
to carry out Remote Code Execution on all current versions (including
5.2.19).</p>
</blockquote>
</body>
</description>
<references>
<url>https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html</url>
<cvename>CVE-2016-10045</cvename>
</references>
<dates>
<discovery>2016-12-28</discovery>
<entry>2016-12-28</entry>
</dates>
</vuln>
<vuln vid="e4bc323f-cc73-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.13</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.8</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.5.3">
<p>[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes
on DNS objects and trigger a controlled memory corruption.</p>
<p>[CVE-2016-2125] Samba client code always requests a forwardable ticket
when using Kerberos authentication. This means the target server, which must be in the current or trusted
domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to
fully impersonate the authenticated user or service.</p>
<p>[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process
to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum.
A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2123</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2123.html</url>
<cvename>CVE-2016-2125</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2125.html</url>
<cvename>CVE-2016-2126</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2126.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-26</entry>
<modified>2016-12-26</modified>
</dates>
</vuln>
<vuln vid="244c8288-cc4a-11e6-a475-bcaec524bf84">
<topic>upnp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthew Garett reports:</p>
<blockquote cite="https://twitter.com/mjg59/status/755062278513319936">
<p>Reported this to upstream 8 months ago without response,
so: libupnp's default behaviour allows anyone to write to your
filesystem. Seriously. Find a device running a libupnp based server
(Shodan says there's rather a lot), and POST a file to /testfile.
Then GET /testfile ... and yeah if the server is running as root
(it is) and is using / as the web root (probably not, but maybe)
this gives full host fs access.</p>
</blockquote>
<p>Scott Tenaglia reports:</p>
<blockquote cite="https://sourceforge.net/p/pupnp/bugs/133/">
<p>There is a heap buffer overflow vulnerability in the
create_url_list function in upnp/src/gena/gena_device.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://twitter.com/mjg59/status/755062278513319936</url>
<url>https://sourceforge.net/p/pupnp/bugs/133/</url>
<cvename>CVE-2016-6255</cvename>
<cvename>CVE-2016-8863</cvename>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-12-27</entry>
</dates>
</vuln>
<vuln vid="c7656d4c-cb60-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.18</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>26.12.2016.07.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html</url>
<url>https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md</url>
<cvename>CVE-2016-10033</cvename>
</references>
<dates>
<discovery>2016-12-26</discovery>
<entry>2016-12-26</entry>
</dates>
</vuln>
<vuln vid="e7002b26-caaa-11e6-a76a-9f7324e5534e">
<topic>exim -- DKIM private key leak</topic>
<affects>
<package>
<name>exim</name>
<range><gt>4.69</gt><lt>4.87.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim project reports:</p>
<blockquote cite="https://exim.org/static/doc/CVE-2016-9963.txt">
<p>Exim leaks the private DKIM signing key to the log files.
Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used,
the key material is included in the bounce message.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/CVE-2016-9963.txt</url>
<cvename>CVE-2016-9963</cvename>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2016-12-25</entry>
</dates>
</vuln>
<vuln vid="2aedd15f-ca8b-11e6-a9a5-b499baebfeaf">
<cancelled superseded="2c948527-d823-11e6-9171-14dae9d210b8"/>
</vuln>
<vuln vid="c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4">
<topic>cURL -- uninitialized random vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.52.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Project curl Security Advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20161223.html">
<p>libcurl's (new) internal function that returns a good 32bit
random value was implemented poorly and overwrote the pointer
instead of writing the value into the buffer the pointer
pointed to.</p>
<p>This random value is used to generate nonces for Digest and
NTLM authentication, for generating boundary strings in HTTP
formposts and more. Having a weak or virtually non-existent
random there makes these operations vulnerable.</p>
<p>This function is brand new in 7.52.0 and is the result of an
overhaul to make sure libcurl uses strong random as much as
possible - provided by the backend TLS crypto libraries when
present. The faulty function was introduced in this commit.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20161223.html</url>
<cvename>CVE-2016-9594</cvename>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2016-12-24</entry>
</dates>
</vuln>
<vuln vid="41f8af15-c8b9-11e6-ae1b-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.1</ge><lt>3.5.23</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0</ge><lt>4.0.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:10 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_10.txt">
<p>Due to incorrect comparison of request headers Squid can deliver
responses containing private data to clients it should not have
reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources. This problem only affects Squid configured
to use the Collapsed Forwarding feature. It is of particular
importance for HTTPS reverse-proxy sites with Collapsed
Forwarding.</p>
</blockquote>
<p>Squid security advisory 2016:11 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_11.txt">
<p>Due to incorrect HTTP conditional request handling Squid can
deliver responses containing private data to clients it should not
have reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10002</cvename>
<cvename>CVE-2016-10003</cvename>
<freebsdpr>ports/215416</freebsdpr>
<freebsdpr>ports/215418</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_10.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_11.txt</url>
</references>
<dates>
<discovery>2016-12-16</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c11629d3-c8ad-11e6-ae1b-002590263bf5">
<topic>vim -- arbitrary command execution</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<range><lt>8.0.0056</lt></range>
</package>
<package>
<name>neovim</name>
<range><lt>0.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248">
<p>vim before patch 8.0.0056 does not properly validate values for the
'filetype', 'syntax' and 'keymap' options, which may result in the
execution of arbitrary code if a file with a specially crafted
modeline is opened.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1248</cvename>
<bid>94478</bid>
<url>https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a</url>
<url>https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c290f093-c89e-11e6-821e-68f7288bdf41">
<topic>Pligg CMS -- XSS Vulnerability</topic>
<affects>
<package>
<name>pligg</name>
<range><le>2.0.2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netsparker reports: </p>
<blockquote cite="https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/">
<p>Proof of Concept URL for XSS in Pligg CMS:</p>
<p>Page: groups.php</p>
<p>Parameter Name: keyword</p>
<p>Parameter Type: GET</p>
<p>Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'</p>
<p>For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/</url>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="fcedcdbb-c86e-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_6</lt></range>
<range><ge>10.3</ge><lt>10.3_15</lt></range>
<range><ge>10.2</ge><lt>10.2_28</lt></range>
<range><ge>10.1</ge><lt>10.1_45</lt></range>
<range><ge>9.3</ge><lt>9.3_53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-9310: Mode 6 unauthenticated trap information
disclosure and DDoS vector. Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-7427: Broadcast Mode Replay Prevention DoS.
Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7428: Broadcast Mode Poll Interval Enforcement
DoS. Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7431: Regression: 010-origin: Zero Origin
Timestamp Bypass. Reported by Sharon Goldberg and Aanchal
Malhotra of Boston University.</p>
<p>CVE-2016-7434: Null pointer dereference in
_IO_str_init_static_internal(). Reported by Magnus Stubman.</p>
<p>CVE-2016-7426: Client rate limiting and server responses.
Reported by Miroslav Lichvar of Red Hat.</p>
<p>CVE-2016-7433: Reboot sync calculation problem. Reported
independently by Brian Utterback of Oracle, and by Sharon
Goldberg and Aanchal Malhotra of Boston University.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a specially crafted packet
to cause a NULL pointer dereference that will crash ntpd,
resulting in a Denial of Service. [CVE-2016-9311]</p>
<p>An exploitable configuration modification vulnerability
exists in the control mode (mode 6) functionality of ntpd.
If, against long-standing BCP recommendations, "restrict
default noquery ..." is not specified, a specially crafted
control mode packet can set ntpd traps, providing information
disclosure and DDoS amplification, and unset ntpd traps,
disabling legitimate monitoring by an attacker from remote.
[CVE-2016-9310]</p>
<p>An attacker with access to the NTP broadcast domain can
periodically inject specially crafted broadcast mode NTP
packets into the broadcast domain which, while being logged
by ntpd, can cause ntpd to reject broadcast mode packets
from legitimate NTP broadcast servers. [CVE-2016-7427]</p>
<p>An attacker with access to the NTP broadcast domain can
send specially crafted broadcast mode NTP packets to the
broadcast domain which, while being logged by ntpd, will
cause ntpd to reject broadcast mode packets from legitimate
NTP broadcast servers. [CVE-2016-7428]</p>
<p>Origin timestamp problems were fixed in ntp 4.2.8p6.
However, subsequent timestamp validation checks introduced
a regression in the handling of some Zero origin timestamp
checks. [CVE-2016-7431]</p>
<p>If ntpd is configured to allow mrulist query requests
from a server that sends a crafted malicious packet, ntpd
will crash on receipt of that crafted malicious mrulist
query packet. [CVE-2016-7434]</p>
<p>An attacker who knows the sources (e.g., from an IPv4
refid in server response) and knows the system is (mis)configured
in this way can periodically send packets with spoofed
source address to keep the rate limiting activated and
prevent ntpd from accepting valid responses from its sources.
[CVE-2016-7426]</p>
<p>Ntp Bug 2085 described a condition where the root delay
was included twice, causing the jitter value to be higher
than expected. Due to a misinterpretation of a small-print
variable in The Book, the fix for this problem was incorrect,
resulting in a root distance that did not include the peer
dispersion. The calculations and formulas have been reviewed
and reconciled, and the code has been updated accordingly.
[CVE-2016-7433]</p>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<freebsdsa>SA-16:39.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-12-22</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="42880202-c81c-11e6-a9a5-b499baebfeaf">
<topic>cURL -- buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/vuln-7.51.0.html">
<h2>printf floating point buffer overflow</h2>
<p>libcurl's implementation of the printf() functions triggers a
buffer overflow when doing a large floating point output. The bug
occurs when the conversion outputs more than 255 bytes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/vuln-7.51.0.html</url>
<cvename>CVE-2016-9586</cvename>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="624b45c0-c7f3-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html">
<h2>[20161201] - Core - Elevated Privileges</h2>
<p>Incorrect use of unfiltered data stored to the session on a form
validation failure allows for existing user accounts to be modified;
to include resetting their username, password, and user group
assignments.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html">
<h2>[20161202] - Core - Shell Upload</h2>
<p>Inadequate filesystem checks allowed files with alternative PHP
file extensions to be uploaded.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html">
<h2>[20161203] - Core - Information Disclosure</h2>
<p>Inadequate ACL checks in the Beez3 com_content article layout
override enables a user to view restricted content.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9836</cvename>
<cvename>CVE-2016-9837</cvename>
<cvename>CVE-2016-9838</cvename>
<url>https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html</url>
<url>https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html</url>
<url>https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="a27d234a-c7f2-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.4</ge><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html">
<h2>[20161001] - Core - Account Creation</h2>
<p>Inadequate checks allows for users to register on a site when
registration has been disabled.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html">
<h2>[20161002] - Core - Elevated Privilege</h2>
<p>Incorrect use of unfiltered data allows for users to register on a
site with elevated privileges.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html">
<h2>[20161003] - Core - Account Modifications</h2>
<p>Incorrect use of unfiltered data allows for existing user accounts
to be modified; to include resetting their username, password, and
user group assignments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8869</cvename>
<cvename>CVE-2016-8870</cvename>
<cvename>CVE-2016-9081</cvename>
<url>https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html</url>
<url>https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html</url>
<url>https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html</url>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="f0806cad-c7f1-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html">
<h2>[20160801] - Core - ACL Violation</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted to users with edit_own
level.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html">
<h2>[20160802] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in mail component.
</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/654-20160803-core-csrf.html">
<h2>[20160803] - Core - CSRF</h2>
<p>Add additional CSRF hardening in com_joomlaupdate.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html</url>
<url>https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/654-20160803-core-csrf.html</url>
<url>https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="c0ef061a-c7f0-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.5.0</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html">
<h2>[20151206] - Core - Session Hardening</h2>
<p>The Joomla Security Strike team has been following up on the
critical security vulnerability patched last week. Since the recent
update it has become clear that the root cause is a bug in PHP
itself. This was fixed by PHP in September of 2015 with the releases
of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all
versions of PHP 7 and has been back-ported in some specific Linux
LTS versions of PHP 5.3). This fixes the bug across all supported
PHP versions.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html">
<h2>[20151207] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html</url>
<url>https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html</url>
<url>https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="3ae078ca-c7eb-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 PV guests may be able to mask interrupts</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-202.html">
<p>Certain PV guest kernel operations (page table writes in
particular) need emulation, and use Xen's general x86 instruction
emulator. This allows a malicious guest kernel which asynchronously
modifies its instruction stream to effect the clearing of EFLAGS.IF
from the state used to return to guest context.</p>
<p>A malicious guest kernel administrator can cause a host hang or
crash, resulting in a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10024</cvename>
<url>https://xenbits.xen.org/xsa/advisory-202.html</url>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2016-8743</cvename>
<cvename>CVE-2016-2161</cvename>
<cvename>CVE-2016-0736</cvename>
<cvename>CVE-2016-8740</cvename>
<cvename>CVE-2016-5387</cvename>
</references>
<dates>
<discovery>2016-12-20</discovery>
<entry>2016-12-21</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-204.html">
<p>The typical behaviour of singlestepping exceptions is determined at
the start of the instruction, with a #DB trap being raised at the
end of the instruction. SYSCALL (and SYSRET, although we don't
implement it) behave differently because the typical behaviour
allows userspace to escalate its privilege. (This difference in
behaviour seems to be undocumented.) Xen wrongly raised the
exception based on the flags at the start of the instruction.</p>
<p>Guest userspace which can invoke the instruction emulator can use
this flaw to escalate its privilege to that of the guest kernel.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10013</cvename>
<url>http://xenbits.xen.org/xsa/advisory-204.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-20</entry>
</dates>
</vuln>
<vuln vid="e47ab5db-c333-11e6-ae1b-002590263bf5">
<topic>atheme-services -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atheme-services</name>
<range><lt>7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9773">
<p>modules/chanserv/flags.c in Atheme before 7.2.7 allows remote
attackers to modify the Anope FLAGS behavior by registering and
dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4478">
<p>Buffer overflow in the xmlrpc_char_encode function in
modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows
remote attackers to cause a denial of service via vectors related
to XMLRPC response encoding.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/209217</freebsdpr>
<cvename>CVE-2014-9773</cvename>
<cvename>CVE-2016-4478</cvename>
<url>https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e</url>
<url>https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b</url>
</references>
<dates>
<discovery>2016-01-09</discovery>
<entry>2016-12-16</entry>
</dates>
</vuln>
<vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.1.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
<p>CVE-2016-9894: Buffer overflow in SkiaGL</p>
<p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p>
<p>CVE-2016-9895: CSP bypass using marquee tag</p>
<p>CVE-2016-9896: Use-after-free with WebVR</p>
<p>CVE-2016-9897: Memory corruption in libGLES</p>
<p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p>
<p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p>
<p>CVE-2016-9904: Cross-origin information leak in shared atoms</p>
<p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p>
<p>CVE-2016-9902: Pocket extension does not validate the origin of events</p>
<p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p>
<p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p>
<p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9894</cvename>
<cvename>CVE-2016-9899</cvename>
<cvename>CVE-2016-9895</cvename>
<cvename>CVE-2016-9896</cvename>
<cvename>CVE-2016-9897</cvename>
<cvename>CVE-2016-9898</cvename>
<cvename>CVE-2016-9900</cvename>
<cvename>CVE-2016-9904</cvename>
<cvename>CVE-2016-9901</cvename>
<cvename>CVE-2016-9902</cvename>
<cvename>CVE-2016-9903</cvename>
<cvename>CVE-2016-9080</cvename>
<cvename>CVE-2016-9893</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.6.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremy Felt reports:</p>
<blockquote cite="https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/">
<p>WordPress versions 4.6 and earlier are affected by two security
issues: a cross-site scripting vulnerability via image filename,
reported by SumOfPwn researcher Cengiz Han Sahin; and a path
traversal vulnerability in the upgrade package uploader, reported
by Dominik Schilling from the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="80a897a2-c1a6-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-200.html">
<p>The x86 instruction CMPXCHG8B is supposed to ignore legacy operand
size overrides; it only honors the REX.W override (making it
CMPXCHG16B). So, the operand size is always 8 or 16. When support
for CMPXCHG16B emulation was added to the instruction emulator,
this restriction on the set of possible operand sizes was relied on
in some parts of the emulation; but a wrong, fully general, operand
size value was used for other parts of the emulation. As a result,
if a guest uses a supposedly-ignored operand size prefix, a small
amount of hypervisor stack data is leaked to the guests: a 96 bit
leak to guests running in 64-bit mode; or, a 32 bit leak to other
guests.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9932</cvename>
<url>http://xenbits.xen.org/xsa/advisory-200.html</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="2d56308b-c0a8-11e6-a9a5-b499baebfeaf">
<topic>PHP -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.29</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2016.php#id2016-12-08-1">
<p>This is a security release. Several security bugs were fixed in
this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2016.php#id2016-12-08-1</url>
<url>http://php.net/archive/2016.php#id2016-12-08-2</url>
</references>
<dates>
<discovery>2016-12-12</discovery>
<entry>2016-12-12</entry>
</dates>
</vuln>
<vuln vid="c0b13887-be44-11e6-b04f-001999f8d30b">
<topic>asterisk -- Authentication Bypass</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The chan_sip channel driver has a liberal definition
for whitespace when attempting to strip the content between
a SIP header name and a colon character. Rather than
following RFC 3261 and stripping only spaces and horizontal
tabs, Asterisk treats any non-printable ASCII character
as if it were whitespace.</p>
<p>This mostly does not pose a problem until Asterisk is
placed in tandem with an authenticating SIP proxy. In
such a case, a crafty combination of valid and invalid
To headers can cause a proxy to allow an INVITE request
into Asterisk without authentication since it believes
the request is an in-dialog request. However, because of
the bug described above, the request will look like an
out-of-dialog request to Asterisk. Asterisk will then
process the request as a new call. The result is that
Asterisk can process calls from unvetted sources without
any authentication.</p>
<p>If you do not use a proxy for authentication, then
this issue does not affect you.</p>
<p>If your proxy is dialog-aware (meaning that the proxy
keeps track of what dialogs are currently valid), then
this issue does not affect you.</p>
<p>If you use chan_pjsip instead of chan_sip, then this
issue does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.digium.com/pub/security/ASTERISK-2016-009.html</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="9e6640fe-be3a-11e6-b04f-001999f8d30b">
<topic>asterisk -- Crash on SDP offer or answer from endpoint using Opus</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.12.0</ge><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>If an SDP offer or answer is received with the Opus
codec and with the format parameters separated using a
space the code responsible for parsing will recursively
call itself until it crashes. This occurs as the code
does not properly handle spaces separating the parameters.
This does NOT require the endpoint to have Opus configured
in Asterisk. This also does not require the endpoint to
be authenticated. If guest is enabled for chan_sip or
anonymous in chan_pjsip an SDP offer or answer is still
processed and the crash occurs.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-008.html</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="eab68cff-bc0c-11e6-b2ca-001b3856973b">
<topic>cryptopp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cryptopp</name>
<range><lt>5.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://eprint.iacr.org/2015/368">
<p>CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function
in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key
operations for the Rabin-Williams digital signature algorithm, which
allows remote attackers to obtain private keys via a timing attack.
Fixed in 5.6.3.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/146">
<p>CVE-2016-3995: Incorrect implementation of Rijndael timing attack
countermeasure. Fixed in 5.6.4.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/277">
<p>CVE-2016-7420: Library built without -DNDEBUG could egress sensitive
information to the filesystem via a core dump if an assert was triggered.
Fixed in 5.6.5.</p>
</blockquote>
</body>
</description>
<references>
<url>https://eprint.iacr.org/2015/368</url>
<url>https://github.com/weidai11/cryptopp/issues/146</url>
<url>https://github.com/weidai11/cryptopp/issues/277</url>
<cvename>CVE-2015-2141</cvename>
<cvename>CVE-2016-3995</cvename>
<cvename>CVE-2016-7420</cvename>
</references>
<dates>
<discovery>2015-02-27</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="e722e3c6-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- bhyve(8) virtual machine escape</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The bounds checking of accesses to guest memory greater
than 4GB by device emulations is subject to integer
overflow.</p>
<h1>Impact:</h1>
<p>For a bhyve virtual machine with more than 3GB of guest
memory configured, a malicious guest could craft device
descriptors that could give it access to the heap of the
bhyve process. Since the bhyve process is running as root,
this may allow guests to obtain full control of the hosts
they're running on.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1889</cvename>
<freebsdsa>SA-16:38.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="0282269d-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- link_ntoa(3) buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_5</lt></range>
<range><ge>10.3</ge><lt>10.3_14</lt></range>
<range><ge>10.2</ge><lt>10.2_27</lt></range>
<range><ge>10.1</ge><lt>10.1_44</lt></range>
<range><ge>9.3</ge><lt>9.3_52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specially crafted argument can trigger a static buffer
overflow in the library, with possibility to rewrite following
static buffers that belong to other library functions.</p>
<h1>Impact:</h1>
<p>Due to very limited use of the function in the existing
applications, and limited length of the overflow, exploitation
of the vulnerability does not seem feasible. None of the
utilities and daemons in the base system are known to be
vulnerable. However, careful review of third party software
that may use the function was not performed.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6559</cvename>
<freebsdsa>SA-16:37.libc</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
<modified>2016-12-08</modified>
</dates>
</vuln>
<vuln vid="e00304d2-bbed-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Possible login(1) argument injection in telnetd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
<range><ge>9.3</ge><lt>9.3_51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unexpected sequence of memory allocation failures
combined with insufficient error checking could result in
the construction and execution of an argument sequence that
was not intended.</p>
<h1>Impact:</h1>
<p>An attacker who controls the sequence of memory allocation
failures and success may cause login(1) to run without
authentication and may be able to cause misbehavior of
login(1) replacements.</p>
<p>No practical way of controlling these memory allocation
failures is known at this time.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1888</cvename>
<freebsdsa>SA-16:36.telnetd</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="cb0bf1ec-bb92-11e6-a9a5-b499baebfeaf">
<topic>Apache httpd -- denial of service in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.17</ge><le>2.4.23_1</le></range>
</package>
<package>
<name>mod_http2-devel</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_http2 reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E">
<p>The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply
limitations on request headers correctly when experimental module
for the HTTP/2 protocol is used to access a resource.</p>
<p>The net result is that a the server allocates too much memory
instead of denying the request. This can lead to memory exhaustion
of the server by a properly crafted request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E</url>
<url>https://github.com/icing/mod_h2/releases/tag/v1.8.3</url>
<cvename>CVE-2016-8740</cvename>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="603fe0a1-bb26-11e6-8e5a-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>55.0.2883.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9651</cvename>
<cvename>CVE-2016-5208</cvename>
<cvename>CVE-2016-5207</cvename>
<cvename>CVE-2016-5206</cvename>
<cvename>CVE-2016-5205</cvename>
<cvename>CVE-2016-5204</cvename>
<cvename>CVE-2016-5209</cvename>
<cvename>CVE-2016-5203</cvename>
<cvename>CVE-2016-5210</cvename>
<cvename>CVE-2016-5212</cvename>
<cvename>CVE-2016-5211</cvename>
<cvename>CVE-2016-5213</cvename>
<cvename>CVE-2016-5214</cvename>
<cvename>CVE-2016-5216</cvename>
<cvename>CVE-2016-5215</cvename>
<cvename>CVE-2016-5217</cvename>
<cvename>CVE-2016-5218</cvename>
<cvename>CVE-2016-5219</cvename>
<cvename>CVE-2016-5221</cvename>
<cvename>CVE-2016-5220</cvename>
<cvename>CVE-2016-5222</cvename>
<cvename>CVE-2016-9650</cvename>
<cvename>CVE-2016-5223</cvename>
<cvename>CVE-2016-5226</cvename>
<cvename>CVE-2016-5225</cvename>
<cvename>CVE-2016-5224</cvename>
<cvename>CVE-2016-9652</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2016-12-05</entry>
</dates>
</vuln>
<vuln vid="e1f67063-aab4-11e6-b2d3-60a44ce6887b">
<topic>ImageMagick7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://github.com/ImageMagick/ImageMagick/issues/296">
<p>CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/">
<p>CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/">
<p>CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<url>https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/</url>
<url>https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/</url>
<cvename>CVE-2016-9298</cvename>
<cvename>CVE-2016-8866</cvename>
<cvename>CVE-2016-8862</cvename>
<freebsdpr>ports/214514</freebsdpr>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
<topic>Pillow -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>3.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pillow reports:</p>
<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
<p>Pillow prior to 3.3.2 may experience integer overflow
errors in map.c when reading specially crafted image files. This may
lead to memory disclosure or corruption.</p>
<p>Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
for negative image sizes in ImagingNew in Storage.c. A negative image
size can lead to a smaller allocation than expected, leading to arbi
trary writes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
<url>https://github.com/python-pillow/Pillow/issues/2105</url>
<cvename>CVE-2016-9189</cvename>
<cvename>CVE-2016-9190</cvename>
<freebsdpr>ports/214410</freebsdpr>
</references>
<dates>
<discovery>2016-09-06</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="19d35b0f-ba73-11e6-b1cf-14dae9d210b8">
<topic>ImageMagick -- heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bastien Roucaries reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q4/413">
<p>Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
suffer from a heap overflow in WaveletDenoiseImage(). This problem is
easily trigerrable from a Perl script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/413</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<cvename>CVE-2016-9298</cvename>
<freebsdpr>ports/214517</freebsdpr>
<freebsdpr>ports/214511</freebsdpr>
<freebsdpr>ports/214520</freebsdpr>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="e5dcb942-ba6f-11e6-b1cf-14dae9d210b8">
<topic>py-cryptography -- vulnerable HKDF key generation</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py33-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alex Gaynor reports:</p>
<blockquote cite="https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d">
<p>Fixed a bug where ``HKDF`` would return an empty
byte-string if used with a ``length`` less than
``algorithm.digest_size``.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d</url>
<cvename>CVE-2016-9243</cvename>
<freebsdpr>ports/214915</freebsdpr>
</references>
<dates>
<discovery>2016-11-05</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="a228c7a0-ba66-11e6-b1cf-14dae9d210b8">
<topic>qemu -- denial of service vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<name>qemu-sbruno</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html">
<p>The VNC server websockets decoder will read and buffer data
from websockets clients until it sees the end of the HTTP headers,
as indicated by \r\n\r\n. In theory this allows a malicious to
trick QEMU into consuming an arbitrary amount of RAM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html</url>
<cvename>CVE-2015-1779</cvename>
<freebsdpr>ports/206725</freebsdpr>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="59f79c99-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- delimiter injection vulnerabilities in pygrub</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-198.html">
<p>pygrub, the boot loader emulator, fails to quote (or sanity check)
its results when reporting them to its caller.</p>
<p>A malicious guest administrator can obtain the contents of
sensitive host files (an information leak). Additionally, a
malicious guest administrator can cause files on the host to be
removed, causing a denial of service. In some unusual host
configurations, ability to remove certain files may be usable for
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9379</cvename>
<cvename>CVE-2016-9380</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-198.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="58685e23-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- qemu incautious about shared ring processing</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-197.html">
<p>The compiler can emit optimizations in qemu which can lead to
double fetch vulnerabilities. Specifically data on the rings shared
between qemu and the hypervisor (which the guest under control can
obtain mappings of) can be fetched twice (during which time the
guest can alter the contents) possibly leading to arbitrary code
execution in qemu.</p>
<p>Malicious administrators can exploit this vulnerability to take
over the qemu process, elevating its privilege to that of the qemu
process.</p>
<p>In a system not using a device model stub domain (or other
techniques for deprivileging qemu), malicious guest administrators
can thus elevate their privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9381</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-197.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="56f0f11e-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 64-bit bit test instruction emulation broken</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-195.html">
<p>The x86 instructions BT, BTC, BTR, and BTS, when used with a
destination memory operand and a source register rather than an
immediate operand, access a memory location offset from that
specified by the memory operand as specified by the high bits of
the register source.</p>
<p>A malicious guest can modify arbitrary memory, allowing for
arbitrary code execution (and therefore privilege escalation
affecting the whole host), a crash of the host (leading to a DoS),
or information leaks. The vulnerability is sometimes exploitable
by unprivileged guest user processes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9383</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-195.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="5555120d-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- guest 32-bit ELF symbol table load leaking host data</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.7</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-194.html">
<p>Along with their main kernel binary, unprivileged guests may
arrange to have their Xen environment load (kernel) symbol tables
for their use. The ELF image metadata created for this purpose has a
few unused bytes when the symbol table binary is in 32-bit ELF
format. These unused bytes were not properly cleared during symbol
table loading.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
<p>The information leak is small and not under the control of the
guest, so effectively exploiting this vulnerability is probably
difficult.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9384</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-194.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="53dbd096-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 segment base write emulation lacking canonical address checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-193.html">
<p>Both writes to the FS and GS register base MSRs as well as the
WRFSBASE and WRGSBASE instructions require their input values to be
canonical, or a #GP fault will be raised. When the use of those
instructions by the hypervisor was enabled, the previous guard
against #GP faults (having recovery code attached) was accidentally
removed.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9385</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-193.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="523bb0b7-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 task switch to VM86 mode mis-handled</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-192.html">
<p>LDTR, just like TR, is purely a protected mode facility. Hence even
when switching to a VM86 mode task, LDTR loading needs to follow
protected mode semantics. This was violated by the code.</p>
<p>On SVM (AMD hardware): a malicious unprivileged guest process can
escalate its privilege to that of the guest operating system.</p>
<p>On both SVM and VMX (Intel hardware): a malicious unprivileged
guest process can crash the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9382</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-192.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="50ac2e96-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 null segments not always treated as unusable</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-191.html">
<p>The Xen x86 emulator erroneously failed to consider the unusability
of segments when performing memory accesses.</p>
<p> The intended behaviour is as follows: The user data segment (%ds,
%es, %fs and %gs) selectors may be NULL in 32-bit to prevent access.
In 64-bit, NULL has a special meaning for user segments, and there
is no way of preventing access. However, in both 32-bit and 64-bit,
a NULL LDT system segment is intended to prevent access.</p>
<p>On Intel hardware, loading a NULL selector zeros the base as well
as most attributes, but sets the limit field to its largest possible
value. On AMD hardware, loading a NULL selector zeros the attributes,
leaving the stale base and limit intact.</p>
<p>Xen may erroneously permit the access using unexpected base/limit
values.</p>
<p>Ability to exploit this vulnerability on Intel is easy, but on AMD
depends in a complicated way on how the guest kernel manages LDTs.
</p>
<p>An unprivileged guest user program may be able to elevate its
privilege to that of the guest operating system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9386</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-191.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4d7cf654-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-190.html">
<p>Instructions touching FPU, MMX, or XMM registers are required to
raise a Device Not Available Exception (#NM) when either CR0.EM or
CR0.TS are set. (Their AVX or AVX-512 extensions would consider only
CR0.TS.) While during normal operation this is ensured by the
hardware, if a guest modifies instructions while the hypervisor is
preparing to emulate them, the #NM delivery could be missed.</p>
<p>Guest code in one task may thus (unintentionally or maliciously)
read or modify register state belonging to another task in the same
VM.</p>
<p>A malicious unprivileged guest user may be able to obtain or
corrupt sensitive information (including cryptographic material) in
other programs in the same guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7777</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-190.html</url>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4bf57137-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- use after free in FIFO event channel code</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-188.html">
<p>When the EVTCHNOP_init_control operation is called with a bad guest
frame number, it takes an error path which frees a control structure
without also clearing the corresponding pointer. Certain subsequent
operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control),
upon finding the non-NULL pointer, continue operation assuming it
points to allocated memory.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS. Arbitrary code execution (and therefore privilege escalation),
and information leaks, cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7154</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-188.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4aae54be-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[]</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-187.html">
<p>x86 HVM guests running with shadow paging use a subset of the x86
emulator to handle the guest writing to its own pagetables. There
are situations a guest can provoke which result in exceeding the
space allocated for internal state.</p>
<p>A malicious HVM guest administrator can cause Xen to fail a bug
check, causing a denial of service to the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7094</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-187.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="49211361-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>4.5.3</eq></range>
<range><eq>4.6.3</eq></range>
<range><ge>4.7.0</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-186.html">
<p>When emulating HVM instructions, Xen uses a small i-cache for
fetches from guest memory. The code that handles cache misses does
not check if the address from which it fetched lies within the cache
before blindly writing to it. As such it is possible for the guest
to overwrite hypervisor memory.</p>
<p>It is currently believed that the only way to trigger this bug is
to use the way that Xen currently incorrectly wraps CS:IP in 16 bit
modes. The included patch prevents such wrapping.</p>
<p>A malicious HVM guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7093</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-186.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="45ca25b5-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-185.html">
<p>On real hardware, a 32-bit PAE guest must leave the USER and RW bit
clear in L3 pagetable entries, but the pagetable walk behaves as if
they were set. (The L3 entries are cached in processor registers,
and don't actually form part of the pagewalk.)</p>
<p>When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR
in the USER and RW bits for L3 updates for the guest to observe
architectural behaviour. This is unsafe in combination with
recursive pagetables.</p>
<p>As there is no way to construct an L3 recursive pagetable in native
32-bit PAE mode, disallow this option in 32-bit PV guests.</p>
<p>A malicious 32-bit PV guest administrator can escalate their
privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7092</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-185.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="7fff2b16-b0ee-11e6-86b8-589cfc054129">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark project reports:</p>
<blockquote cite="://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html">
<p>Wireshark project is releasing Wireshark 2.2.2, which addresses:</p>
<ul>
<li>wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372</li>
<li>wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374</li>
<li>wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376</li>
<li>wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373</li>
<li>wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html</url>
<cvename>CVE-2016-9372</cvename>
<cvename>CVE-2016-9373</cvename>
<cvename>CVE-2016-9374</cvename>
<cvename>CVE-2016-9375</cvename>
<cvename>CVE-2016-9376</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-12-01</entry>
</dates>
</vuln>
<vuln vid="18f39fb6-7400-4063-acaf-0806e92c094f">
<topic>Mozilla -- SVG Animation Remote Code Execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.1,2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/">
<p>A use-after-free vulnerability in SVG Animation has been
discovered. An exploit built on this vulnerability has been
discovered in the wild targeting Firefox and Tor Browser
users on Windows.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9079</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/</url>
</references>
<dates>
<discovery>2016-11-30</discovery>
<entry>2016-12-01</entry>
<modified>2016-12-16</modified>
</dates>
</vuln>
<vuln vid="479c5b91-b6cc-11e6-a04e-3417eb99b9a0">
<topic>wget -- Access List Bypass / Race Condition</topic>
<affects>
<package>
<name>wget</name>
<range><le>1.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html">
<p>GNU wget in version 1.17 and earlier, when used in
mirroring/recursive mode, is affected by a Race Condition
vulnerability that might allow remote attackers to bypass intended
wget access list restrictions specified with -A parameter.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098</url>
<cvename>CVE-2016-7098</cvename>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="48e83187-b6e9-11e6-b6cf-5453ed2e2b49">
<topic>p7zip -- Null pointer dereference</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9296">
<p>A null pointer dereference bug affects the 16.02 and many old
versions of p7zip. A lack of null pointer check for the variable
<code>folders.PackPositions</code> in function
<code>CInArchive::ReadAndDecodePackedStreams</code>, as used in
the 7z.so library and in 7z applications, will cause a crash and a
denial of service when decoding malformed 7z files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9296</cvename>
<url>https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/</url>
<url>https://sourceforge.net/p/p7zip/bugs/185/</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="ac256985-b6a9-11e6-a3bf-206a8a720317">
<topic>subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)</topic>
<affects>
<package>
<name>subversion18</name>
<range><lt>1.8.17</lt></range>
</package>
<package>
<name>subversion</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-8734-advisory.txt">
<p>The mod_dontdothat module of subversion and subversion clients using
http(s):// are vulnerable to a denial-of-service attack, caused by
exponential XML entity expansion. The attack targets XML parsers
causing targeted process to consume excessive amounts of resources.
The attack is also known as the "billions of laughs attack."</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2016-8734-advisory.txt</url>
<cvename>CVE-2016-8734</cvename>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="18449f92-ab39-11e6-8011-005056925db4">
<topic>libwww -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwww</name>
<range><lt>5.4.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3183">
<p>The HTBoundary_put_block function in HTBound.c for W3C libwww
(w3c-libwww) allows remote servers to cause a denial of service
(segmentation fault) via a crafted multipart/byteranges MIME message
that triggers an out-of-bounds read.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
as used in the XML-Twig module for Perl, allows context-dependent
attackers to cause a denial of service (application crash) via an XML
document with malformed UTF-8 sequences that trigger a buffer
over-read, related to the doProlog function in lib/xmlparse.c, a
different vulnerability than CVE-2009-2625 and CVE-2009-3720.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
<p>The updatePosition function in lib/xmltok_impl.c in libexpat in
Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other
software, allows context-dependent attackers to cause a denial of
service (application crash) via an XML document with crafted UTF-8
sequences that trigger a buffer over-read, a different vulnerability
than CVE-2009-2625.</p>
</blockquote>
</body>
</description>
<references>
<bid>15035</bid>
<cvename>CVE-2005-3183</cvename>
<cvename>CVE-2009-3560</cvename>
<cvename>CVE-2009-3720</cvename>
<freebsdpr>ports/214546</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=170518</url>
</references>
<dates>
<discovery>2005-10-12</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e">
<topic>mozilla -- data: URL can inherit wrong origin after an HTTP redirect</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/">
<p>Redirection from an HTTP connection to a data: URL
assigns the referring site's origin to the data: URL in some
circumstances. This can result in same-origin violations
against a domain if it loads resources from malicious
sites. Cross-origin setting of cookies has been demonstrated
without the ability to read them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9078</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-91/</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="125f5958-b611-11e6-a9a5-b499baebfeaf">
<topic>Roundcube -- arbitrary command execution</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9920">
<p>steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before
1.2.3, when no SMTP server is configured and the sendmail program is
enabled, does not properly restrict the use of custom envelope-from
addresses on the sendmail command line, which allows remote
authenticated users to execute arbitrary code via a modified HTTP
request that sends a crafted e-mail message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9920</cvename>
<bid>94858</bid>
<url>http://www.openwall.com/lists/oss-security/2016/12/08/17</url>
<url>https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123</url>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
<modified>2016-12-14</modified>
</dates>
</vuln>
<vuln vid="8db24888-b2f5-11e6-8153-00248c0c745d">
<topic>Drupal Code -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><ge>7.0</ge><lt>7.52</lt></range>
</package>
<package>
<name>drupal8</name>
<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-005">
<h3>Inconsistent name for term access query (Less critical - Drupal
7 and Drupal 8)</h3>
<p>Drupal provides a mechanism to alter database SELECT queries before
they are executed. Contributed and custom modules may use this
mechanism to restrict access to certain entities by implementing
hook_query_alter() or hook_query_TAG_alter() in order to add
additional conditions. Queries can be distinguished by means of
query tags. As the documentation on EntityFieldQuery::addTag()
suggests, access-tags on entity queries normally follow the form
ENTITY_TYPE_access (e.g. node_access). However, the taxonomy
module's access query tag predated this system and used term_access
as the query tag instead of taxonomy_term_access.</p>
<p>As a result, before this security release modules wishing to
restrict access to taxonomy terms may have implemented an
unsupported tag, or needed to look for both tags (term_access and
taxonomy_term_access) in order to be compatible with queries
generated both by Drupal core as well as those generated by
contributed modules like Entity Reference. Otherwise information
on taxonomy terms might have been disclosed to unprivileged users.
</p>
<h3>Incorrect cache context on password reset page (Less critical -
Drupal 8)</h3>
<p>The user password reset form does not specify a proper cache
context, which can lead to cache poisoning and unwanted content on
the page.</p>
<h3>Confirmation forms allow external URLs to be injected (Moderately
critical - Drupal 7)</h3>
<p>Under certain circumstances, malicious users could construct a URL
to a confirmation form that would trick users into being redirected
to a 3rd party website after interacting with the form, thereby
exposing the users to potential social engineering attacks.</p>
<h3>Denial of service via transliterate mechanism (Moderately critical
- Drupal 8)</h3>
<p>A specially crafted URL can cause a denial of service via the
transliterate mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9449</cvename>
<cvename>CVE-2016-9450</cvename>
<cvename>CVE-2016-9451</cvename>
<cvename>CVE-2016-9452</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-11-25</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="6fe72178-b2e3-11e6-8b2a-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-57/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-58/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-59/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-60/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-61/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-62/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-63/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-64/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-65/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-66/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-67/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-68/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-69/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-70/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-71/</url>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
<cvename>CVE-2016-4412</cvename>
</references>
<dates>
<discovery>2016-11-25</discovery>
<entry>2016-11-25</entry>
</dates>
</vuln>
<vuln vid="dc596a17-7a9e-11e6-b034-f0def167eeea">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-24</entry>
<modified>2016-11-24</modified>
</dates>
</vuln>
<vuln vid="8db8d62a-b08b-11e6-8eba-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p9</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se">
<p>NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:</p>
<ul>
<li>1 HIGH severity vulnerability that only affects Windows</li>
<li>2 MEDIUM severity vulnerabilities</li>
<li>2 MEDIUM/LOW severity vulnerabilities</li>
<li>5 LOW severity vulnerabilities</li>
<li>28 other non-security fixes and improvements</li>
</ul>
<p>All of the security issues in this release are listed in
<a href="http://www.kb.cert.org/vuls/id/633847">VU#633847</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7429</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<cvename>CVE-2016-9312</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se</url>
<url>http://www.kb.cert.org/vuls/id/633847</url>
</references>
<dates>
<discovery>2016-11-21</discovery>
<entry>2016-11-22</entry>
</dates>
</vuln>
<vuln vid="81fc7705-b002-11e6-b20a-14dae9d5a9d2">
<topic>teeworlds -- Remote code execution</topic>
<affects>
<package>
<name>teeworlds</name>
<range><lt>0.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Teeworlds project reports:</p>
<blockquote cite="https://www.teeworlds.com/?page=news&id=12086">
<p>Attacker controlled memory-writes and possibly arbitrary code
execution on the client, abusable by any server the client joins</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.teeworlds.com/?page=news&id=12086</url>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-11-21</entry>
</dates>
</vuln>
<vuln vid="27eee66d-9474-44a5-b830-21ec12a1c307">
<topic>jenkins -- Remote code execution vulnerability in remoting module</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.31</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.19.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16">
<p>An unauthenticated remote code execution vulnerability allowed
attackers to transfer a serialized Java object to the Jenkins CLI,
making Jenkins connect to an attacker-controlled LDAP server, which
in turn can send a serialized payload leading to code execution,
bypassing existing protection mechanisms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9299</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="f6565fbf-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.9</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.7</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0023: Question engine allows access to files that
should not be available</p></li>
<li><p>MSA-16-0024: Non-admin site managers may accidentally edit
admins via web services</p></li>
<li><p>MSA-16-0025: Capability to view course notes is checked in
the wrong context</p></li>
<li><p>MSA-16-0026: When debugging is enabled, error exceptions
returned from webservices could contain private data</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8642</cvename>
<cvename>CVE-2016-8643</cvename>
<cvename>CVE-2016-8644</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2016-11-16</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="ab02f981-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.8</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.6</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0022: Web service tokens should be invalidated when
the user password is changed or forced to be changed.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7038</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="d1853110-07f4-4645-895b-6fd462ad0589">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5289</cvename>
<cvename>CVE-2016-5290</cvename>
<cvename>CVE-2016-5291</cvename>
<cvename>CVE-2016-5292</cvename>
<cvename>CVE-2016-5293</cvename>
<cvename>CVE-2016-5294</cvename>
<cvename>CVE-2016-5295</cvename>
<cvename>CVE-2016-5296</cvename>
<cvename>CVE-2016-5297</cvename>
<cvename>CVE-2016-5298</cvename>
<cvename>CVE-2016-5299</cvename>
<cvename>CVE-2016-9061</cvename>
<cvename>CVE-2016-9062</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2016-9064</cvename>
<cvename>CVE-2016-9065</cvename>
<cvename>CVE-2016-9066</cvename>
<cvename>CVE-2016-9067</cvename>
<cvename>CVE-2016-9068</cvename>
<cvename>CVE-2016-9070</cvename>
<cvename>CVE-2016-9071</cvename>
<cvename>CVE-2016-9072</cvename>
<cvename>CVE-2016-9073</cvename>
<cvename>CVE-2016-9074</cvename>
<cvename>CVE-2016-9075</cvename>
<cvename>CVE-2016-9076</cvename>
<cvename>CVE-2016-9077</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-89/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-90/</url>
</references>
<dates>
<discovery>2016-11-15</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="a8e9d834-a916-11e6-b9b4-bcaec524bf84">
<topic>lives -- insecure files permissions</topic>
<affects>
<package>
<name>lives</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565">
<p>smogrify script creates insecure temporary files.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043">
<p>lives creates and uses world-writable directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043</url>
</references>
<dates>
<discovery>2016-07-30</discovery>
<entry>2016-11-12</entry>
</dates>
</vuln>
<vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20161110.txt">
<ul>
<li>ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)<br/>
Severity: High<br/>
TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
attack by corrupting larger payloads. This can result in an OpenSSL crash. This
issue is not considered to be exploitable beyond a DoS.</li>
<li>CMS Null dereference (CVE-2016-7053)<br/>
Severity: Medium<br/>
Applications parsing invalid CMS structures can crash with a NULL pointer
dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
callback if an attempt is made to free certain invalid encodings. Only CHOICE
structures using a callback which do not handle NULL value are affected.</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)i<br/>
Severity: Low<br/>
There is a carry propagating bug in the Broadwell-specific Montgomery
multiplication procedure that handles input lengths divisible by, but
longer than 256 bits.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20161110.txt</url>
<cvename>CVE-2016-7054</cvename>
<cvename>CVE-2016-7053</cvename>
<cvename>CVE-2016-7055</cvename>
</references>
<dates>
<discovery>2016-11-10</discovery>
<entry>2016-11-10</entry>
<modified>2016-11-11</modified>
</dates>
</vuln>
<vuln vid="a3473f5a-a739-11e6-afaa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html">
<p>4 security fixes in this release, including:</p>
<ul>
<li>[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to
Paul Mehta</li>
<li>[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to
Choongwoo Han</li>
<li>[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to
Rob Wu</li>
<li>[662843] CVE-2016-5202: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5199</cvename>
<cvename>CVE-2016-5200</cvename>
<cvename>CVE-2016-5201</cvename>
<cvename>CVE-2016-5202</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html</url>
</references>
<dates>
<discovery>2016-11-09</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="96f6bf10-a731-11e6-95ca-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.644</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html">
<ul>
<li>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2016-7860, CVE-2016-7861,
CVE-2016-7865).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-7857, CVE-2016-7858,
CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-37.html</url>
<cvename>CVE-2016-7857</cvename>
<cvename>CVE-2016-7858</cvename>
<cvename>CVE-2016-7859</cvename>
<cvename>CVE-2016-7860</cvename>
<cvename>CVE-2016-7861</cvename>
<cvename>CVE-2016-7862</cvename>
<cvename>CVE-2016-7863</cvename>
<cvename>CVE-2016-7864</cvename>
<cvename>CVE-2016-7865</cvename>
</references>
<dates>
<discovery>2016-11-08</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="10968dfd-a687-11e6-b2d3-60a44ce6887b">
<topic>gitlab -- Directory traversal via "import/export" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.10.0</ge><le>8.10.12</le></range>
<range><ge>8.11.0</ge><le>8.11.9</le></range>
<range><ge>8.12.0</ge><le>8.12.7</le></range>
<range><ge>8.13.0</ge><le>8.13.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/">
<p>The import/export feature did not properly check for symbolic links
in user-provided archives and therefore it was possible for an
authenticated user to retrieve the contents of any file
accessible to the GitLab service account. This included
sensitive files such as those that contain secret tokens used
by the GitLab service to authenticate users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/</url>
<cvename>CVE-2016-9086</cvename>
<freebsdpr>ports/214360</freebsdpr>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-09</entry>
<modified>2017-05-18</modified>
</dates>
</vuln>
<vuln vid="ae9cb9b8-a203-11e6-a265-3065ec8fd3ec">
<topic>chromium -- out-of-bounds memory access</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html">
<p>[659475] High CVE-2016-5198: Out of bounds memory access in V8.
Credit to Tencent Keen Security Lab, working with Trend Micro's
Zero Day Initiative.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5198</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-03</entry>
</dates>
</vuln>
<vuln vid="0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- OpenSSL Remote DoS vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
<range><ge>10.2</ge><lt>10.2_25</lt></range>
<range><ge>10.1</ge><lt>10.1_42</lt></range>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0a</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to improper handling of alert packets, OpenSSL would
consume an excessive amount of CPU time processing undefined
alert messages.</p>
<h1>Impact:</h1>
<p>A remote attacker who can initiate handshakes with an
OpenSSL based server can cause the server to consume a lot
of computation power with very little bandwidth usage, and
may be able to use this technique in a leveraged Denial of
Service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2016-8610</cvename>
<freebsdsa>SA-16:35.openssl</freebsdsa>
<url>http://seclists.org/oss-sec/2016/q4/224</url>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
<modified>2017-02-22</modified>
</dates>
</vuln>
<vuln vid="cb116651-79db-4c09-93a2-c38f9df46724">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.11</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/nov/01/security-releases/">
<p>Today the Django team released Django 1.10.3, Django 1.9.11,
and 1.8.16. These releases addresses two security issues
detailed below. We encourage all users of Django to upgrade
as soon as possible.</p>
<ul>
<li>User with hardcoded password created when running tests on Oracle</li>
<li>DNS rebinding vulnerability when DEBUG=True</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/nov/01/security-releases/</url>
<cvename>CVE-2016-9013</cvename>
<cvename>CVE-2016-9014</cvename>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="765feb7d-a0d1-11e6-a881-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.51.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>cookie injection for other servers</li>
<li>case insensitive password comparison</li>
<li>OOB write via unchecked multiplication</li>
<li>double-free in curl_maprintf</li>
<li>double-free in krb5 code</li>
<li>glob parser write/read out of bounds</li>
<li>curl_getdate read out of bounds</li>
<li>URL unescape heap overflow via integer truncation</li>
<li>Use-after-free via shared cookies</li>
<li>invalid URL parsing with '#'</li>
<li>IDNA 2003 makes curl use wrong host</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2016-8615</cvename>
<cvename>CVE-2016-8616</cvename>
<cvename>CVE-2016-8617</cvename>
<cvename>CVE-2016-8618</cvename>
<cvename>CVE-2016-8619</cvename>
<cvename>CVE-2016-8620</cvename>
<cvename>CVE-2016-8621</cvename>
<cvename>CVE-2016-8622</cvename>
<cvename>CVE-2016-8623</cvename>
<cvename>CVE-2016-8624</cvename>
<cvename>CVE-2016-8625</cvename>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="0b8d01a4-a0d2-11e6-9ca2-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P4</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P1</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.10.21</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01434/">
<p>A defect in BIND's handling of responses containing
a DNAME answer can cause a resolver to exit after
encountering an assertion failure in db.c or
resolver.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8864</cvename>
<freebsdsa>SA-16:34.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01434/</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="f4bf713f-6ac7-4b76-8980-47bf90c5419f">
<topic>memcached -- multiple vulnerabilities</topic>
<affects>
<package>
<name>memcached</name>
<range><lt>1.4.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html">
<p>Multiple integer overflow vulnerabilities exist within Memcached
that could be exploited to achieve remote code execution on the
targeted system. These vulnerabilities manifest in various Memcached
functions that are used in inserting, appending, prepending, or
modifying key-value data pairs. Systems which also have Memcached
compiled with support for SASL authentication are also vulnerable to
a third flaw due to how Memcached handles SASL authentication
commands.</p>
<p>An attacker could exploit these vulnerabilities by sending a
specifically crafted Memcached command to the targeted server.
Additionally, these vulnerabilities could also be exploited to leak
sensitive process information which an attacker could use to bypass
common exploitation mitigations, such as ASLR, and can be triggered
multiple times. This enables reliable exploitation which makes these
vulnerabilities severe.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html</url>
<cvename>CVE-2016-8704</cvename>
<cvename>CVE-2016-8705</cvename>
<cvename>CVE-2016-8706</cvename>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="9bc14850-a070-11e6-a881-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<name>mysql55-server</name>
<range><lt>5.5.53</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.34</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/">
<p>Fixes for the following security vulnerabilities:</p>
<ul>
<li>CVE-2016-7440</li>
<li>CVE-2016-5584</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/</url>
<cvename>CVE-2016-7440</cvename>
<cvename>CVE-2016-5584</cvename>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-11-01</entry>
</dates>
</vuln>
<vuln vid="9118961b-9fa5-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html">
<p>21 security fixes in this release, including:</p>
<ul>
<li>[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to
Anonymous</li>
<li>[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to
Giwan Go of STEALIEN</li>
<li>[645122] High CVE-2016-5183: Use after free in PDFium. Credit
to Anonymous</li>
<li>[630654] High CVE-2016-5184: Use after free in PDFium. Credit
to Anonymous</li>
<li>[621360] High CVE-2016-5185: Use after free in Blink. Credit to
cloudfuzzer</li>
<li>[639702] High CVE-2016-5187: URL spoofing. Credit to Luan
Herrera</li>
<li>[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan
Herrera</li>
<li>[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink.
Credit to haojunhou@gmail.com</li>
<li>[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr
of Tencent's Xuanwu Lab</li>
<li>[644963] Medium CVE-2016-5186: Out of bounds read in DevTools.
Credit to Abdulrahman Alqabandi (@qab)</li>
<li>[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks.
Credit to Gareth Hughes</li>
<li>[642067] Medium CVE-2016-5190: Use after free in Internals.
Credit to Atte Kettunen of OUSPG</li>
<li>[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang
ZHOU (martinzhou96)</li>
<li>[654782] CVE-2016-5194: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5181</cvename>
<cvename>CVE-2016-5182</cvename>
<cvename>CVE-2016-5183</cvename>
<cvename>CVE-2016-5184</cvename>
<cvename>CVE-2016-5185</cvename>
<cvename>CVE-2016-5186</cvename>
<cvename>CVE-2016-5187</cvename>
<cvename>CVE-2016-5188</cvename>
<cvename>CVE-2016-5189</cvename>
<cvename>CVE-2016-5190</cvename>
<cvename>CVE-2016-5191</cvename>
<cvename>CVE-2016-5192</cvename>
<cvename>CVE-2016-5193</cvename>
<cvename>CVE-2016-5194</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="9c135c7e-9fa4-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.143</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[642496] High CVE-2016-5177: Use after free in V8. Credit to
Anonymous</li>
<li>[651092] CVE-2016-5178: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5177</cvename>
<cvename>CVE-2016-5178</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2016-09-29</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="6a2cfcdc-9dea-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- OpenSSH Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3p1_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_3</lt></range>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When processing the SSH_MSG_KEXINIT message, the server
could allocate up to a few hundreds of megabytes of memory
per each connection, before any authentication take place.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause a SSH server to
allocate an excessive amount of memory. Note that the default
MaxStartups setting on FreeBSD will limit the effectiveness
of this attack.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/191</url>
<cvename>CVE-2016-8858</cvename>
<freebsdsa>SA-16:33.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-10-19</discovery>
<entry>2016-10-29</entry>
<modified>2016-11-02</modified>
</dates>
</vuln>
<vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
<topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
<p>A flaw exists in sudo's noexec functionality that may allow
a user with sudo privileges to run additional commands even when the
NOEXEC tag has been applied to a command that uses the wordexp()
function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
<cvename>CVE-2016-7076</cvename>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
<topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html">
<p>Apache Axis2 1.7.4 is a maintenance release that includes fixes for
several issues, including the following security issues:
Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities
affecting the admin console.
A dependency on an Apache HttpClient version affected by known security
vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-4739</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5683</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5757</url>
<cvename>CVE-2012-6153</cvename>
<cvename>CVE-2014-3577</cvename>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="28bb6ee5-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- ares_create_query single byte out of buffer write</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.48</lt></range>
</package>
<package>
<name>node012</name>
<range><lt>0.12.17</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js has released new versions containing the following security fix:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>The following releases all contain fixes for CVE-2016-5180 "ares_create_query single
byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance),
Node.js v4.6.1 (LTS "Argon")
</p>
<p>While this is not a critical update, all users of these release lines should upgrade at
their earliest convenience.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5180</cvename>
<freebsdpr>ports/213800</freebsdpr>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-26</entry>
</dates>
</vuln>
<vuln vid="27180c99-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><ge>6.0.0</ge><lt>6.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL
configuration file, from the OPENSSL_CONF environment variable or from the default
location for the current platform. Always triggering a configuration file load attempt
may allow an attacker to load compromised OpenSSL configuration into a Node.js process
if they are able to place a file in a default location.
</p>
<p>Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes,
potentially allowing an attacker to obtain sensitive information from arbitrary memory
locations via crafted JavaScript code. This vulnerability would require an attacker to
be able to execute arbitrary JavaScript code in a Node.js process.
</p>
<p>Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of
the inspector. This provides additional security to prevent unauthorized clients from
connecting to the Node.js process via the v8_inspector port when running with --inspect.
Since the debugging protocol allows extensive access to the internals of a running process,
and the execution of arbitrary code, it is important to limit connections to authorized
tools only. Note that the v8_inspector protocol in Node.js is still considered an
experimental feature. Vulnerability originally reported by Jann Horn.
</p>
<p>All of these vulnerabilities are considered low-severity for Node.js users, however,
users of Node.js v6.x should upgrade at their earliest convenience.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5172</cvename>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="c5c6e293-9cc7-11e6-823f-b8aeed92ecc4">
<topic>urllib3 -- certificate verification failure</topic>
<affects>
<package>
<name>py-urllib3</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>urllib3 reports:</p>
<blockquote cite="https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst">
<p>CVE-2016-9015: Certification verification failure</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9015</cvename>
<url>https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="de6d01d5-9c44-11e6-ba67-0011d823eebd">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<range><lt>11.2r202.643</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-36.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and Chrome OS. These updates address a
critical vulnerability that could potentially allow an attacker to
take control of the affected system.</p>
<p>Adobe is aware of a report that an exploit for CVE-2016-7855
exists in the wild, and is being used in limited, targeted attacks
against users running Windows versions 7, 8.1 and 10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7855</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-36.html</url>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2016-10-27</entry>
</dates>
</vuln>
<vuln vid="a479a725-9adb-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- bhyve - privilege escalation vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unchecked array reference in the VGA device emulation
code could potentially allow guests access to the heap of
the bhyve process. Since the bhyve process is running as
root, this may allow guests to obtain full control of the
hosts they are running on.</p>
<h1>Impact:</h1>
<p>For bhyve virtual machines with the "fbuf" framebuffer
device configured, if exploited, a malicious guest could
obtain full access to not just the host system, but to other
virtual machines running on the system.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:32.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-10-25</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="2482c798-93c6-11e6-846f-bc5ff4fb5ea1">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.637</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and ChromeOS. These updates address
critical vulnerabilities that could potentially allow an attacker
to take control of the affected system.</p>
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2016-6992).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-6981, CVE-2016-6987).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-4286).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4273, CVE-2016-6982,
CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986,
CVE-2016-6989, CVE-2016-6990).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4273</cvename>
<cvename>CVE-2016-4286</cvename>
<cvename>CVE-2016-6981</cvename>
<cvename>CVE-2016-6982</cvename>
<cvename>CVE-2016-6983</cvename>
<cvename>CVE-2016-6984</cvename>
<cvename>CVE-2016-6985</cvename>
<cvename>CVE-2016-6986</cvename>
<cvename>CVE-2016-6987</cvename>
<cvename>CVE-2016-6989</cvename>
<cvename>CVE-2016-6990</cvename>
<cvename>CVE-2016-6992</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-32.html</url>
</references>
<dates>
<discovery>2016-10-11</discovery>
<entry>2016-10-24</entry>
</dates>
</vuln>
<vuln vid="aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/">
<p>CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements</p>
<p>CVE-2016-5288: Web content can read cache entries</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5287</cvename>
<cvename>CVE-2016-5288</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-87/</url>
</references>
<dates>
<discovery>2016-10-20</discovery>
<entry>2016-10-21</entry>
</dates>
</vuln>
<vuln vid="0baadc45-92d0-11e6-8011-005056925db4">
<topic>Axis2 -- Cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html">
<p>Apache Axis2 1.7.3 is a security release that contains a fix
for CVE-2010-3981. That security vulnerability affects the admin console
that is part of the Axis2 Web application and was originally reported
for SAP BusinessObjects (which includes a version of Axis2). That report
didn’t mention Axis2 at all and the Axis2 project only recently became
aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue
affects Apache Axis2 as well.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html</url>
<cvename>CVE-2010-3981</cvename>
<freebsdpr>ports/213546</freebsdpr>
</references>
<dates>
<discovery>2010-10-18</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec">
<topic>Tor -- remote denial of service</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.8.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.9.4-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Blog reports:</p>
<blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes">
<p>Prevent a class of security bugs caused by treating the contents
of a buffer chunk as if they were a NUL-terminated string. At least
one such bug seems to be present in all currently used versions of
Tor, and would allow an attacker to remotely crash most Tor
instances, especially those compiled with extra compiler hardening.
With this defense in place, such bugs can't crash Tor, though we
should still fix them as they occur. Closes ticket 20384
(TROVE-2016-10-001).</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
<affects>
<package>
<name>rubygem-actionview</name>
<range><gt>3.0.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE">
<p>There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers. This vulnerability has been assigned the CVE identifier
CVE-2016-6316.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE</url>
<cvename>CVE-2016-6316</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="7e61cf44-6549-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Unsafe Query Generation Risk in Active Record</topic>
<affects>
<package>
<name>rubygem-activerecord4</name>
<range><gt>4.2.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA">
<p>There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
and CVE-2013-0155.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA</url>
<cvename>CVE-2016-6317</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="f471032a-8700-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.11">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.11</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-15</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="8d5180a6-86fe-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.26">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.26</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7411</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-16</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="ad479f89-9020-11e6-a590-14dae9d210b8">
<topic>file-roller -- path traversal vulnerability</topic>
<affects>
<package>
<name>file-roller</name>
<range><ge>3.5.4,1</ge><lt>3.20.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/4">
<p>File Roller 3.5.4 through 3.20.2 was affected by a path
traversal bug that could result in deleted files if a user
were tricked into opening a malicious archive.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/09/08/4</url>
<cvename>CVE-2016-7162</cvename>
<freebsdpr>ports/213199</freebsdpr>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="7d40edd1-901e-11e6-a590-14dae9d210b8">
<topic>VirtualBox -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><ge>5.0</ge><lt>5.0.8</lt></range>
<range><ge>4.3</ge><lt>4.3.32</lt></range>
<range><ge>4.2</ge><lt>4.2.34</lt></range>
<range><ge>4.1</ge><lt>4.1.42</lt></range>
<range><ge>4.0</ge><lt>4.0.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local
users to affect availability via unknown vectors related to Core.</p>
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature
(RDP) enabled, allows remote attackers to affect availability via
unknown vectors related to Core.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4813</cvename>
<cvename>CVE-2015-4896</cvename>
<freebsdpr>ports/204406</freebsdpr>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="10f7f782-901c-11e6-a590-14dae9d210b8">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.5.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2016/dsa-3675">
<p>Various memory handling problems and cases of missing or
incomplete input sanitizing may result in denial of service or the
execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and
CALS files are processed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2016/dsa-3675</url>
<freebsdpr>ports/213032</freebsdpr>
</references>
<dates>
<discovery>2016-09-23</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="2a526c78-84ab-11e6-a4a1-60a44ce6887b">
<topic>libgd -- integer overflow which could lead to heap buffer overflow</topic>
<affects>
<package>
<name>gd</name>
<range><le>2.2.3</le></range>
</package>
<package>
<name>php70-gd</name>
<range><le>7.0.11</le></range>
</package>
<package>
<name>php56-gd</name>
<range><le>5.6.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibGD reports:</p>
<blockquote cite="https://github.com/libgd/libgd/issues/308">
<p>An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/issues/308</url>
<url>https://bugs.php.net/bug.php?id=73003</url>
<freebsdpr>ports/213023</freebsdpr>
</references>
<dates>
<discovery>2016-09-02</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="cb3f036d-8c7f-11e6-924a-60a44ce6887b">
<topic>libvncserver -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nicolas Ruff reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/639">
<p>Integer overflow in MallocFrameBuffer() on client side.</p>
<p>Lack of malloc() return value checking on client side.</p>
<p>Server crash on a very large ClientCutText message.</p>
<p>Server crash when scaling factor is set to zero.</p>
<p>Multiple stack overflows in File Transfer feature.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/639</url>
<cvename>CVE-2014-6051</cvename>
<cvename>CVE-2014-6052</cvename>
<cvename>CVE-2014-6053</cvename>
<cvename>CVE-2014-6054</cvename>
<cvename>CVE-2014-6055</cvename>
<freebsdpr>ports/212380</freebsdpr>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="ab947396-9018-11e6-a590-14dae9d210b8">
<topic>openoffice -- information disclosure vulnerability</topic>
<affects>
<package>
<name>apache-openoffice</name>
<name>apache-openoffice-devel</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2014-3575.html">
<p>The exposure exploits the way OLE previews are generated to
embed arbitrary file data into a specially crafted document when it is
opened. Data exposure is possible if the updated document is distributed
to other parties.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/cves/CVE-2014-3575.html</url>
<cvename>CVE-2014-3575</cvename>
<freebsdpr>ports/212379</freebsdpr>
</references>
<dates>
<discovery>2014-08-21</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="47157c14-9013-11e6-a590-14dae9d210b8">
<topic>mupdf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mupdf</name>
<range><lt>1.9a_1,1</lt></range>
</package>
<package>
<name>llpp</name>
<range><lt>22_2</lt></range>
</package>
<package>
<name>zathura-pdf-mupdf</name>
<range><lt>0.3.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Kortkamp reports:</p>
<blockquote cite="http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html">
<p>Heap-based buffer overflow in the pdf_load_mesh_params
function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a
denial of service (crash) or execute arbitrary code via a large decode
array.</p>
<p>Use-after-free vulnerability in the pdf_load_xref function in
pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
service (crash) via a crafted PDF file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696941</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696954</url>
<cvename>CVE-2016-6525</cvename>
<cvename>CVE-2016-6265</cvename>
<freebsdpr>ports/212207</freebsdpr>
</references>
<dates>
<discovery>2016-08-27</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="b7d56d0b-7a11-11e6-af78-589cfc0654e1">
<topic>openjpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tencent's Xuanwu LAB reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/2">
<p>A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in
function opj_dwt_interleave_v of dwt.c. This vulnerability allows
remote attackers to execute arbitrary code on vulnerable installations
of OpenJPEG.</p>
<p>An integer overflow issue exists in function opj_pi_create_decode of
pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in
function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp,
opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be
vulnerable). This vulnerability allows remote attackers to execute
arbitrary code on vulnerable installations of OpenJPEG.</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/2"</url>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/3"</url>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-7163</cvename>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="fa175f30-8c75-11e6-924a-60a44ce6887b">
<topic>redis -- sensitive information leak through command history file</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis team reports:</p>
<blockquote cite="https://github.com/antirez/redis/pull/1418">
<p>The redis-cli history file (in linenoise) is created with the
default OS umask value which makes it world readable in most systems
and could potentially expose authentication credentials to other
users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/antirez/redis/pull/1418</url>
<url>https://github.com/antirez/redis/issues/3284</url>
<cvename>CVE-2013-7458</cvename>
</references>
<dates>
<discovery>2013-11-30</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="1a71a972-8ee7-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple libarchive vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in libarchive's handling of symlinks and hard links
allow overwriting files outside the extraction directory,
or permission changes to a directory outside the extraction
directory.</p>
<h1>Impact:</h1>
<p>An attacker who can control freebsd-update's or portsnap's
input to tar(1) can change file content or permissions on
files outside of the update tool's working sandbox.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:31.libarchive</freebsdsa>
</references>
<dates>
<discovery>2016-10-05</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="e7dcd69d-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple portsnap vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in portsnap's verification of downloaded tar files
allows additional files to be included without causing the
verification to fail. Portsnap may then use or execute these
files.</p>
<h1>Impact:</h1>
<p>An attacker who can conduct man in the middle attack on
the network at the time when portsnap is run can cause
portsnap to execute arbitrary commands under the credentials
of the user who runs portsnap, typically root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:30.portsnap</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="ce808022-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Heap overflow vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch is susceptible to integer
overflows with carefully crafted input, potentially allowing
an attacker who can control the patch file to write at
arbitrary locations in the heap. This issue was partially
addressed in FreeBSD-SA-16:25.bspatch, but some possible
integer overflows remained.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:29.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="aeb7874e-8df1-11e6-a082-5404a68ad561">
<topic>mkvtoolnix -- code execution via specially crafted files</topic>
<affects>
<package>
<name>mkvtoolnix</name>
<range><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moritz Bunkus reports:</p>
<blockquote cite="https://mkvtoolnix.download/doc/ChangeLog">
<p>most of the bugs fixed on 2016-09-06 and 2016-09-07 for
issue #1780 are potentially exploitable. The scenario is arbitrary
code execution with specially-crafted files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mkvtoolnix.download/doc/ChangeLog</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-10-09</entry>
</dates>
</vuln>
<vuln vid="1cf65085-a760-41d2-9251-943e1af62eb8">
<topic>X.org libraries -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.4,1</lt></range>
</package>
<package>
<name>libXfixes</name>
<range><lt>5.0.3</lt></range>
</package>
<package>
<name>libXi</name>
<range><lt>1.7.7,1</lt></range>
</package>
<package>
<name>libXrandr</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>libXrender</name>
<range><lt>0.9.10</lt></range>
</package>
<package>
<name>libXtst</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>libXv</name>
<range><lt>1.0.11,1</lt></range>
</package>
<package>
<name>libXvMC</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2016-October/002720.html">
<p>Tobias Stoeckmann from the OpenBSD project has discovered a
number of issues in the way various X client libraries handle
the responses they receive from servers, and has worked with
X.Org's security team to analyze, confirm, and fix these issues.
These issue come in addition to the ones discovered by Ilja van
Sprundel in 2013.</p>
<p>Most of these issues stem from the client libraries trusting
the server to send correct protocol data, and not verifying
that the values will not overflow or cause other damage. Most
of the time X clients and servers are run by the same user, with
the server more privileged than the clients, so this is not a
problem, but there are scenarios in which a privileged client
can be connected to an unprivileged server, for instance,
connecting a setuid X client (such as a screen lock program)
to a virtual X server (such as Xvfb or Xephyr) which the user
has modified to return invalid data, potentially allowing the
user to escalate their privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2016-October/002720.html</url>
<cvename>CVE-2016-5407</cvename>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-10-07</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="c8d902b1-8550-11e6-81e7-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P3</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.rc3</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.09.10</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01419">
<p>Testing by ISC has uncovered a critical error condition
which can occur when a nameserver is constructing a
response. A defect in the rendering of messages into
packets can cause named to exit with an assertion
failure in buffer.c while constructing a response
to a query that meets certain criteria.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2776</cvename>
<freebsdsa>SA-16:28.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01419</url>
</references>
<dates>
<discovery>2016-09-27</discovery>
<entry>2016-09-28</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="bb022643-84fb-11e6-a4a1-60a44ce6887b">
<topic>django -- CSRF protection bypass on a site with Google Analytics</topic>
<affects>
<package>
<name>py-django19</name>
<range><lt>1.9.10</lt></range>
</package>
<package>
<name>py-django18</name>
<range><lt>1.8.15</lt></range>
</package>
<package>
<name>py-django</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Software Foundation reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/sep/26/security-releases/">
<p>An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/sep/26/security-releases/</url>
<cvename>CVE-2016-7401</cvename>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-27</entry>
</dates>
</vuln>
<vuln vid="91a337d8-83ed-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2j,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0b</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160926.txt">
<p>Critical vulnerability in OpenSSL 1.1.0a<br/>
Fix Use After Free for large message sizes (CVE-2016-6309)</p>
<p>Moderate vulnerability in OpenSSL 1.0.2i<br/>
Missing CRL sanity check (CVE-2016-7052)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160926.txt</url>
<cvename>CVE-2016-6309</cvename>
<cvename>CVE-2016-7052</cvename>
<freebsdsa>SA-16:27.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-26</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="43eaa656-80bc-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><ge>1.1.0</ge><lt>1.1.0_1</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_11</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_8</lt></range>
<range><ge>10.2</ge><lt>10.2_21</lt></range>
<range><ge>10.1</ge><lt>10.1_38</lt></range>
<range><ge>9.3</ge><lt>9.3_46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160922.txt">
<p>High: OCSP Status Request extension unbounded memory growth</p>
<p>SSL_peek() hang on empty record</p>
<p>SWEET32 Mitigation</p>
<p>OOB write in MDC2_Update()</p>
<p>Malformed SHA512 ticket DoS</p>
<p>OOB write in BN_bn2dec()</p>
<p>OOB read in TS_OBJ_print_bio()</p>
<p>Pointer arithmetic undefined behaviour</p>
<p>Constant time flag not preserved in DSA signing</p>
<p>DTLS buffered message DoS</p>
<p>DTLS replay protection DoS</p>
<p>Certificate message OOB reads</p>
<p>Excessive allocation of memory in tls_get_message_header()</p>
<p>Excessive allocation of memory in dtls1_preprocess_fragment()</p>
<p>NB: LibreSSL is only affected by CVE-2016-6304</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160922.txt</url>
<cvename>CVE-2016-6304</cvename>
<cvename>CVE-2016-6305</cvename>
<cvename>CVE-2016-2183</cvename>
<cvename>CVE-2016-6303</cvename>
<cvename>CVE-2016-6302</cvename>
<cvename>CVE-2016-2182</cvename>
<cvename>CVE-2016-2180</cvename>
<cvename>CVE-2016-2177</cvename>
<cvename>CVE-2016-2178</cvename>
<cvename>CVE-2016-2179</cvename>
<cvename>CVE-2016-2181</cvename>
<cvename>CVE-2016-6306</cvename>
<cvename>CVE-2016-6307</cvename>
<cvename>CVE-2016-6308</cvename>
<freebsdsa>SA-16:26.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-22</discovery>
<entry>2016-09-22</entry>
<modified>2016-10-11</modified>
</dates>
</vuln>
<vuln vid="e78261e4-803d-11e6-a590-14dae9d210b8">
<topic>irssi -- heap corruption and missing boundary checks</topic>
<affects>
<package>
<name>irssi</name>
<name>zh-irssi</name>
<range><ge>0.8.17</ge><lt>0.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2016.txt">
<p>Remote crash and heap corruption. Remote code execution seems
difficult since only Nuls are written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2016.txt</url>
<cvename>CVE-2016-7044</cvename>
<cvename>CVE-2016-7045</cvename>
</references>
<dates>
<discovery>2016-09-21</discovery>
<entry>2016-09-21</entry>
<modified>2016-09-22</modified>
</dates>
</vuln>
<vuln vid="2c57c47e-8bb3-4694-83c8-9fc3abad3964">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/">
<p>CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]</p>
<p>CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]</p>
<p>CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]</p>
<p>CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]</p>
<p>CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]</p>
<p>CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]</p>
<p>CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]</p>
<p>CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]</p>
<p>CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]</p>
<p>CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]</p>
<p>CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]</p>
<p>CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]</p>
<p>CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]</p>
<p>CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]</p>
<p>CVE-2016-5281 - use-after-free in DOMSVGLength [high]</p>
<p>CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]</p>
<p>CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]</p>
<p>CVE-2016-5284 - Add-on update site certificate pin expiration [high]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2827</cvename>
<cvename>CVE-2016-5256</cvename>
<cvename>CVE-2016-5257</cvename>
<cvename>CVE-2016-5270</cvename>
<cvename>CVE-2016-5271</cvename>
<cvename>CVE-2016-5272</cvename>
<cvename>CVE-2016-5273</cvename>
<cvename>CVE-2016-5274</cvename>
<cvename>CVE-2016-5275</cvename>
<cvename>CVE-2016-5276</cvename>
<cvename>CVE-2016-5277</cvename>
<cvename>CVE-2016-5278</cvename>
<cvename>CVE-2016-5279</cvename>
<cvename>CVE-2016-5280</cvename>
<cvename>CVE-2016-5281</cvename>
<cvename>CVE-2016-5282</cvename>
<cvename>CVE-2016-5283</cvename>
<cvename>CVE-2016-5284</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-88/</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-20</entry>
<modified>2016-10-21</modified>
</dates>
</vuln>
<vuln vid="653a8059-7c49-11e6-9242-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[641101] High CVE-2016-5170: Use after free in Blink.Credit to
Anonymous</li>
<li>[643357] High CVE-2016-5171: Use after free in Blink. Credit to
Anonymous</li>
<li>[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8.
Credit to Choongwoo Han</li>
<li>[468931] Medium CVE-2016-5173: Extension resource access.
Credit to Anonymous</li>
<li>[579934] Medium CVE-2016-5174: Popup not correctly suppressed.
Credit to Andrey Kovalev (@L1kvID) Yandex Security Team</li>
<li>[646394] CVE-2016-5175: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5170</cvename>
<cvename>CVE-2016-5171</cvename>
<cvename>CVE-2016-5172</cvename>
<cvename>CVE-2016-5173</cvename>
<cvename>CVE-2016-5174</cvename>
<cvename>CVE-2016-5175</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-16</entry>
</dates>
</vuln>
<vuln vid="b64a7389-7c27-11e6-8aaa-5404a68ad561">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="bc19dcca-7b13-11e6-b99e-589cfc0654e1">
<topic>dropbear -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/15/2">
<p>If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.</p>
<p>dropbearconvert import of OpenSSH keys could run arbitrary code as
the local dropbearconvert user when parsing malicious key files.</p>
<p>dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts.</p>
<p>dbclient or dropbear server could expose process memory to the
running user if compiled with DEBUG_TRACE and running with -v</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/15/2"</url>
<cvename>CVE-2016-7406</cvename>
<cvename>CVE-2016-7407</cvename>
<cvename>CVE-2016-7408</cvename>
<cvename>CVE-2016-7409</cvename>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-09-15</entry>
</dates>
</vuln>
<vuln vid="08664d42-7989-11e6-b7a8-74d02b9a84d5">
<topic>h2o -- fix DoS attack vector</topic>
<affects>
<package>
<name>h2o</name>
<range>
<lt>2.0.4</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reported a denial-of-service attack vector
due to an unhandled error condition during socket connection.</p>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/1077</url>
<cvename>CVE-2016-4864</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="b018121b-7a4b-11e6-bf52-b499baebfeaf">
<topic>cURL -- Escape and unescape integer overflows</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.11.1</ge><lt>7.50.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20160914.html">
<p>The four libcurl functions curl_escape(), curl_easy_escape(),
curl_unescape and curl_easy_unescape perform string URL percent
escaping and unescaping. They accept custom string length inputs
in signed integer arguments.</p>
<p>The provided string length arguments were not properly checked
and due to arithmetic in the functions, passing in the length
0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up
causing an allocation of zero bytes of heap memory that curl
would attempt to write gigabytes of data into.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20160914.html</url>
<cvename>CVE-2016-7167</cvename>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="769ba449-79e1-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html">
<p>33 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5147</cvename>
<cvename>CVE-2016-5148</cvename>
<cvename>CVE-2016-5149</cvename>
<cvename>CVE-2016-5150</cvename>
<cvename>CVE-2016-5151</cvename>
<cvename>CVE-2016-5152</cvename>
<cvename>CVE-2016-5153</cvename>
<cvename>CVE-2016-5154</cvename>
<cvename>CVE-2016-5155</cvename>
<cvename>CVE-2016-5156</cvename>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-5158</cvename>
<cvename>CVE-2016-5159</cvename>
<cvename>CVE-2016-5160</cvename>
<cvename>CVE-2016-5161</cvename>
<cvename>CVE-2016-5162</cvename>
<cvename>CVE-2016-5163</cvename>
<cvename>CVE-2016-5164</cvename>
<cvename>CVE-2016-5165</cvename>
<cvename>CVE-2016-5166</cvename>
<cvename>CVE-2016-5167</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html</url>
</references>
<dates>
<discovery>2016-08-31</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="958b9cee-79da-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html">
<p>10 security fixes in this release, including:</p>
<ul>
<li>[629542] High CVE-2016-5141 Address bar spoofing. Credit to
anonymous</li>
<li>[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to
anonymous</li>
<li>[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to
GiWan Go of Stealien</li>
<li>[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to
Ke Liu of Tencent's Xuanwu LAB</li>
<li>[623406] Medium CVE-2016-5145 Same origin bypass for images in
Blink. Credit to anonymous</li>
<li>[619414] Medium CVE-2016-5143 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[618333] Medium CVE-2016-5144 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[633486] CVE-2016-5146: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5139</cvename>
<cvename>CVE-2016-5140</cvename>
<cvename>CVE-2016-5141</cvename>
<cvename>CVE-2016-5142</cvename>
<cvename>CVE-2016-5143</cvename>
<cvename>CVE-2016-5144</cvename>
<cvename>CVE-2016-5145</cvename>
<cvename>CVE-2016-5146</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="856b88bf-7984-11e6-81e7-d050996490d0">
<topic>mysql -- Remote Root Code Execution</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.51</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.27</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.17</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.51.38.1</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.32.78.0</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.14.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt">
<p>An independent research has revealed multiple severe MySQL
vulnerabilities. This advisory focuses on a critical
vulnerability with a CVEID of CVE-2016-6662 which can allow
attackers to (remotely) inject malicious settings into MySQL
configuration files (my.cnf) leading to critical
consequences.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt</url>
<url>https://jira.mariadb.org/browse/MDEV-10465</url>
<url>https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/</url>
<url>https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/</url>
<url>https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a">
<topic>wolfssl -- leakage of private key information</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer of Redhat discovered that an optimization in
RSA signature validation can result in disclosure of the
server's private key under certain fault conditions.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url>
<cvename>CVE-2015-7744</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96">
<topic>wolfssl -- DDoS amplification in DTLS</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher identified an error in wolfSSL's implementation
of the server side of the DTLS handshake, which could be abused
for DDoS amplification or a DoS on the DTLS server itself.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://github.com/IAIK/wolfSSL-DoS</url>
<cvename>CVE-2015-6925</cvename>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="a0128291-7690-11e6-95a8-0011d823eebd">
<topic>gnutls -- OCSP validation issue</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-3">
<p>Stefan Bühler discovered an issue that affects validation
of certificates using OCSP responses, which can falsely report a
certificate as valid under certain circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-3</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-09-09</entry>
</dates>
</vuln>
<vuln vid="aa1aefe3-6e37-47db-bfda-343ef4acb1b5">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>48.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-2830</cvename>
<cvename>CVE-2016-2835</cvename>
<cvename>CVE-2016-2836</cvename>
<cvename>CVE-2016-2837</cvename>
<cvename>CVE-2016-2838</cvename>
<cvename>CVE-2016-2839</cvename>
<cvename>CVE-2016-5250</cvename>
<cvename>CVE-2016-5251</cvename>
<cvename>CVE-2016-5252</cvename>
<cvename>CVE-2016-5253</cvename>
<cvename>CVE-2016-5254</cvename>
<cvename>CVE-2016-5255</cvename>
<cvename>CVE-2016-5258</cvename>
<cvename>CVE-2016-5259</cvename>
<cvename>CVE-2016-5260</cvename>
<cvename>CVE-2016-5261</cvename>
<cvename>CVE-2016-5262</cvename>
<cvename>CVE-2016-5263</cvename>
<cvename>CVE-2016-5264</cvename>
<cvename>CVE-2016-5265</cvename>
<cvename>CVE-2016-5266</cvename>
<cvename>CVE-2016-5267</cvename>
<cvename>CVE-2016-5268</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/</url>
</references>
<dates>
<discovery>2016-08-02</discovery>
<entry>2016-09-07</entry>
<modified>2016-09-20</modified>
</dates>
</vuln>
<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
<topic>asterisk -- RTP Resource Exhaustion</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.23.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The overlap dialing feature in chan_sip allows chan_sip
to report to a device that the number that has been dialed
is incomplete and more digits are required. If this
functionality is used with a device that has performed
username/password authentication RTP resources are leaked.
This occurs because the code fails to release the old RTP
resources before allocating new ones in this scenario.
If all resources are used then RTP port exhaustion will
occur and no RTP sessions are able to be set up.</p>
<p>If overlap dialing support is not needed the "allowoverlap"
option can be set to no. This will stop any usage of the
scenario which causes the resource exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
<topic>asterisk -- Crash on ACK from unknown endpoint</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk can be crashed remotely by sending an ACK to
it from an endpoint username that Asterisk does not
recognize. Most SIP request types result in an "artificial"
endpoint being looked up, but ACKs bypass this lookup.
The resulting NULL pointer results in a crash when
attempting to determine if ACLs should be applied.</p>
<p>This issue was introduced in the Asterisk 13.10 release
and only affects that release.</p>
<p>This issue only affects users using the PJSIP stack
with Asterisk. Those users that use chan_sip are
unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
<topic>inspircd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam reports:</p>
<blockquote cite="http://www.inspircd.org/2016/09/03/v2023-released.html">
<p>A serious vulnerability exists in when using m_sasl in
combination with any services that support SASL EXTERNAL.
To be vulnerable you must have m_sasl loaded, and have services which
support SASL EXTERNAL authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2016/09/03/v2023-released.html</url>
</references>
<dates>
<discovery>2016-09-03</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="9e50dcc3-740b-11e6-94a2-080027ef73ec">
<topic>mailman -- CSRF hardening in parts of the web interface</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The late Tokio Kikuchi reported:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/775294">
<p>We may have to set lifetime for input forms because of recent
activities on cross-site request forgery (CSRF). The form lifetime
is successfully deployed in frameworks like web.py or plone etc.
Proposed branch lp:~tkikuchi/mailman/form-lifetime implement
lifetime in admin, admindb, options and edithtml interfaces.
[...]</p>
</blockquote>
<blockquote cite="https://launchpad.net/mailman/2.1/2.1.15">
<p>The web admin interface has been hardened against CSRF attacks by
adding a hidden, encrypted token with a time stamp to form submissions
and not accepting authentication by cookie if the token is missing,
invalid or older than the new mm_cfg.py setting FORM_LIFETIME which
defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/775294</url>
<url>https://launchpad.net/mailman/2.1/2.1.15</url>
<cvename>CVE-2016-7123</cvename>
</references>
<dates>
<discovery>2011-05-02</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="adccefd1-7080-11e6-a2cb-c80aa9043978">
<topic>openssh -- sshd -- remote valid user discovery and PAM /bin/login attack</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/release-7.3">
<p>* sshd(8): Mitigate timing differences in password authentication
that could be used to discern valid from invalid account names
when long passwords were sent and particular password hashing
algorithms are in use on the server. CVE-2016-6210, reported by
EddieEzra.Harari at verint.com
</p>
<p> * sshd(8): (portable only) Ignore PAM environment vars when
UseLogin=yes. If PAM is configured to read user-specified
environment variables and UseLogin=yes in sshd_config, then a
hostile local user may attack /bin/login via LD_PRELOAD or
similar environment variables set via PAM. CVE-2015-8325,
found by Shayan Sadigh.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.3</url>
<cvename>CVE-2016-6210</cvename>
<cvename>CVE-2015-8325</cvename>
</references>
<dates>
<discovery>2016-08-01</discovery>
<entry>2016-09-01</entry>
</dates>
</vuln>
<vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
<topic>mailman -- CSRF protection enhancements</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
<p>CSRF protection has been extended to the user options page. This
was actually fixed by Tokio Kikuchi as part of the fix for LP:
#775294 and intended for Mailman 2.1.15, but that fix wasn't
completely merged at the time. The full fix also addresses the
admindb, and edithtml pages as well as the user options page and the
previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
<url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
<cvename>CVE-2016-6893</cvename>
</references>
<dates>
<discovery>2016-08-19</discovery>
<entry>2016-08-29</entry>
</dates>
</vuln>
<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veillard reports:</p>
<blockquote cite="https://mail.gnome.org/archives/xml/2016-May/msg00023.html">
<p>More format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Avoid building recursive entities (Daniel Veillard)</p>
<p>Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)</p>
<p>Heap-based buffer-underreads due to xmlParseName (David Kilzer)</p>
<p>Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)</p>
<p>Heap use-after-free in htmlParsePubidLiteral and
htmlParseSystemiteral (Pranjal Jumde)</p>
<p>Fix some format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Detect change of encoding when parsing HTML names (Hugh Davenport)</p>
<p>Fix inappropriate fetch of entities content (Daniel Veillard)</p>
<p>Bug 759398: Heap use-after-free in xmlDictComputeFastKey
(Pranjal Jumde)</p>
<p>Bug 758605: Heap-based buffer overread in xmlDictAddString
(Pranjal Jumde)</p>
<p>Bug 758588: Heap-based buffer overread in
xmlParserPrintFileContextInternal (David Kilzer)</p>
<p>Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
(Pranjal Jumde)</p>
<p>Add missing increments of recursion depth counter to XML parser.
(Peter Simons)</p>
<p>Fix NULL pointer deref in XPointer range-to</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/xml/2016-May/msg00023.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=759398</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758605</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758588</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=757711</url>
<url>https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb</url>
<cvename>CVE-2016-1762</cvename>
<cvename>CVE-2016-1833</cvename>
<cvename>CVE-2016-1834</cvename>
<cvename>CVE-2016-1835</cvename>
<cvename>CVE-2016-1836</cvename>
<cvename>CVE-2016-1837</cvename>
<cvename>CVE-2016-1838</cvename>
<cvename>CVE-2016-1839</cvename>
<cvename>CVE-2016-1840</cvename>
<cvename>CVE-2016-3627</cvename>
<cvename>CVE-2016-3705</cvename>
<cvename>CVE-2016-4449</cvename>
<cvename>CVE-2016-4483</cvename>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-08-28</entry>
</dates>
</vuln>
<vuln vid="4472ab39-6c66-11e6-9ca5-50e549ebab6c">
<topic>kdelibs -- directory traversal vulnerability</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Faure reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160724-1.txt">
<p>A maliciously crafted archive (.zip or .tar.bz2) with "../" in the
file paths could be offered for download via the KNewStuff
framework (e.g. on www.kde-look.org), and upon extraction would
install files anywhere in the user's home directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6232</cvename>
<url>https://www.kde.org/info/security/advisory-20160724-1.txt</url>
</references>
<dates>
<discovery>2016-07-24</discovery>
<entry>2016-08-27</entry>
</dates>
</vuln>
<vuln vid="f5035ead-688b-11e6-8b1d-c86000169601">
<topic>eog -- out-of-bounds write</topic>
<affects>
<package>
<name>eog</name>
<range><lt>3.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felix Riemann reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html">
<p>CVE-2016-6855 out-of-bounds write in eog 3.10.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html</url>
<cvename>CVE-2016-6855</cvename>
</references>
<dates>
<discovery>2016-08-21</discovery>
<entry>2016-08-22</entry>
</dates>
</vuln>
<vuln vid="44989c29-67d1-11e6-8b1d-c86000169601">
<topic>fontconfig -- insufficiently cache file validation</topic>
<affects>
<package>
<name>fontconfig</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian security team reports:</p>
<blockquote cite="https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html">
<p>Tobias Stoeckmann discovered that cache files are insufficiently
validated in fontconfig, a generic font configuration library. An
attacker can trigger arbitrary free() calls, which in turn allows
double free attacks and therefore arbitrary code execution. In
combination with setuid binaries using crafted cache files, this
could allow privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html</url>
<cvename>CVE-2016-5384</cvename>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-08-21</entry>
</dates>
</vuln>
<vuln vid="7fe7df75-6568-11e6-a590-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>python32</name>
<name>python31</name>
<name>python30</name>
<name>python26</name>
<name>python25</name>
<name>python24</name>
<name>python23</name>
<name>python22</name>
<name>python21</name>
<name>python20</name>
<name>python15</name>
<range><ge>0</ge></range>
</package>
<package>
<name>php54</name>
<name>php53</name>
<name>php52</name>
<name>php5</name>
<name>php4</name>
<range><ge>0</ge></range>
</package>
<package>
<name>perl5</name>
<range><lt>5.18</lt></range>
</package>
<package>
<name>perl5.16</name>
<name>perl5.14</name>
<name>perl5.12</name>
<name>perl</name> <!-- Perl 5.10 and earlier were called "perl" -->
<range><ge>0</ge></range>
</package>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><lt>2.1,1</lt></range>
</package>
<package>
<name>unifi2</name>
<name>unifi3</name>
<range><ge>0</ge></range>
</package>
<package>
<name>apache21</name>
<name>apache20</name>
<name>apache13</name>
<range><ge>0</ge></range>
</package>
<package>
<name>tomcat55</name>
<name>tomcat41</name>
<range><ge>0</ge></range>
</package>
<package>
<name>mysql51-client</name>
<name>mysql51-server</name>
<name>mysql50-client</name>
<name>mysql50-server</name>
<name>mysql41-client</name>
<name>mysql41-server</name>
<name>mysql40-client</name>
<name>mysql40-server</name>
<range><ge>0</ge></range>
</package>
<package>
<name>postgresql90-client</name>
<name>postgresql90-server</name>
<name>postgresql84-client</name>
<name>postgresql84-server</name>
<name>postgresql83-client</name>
<name>postgresql83-server</name>
<name>postgresql82-client</name>
<name>postgresql82-server</name>
<name>postgresql81-client</name>
<name>postgresql81-server</name>
<name>postgresql80-client</name>
<name>postgresql80-server</name>
<name>postgresql74-client</name>
<name>postgresql74-server</name>
<name>postgresql73-client</name>
<name>postgresql73-server</name>
<name>postgresql72-client</name>
<name>postgresql72-server</name>
<name>postgresql71-client</name>
<name>postgresql71-server</name>
<name>postgresql7-client</name>
<name>postgresql7-server</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2016-08-18</discovery>
<entry>2016-08-18</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="e1c71d8d-64d9-11e6-b38a-25a46b33f2ed">
<topic>gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output</topic>
<affects>
<package>
<name>gnupg1</name>
<range><lt>1.4.21</lt></range>
</package>
<package>
<name>libgcrypt</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>linux-c6-libgcrypt</name>
<range><lt>1.4.5_4</lt></range>
</package>
<package>
<name>linux-c7-libgcrypt</name>
<range><lt>1.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html">
<p>There was a bug in the mixing functions of Libgcrypt's random
number generator: An attacker who obtains 4640 bits from the RNG can
trivially predict the next 160 bits of output. This bug exists since
1998 in all GnuPG and Libgcrypt versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html</url>
<cvename>CVE-2016-6313</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-18</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="ef70b201-645d-11e6-9cdc-6805ca0b3d42">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-29/">
<p>Weakness with cookie encryption</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-30/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-31/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-32/">
<p>PHP code injection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-33/">
<p>Full path disclosure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-34/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-35/">
<p>Local file exposure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-36/">
<p>Local file exposure through symlinks with
UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-37/">
<p>Path traversal with SaveDir and UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-38/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-39/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-40/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-41/">
<p>Denial of service (DOS) attack in transformation
feature</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-42/">
<p>SQL injection attack as control user</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-43/">
<p>Unvalidated data passed to unserialize()</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-45/">
<p>DOS attack with forced persistent connections</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-46/">
<p>Denial of service (DOS) attack by for loops</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-47/">
<p>IPv6 and proxy server IP-based authentication rule
circumvention</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-48/">
<p>Detect if user is logged in</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-49/">
<p>Bypass URL redirect protection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-50/">
<p>Referrer leak in url.php</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-51/">
<p>Reflected File Download attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-52/">
<p>ArbitraryServerRegexp bypass</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-53/">
<p>Denial of service (DOS) attack by changing password to a
very long string</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-54/">
<p>Remote code execution vulnerability when run as CGI</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-55/">
<h3>Summary</h3>
<p>Denial of service (DOS) attack with dbase extension</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-56/">
<p>Remote code execution vulnerability when PHP is running
with dbase extension</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-29/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-30/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-31/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-32/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-33/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-34/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-35/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-36/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-37/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-38/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-39/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-40/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-41/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-42/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-43/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-45/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-46/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-47/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-48/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-49/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-50/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-51/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-52/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-53/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-54/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-55/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-56/</url>
<cvename>CVE-2016-6606</cvename>
<cvename>CVE-2016-6607</cvename>
<cvename>CVE-2016-6608</cvename>
<cvename>CVE-2016-6609</cvename>
<cvename>CVE-2016-6610</cvename>
<cvename>CVE-2016-6611</cvename>
<cvename>CVE-2016-6612</cvename>
<cvename>CVE-2016-6613</cvename>
<cvename>CVE-2016-6614</cvename>
<cvename>CVE-2016-6615</cvename>
<cvename>CVE-2016-6616</cvename>
<cvename>CVE-2016-6617</cvename>
<cvename>CVE-2016-6618</cvename>
<cvename>CVE-2016-6619</cvename>
<cvename>CVE-2016-6620</cvename>
<cvename>CVE-2016-6622</cvename>
<cvename>CVE-2016-6623</cvename>
<cvename>CVE-2016-6624</cvename>
<cvename>CVE-2016-6625</cvename>
<cvename>CVE-2016-6626</cvename>
<cvename>CVE-2016-6627</cvename>
<cvename>CVE-2016-6628</cvename>
<cvename>CVE-2016-6629</cvename>
<cvename>CVE-2016-6630</cvename>
<cvename>CVE-2016-6631</cvename>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-17</entry>
</dates>
</vuln>
<vuln vid="f7dd2d09-625e-11e6-828b-fcaa14edc6a6">
<topic>TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution</topic>
<affects>
<package>
<name>teamspeak3-server</name>
<range><le>3.0.13_1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanz Jenson audit report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2016/Aug/61">
<p>I found 10 vulnerabilities. Some of these are critical and allow remote code
execution. For the average user, that means that these vulnerabilities can be
exploited by a malicious attacker in order to take over any Teamspeak server,
not only becoming serveradmin, but getting a shell on the affected machine.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/fulldisclosure/2016/Aug/61</url>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2016-08-14</entry>
</dates>
</vuln>
<vuln vid="df502a2f-61f6-11e6-a461-643150d3111d">
<topic>puppet-agent MCollective plugin -- Remote Code Execution vulnerability</topic>
<affects>
<package>
<name>mcollective-puppet-agent</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/security/cve/cve-2015-7331">
<p>Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.</p>
</blockquote>
</body>
</description>
<references>
<url>https://puppet.com/security/cve/cve-2015-7331</url>
<cvename>CVE-2015-7331</cvename>
</references>
<dates>
<discovery>2016-08-09</discovery>
<entry>2016-08-15</entry>
</dates>
</vuln>
<vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Heap vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_6</lt></range>
<range><ge>10.2</ge><lt>10.2_20</lt></range>
<range><ge>10.1</ge><lt>10.1_37</lt></range>
<range><ge>9.3</ge><lt>9.3_45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch does not check for a
negative value on numbers of bytes read from the diff and
extra streams, allowing an attacker who can control the
patch file to write at arbitrary locations in the heap.</p>
<p>This issue was first discovered by The Chromium Project
and reported independently by Lu Tung-Pin to the FreeBSD
project.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<cvename>CVE-2014-9862</cvename>
<freebsdsa>SA-16:25.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-07-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple ntp vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_5</lt></range>
<range><ge>10.2</ge><lt>10.2_19</lt></range>
<range><ge>10.1</ge><lt>10.1_36</lt></range>
<range><ge>9.3</ge><lt>9.3_44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that
could cause ntpd to crash. [CVE-2016-4957, Reported by
Nicolas Edet of Cisco]</p>
<p>An attacker who knows the origin timestamp and can send
a spoofed packet containing a CRYPTO-NAK to an ephemeral
peer target before any other response is sent can demobilize
that association. [CVE-2016-4953, Reported by Miroslav
Lichvar of Red Hat]</p>
<p>An attacker who is able to spoof packets with correct
origin timestamps from enough servers before the expected
response packets arrive at the target machine can affect
some peer variables and, for example, cause a false leap
indication to be set. [CVE-2016-4954, Reported by Jakub
Prokes of Red Hat]</p>
<p>An attacker who is able to spoof a packet with a correct
origin timestamp before the expected response packet arrives
at the target machine can send a CRYPTO_NAK or a bad MAC
and cause the association's peer variables to be cleared.
If this can be done often enough, it will prevent that
association from working. [CVE-2016-4955, Reported by
Miroslav Lichvar of Red Hat]</p>
<p>The fix for NtpBug2978 does not cover broadcast associations,
so broadcast clients can be triggered to flip into interleave
mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red
Hat.]</p>
<h1>Impact:</h1>
<p>Malicious remote attackers may be able to break time
synchronization, or cause the ntpd(8) daemon to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2016-4953</cvename>
<cvename>CVE-2016-4954</cvename>
<cvename>CVE-2016-4955</cvename>
<cvename>CVE-2016-4956</cvename>
<cvename>CVE-2016-4957</cvename>
<freebsdsa>SA-16:24.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-06-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of historic stat(2) system call does
not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:21.43bsd</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of the TIOCGSERIAL ioctl(2) does not
clear the output struct before copying it out to userland.</p>
<p>The implementation of the Linux sysinfo() system call
does not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:20.linux</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect argument handling in the socket code allows
malicious local user to overwrite large portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>Malicious local user may crash kernel or execute arbitrary
code in the kernel, potentially gaining superuser privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1887</cvename>
<freebsdsa>SA-16:19.sendmsg</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in keyboard driver</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
<range><ge>9.3</ge><lt>9.3_42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect signedness comparison in the ioctl(2) handler
allows a malicious local user to overwrite a portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>A local user may crash the kernel, read a portion of
kernel memory and execute arbitrary code in kernel context.
The result of executing an arbitrary kernel code is privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1886</cvename>
<freebsdsa>SA-16:18.atkbd</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
<range><ge>10.3</ge><lt>10.3_11</lt></range>
<range><ge>10.2</ge><lt>10.2_24</lt></range>
<range><ge>10.1</ge><lt>10.1_41</lt></range>
<range><ge>9.3</ge><lt>9.3_49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A special combination of sysarch(2) arguments, specify
a request to uninstall a set of descriptors from the LDT.
The start descriptor is cleared and the number of descriptors
are provided. Due to lack of sufficient bounds checking
during argument validity verification, unbound zero'ing of
the process LDT and adjacent memory can be initiated from
usermode.</p>
<h1>Impact:</h1>
<p>This vulnerability could cause the kernel to panic. In
addition it is possible to perform a local Denial of Service
against the system by unprivileged processes.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1885</cvename>
<freebsdsa>SA-16:15.sysarch</freebsdsa>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-08-11</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_13</lt></range>
<range><ge>10.1</ge><lt>10.1_30</lt></range>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A cross-protocol attack was discovered that could lead
to decryption of TLS sessions by using a server supporting
SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA
padding oracle. Note that traffic between clients and
non-vulnerable servers can be decrypted provided another
server supporting SSLv2 and EXPORT ciphers (even with a
different protocol such as SMTP, IMAP or POP3) shares the
RSA keys of the non-vulnerable server. This vulnerability
is known as DROWN. [CVE-2016-0800]</p>
<p>A double free bug was discovered when OpenSSL parses
malformed DSA private keys and could lead to a DoS attack
or memory corruption for applications that receive DSA
private keys from untrusted sources. This scenario is
considered rare. [CVE-2016-0705]</p>
<p>The SRP user database lookup method SRP_VBASE_get_by_user
had confusing memory management semantics; the returned
pointer was sometimes newly allocated, and sometimes owned
by the callee. The calling code has no way of distinguishing
these two cases. [CVE-2016-0798]</p>
<p>In the BN_hex2bn function, the number of hex digits is
calculated using an int value |i|. Later |bn_expand| is
called with a value of |i * 4|. For large values of |i|
this can result in |bn_expand| not allocating any memory
because |i * 4| is negative. This can leave the internal
BIGNUM data field as NULL leading to a subsequent NULL
pointer dereference. For very large values of |i|, the
calculation |i * 4| could be a positive value smaller than
|i|. In this case memory is allocated to the internal BIGNUM
data field, but it is insufficiently sized leading to heap
corruption. A similar issue exists in BN_dec2bn. This could
have security consequences if BN_hex2bn/BN_dec2bn is ever
called by user applications with very large untrusted hex/dec
data. This is anticipated to be a rare occurrence.
[CVE-2016-0797]</p>
<p>The internal |fmtstr| function used in processing a "%s"
formatted string in the BIO_*printf functions could overflow
while calculating the length of a string and cause an
out-of-bounds read when printing very long strings.
[CVE-2016-0799]</p>
<p>A side-channel attack was found which makes use of
cache-bank conflicts on the Intel Sandy-Bridge microarchitecture
which could lead to the recovery of RSA keys. [CVE-2016-0702]</p>
<p>s2_srvr.c did not enforce that clear-key-length is 0 for
non-export ciphers. If clear-key bytes are present for these
ciphers, they displace encrypted-key bytes. [CVE-2016-0703]</p>
<p>s2_srvr.c overwrites the wrong bytes in the master key
when applying Bleichenbacher protection for export cipher
suites. [CVE-2016-0704]</p>
<h1>Impact:</h1>
<p>Servers that have SSLv2 protocol enabled are vulnerable
to the "DROWN" attack which allows a remote attacker to
fast attack many recorded TLS connections made to the server,
even when the client did not make any SSLv2 connections
themselves.</p>
<p>An attacker who can supply malformed DSA private keys
to OpenSSL applications may be able to cause memory corruption
which would lead to a Denial of Service condition.
[CVE-2016-0705]</p>
<p>An attacker connecting with an invalid username can cause
memory leak, which could eventually lead to a Denial of
Service condition. [CVE-2016-0798]</p>
<p>An attacker who can inject malformed data into an
application may be able to cause memory corruption which
would lead to a Denial of Service condition. [CVE-2016-0797,
CVE-2016-0799]</p>
<p>A local attacker who has control of code in a thread
running on the same hyper-threaded core as the victim thread
which is performing decryptions could recover RSA keys.
[CVE-2016-0702]</p>
<p>An eavesdropper who can intercept SSLv2 handshake can
conduct an efficient divide-and-conquer key recovery attack
and use the server as an oracle to determine the SSLv2
master-key, using only 16 connections to the server and
negligible computation. [CVE-2016-0703]</p>
<p>An attacker can use the Bleichenbacher oracle, which
enables more efficient variant of the DROWN attack.
[CVE-2016-0704]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0703</cvename>
<cvename>CVE-2016-0704</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
<cvename>CVE-2016-0798</cvename>
<cvename>CVE-2016-0799</cvename>
<cvename>CVE-2016-0800</cvename>
<freebsdsa>SA-16:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
could cause the issetugid(2) system call to return incorrect
information.</p>
<h1>Impact:</h1>
<p>If an application relies on output of the issetugid(2)
system call and that information is incorrect, this could
lead to a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1883</cvename>
<freebsdsa>SA-16:10.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default snmpd.config permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SNMP protocol supports an authentication model called
USM, which relies on a shared secret. The default permission
of the snmpd configuration file, /etc/snmpd.config, is
weak and does not provide adequate protection against local
unprivileged users.</p>
<h1>Impact:</h1>
<p>A local user may be able to read the shared secret, if
configured and used by the system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5677</cvename>
<freebsdsa>SA-16:06.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP MD5 signature denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in processing a TCP connection with
both TCP_MD5SIG and TCP_NOOPT socket options may lead to
kernel crash.</p>
<h1>Impact:</h1>
<p>A local attacker can crash the kernel, resulting in a
denial-of-service.</p>
<p>A remote attack is theoretically possible, if server has
a listening socket with TCP_NOOPT set, and server is either
out of SYN cache entries, or SYN cache is disabled by
configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1882</cvename>
<freebsdsa>SA-16:05.tcp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
setgroups(2) system call can lead to an unexpected results,
such as overwriting random kernel memory contents.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to overwrite portions
of kernel memory, which may result in a privilege escalation
or cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1881</cvename>
<freebsdsa>SA-16:04.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the handling of Linux futex robust
lists may result in incorrect memory locations being
accessed.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to read portions of
kernel memory, which may result in a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1880</cvename>
<freebsdsa>SA-16:03.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A lack of proper input checks in the ICMPv6 processing
in the SCTP stack can lead to either a failed kernel assertion
or to a NULL pointer dereference. In either case, a kernel
panic will follow.</p>
<h1>Impact:</h1>
<p>A remote, unauthenticated attacker can reliably trigger
a kernel panic in a vulnerable system running IPv6. Any
kernel compiled with both IPv6 and SCTP support is vulnerable.
There is no requirement to have an SCTP socket open.</p>
<p>IPv4 ICMP processing is not impacted by this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1879</cvename>
<freebsdsa>SA-16:01.sctp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_5</lt></range>
<range><ge>10.1</ge><lt>10.1_22</lt></range>
<range><ge>9.3</ge><lt>9.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In rpcbind(8), netbuf structures are copied directly,
which would result in two netbuf structures that reference
to one shared address buffer. When one of the two netbuf
structures is freed, access to the other netbuf structure
would result in an undefined result that may crash the
rpcbind(8) daemon.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send specifically crafted
packets to the rpcbind(8) daemon can cause it to crash,
resulting in a denial of service condition.</p>
</body>
</description>
<references>
<cvename>CVE-2015-7236</cvename>
<freebsdsa>SA-15:24.rpcbind</freebsdsa>
</references>
<dates>
<discovery>2015-09-29</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0dfa5dde-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Local privilege escalation in IRET handler</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the kernel-mode IRET instruction generates an #SS or
#NP exception, but the exception handler does not properly
ensure that the right GS register base for kernel is reloaded,
the userland GS segment may be used in the context of the
kernel exception handler.</p>
<h1>Impact:</h1>
<p>By causing an IRET with #SS or #NP exceptions, a local
attacker can cause the kernel to use an arbitrary GS base,
which may allow escalated privileges or panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5675</cvename>
<freebsdsa>SA-15:21.amd64</freebsdsa>
</references>
<dates>
<discovery>2015-08-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0da8a68e-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_18</lt></range>
<range><ge>10.2</ge><lt>10.2_1</lt></range>
<range><ge>9.3</ge><lt>9.3_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple integer overflows have been discovered in the
XML_GetBuffer() function in the expat library.</p>
<h1>Impact:</h1>
<p>The integer overflows may be exploited by using specifically
crafted XML data and lead to infinite loop, or a heap buffer
overflow, which results in a Denial of Service condition,
or enables remote attackers to execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1283</cvename>
<freebsdsa>SA-15:20.expat</freebsdsa>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d584493-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
<range><ge>9.3</ge><lt>9.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5674</cvename>
<freebsdsa>SA-15:19.routed</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d090952-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to pass certain ed(1) scripts to the ed(1) editor, which
would run commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1418</cvename>
<freebsdsa>SA-15:18.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0cb9d5bb-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a mistake with the introduction of VNET, which
converted the global limit on the number of segments that
could belong to reassembly queues into a per-VNET limit.
Because mbufs are allocated from a global pool, in the
presence of a sufficient number of VNETs, the total number
of mbufs attached to reassembly queues can grow to the total
number of mbufs in the system, at which point all network
traffic would cease.</p>
<h1>Impact:</h1>
<p>An attacker who can establish concurrent TCP connections
across a sufficient number of VNETs and manipulate the
inbound packet streams such that the maximum number of mbufs
are enqueued on each reassembly queue can cause mbuf cluster
exhaustion on the target system, resulting in a Denial of
Service condition.</p>
<p>As the default per-VNET limit on the number of segments
that can belong to reassembly queues is 1/16 of the total
number of mbuf clusters in the system, only systems that
have 16 or more VNET instances are vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1417</cvename>
<freebsdsa>SA-15:15.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c6759dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to run commands in addition to the desired SCCS or RCS
commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1416</cvename>
<freebsdsa>SA-15:14.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c064c43-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_15</lt></range>
<range><ge>9.3</ge><lt>9.3_20</lt></range>
<range><ge>8.4</ge><lt>8.4_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>TCP connections transitioning to the LAST_ACK state can
become permanently stuck due to mishandling of protocol
state in certain situations, which in turn can lead to
accumulated consumption and eventual exhaustion of system
resources, such as mbufs and sockets.</p>
<h1>Impact:</h1>
<p>An attacker who can repeatedly establish TCP connections
to a victim system (for instance, a Web server) could create
many TCP connections that are stuck in LAST_ACK state and
cause resource exhaustion, resulting in a denial of service
condition. This may also happen in normal operation where
no intentional attack is conducted, but an attacker who can
send specifically crafted packets can trigger this more
reliably.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5358</cvename>
<freebsdsa>SA-15:13.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0bb55a18-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service with IPv6 Router Advertisements</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The Neighbor Discover Protocol allows a local router to
advertise a suggested Current Hop Limit value of a link,
which will replace Current Hop Limit on an interface connected
to the link on the FreeBSD system.</p>
<h1>Impact:</h1>
<p>When the Current Hop Limit (similar to IPv4's TTL) is
small, IPv6 packets may get dropped before they reached
their destinations.</p>
<p>By sending specifically crafted Router Advertisement
packets, an attacker on the local network can cause the
FreeBSD system to lose the ability to communicate with
another IPv6 node on a different network.</p>
</body>
</description>
<references>
<cvename>CVE-2015-2923</cvename>
<freebsdsa>SA-15:09.ipv6</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0b65f297-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default GELI keyfile permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default permission set by bsdinstall(8) installer
when configuring full disk encrypted ZFS is too open.</p>
<h1>Impact:</h1>
<p>A local attacker may be able to get a copy of the geli(8)
provider's keyfile which is located at a fixed location.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1415</cvename>
<freebsdsa>SA-15:08.bsdinstall</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0afe8b29-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Integer overflow in IGMP protocol</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An integer overflow in computing the size of IGMPv3 data
buffer can result in a buffer which is too small for the
requested operation.</p>
<h1>Impact:</h1>
<p>An attacker who can send specifically crafted IGMP packets
could cause a denial of service situation by causing the
kernel to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1414</cvename>
<freebsdsa>SA-15:04.igmp</freebsdsa>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0aad3ce5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP stream reset vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input validation of received SCTP RE_CONFIG chunks
is insufficient, and can result in a NULL pointer deference
later.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a malformed SCTP packet
to a FreeBSD system that serves SCTP can cause a kernel
panic, resulting in a Denial of Service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8613</cvename>
<freebsdsa>SA-15:03.sctp</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0a5cf6d8-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of the SCTP stream ID,
which serves as an array index, a local unprivileged attacker
can read or write 16-bits of kernel memory.</p>
<h1>Impact:</h1>
<p>An unprivileged process can read or modify 16-bits of
memory which belongs to the kernel. This may lead to
exposure of sensitive information or allow privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8612</cvename>
<freebsdsa>SA-15:02.kmem</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74ded00e-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in stdio</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the standard I/O library's
__sflush() function could erroneously adjust the buffered
stream's internal state even when no write actually occurred
in the case when write(2) system call returns an error.</p>
<h1>Impact:</h1>
<p>The accounting mismatch would accumulate, if the caller
does not check for stream status and will eventually lead
to a heap buffer overflow.</p>
<p>Such overflows may lead to data corruption or the execution
of arbitrary code at the privilege level of the calling
program.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8611</cvename>
<freebsdsa>SA-14:27.stdio</freebsdsa>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7488378d-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Remote command execution in ftp(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A malicious HTTP server could cause ftp(1) to execute
arbitrary commands.</p>
<h1>Impact:</h1>
<p>When operating on HTTP URIs, the ftp(1) client follows
HTTP redirects, and uses the part of the path after the
last '/' from the last resource it accesses as the output
filename if '-o' is not specified.</p>
<p>If the output file name provided by the server begins
with a pipe ('|'), the output is passed to popen(3), which
might be used to execute arbitrary commands on the ftp(1)
client machine.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8517</cvename>
<freebsdsa>SA-14:26.ftp</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74389f22-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When setlogin(2) is called while setting up a new login
session, the login name is copied into an uninitialized
stack buffer, which is then copied into a buffer of the
same size in the session structure. The getlogin(2) system
call returns the entire buffer rather than just the portion
occupied by the login name associated with the session.</p>
<h1>Impact:</h1>
<p>An unprivileged user can access this memory by calling
getlogin(2) and reading beyond the terminating NUL character
of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD
9 and 10) bytes of kernel memory may be leaked in this
manner for each invocation of setlogin(2).</p>
<p>This memory may contain sensitive information, such as
portions of the file cache or terminal buffers, which an
attacker might leverage to obtain elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8476</cvename>
<freebsdsa>SA-14:25.setlogin</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73e9a137-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of service attack against sshd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Although OpenSSH is not multithreaded, when OpenSSH is
compiled with Kerberos support, the Heimdal libraries bring
in the POSIX thread library as a dependency. Due to incorrect
library ordering while linking sshd(8), symbols in the C
library which are shadowed by the POSIX thread library may
not be resolved correctly at run time.</p>
<p>Note that this problem is specific to the FreeBSD build
system and does not affect other operating systems or the
version of OpenSSH available from the FreeBSD ports tree.</p>
<h1>Impact:</h1>
<p>An incorrectly linked sshd(8) child process may deadlock
while handling an incoming connection. The connection may
then time out or be interrupted by the client, leaving the
deadlocked sshd(8) child process behind. Eventually, the
sshd(8) parent process stops accepting new connections.</p>
<p>An attacker may take advantage of this by repeatedly
connecting and then dropping the connection after having
begun, but not completed, the authentication process.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8475</cvename>
<freebsdsa>SA-14:24.sshd</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73964eac-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- memory leak in sandboxed namei lookup</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The namei facility will leak a small amount of kernel
memory every time a sandboxed process looks up a nonexistent
path name.</p>
<h1>Impact:</h1>
<p>A remote attacker that can cause a sandboxed process
(for instance, a web server) to look up a large number of
nonexistent path names can cause memory exhaustion.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3711</cvename>
<freebsdsa>SA-14:22.namei</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="734233f4-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
<range><ge>8.4</ge><lt>8.4_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3955</cvename>
<freebsdsa>SA-14:21.routed</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="72ee7111-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rtsold(8) remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a missing length check in the code that handles
DNS parameters, a malformed router advertisement message
can result in a stack buffer overflow in rtsold(8).</p>
<h1>Impact:</h1>
<p>Receipt of a router advertisement message with a malformed
DNSSL option, for instance from a compromised host on the
same network, can cause rtsold(8) to crash.</p>
<p>While it is theoretically possible to inject code into
rtsold(8) through malformed router advertisement messages,
it is normally compiled with stack protection enabled,
rendering such an attack extremely difficult.</p>
<p>When rtsold(8) crashes, the existing DNS configuration
will remain in force, and the kernel will continue to receive
and process periodic router advertisements.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3954</cvename>
<freebsdsa>SA-14:20.rtsold</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="729c4a9f-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service in TCP packet processing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_9</lt></range>
<range><ge>9.3</ge><lt>9.3_2</lt></range>
<range><ge>9.2</ge><lt>9.2_12</lt></range>
<range><ge>9.1</ge><lt>9.1_19</lt></range>
<range><ge>8.4</ge><lt>8.4_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When a segment with the SYN flag for an already existing
connection arrives, the TCP stack tears down the connection,
bypassing a check that the sequence number in the segment
is in the expected window.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to spoof IP traffic can
tear down a TCP connection by sending only 2 packets, if
they know both TCP port numbers. In case one of the two
port numbers is unknown, a successful attack requires less
than 2**17 packets spoofed, which can be generated within
less than a second on a decent connection to the Internet.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0230</cvename>
<freebsdsa>SA-14:19.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7240de58-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in control messages and SCTP</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_7</lt></range>
<range><ge>9.2</ge><lt>9.2_10</lt></range>
<range><ge>9.1</ge><lt>9.1_17</lt></range>
<range><ge>8.4</ge><lt>8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Buffer between control message header and data may not
be completely initialized before being copied to userland.
[CVE-2014-3952]</p>
<p>Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO,
have implicit padding that may not be completely initialized
before being copied to userland. In addition, three SCTP
notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and
SCTP_AUTHENTICATION_EVENT, have padding in the returning
data structure that may not be completely initialized before
being copied to userland. [CVE-2014-3953]</p>
<h1>Impact:</h1>
<p>An unprivileged local process may be able to retrieve
portion of kernel memory.</p>
<p>For the generic control message, the process may be able
to retrieve a maximum of 4 bytes of kernel memory.</p>
<p>For SCTP, the process may be able to retrieve 2 bytes
of kernel memory for all three control messages, plus 92
bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the
local process is permitted to receive SCTP notification, a
maximum of 112 bytes of kernel memory may be returned to
userland.</p>
<p>This information might be directly useful, or it might
be leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3952</cvename>
<cvename>CVE-2014-3953</cvename>
<freebsdsa>SA-14:17.kmem</freebsdsa>
</references>
<dates>
<discovery>2014-07-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="70140f20-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
<range><ge>9.2</ge><lt>9.2_9</lt></range>
<range><ge>9.1</ge><lt>9.1_16</lt></range>
<range><ge>8.4</ge><lt>8.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specifically crafted Composite Document File (CDF)
file can trigger an out-of-bounds read or an invalid pointer
dereference. [CVE-2012-1571]</p>
<p>A flaw in regular expression in the awk script detector
makes use of multiple wildcards with unlimited repetitions.
[CVE-2013-7345]</p>
<p>A malicious input file could trigger infinite recursion
in libmagic(3). [CVE-2014-1943]</p>
<p>A specifically crafted Portable Executable (PE) can
trigger out-of-bounds read. [CVE-2014-2270]</p>
<h1>Impact:</h1>
<p>An attacker who can cause file(1) or any other applications
using the libmagic(3) library to be run on a maliciously
constructed input can the application to crash or consume
excessive CPU resources, resulting in a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2012-1571</cvename>
<cvename>CVE-2013-7345</cvename>
<cvename>CVE-2014-1943</cvename>
<cvename>CVE-2014-2270</cvename>
<freebsdsa>SA-14:16.file</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6f91a709-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A NULL pointer dereference in the initialization code
of the HZ module and an out of bounds array access in the
initialization code of the VIQR module make iconv_open(3)
calls involving HZ or VIQR result in an application crash.</p>
<h1>Impact:</h1>
<p>Services where an attacker can control the arguments of
an iconv_open(3) call can be caused to crash resulting in
a denial-of-service. For example, an email encoded in HZ
may cause an email delivery service to crash if it converts
emails to a more generic encoding like UTF-8 before applying
filtering rules.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3951</cvename>
<freebsdsa>SA-14:15.iconv</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e8f9003-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect error handling in PAM policy parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The OpenPAM library searches for policy definitions in
several locations. While doing so, the absence of a policy
file is a soft failure (handled by searching in the next
location) while the presence of an invalid file is a hard
failure (handled by returning an error to the caller).</p>
<p>The policy parser returns the same error code (ENOENT)
when a syntactically valid policy references a non-existent
module as when the requested policy file does not exist.
The search loop regards this as a soft failure and looks
for the next similarly-named policy, without discarding the
partially-loaded configuration.</p>
<p>A similar issue can arise if a policy contains an include
directive that refers to a non-existent policy.</p>
<h1>Impact:</h1>
<p>If a module is removed, or the name of a module is
misspelled in the policy file, the PAM library will proceed
with a partially loaded configuration. Depending on the
exact circumstances, this may result in a fail-open scenario
where users are allowed to log in without a password, or
with an incorrect password.</p>
<p>In particular, if a policy references a module installed
by a package or port, and that package or port is being
reinstalled or upgraded, there is a brief window of time
during which the module is absent and policies that use it
may fail open. This can be especially damaging to Internet-facing
SSH servers, which are regularly subjected to brute-force
scans.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3879</cvename>
<freebsdsa>SA-14:13.pam</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e04048b-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- ktrace kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to an overlooked merge to -STABLE branches, the size
for page fault kernel trace entries was set incorrectly.</p>
<h1>Impact:</h1>
<p>A user who can enable kernel process tracing could end
up reading the contents of kernel memory.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3873</cvename>
<freebsdsa>SA-14:12.ktrace</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d9eadaf-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- sendmail improper close-on-exec flag handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in sendmail(8) that prevented
open file descriptors have close-on-exec properly set.
Consequently a subprocess will be able to access all open
files that the parent process have open.</p>
<h1>Impact:</h1>
<p>A local user who can execute their own program for mail
delivery will be able to interfere with an open SMTP
connection.</p>
</body>
</description>
<references>
<freebsdsa>SA-14:11.sendmail</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d472244-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP reassembly vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>8.4</ge><lt>8.4_9</lt></range>
<range><ge>8.3</ge><lt>8.3_16</lt></range>
<range><ge>9.2</ge><lt>9.2_5</lt></range>
<range><ge>9.1</ge><lt>9.1_12</lt></range>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>FreeBSD may add a reassemble queue entry on the stack
into the segment list when the reassembly queue reaches its
limit. The memory from the stack is undefined after the
function returns. Subsequent iterations of the reassembly
function will attempt to access this entry.</p>
<h1>Impact:</h1>
<p>An attacker who can send a series of specifically crafted
packets with a connection could cause a denial of service
situation by causing the kernel to crash.</p>
<p>Additionally, because the undefined on stack memory may
be overwritten by other kernel threads, while extremely
difficult, it may be possible for an attacker to construct
a carefully crafted attack to obtain portion of kernel
memory via a connected socket. This may result in the
disclosure of sensitive information such as login credentials,
etc. before or even without crashing the system.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3000</cvename>
<freebsdsa>SA-14:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6b6ca5b6-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- devfs rules not applied by default for jails</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default devfs rulesets are not loaded on boot, even
when jails are used. Device nodes will be created in the
jail with their normal default access permissions, while
most of them should be hidden and inaccessible.</p>
<h1>Impact:</h1>
<p>Jailed processes can get access to restricted resources
on the host system. For jailed processes running with
superuser privileges this implies access to all devices on
the system. This level of access could lead to information
leakage and privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3001</cvename>
<freebsdsa>SA-14:07.devfs</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6a384960-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Deadlock in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
<range><ge>9.2</ge><lt>9.2_4</lt></range>
<range><ge>9.1</ge><lt>9.1_11</lt></range>
<range><ge>8.4</ge><lt>8.4_8</lt></range>
<range><ge>8.3</ge><lt>8.3_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel holds a lock over the source directory vnode
while trying to convert the target directory file handle
to a vnode, which needs to be returned with the lock held,
too. This order may be in violation of normal lock order,
which in conjunction with other threads that grab locks in
the right order, constitutes a deadlock condition because
no thread can proceed.</p>
<h1>Impact:</h1>
<p>An attacker on a trusted client could cause the NFS
server become deadlocked, resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1453</cvename>
<freebsdsa>SA-14:05.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2014-04-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- bsnmpd remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_3</lt></range>
<range><ge>9.1</ge><lt>9.1_10</lt></range>
<range><ge>8.4</ge><lt>8.4_7</lt></range>
<range><ge>8.3</ge><lt>8.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The bsnmpd(8) daemon is prone to a stack-based
buffer-overflow when it has received a specifically crafted
GETBULK PDU request.</p>
<p>Impact:</p>
<p>This issue could be exploited to execute arbitrary code in
the context of the service daemon, or crash the service daemon, causing
a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1452</cvename>
<freebsdsa>SA-14:01.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730">
<topic>PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.23</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.18</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1688/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2016-5423: certain nested CASE expressions can cause the
server to crash.
</li>
<li>CVE-2016-5424: database and role names with embedded special
characters can allow code injection during administrative operations
like pg_dumpall.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="https://piwik.org/changelog/piwik-2-16-2/">
<p>We have identified and fixed several XSS security issues in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>We have identified and fixed several XSS security issues in this release.</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
<topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
<affects>
<package>
<name>bind99</name>
<range><le>9.9.9P2</le></range>
</package>
<package>
<name>bind910</name>
<range><le>9.10.4P2</le></range>
</package>
<package>
<name>bind911</name>
<range><le>9.11.0.b2</le></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.11.02</le></range>
</package>
<package>
<name>knot</name>
<name>knot1</name>
<range><lt>1.6.8</lt></range>
</package>
<package>
<name>knot2</name>
<range><lt>2.3.0</lt></range>
</package>
<package>
<name>nsd</name>
<range><lt>4.1.11</lt></range>
</package>
<package>
<name>powerdns</name>
<range><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01390">
<p>DNS protocols were designed with the assumption that a certain
amount of trust could be presumed between the operators of primary
and secondary servers for a given zone. However, in current
practice some organizations have scenarios which require them to
accept zone data from sources that are not fully trusted (for
example: providers of secondary name service). A party who is
allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
updates) can overwhelm the server which is accepting data by
intentionally or accidentally exhausting that server's memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6170</cvename>
<cvename>CVE-2016-6171</cvename>
<cvename>CVE-2016-6172</cvename>
<cvename>CVE-2016-6173</cvename>
<url>https://kb.isc.org/article/AA-01390</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
</references>
<dates>
<discovery>2016-07-06</discovery>
<entry>2016-08-10</entry>
<modified>2017-04-24</modified>
</dates>
</vuln>
<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>When initializing the SCTP state cookie being sent in INIT-ACK chunks,
a buffer allocated from the kernel stack is not completely initialized.</p>
<p>Impact:</p>
<p>Fragments of kernel memory may be included in SCTP packets and
transmitted over the network. For each SCTP session, there are two
separate instances in which a 4-byte fragment may be transmitted.</p>
<p>This memory might contain sensitive information, such as portions of the
file cache or terminal buffers. This information might be directly
useful, or it might be leveraged to obtain elevated privileges in
some way. For example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<freebsdsa>SA-13:10.sctp</freebsdsa>
<cvename>CVE-2013-5209</cvename>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="0844632f-5e78-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- integer overflow in IP_MSFILTER</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>An integer overflow in computing the size of a temporary
buffer can result in a buffer which is too small for the requested
operation.</p>
<p>Impact:</p>
<p>An unprivileged process can read or write pages of memory
which belong to the kernel. These may lead to exposure of sensitive
information or allow privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2013-3077</cvename>
<freebsdsa>SA-13:09.ip_multicast</freebsdsa>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="e5d2442d-5e76-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect privilege validation in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_5</lt></range>
<range><ge>8.3</ge><lt>8.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The kernel incorrectly uses client supplied credentials
instead of the one configured in exports(5) when filling out the
anonymous credential for a NFS export, when -network or -host
restrictions are used at the same time.</p>
<p>Impact:</p>
<p>The remote client may supply privileged credentials (e.g. the
root user) when accessing a file under the NFS share, which will bypass
the normal access checks.</p>
</body>
</description>
<references>
<cvename>CVE-2013-4851</cvename>
<freebsdsa>SA-13:08.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2013-07-06</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="6da45e38-5b55-11e6-8859-000c292ee6b8">
<topic>collectd -- Network plugin heap overflow</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The collectd Project reports:</p>
<blockquote cite="http://collectd.org/news.shtml#news98">
<p>Emilien Gaspar has identified a heap overflow in collectd's
network plugin which can be triggered remotely and is potentially
exploitable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6254</cvename>
<url>http://collectd.org/news.shtml#news98</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-05</entry>
</dates>
</vuln>
<vuln vid="3ddcb42b-5b78-11e6-b334-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><le>2.8.12</le></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.7</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.5</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0019: Glossary search displays entries without
checking user permissions to view them</p></li>
<li><p>MSA-16-0020: Text injection in email headers</p></li>
<li><p>MSA-16-0021: Unenrolled user still receives event monitor
notifications even though they can no longer access course</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5012</cvename>
<cvename>CVE-2016-5013</cvename>
<cvename>CVE-2016-5014</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="7a31e0de-5b6d-11e6-b334-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P2</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.b2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.07.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01393">
<p>A query name which is too long can cause a segmentation fault in
lwresd.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2775</cvename>
<url>https://kb.isc.org/article/AA-01393</url>
</references>
<dates>
<discovery>2016-07-18</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="610101ea-5b6a-11e6-b334-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-41</p>
<p>PacketBB crash. (Bug 12577)</p></li>
<li><p>wnpa-sec-2016-42</p>
<p>WSP infinite loop. (Bug 12594)</p></li>
<li><p>wnpa-sec-2016-44</p>
<p>RLC long loop. (Bug 12660)</p></li>
<li><p>wnpa-sec-2016-45</p>
<p>LDSS dissector crash. (Bug 12662)</p></li>
<li><p>wnpa-sec-2016-46</p>
<p>RLC dissector crash. (Bug 12664)</p></li>
<li><p>wnpa-sec-2016-47</p>
<p>OpenFlow long loop. (Bug 12659)</p></li>
<li><p>wnpa-sec-2016-48</p>
<p>MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)</p></li>
<li><p>wnpa-sec-2016-49</p>
<p>WBXML crash. (Bug 12663)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6505</cvename>
<cvename>CVE-2016-6506</cvename>
<cvename>CVE-2016-6508</cvename>
<cvename>CVE-2016-6509</cvename>
<cvename>CVE-2016-6510</cvename>
<cvename>CVE-2016-6511</cvename>
<cvename>CVE-2016-6512</cvename>
<cvename>CVE-2016-6513</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/08/01/4</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="3e08047f-5a6c-11e6-a6c3-14dae9d210b8">
<topic>p5-XSLoader -- local arbitrary code execution</topic>
<affects>
<package>
<name>p5-XSLoader</name>
<range><lt>0.22</lt></range>
</package>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_24</lt></range>
<range><ge>5.20</ge><lt>5.20.3_15</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.2.87</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Wilk reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578">
<p>XSLoader tries to load code from a subdirectory in the cwd when
called inside a string eval</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578</url>
<cvename>CVE-2016-6185</cvename>
</references>
<dates>
<discovery>2016-06-30</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="72bfbb09-5a6a-11e6-a6c3-14dae9d210b8">
<topic>perl -- local arbitrary code execution</topic>
<affects>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_23</lt></range>
<range><ge>5.20</ge><lt>5.20.3_14</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.3.18</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sawyer X reports:</p>
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html">
<p>Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do
not properly remove . (period) characters from the end of the includes
directory array, which might allow local users to gain privileges via a
Trojan horse module under the current working directory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html</url>
<cvename>CVE-2016-1238</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="556d2286-5a51-11e6-a6c3-14dae9d210b8">
<topic>gd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Joye reports:</p>
<blockquote cite="https://github.com/libgd/libgd/releases/tag/gd-2.2.3">
<ul>
<li><p>fix php bug 72339, Integer Overflow in _gd2GetHeader
(CVE-2016-5766)</p></li>
<li><p>gd: Buffer over-read issue when parsing crafted TGA
file (CVE-2016-6132)</p></li>
<li><p>Integer overflow error within _gdContributionsAlloc()
(CVE-2016-6207)</p></li>
<li><p>fix php bug 72494, invalid color index not handled, can
lead to crash ( CVE-2016-6128)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.3</url>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-6132</cvename>
<cvename>CVE-2016-6207</cvename>
<cvename>CVE-2016-6128</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1">
<topic>Vulnerabilities in Curl</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.32.0</ge><lt>7.50.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Curl security team reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2016-5419 - TLS session resumption client cert bypass</p>
<p>CVE-2016-5420 - Re-using connections with wrong client cert</p>
<p>CVE-2016-5421 - use of connection struct after free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5419</cvename>
<cvename>CVE-2016-5420</cvename>
<cvename>CVE-2016-5421</cvename>
<url>https://curl.haxx.se/docs/adv_20160803A.html</url>
<url>https://curl.haxx.se/docs/adv_20160803B.html</url>
<url>https://curl.haxx.se/docs/adv_20160803C.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="ef0033ad-5823-11e6-80cc-001517f335e2">
<topic>lighttpd - multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="http://www.lighttpd.net/2016/7/31/1.4.41/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: encode quoting chars in HTML and XML</p></li>
<li><p>security: ensure gid != 0 if server.username is set, but not server.groupname</p></li>
<li><p>security: disable stat_cache if server.follow-symlink = “disable”</p></li>
<li><p>security: httpoxy defense: do not emit HTTP_PROXY to CGI env</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.lighttpd.net/2016/7/31/1.4.41/</url>
<freebsdpr>ports/211495</freebsdpr>
</references>
<dates>
<discovery>2016-07-31</discovery>
<entry>2016-08-03</entry>
</dates>
</vuln>
<vuln vid="06574c62-5854-11e6-b334-002590263bf5">
<topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
<p>A guest can submit virtio requests without bothering to wait for
completion and is therefore not bound by virtqueue size...</p>
<p>A malicious guest administrator can cause unbounded memory
allocation in QEMU, which can cause an Out-of-Memory condition
in the domain running qemu. Thus, a malicious guest administrator
can cause a denial of service affecting the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5403</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-184.html</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><gt>4.5</gt><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
<p>Supervisor Mode Access Prevention is a hardware feature designed
to make an Operating System more robust, by raising a pagefault
rather than accidentally following a pointer into userspace.
However, legitimate accesses into userspace require whitelisting,
and the exception delivery mechanism for 32bit PV guests wasn't
whitelisted.</p>
<p>A malicious 32-bit PV guest kernel can trigger a safety check,
crashing the hypervisor and causing a denial of service to other
VMs on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6259</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-183.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="032aa524-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
<p>The PV pagetable code has fast-paths for making updates to
pre-existing pagetable entries, to skip expensive re-validation
in safe cases (e.g. clearing only Access/Dirty bits). The bits
considered safe were too broad, and not actually safe.</p>
<p>A malicious PV guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6258</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-182.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
<topic>libidn -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
<p>libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.</p>
<p>idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.</p>
<p>libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
always documented to only accept UTF-8 data, but now it doesn't
crash when presented with such data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6261</cvename>
<cvename>CVE-2015-8948</cvename>
<cvename>CVE-2016-6262</cvename>
<cvename>CVE-2016-6263</cvename>
<url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-31</entry>
</dates>
</vuln>
<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
<topic>The GIMP -- Use after Free vulnerability</topic>
<affects>
<package>
<name>gimp-app</name>
<range><lt>2.8.18,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GIMP team reports:</p>
<blockquote cite="https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html">
<p>A Use-after-free vulnerability was found in the xcf_load_image function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=767873</url>
<cvename>CVE-2016-4994</cvename>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-07-19</entry>
</dates>
</vuln>
<vuln vid="cb09a7aa-5344-11e6-a7bd-14dae9d210b8">
<topic>xercesi-c3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt">
<p>The Xerces-C XML parser fails to successfully parse a
DTD that is deeply nested, and this causes a stack overflow, which
makes a denial of service attack against many applications possible
by an unauthenticated attacker.</p>
<p>Also, CVE-2016-2099: Use-after-free vulnerability in
validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier
allows context-dependent attackers to have unspecified impact via an
invalid character in an XML document.</p>
</blockquote>
</body>
</description>
<references>
<url>https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/09/7</url>
<cvename>CVE-2016-2099</cvename>
<cvename>CVE-2016-4463</cvename>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-curl</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-bz2</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-bz2</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-bz2</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-exif</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-exif</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-exif</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-gd</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-gd</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-mcrypt</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-odbc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-odbc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-odbc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-snmp</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-snmp</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-snmp</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-xmlrpc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-xmlrpc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-xmlrpc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-zip</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-zip</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-zip</name>
<range><lt>7.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
<ul>
<li><p>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</p></li>
<li><p>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</p></li>
<li><p>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</p></li>
<li><p>Fixed bug #72519 (imagegif/output out-of-bounds access).</p></li>
<li><p>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</p></li>
<li><p>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</p></li>
<li><p>Fixed bug #72541 (size_t overflow lead to heap corruption).</p></li>
<li><p>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</p></li>
<li><p>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</p></li>
<li><p>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</p></li>
<li><p>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</p></li>
<li><p>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</p></li>
<li><p>Fixed bug #72613 (Inadequate error handling in bzread()).</p></li>
<li><p>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
<url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
<url>http://seclists.org/oss-sec/2016/q3/121</url>
<cvename>CVE-2015-8879</cvename>
<cvename>CVE-2016-5385</cvename>
<cvename>CVE-2016-5399</cvename>
<cvename>CVE-2016-6288</cvename>
<cvename>CVE-2016-6289</cvename>
<cvename>CVE-2016-6290</cvename>
<cvename>CVE-2016-6291</cvename>
<cvename>CVE-2016-6292</cvename>
<cvename>CVE-2016-6294</cvename>
<cvename>CVE-2016-6295</cvename>
<cvename>CVE-2016-6296</cvename>
<cvename>CVE-2016-6297</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
<p>48 security fixes in this release, including:</p>
<ul>
<li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
<li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
Credit to Adam Varsan</li>
<li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
Credit to ChenQin of Topsec Security Team</li>
<li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
to cloudfuzzer</li>
<li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
to Anonymous</li>
<li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
Jeonghoon Shin</li>
<li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
Matar</li>
<li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
to Nick Wellnhofer</li>
<li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
Service Workers. Credit to Ben Kelly</li>
<li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
authentication. Credit to Patch Eudor</li>
<li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
Credit to Paul Stone</li>
<li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
Credit to kingxwy</li>
<li>[625393] Medium CVE-2016-5136: Use after free in extensions.
Credit to Rob Wu</li>
<li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
CSP. Credit to Xiaoyin Liu</li>
<li>[629852] CVE-2016-1705: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1705</cvename>
<cvename>CVE-2016-1706</cvename>
<cvename>CVE-2016-1708</cvename>
<cvename>CVE-2016-1709</cvename>
<cvename>CVE-2016-1710</cvename>
<cvename>CVE-2016-1711</cvename>
<cvename>CVE-2016-5127</cvename>
<cvename>CVE-2016-5128</cvename>
<cvename>CVE-2016-5129</cvename>
<cvename>CVE-2016-5130</cvename>
<cvename>CVE-2016-5131</cvename>
<cvename>CVE-2016-5132</cvename>
<cvename>CVE-2016-5133</cvename>
<cvename>CVE-2016-5134</cvename>
<cvename>CVE-2016-5135</cvename>
<cvename>CVE-2016-5136</cvename>
<cvename>CVE-2016-5137</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-22</entry>
</dates>
</vuln>
<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
<topic>krb5 -- KDC denial of service vulnerability</topic>
<affects>
<package>
<name>krb5-113</name>
<range><lt>1.13.6</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Major changes in krb5 1.14.3 and krb5 1.13.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.14/">
<p>Fix a rare KDC denial of service vulnerability when anonymous
client principals are restricted to obtaining TGTs only
[CVE-2016-3120] .</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3120</cvename>
<url>http://web.mit.edu/kerberos/krb5-1.14/</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-07-26</modified>
</dates>
</vuln>
<vuln vid="72f71e26-4f69-11e6-ac37-ac9e174be3af">
<topic>Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2_8</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1753426,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2016-1513.html">
<p>An OpenDocument Presentation .ODP or Presentation Template
.OTP file can contain invalid presentation elements that lead
to memory corruption when the document is loaded in Apache
OpenOffice Impress. The defect may cause the document to appear
as corrupted and OpenOffice may crash in a recovery-stuck mode
requiring manual intervention. A crafted exploitation of the
defect can allow an attacker to cause denial of service
(memory corruption and application crash) and possible
execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1513</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-07-21</entry>
</dates>
</vuln>
<vuln vid="ca5cb202-4f51-11e6-b2ec-b499baebfeaf">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mariadb100-server</name>
<range><le>10.0.25</le></range>
</package>
<package>
<name>mariadb101-server</name>
<range><le>10.1.14</le></range>
</package>
<package>
<name>mysql55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12_1</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>percona56-server</name>
<range><le>5.6.30</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL">
<p>The quarterly Critical Patch Update contains 22 new security fixes for
Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL</url>
<cvename>CVE-2016-3477</cvename>
<cvename>CVE-2016-3440</cvename>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-3471</cvename>
<cvename>CVE-2016-3486</cvename>
<cvename>CVE-2016-3501</cvename>
<cvename>CVE-2016-3518</cvename>
<cvename>CVE-2016-3521</cvename>
<cvename>CVE-2016-3588</cvename>
<cvename>CVE-2016-3615</cvename>
<cvename>CVE-2016-3614</cvename>
<cvename>CVE-2016-5436</cvename>
<cvename>CVE-2016-3459</cvename>
<cvename>CVE-2016-5437</cvename>
<cvename>CVE-2016-3424</cvename>
<cvename>CVE-2016-5439</cvename>
<cvename>CVE-2016-5440</cvename>
<cvename>CVE-2016-5441</cvename>
<cvename>CVE-2016-5442</cvename>
<cvename>CVE-2016-5443</cvename>
<cvename>CVE-2016-5444</cvename>
<cvename>CVE-2016-3452</cvename>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-08-08</modified>
</dates>
</vuln>
<vuln vid="3caf4e6c-4cef-11e6-a15f-00248c0c745d">
<topic>typo3 -- Missing access check in Extbase</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.8</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/">
<p>Extbase request handling fails to implement a proper access check for
requested controller/ action combinations, which makes it possible for an
attacker to execute arbitrary Extbase actions by crafting a special request. To
successfully exploit this vulnerability, an attacker must have access to at
least one Extbase plugin or module action in a TYPO3 installation. The missing
access check inevitably leads to information disclosure or remote code
execution, depending on the action that an attacker is able to execute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5091</cvename>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/</url>
<url>https://wiki.typo3.org/TYPO3_CMS_7.6.8</url>
<url>https://wiki.typo3.org/TYPO3_CMS_6.2.24</url>
</references>
<dates>
<discovery>2016-05-24</discovery>
<entry>2016-07-18</entry>
</dates>
</vuln>
<vuln vid="cf0b5668-4d1b-11e6-b2ec-b499baebfeaf">
<cancelled/>
</vuln>
<vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2">
<p>Security Fixes: Added a new layer of security over all php
superglobals, fixed several XSS, CSRF, and SQL injection
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="ffa8ca79-4afb-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1">
<p>Security Fixes: A number of minor XSS vulnerabilities discovered in
the previous version of ATutor have been corrected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1</url>
</references>
<dates>
<discovery>2016-01-30</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="a522d6ac-4aed-11e6-97ea-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.632</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-25.htmL">
<p>These updates resolve a race condition vulnerability that could
lead to information disclosure (CVE-2016-4247).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4223, CVE-2016-4224,
CVE-2016-4225).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222,
CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-4249).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183,
CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221,
CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236,
CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
CVE-2016-4245, CVE-2016-4246).</p>
<p>These updates resolve a memory leak vulnerability (CVE-2016-4232).
</p>
<p>These updates resolve stack corruption vulnerabilities that could
lead to code execution (CVE-2016-4176, CVE-2016-4177).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2016-4178).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4172</cvename>
<cvename>CVE-2016-4173</cvename>
<cvename>CVE-2016-4174</cvename>
<cvename>CVE-2016-4175</cvename>
<cvename>CVE-2016-4176</cvename>
<cvename>CVE-2016-4177</cvename>
<cvename>CVE-2016-4178</cvename>
<cvename>CVE-2016-4179</cvename>
<cvename>CVE-2016-4180</cvename>
<cvename>CVE-2016-4181</cvename>
<cvename>CVE-2016-4182</cvename>
<cvename>CVE-2016-4183</cvename>
<cvename>CVE-2016-4184</cvename>
<cvename>CVE-2016-4185</cvename>
<cvename>CVE-2016-4186</cvename>
<cvename>CVE-2016-4187</cvename>
<cvename>CVE-2016-4188</cvename>
<cvename>CVE-2016-4189</cvename>
<cvename>CVE-2016-4190</cvename>
<cvename>CVE-2016-4217</cvename>
<cvename>CVE-2016-4218</cvename>
<cvename>CVE-2016-4219</cvename>
<cvename>CVE-2016-4220</cvename>
<cvename>CVE-2016-4221</cvename>
<cvename>CVE-2016-4222</cvename>
<cvename>CVE-2016-4223</cvename>
<cvename>CVE-2016-4224</cvename>
<cvename>CVE-2016-4225</cvename>
<cvename>CVE-2016-4226</cvename>
<cvename>CVE-2016-4227</cvename>
<cvename>CVE-2016-4228</cvename>
<cvename>CVE-2016-4229</cvename>
<cvename>CVE-2016-4230</cvename>
<cvename>CVE-2016-4231</cvename>
<cvename>CVE-2016-4232</cvename>
<cvename>CVE-2016-4233</cvename>
<cvename>CVE-2016-4234</cvename>
<cvename>CVE-2016-4235</cvename>
<cvename>CVE-2016-4236</cvename>
<cvename>CVE-2016-4237</cvename>
<cvename>CVE-2016-4238</cvename>
<cvename>CVE-2016-4239</cvename>
<cvename>CVE-2016-4240</cvename>
<cvename>CVE-2016-4241</cvename>
<cvename>CVE-2016-4242</cvename>
<cvename>CVE-2016-4243</cvename>
<cvename>CVE-2016-4244</cvename>
<cvename>CVE-2016-4245</cvename>
<cvename>CVE-2016-4246</cvename>
<cvename>CVE-2016-4247</cvename>
<cvename>CVE-2016-4248</cvename>
<cvename>CVE-2016-4249</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-25.html</url>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="61b8c359-4aab-11e6-a7bd-14dae9d210b8">
<cancelled superseded="cbceeb49-3bc7-11e6-8e82-002590263bf5"/>
</vuln>
<vuln vid="3159cd70-4aaa-11e6-a7bd-14dae9d210b8">
<topic>libreoffice -- use-after-free vulnerability</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0126/">
<p>An exploitable Use After Free vulnerability exists in the
RTF parser LibreOffice. A specially crafted file can cause a use after
free resulting in a possible arbitrary code execution. To exploit the
vulnerability a malicious file needs to be opened by the user via
vulnerable application.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0126/</url>
<url>http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/</url>
<cvename>CVE-2016-4324</cvename>
</references>
<dates>
<discovery>2016-06-27</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="c17fe91d-4aa6-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="0ab66088-4aa5-11e6-a7bd-14dae9d210b8">
<topic>tiff -- buffer overflow</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_2</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mathias Svensson reports:</p>
<blockquote cite="https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2">
<p>potential buffer write overrun in PixarLogDecode() on
corrupted/unexpected images</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2</url>
<cvename>CVE-2016-5314</cvename>
<cvename>CVE-2016-5320</cvename>
<cvename>CVE-2016-5875</cvename>
</references>
<dates>
<discovery>2016-06-28</discovery>
<entry>2016-07-15</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="42ecf370-4aa4-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="d706a3a3-4a7c-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- out-of-bounds read vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0094/">
<p>An out-of-bounds read vulnerability exists in the way 7-Zip
handles Universal Disk Format (UDF) files.</p>
<p>Central to 7-Zip’s processing of UDF files is the
CInArchive::ReadFileItem method. Because volumes can have more than
one partition map, their objects are kept in an object vector. To
start looking for an item, this method tries to reference the proper
object using the partition map’s object vector and the "PartitionRef"
field from the Long Allocation Descriptor. Lack of checking whether
the "PartitionRef" field is bigger than the available amount of
partition map objects causes a read out-of-bounds and can lead, in
some circumstances, to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2335</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- heap overflow vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0093/">
<p>An exploitable heap overflow vulnerability exists in the
NArchive::NHfs::CHandler::ExtractZlibFile method functionality of
7zip that can lead to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2334</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="4729c849-4897-11e6-b704-000c292e4fd8">
<topic>samba -- client side SMB2/3 required signing can be downgraded</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.14</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.11</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2016-2119.html">
<p>A man in the middle attack can disable client signing over
SMB2/3, even if enforced by configuration parameters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2119</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2119.html</url>
</references>
<dates>
<discovery>2016-07-07</discovery>
<entry>2016-07-13</entry>
</dates>
</vuln>
<vuln vid="3fcd52b2-4510-11e6-a15f-00248c0c745d">
<topic>ruby-saml -- XML signature wrapping attack</topic>
<affects>
<package>
<name>rubygem-ruby-saml</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RubySec reports:</p>
<blockquote cite="http://rubysec.com/advisories/CVE-2016-5697/">
<p>ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
in the specific scenario where there was a signature that referenced at the same
time 2 elements (but past the scheme validator process since 1 of the element was
inside the encrypted assertion).</p>
<p>ruby-saml users must update to 1.3.0, which implements 3 extra validations to
mitigate this kind of attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5697</cvename>
<url>http://rubysec.com/advisories/CVE-2016-5697/</url>
<url>https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995</url>
</references>
<dates>
<discovery>2016-06-24</discovery>
<entry>2016-07-08</entry>
</dates>
</vuln>
<vuln vid="7d64d00c-43e3-11e6-ab34-002590263bf5">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414">
<p>The onReadyRead function in core/coreauthhandler.cpp in Quassel
before 0.12.4 allows remote attackers to cause a denial of service
(NULL pointer dereference and crash) via invalid handshake data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4414</cvename>
<url>http://quassel-irc.org/node/129</url>
<url>https://github.com/quassel/quassel/commit/e678873</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/4</url>
</references>
<dates>
<discovery>2016-04-24</discovery>
<entry>2016-07-07</entry>
</dates>
</vuln>
<vuln vid="e9d1e040-42c9-11e6-9608-20cf30e32f6d">
<topic>apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.18</ge><lt>2.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="INSERT URL HERE">
<p>The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
client certificate correctly when experimental module for the HTTP/2
protocol is used to access a resource.</p>
<p>The net result is that a resource that should require a valid client
certificate in order to get access can be accessed without that credential.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4979</cvename>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-05</entry>
</dates>
</vuln>
<vuln vid="e800cd4b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unrestricted qemu logging</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-180.html">
<p>When the libxl toolstack launches qemu for HVM guests, it pipes the
output of stderr to a file in /var/log/xen. This output is not
rate-limited in any way. The guest can easily cause qemu to print
messages to stderr, causing this file to become arbitrarily large.
</p>
<p>The disk containing the logfile can be exhausted, possibly causing a
denial-of-service (DoS).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3672</cvename>
<url>http://xenbits.xen.org/xsa/advisory-180.html</url>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e6ce6f50-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-179.html">
<p>Qemu VGA module allows banked access to video memory using the
window at 0xa00000 and it supports different access modes with
different address calculations.</p>
<p>Qemu VGA module allows guest to edit certain registers in 'vbe'
and 'vga' modes.</p>
<p>A privileged guest user could use CVE-2016-3710 to exceed the bank
address window and write beyond the said memory area, potentially
leading to arbitrary code execution with privileges of the Qemu
process. If the system is not using stubdomains, this will be in
domain 0.</p>
<p>A privileged guest user could use CVE-2016-3712 to cause potential
integer overflow or OOB read access issues in Qemu, resulting in a DoS
of the guest itself. More dangerous effect, such as data leakage or
code execution, are not known but cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3710</cvename>
<cvename>CVE-2016-3712</cvename>
<url>http://xenbits.xen.org/xsa/advisory-179.html</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e589ae90-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised driver domain input in libxl device handling</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-178.html">
<p>libxl's device-handling code freely uses and trusts information
from the backend directories in xenstore.</p>
<p>A malicious driver domain can deny service to management tools.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4963</cvename>
<url>http://xenbits.xen.org/xsa/advisory-178.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e43b210a-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 software guest page walk PS bit handling flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-176.html">
<p>The Page Size (PS) page table entry bit exists at all page table
levels other than L1. Its meaning is reserved in L4, and
conditionally reserved in L3 and L2 (depending on hardware
capabilities). The software page table walker in the hypervisor,
however, so far ignored that bit in L4 and (on respective hardware)
L3 entries, resulting in pages to be treated as page tables which
the guest OS may not have designated as such. If the page in
question is writable by an unprivileged user, then that user will
be able to map arbitrary guest memory.</p>
<p>On vulnerable OSes, guest user mode code may be able to establish
mappings of arbitrary memory inside the guest, allowing it to
elevate its privileges inside the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4480</cvename>
<url>http://xenbits.xen.org/xsa/advisory-176.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e2fca11b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised guest input in libxl device handling code</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-175.html">
<p>Various parts of libxl device-handling code inappropriately use
information from (partially) guest controlled areas of xenstore.</p>
<p>A malicious guest administrator can cause denial of service by
resource exhaustion.</p>
<p>A malicious guest administrator can confuse and/or deny service to
management facilities.</p>
<p>A malicious guest administrator of a guest configured with channel
devices may be able to escalate their privilege to that of the
backend domain (i.e., normally, to that of the host).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4962</cvename>
<url>http://xenbits.xen.org/xsa/advisory-175.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="d51ced72-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 shadow pagetables: address width overflow</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-173.html">
<p>In the x86 shadow pagetable code, the guest frame number of a
superpage mapping is stored in a 32-bit field. If a shadowed guest
can cause a superpage mapping of a guest-physical address at or
above 2^44 to be shadowed, the top bits of the address will be lost,
causing an assertion failure or NULL dereference later on, in code
that removes the shadow.</p>
<p>A HVM guest using shadow pagetables can cause the host to crash.
</p>
<p>A PV guest using shadow pagetables (i.e. being migrated) with PV
superpages enabled (which is not the default) can crash the host, or
corrupt hypervisor memory, and so a privilege escalation cannot be
ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3960</cvename>
<url>http://xenbits.xen.org/xsa/advisory-173.html</url>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="313e9557-41e8-11e6-ab34-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-29</p>
<p>The SPOOLS dissector could go into an infinite loop. Discovered
by the CESG.</p></li>
<li><p>wnpa-sec-2016-30</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11585)</p></li>
<li><p>wnpa-sec-2016-31</p>
<p>The IEEE 802.11 dissector could crash. Discovered by Mateusz
Jurczyk. (Bug 12175)</p></li>
<li><p>wnpa-sec-2016-32</p>
<p>The UMTS FP dissector could crash. (Bug 12191)</p></li>
<li><p>wnpa-sec-2016-33</p>
<p>Some USB dissectors could crash. Discovered by Mateusz
Jurczyk. (Bug 12356)</p></li>
<li><p>wnpa-sec-2016-34</p>
<p>The Toshiba file parser could crash. Discovered by iDefense
Labs. (Bug 12394)</p></li>
<li><p>wnpa-sec-2016-35</p>
<p>The CoSine file parser could crash. Discovered by iDefense
Labs. (Bug 12395)</p></li>
<li><p>wnpa-sec-2016-36</p>
<p>The NetScreen file parser could crash. Discovered by iDefense
Labs. (Bug 12396)</p></li>
<li><p>wnpa-sec-2016-37</p>
<p>The Ethernet dissector could crash. (Bug 12440)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5350</cvename>
<cvename>CVE-2016-5351</cvename>
<cvename>CVE-2016-5352</cvename>
<cvename>CVE-2016-5353</cvename>
<cvename>CVE-2016-5354</cvename>
<cvename>CVE-2016-5355</cvename>
<cvename>CVE-2016-5356</cvename>
<cvename>CVE-2016-5357</cvename>
<cvename>CVE-2016-5358</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/4</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="8656cf5f-4170-11e6-8dfe-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.12</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.6</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0013: Users are able to change profile fields that
were locked by the administrator.</p></li>
<li><p>MSA-16-0015: Information disclosure of hidden forum names
and sub-names.</p></li>
<li><p>MSA-16-0016: User can view badges of other users without
proper permissions.</p></li>
<li><p>MSA-16-0017: Course idnumber not protected from teacher
restore.</p></li>
<li><p>MSA-16-0018: CSRF in script marking forum posts as read.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3729</cvename>
<cvename>CVE-2016-3731</cvename>
<cvename>CVE-2016-3732</cvename>
<cvename>CVE-2016-3733</cvename>
<cvename>CVE-2016-3734</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-05-18</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="ad9b77f6-4163-11e6-b05b-14dae9d210b8">
<topic>icingaweb2 -- remote code execution</topic>
<affects>
<package>
<name>icingaweb2</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Lippmann reports:</p>
<blockquote cite="https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/">
<p>Possibility of remote code execution via the remote command
transport.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="a5c204b5-4153-11e6-8dfe-002590263bf5">
<topic>hive -- authorization logic vulnerability</topic>
<affects>
<package>
<name>hive</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sushanth Sowmyan reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E">
<p>Some partition-level operations exist that do not explicitly also
authorize privileges of the parent table. This can lead to issues when
the parent table would have denied the operation, but no denial occurs
because the partition-level privilege is not checked by the
authorization framework, which defines authorization entities only
from the table level upwards.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7521</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E</url>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="546deeea-3fc6-11e6-a671-60a44ce6887b">
<topic>SQLite3 -- Tempdir Selection Vulnerability</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KoreLogic security reports:</p>
<blockquote cite="https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt">
<p>Affected versions of SQLite reject potential tempdir locations if
they are not readable, falling back to '.'. Thus, SQLite will favor
e.g. using cwd for tempfiles on such a system, even if cwd is an
unsafe location. Notably, SQLite also checks the permissions of
'.', but ignores the results of that check.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6153</cvename>
<freebsdpr>ports/209827</freebsdpr>
<url>https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt</url>
<url>http://openwall.com/lists/oss-security/2016/07/01/2</url>
<url>http://www.sqlite.org/cgi/src/info/67985761aa93fb61</url>
<url>http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3</url>
<url>http://www.sqlite.org/cgi/src/info/614bb709d34e1148</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="8d5368ef-40fe-11e6-b2ec-b499baebfeaf">
<topic>Python -- smtplib StartTLS stripping vulnerability</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.12</lt></range>
</package>
<package>
<name>python33</name>
<range><gt>0</gt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772">
<p>A vulnerability in smtplib allowing MITM attacker to perform a
startTLS stripping attack. smtplib does not seem to raise an exception
when the remote end (smtp server) is capable of negotiating starttls but
fails to respond with 220 (ok) to an explicit call of SMTP.starttls().
This may allow a malicious MITM to perform a startTLS stripping attack
if the client code does not explicitly check the response code for startTLS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772</url>
<cvename>CVE-2016-0772</cvename>
</references>
<dates>
<discovery>2016-06-14</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="e7028e1d-3f9b-11e6-81f9-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-17/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-18/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-19/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-20/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-21/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-22/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-23/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-24/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-25/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-26/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-27/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-28/</url>
<cvename>CVE-2016-5701</cvename>
<cvename>CVE-2016-5702</cvename>
<cvename>CVE-2016-5703</cvename>
<cvename>CVE-2016-5704</cvename>
<cvename>CVE-2016-5705</cvename>
<cvename>CVE-2016-5706</cvename>
<cvename>CVE-2016-5730</cvename>
<cvename>CVE-2016-5731</cvename>
<cvename>CVE-2016-5732</cvename>
<cvename>CVE-2016-5733</cvename>
<cvename>CVE-2016-5734</cvename>
<cvename>CVE-2016-5739</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-01</entry>
</dates>
</vuln>
<vuln vid="f1c219ba-3f14-11e6-b3c8-14dae9d210b8">
<topic>haproxy -- denial of service</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.6.0</ge><lt>1.6.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAproxy reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/06/09/5">
<p>HAproxy 1.6.x before 1.6.6, when a deny comes from a
reqdeny rule, allows remote attackers to cause a denial of service
(uninitialized memory access and crash) or possibly have unspecified
other impact via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/5</url>
<cvename>CVE-2016-5360</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="093584f2-3f14-11e6-b3c8-14dae9d210b8">
<topic>libtorrent-rasterbar -- denial of service</topic>
<affects>
<package>
<name>libtorrent-rasterbar</name>
<range><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="https://github.com/arvidn/libtorrent/issues/780">
<p>The parse_chunk_header function in libtorrent before 1.1.1
allows remote attackers to cause a denial of service (crash) via a
crafted (1) HTTP response or possibly a (2) UPnP broadcast.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/arvidn/libtorrent/issues/780</url>
<cvename>CVE-2016-5301</cvename>
</references>
<dates>
<discovery>2016-06-03</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="ff76f0e0-3f11-11e6-b3c8-14dae9d210b8">
<topic>expat2 -- denial of service</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1344251">
<p>It was found that original patch for issues CVE-2015-1283
and CVE-2015-2716 used overflow checks that could be optimized out by
some compilers applying certain optimization settings, which can cause
the vulnerability to remain even after applying the patch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1344251</url>
<cvename>CVE-2016-4472</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="875e4cf8-3f0e-11e6-b3c8-14dae9d210b8">
<topic>dnsmasq -- denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.76,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.76.0test1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html">
<p>Dnsmasq before 2.76 allows remote servers to cause a denial
of service (crash) via a reply with an empty DNS address that has an (1)
A or (2) AAAA record defined locally.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/03/7</url>
<cvename>CVE-2015-8899</cvename>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-06-30</entry>
<modified>2016-06-30</modified>
</dates>
</vuln>
<vuln vid="a61374fc-3a4d-11e6-a671-60a44ce6887b">
<topic>Python -- HTTP Header Injection in Python urllib</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>python33</name>
<range><ge>0</ge></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="https://bugs.python.org/issue22928">
<p>HTTP header injection in urrlib2/urllib/httplib/http.client with
newlines in header values, where newlines have a semantic consequence of
denoting the start of an additional header line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue22928</url>
<url>http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/14/7</url>
<cvename>CVE-2016-5699</cvename>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2016-06-30</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="0ca24682-3f03-11e6-b3c8-14dae9d210b8">
<topic>openssl -- denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177">
<p>OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
for heap-buffer boundary checks, which might allow remote attackers to
cause a denial of service (integer overflow and application crash) or
possibly have unspecified other impact by leveraging unexpected malloc
behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177</url>
<url>ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705</url>
<url>https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/</url>
<cvename>CVE-2016-2177</cvename>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="cbceeb49-3bc7-11e6-8e82-002590263bf5">
<topic>Apache Commons FileUpload -- denial of service (DoS) vulnerability</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.70</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.36</lt></range>
</package>
<package>
<name>apache-struts</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E">
<p>CVE-2016-3092 is a denial of service vulnerability that has been
corrected in the Apache Commons FileUpload component. It occurred
when the length of the multipart boundary was just below the size of
the buffer (4096 bytes) used to read the uploaded file. This caused
the file upload process to take several orders of magnitude longer
than if the boundary length was the typical tens of bytes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3092</cvename>
<freebsdpr>ports/209669</freebsdpr>
<url>http://tomcat.apache.org/security-7.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E</url>
<url>http://jvn.jp/en/jp/JVN89379547/index.html</url>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-06-26</entry>
<modified>2017-08-10</modified>
</dates>
</vuln>
<vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Silverstein reports:</p>
<blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">
<p>WordPress 4.5.3 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.2 and earlier are affected by several
security issues: redirect bypass in the customizer, reported by
Yassine Aboukir; two different XSS problems via attachment names,
reported by Jouko Pynnönenand Divyesh Prajapati; revision history
information disclosure, reported independently by John Blackbourn
from the WordPress security team and by Dan Moen from the Wordfence
Research Team; oEmbed denial of service reported by Jennifer Dodd
from Automattic; unauthorized category removal from a post, reported
by David Herrera from Alley Interactive; password change via stolen
cookie, reported by Michael Adams from the WordPress security team;
and some less secure sanitize_file_name edge cases reported by Peter
Westwood of the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5832</cvename>
<cvename>CVE-2016-5833</cvename>
<cvename>CVE-2016-5834</cvename>
<cvename>CVE-2016-5835</cvename>
<cvename>CVE-2016-5836</cvename>
<cvename>CVE-2016-5837</cvename>
<cvename>CVE-2016-5838</cvename>
<cvename>CVE-2016-5839</cvename>
<freebsdpr>ports/210480</freebsdpr>
<freebsdpr>ports/210581</freebsdpr>
<url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>
</references>
<dates>
<discovery>2016-06-18</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-mbstring</name>
<name>php55-wddx</name>
<name>php55-zip</name>
<range><lt>5.5.37</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<name>php56-zip</name>
<range><lt>5.6.23</lt></range>
</package>
<package>
<name>php70</name>
<name>php70-gd</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-wddx</name>
<name>php70-zip</name>
<range><lt>7.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.37">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8874</cvename>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-5767</cvename>
<cvename>CVE-2016-5768</cvename>
<cvename>CVE-2016-5769</cvename>
<cvename>CVE-2016-5770</cvename>
<cvename>CVE-2016-5771</cvename>
<cvename>CVE-2016-5772</cvename>
<cvename>CVE-2016-5773</cvename>
<freebsdpr>ports/210491</freebsdpr>
<freebsdpr>ports/210502</freebsdpr>
<url>http://php.net/ChangeLog-5.php#5.5.37</url>
<url>http://php.net/ChangeLog-5.php#5.6.23</url>
<url>http://php.net/ChangeLog-7.php#7.0.8</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock and Cisco Talos report:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2016/06/23/6">
<ul>
<li><p>Out of bounds heap read in RAR parser</p></li>
<li><p>Signed integer overflow in ISO parser</p></li>
<li><p>TALOS-2016-0152 [CVE-2016-4300]: 7-Zip
read_SubStreamsInfo Integer Overflow</p></li>
<li><p>TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack
Based Buffer Overflow</p></li>
<li><p>TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel
Heap Overflow</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://openwall.com/lists/oss-security/2016/06/23/6</url>
<url>https://github.com/libarchive/libarchive/issues/521</url>
<url>https://github.com/libarchive/libarchive/issues/717#event-697151157</url>
<url>http://blog.talosintel.com/2016/06/the-poisoned-archives.html</url>
<cvename>CVE-2015-8934</cvename>
<cvename>CVE-2016-4300</cvename>
<cvename>CVE-2016-4301</cvename>
<cvename>CVE-2016-4302</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="22775cdd-395a-11e6-b3c8-14dae9d210b8">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-16-1/">
<p>The Piwik Security team is grateful for the responsible
disclosures by our security researchers: Egidio Romano (granted a
critical security bounty), James Kettle and Paweł Bartunek (XSS) and
Emanuel Bronshtein (limited XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>http://piwik.org/changelog/piwik-2-16-1/</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="6df56c60-3738-11e6-a671-60a44ce6887b">
<topic>wget -- HTTP to FTP redirection file name confusion vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Giuseppe Scrivano reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html">
<p>On a server redirect from HTTP to a FTP resource, wget would trust the
HTTP server and uses the name in the redirected URL as the destination
filename.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html</url>
<cvename>CVE-2016-4971</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-21</entry>
</dates>
</vuln>
<vuln vid="1a2aa04f-3718-11e6-b3c8-14dae9d210b8">
<topic>libxslt -- Denial of Service</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2016/Jun/81">
<ul>
<li>[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
Credit to Nicolas Gregoire.</li>
<li>[583171] Medium CVE-2016-1684: Integer overflow in libxslt.
Credit to Nicolas Gregoire.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html</url>
<cvename>CVE-2016-1683</cvename>
<cvename>CVE-2016-1684</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-20</entry>
</dates>
</vuln>
<vuln vid="0e3dfdde-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.626</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-18.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4144, CVE-2016-4149).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2016-4135, CVE-2016-4136,
CVE-2016-4138).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129,
CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133,
CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,
CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4140).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2016-4139).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4122</cvename>
<cvename>CVE-2016-4123</cvename>
<cvename>CVE-2016-4124</cvename>
<cvename>CVE-2016-4125</cvename>
<cvename>CVE-2016-4127</cvename>
<cvename>CVE-2016-4128</cvename>
<cvename>CVE-2016-4129</cvename>
<cvename>CVE-2016-4130</cvename>
<cvename>CVE-2016-4131</cvename>
<cvename>CVE-2016-4132</cvename>
<cvename>CVE-2016-4133</cvename>
<cvename>CVE-2016-4134</cvename>
<cvename>CVE-2016-4135</cvename>
<cvename>CVE-2016-4136</cvename>
<cvename>CVE-2016-4137</cvename>
<cvename>CVE-2016-4138</cvename>
<cvename>CVE-2016-4139</cvename>
<cvename>CVE-2016-4140</cvename>
<cvename>CVE-2016-4141</cvename>
<cvename>CVE-2016-4142</cvename>
<cvename>CVE-2016-4143</cvename>
<cvename>CVE-2016-4144</cvename>
<cvename>CVE-2016-4145</cvename>
<cvename>CVE-2016-4146</cvename>
<cvename>CVE-2016-4147</cvename>
<cvename>CVE-2016-4148</cvename>
<cvename>CVE-2016-4149</cvename>
<cvename>CVE-2016-4150</cvename>
<cvename>CVE-2016-4151</cvename>
<cvename>CVE-2016-4152</cvename>
<cvename>CVE-2016-4153</cvename>
<cvename>CVE-2016-4154</cvename>
<cvename>CVE-2016-4155</cvename>
<cvename>CVE-2016-4156</cvename>
<cvename>CVE-2016-4166</cvename>
<cvename>CVE-2016-4171</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-18.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="0c6b008d-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.621</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-15.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1105, CVE-2016-4117).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107,
CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,
CVE-2016-4110, CVE-2016-4121).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-1101).</p>
<p>These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2016-1103).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099,
CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,
CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,
CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161,
CVE-2016-4162, CVE-2016-4163).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4116).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1096</cvename>
<cvename>CVE-2016-1097</cvename>
<cvename>CVE-2016-1098</cvename>
<cvename>CVE-2016-1099</cvename>
<cvename>CVE-2016-1100</cvename>
<cvename>CVE-2016-1101</cvename>
<cvename>CVE-2016-1102</cvename>
<cvename>CVE-2016-1103</cvename>
<cvename>CVE-2016-1104</cvename>
<cvename>CVE-2016-1105</cvename>
<cvename>CVE-2016-1106</cvename>
<cvename>CVE-2016-1107</cvename>
<cvename>CVE-2016-1108</cvename>
<cvename>CVE-2016-1109</cvename>
<cvename>CVE-2016-1110</cvename>
<cvename>CVE-2016-4108</cvename>
<cvename>CVE-2016-4109</cvename>
<cvename>CVE-2016-4110</cvename>
<cvename>CVE-2016-4111</cvename>
<cvename>CVE-2016-4112</cvename>
<cvename>CVE-2016-4113</cvename>
<cvename>CVE-2016-4114</cvename>
<cvename>CVE-2016-4115</cvename>
<cvename>CVE-2016-4116</cvename>
<cvename>CVE-2016-4117</cvename>
<cvename>CVE-2016-4120</cvename>
<cvename>CVE-2016-4121</cvename>
<cvename>CVE-2016-4160</cvename>
<cvename>CVE-2016-4161</cvename>
<cvename>CVE-2016-4162</cvename>
<cvename>CVE-2016-4163</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-15.html</url>
</references>
<dates>
<discovery>2016-05-12</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="07888b49-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.616</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html">
<p>These updates harden a mitigation against JIT spraying attacks that
could be used to bypass memory layout randomization mitigations
(CVE-2016-1006).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1015, CVE-2016-1019).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016,
CVE-2016-1017, CVE-2016-1031).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021,
CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
CVE-2016-1032, CVE-2016-1033).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2016-1018).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-1030).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-1014).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1006</cvename>
<cvename>CVE-2016-1011</cvename>
<cvename>CVE-2016-1012</cvename>
<cvename>CVE-2016-1013</cvename>
<cvename>CVE-2016-1014</cvename>
<cvename>CVE-2016-1015</cvename>
<cvename>CVE-2016-1016</cvename>
<cvename>CVE-2016-1017</cvename>
<cvename>CVE-2016-1018</cvename>
<cvename>CVE-2016-1019</cvename>
<cvename>CVE-2016-1020</cvename>
<cvename>CVE-2016-1021</cvename>
<cvename>CVE-2016-1022</cvename>
<cvename>CVE-2016-1023</cvename>
<cvename>CVE-2016-1024</cvename>
<cvename>CVE-2016-1025</cvename>
<cvename>CVE-2016-1026</cvename>
<cvename>CVE-2016-1027</cvename>
<cvename>CVE-2016-1028</cvename>
<cvename>CVE-2016-1029</cvename>
<cvename>CVE-2016-1030</cvename>
<cvename>CVE-2016-1031</cvename>
<cvename>CVE-2016-1032</cvename>
<cvename>CVE-2016-1033</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-10.html</url>
</references>
<dates>
<discovery>2016-04-07</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="d59ebed4-34be-11e6-be25-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.103</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[620742] CVE-2016-1704: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1704</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="1d0f6852-33d8-11e6-a671-60a44ce6887b">
<topic>Python -- Integer overflow in zipimport module</topic>
<affects>
<package>
<name>python35</name>
<range><lt>3.5.1_3</lt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4_3</lt></range>
</package>
<package>
<name>python33</name>
<range><lt>3.3.6_5</lt></range>
</package>
<package>
<name>python27</name>
<range><lt>2.7.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="http://bugs.python.org/issue26171">
<p>Possible integer overflow and heap corruption in
zipimporter.get_data()</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.python.org/issue26171</url>
<cvename>CVE-2016-5636</cvename>
</references>
<dates>
<discovery>2016-01-21</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="7932548e-3427-11e6-8e82-002590263bf5">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.44</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-002">
<ul>
<li><p>Saving user accounts can sometimes grant the user all roles
(User module - Drupal 7 - Moderately Critical)</p></li>
<li><p>Views can allow unauthorized users to see Statistics
information (Views module - Drupal 8 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6211</cvename>
<cvename>CVE-2016-6212</cvename>
<url>https://www.drupal.org/SA-CORE-2016-002</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/13/7</url>
</references>
<dates>
<discovery>2016-06-15</discovery>
<entry>2016-06-17</entry>
<modified>2016-07-16</modified>
</dates>
</vuln>
<vuln vid="ac0900df-31d0-11e6-8e82-002590263bf5">
<topic>botan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jack Lloyd reports:</p>
<blockquote cite="https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html">
<p>Botan 1.10.13 has been released backporting some side channel
protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA
decryption (CVE-2015-7827).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2849</cvename>
<cvename>CVE-2015-7827</cvename>
<url>https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="f771880c-31cf-11e6-8e82-002590263bf5">
<topic>botan -- cryptographic vulnerability</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9742">
<p>The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x
before 1.11.9 improperly uses a single random base, which makes it
easier for remote attackers to defeat cryptographic protection
mechanisms via a DH group.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9742</cvename>
</references>
<dates>
<discovery>2014-04-11</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="6d402857-2fba-11e6-9f31-5404a68ad561">
<topic>VLC -- Possibly remote code execution via crafted file</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.4,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.4,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
<p>Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5108</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-11</entry>
</dates>
</vuln>
<vuln vid="97e86d10-2ea7-11e6-ae88-002590263bf5">
<topic>roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.1.5_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://github.com/roundcube/roundcubemail/wiki/Changelog">
<p>Fix XSS issue in href attribute on area tag (#5240).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5103</cvename>
<freebsdpr>ports/209841</freebsdpr>
<url>https://github.com/roundcube/roundcubemail/issues/5240</url>
<url>http://seclists.org/oss-sec/2016/q2/414</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-06-10</entry>
</dates>
</vuln>
<vuln vid="6f0529e2-2e82-11e6-b2ec-b499baebfeaf">
<topic>OpenSSL -- vulnerability in DSA signing</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_13</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.2.9</lt></range>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2">
<p>Operations in the DSA signing algorithm should run in constant time
in order to avoid side channel attacks. A flaw in the OpenSSL DSA
implementation means that a non-constant time codepath is followed for
certain operations. This has been demonstrated through a cache-timing
attack to be sufficient for an attacker to recover the private DSA key.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2</url>
<cvename>CVE-2016-2178</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-09</entry>
<modified>2016-12-20</modified>
</dates>
</vuln>
<vuln vid="c9c252f5-2def-11e6-ae88-002590263bf5">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Pipping reports:</p>
<blockquote cite="https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/">
<p>CVE-2012-6702 -- Resolve troublesome internal call to srand that
was introduced with Expat 2.1.0 when addressing CVE-2012-0876
(issue #496)</p>
<p>CVE-2016-5300 -- Use more entropy for hash initialization than the
original fix to CVE-2012-0876.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6702</cvename>
<cvename>CVE-2016-5300</cvename>
<freebsdpr>ports/210155</freebsdpr>
<url>https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/</url>
<url>http://www.openwall.com/lists/oss-security/2016/03/18/3</url>
</references>
<dates>
<discovery>2016-03-18</discovery>
<entry>2016-06-09</entry>
<modified>2016-11-06</modified>
</dates>
</vuln>
<vuln vid="d6bbf2d8-2cfc-11e6-800b-080027468580">
<topic>iperf3 -- buffer overflow</topic>
<affects>
<package>
<name>iperf3</name>
<range><ge>3.1</ge><lt>3.1.3</lt></range>
<range><ge>3.0</ge><lt>3.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ESnet reports:</p>
<blockquote cite="https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc">
<p>A malicious process can connect to an iperf3 server and,
by sending a malformed message on the control channel,
corrupt the server process's heap area. This can lead to a
crash (and a denial of service), or theoretically a remote
code execution as the user running the iperf3 server. A
malicious iperf3 server could potentially mount a similar
attack on an iperf3 client.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4303</cvename>
<url>https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc</url>
</references>
<dates>
<discovery>2016-06-08</discovery>
<entry>2016-06-08</entry>
</dates>
</vuln>
<vuln vid="9c196cfd-2ccc-11e6-94b0-0011d823eebd">
<topic>gnutls -- file overwrite by setuid programs</topic>
<affects>
<package>
<name>gnutls</name>
<range><ge>3.4.12</ge><lt>3.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-1">
<p>Setuid programs using GnuTLS 3.4.12 could potentially allow an
attacker to overwrite and corrupt arbitrary files in the
filesystem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-1</url>
</references>
<dates>
<discovery>2016-06-06</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="32166082-53fa-41fa-b081-207e7a989a0a">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.23</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><lt>3.21.3</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-61/">
<p>Mozilla has updated the version of Network Security
Services (NSS) library used in Firefox to NSS 3.23. This
addresses four moderate rated networking security issues
reported by Mozilla engineers Tyson Smith and Jed Davis.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2834</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-61/</url>
<url>https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672</url>
<url>https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a</url>
<url>https://hg.mozilla.org/projects/nss/rev/5fde729fdbff</url>
<url>https://hg.mozilla.org/projects/nss/rev/329932eb1700</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
<modified>2016-11-23</modified>
</dates>
</vuln>
<vuln vid="8065d37b-8e7c-4707-a608-1b0a2b8509c3">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>47.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47">
<p>MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 /
rv:45.2)</p>
<p>MFSA 2016-50 Buffer overflow parsing HTML5 fragments</p>
<p>MFSA 2016-51 Use-after-free deleting tables from a
contenteditable document</p>
<p>MFSA 2016-52 Addressbar spoofing though the SELECT element</p>
<p>MFSA 2016-54 Partial same-origin-policy through setting
location.host through data URI</p>
<p>MFSA 2016-56 Use-after-free when textures are used in WebGL
operations after recycle pool destruction</p>
<p>MFSA 2016-57 Incorrect icon displayed on permissions
notifications</p>
<p>MFSA 2016-58 Entering fullscreen and persistent pointerlock
without user permission</p>
<p>MFSA 2016-59 Information disclosure of disabled plugins
through CSS pseudo-classes</p>
<p>MFSA 2016-60 Java applets bypass CSP protections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2815</cvename>
<cvename>CVE-2016-2818</cvename>
<cvename>CVE-2016-2819</cvename>
<cvename>CVE-2016-2821</cvename>
<cvename>CVE-2016-2822</cvename>
<cvename>CVE-2016-2825</cvename>
<cvename>CVE-2016-2828</cvename>
<cvename>CVE-2016-2829</cvename>
<cvename>CVE-2016-2831</cvename>
<cvename>CVE-2016-2832</cvename>
<cvename>CVE-2016-2833</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-60/</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="c039a761-2c29-11e6-8912-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html">
<p>15 security fixes in this release, including:</p>
<ul>
<li>601073] High CVE-2016-1696: Cross-origin bypass in Extension
bindings. Credit to anonymous.</li>
<li>[613266] High CVE-2016-1697: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[603725] Medium CVE-2016-1698: Information leak in Extension
bindings. Credit to Rob Wu.</li>
<li>[607939] Medium CVE-2016-1699: Parameter sanitization failure
in DevTools. Credit to Gregory Panakkal.</li>
<li>[608104] Medium CVE-2016-1700: Use-after-free in Extensions.
Credit to Rob Wu.</li>
<li>[608101] Medium CVE-2016-1701: Use-after-free in Autofill.
Credit to Rob Wu.</li>
<li>[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia.
Credit to cloudfuzzer.</li>
<li>[616539] CVE-2016-1703: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1695</cvename>
<cvename>CVE-2016-1696</cvename>
<cvename>CVE-2016-1697</cvename>
<cvename>CVE-2016-1698</cvename>
<cvename>CVE-2016-1699</cvename>
<cvename>CVE-2016-1700</cvename>
<cvename>CVE-2016-1701</cvename>
<cvename>CVE-2016-1702</cvename>
<cvename>CVE-2016-1703</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-06</entry>
</dates>
</vuln>
<vuln vid="bcbd3fe0-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt">
<p>Foreign users can bypass access controls to create groups as
system:administrators, including in the user namespace and the
system: namespace.</p>
</blockquote>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt">
<p>The contents of uninitialized memory are sent on the wire when
clients perform certain RPCs. Depending on the RPC, the information
leaked may come from kernel memory or userspace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2860</cvename>
<cvename>CVE-2016-4536</cvename>
<freebsdpr>ports/209534</freebsdpr>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt</url>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="2e8fe57e-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- local DoS vulnerability</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16">
<p>Avoid a potential denial of service issue, by fixing a bug in
pioctl logic that allowed a local user to overrun a kernel buffer
with a single NUL byte.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8312</cvename>
<url>https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="0297b260-2b3b-11e6-ae88-002590263bf5">
<topic>ikiwiki -- XSS vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20160509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561">
<p>Cross-site scripting (XSS) vulnerability in the cgierror function
in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers
to inject arbitrary web script or HTML via unspecified vectors
involving an error message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4561</cvename>
<freebsdpr>ports/209593</freebsdpr>
</references>
<dates>
<discovery>2016-05-04</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5">
<topic>h2o -- use after free on premature connection close</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Newsha reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When H2O tries to disconnect a premature HTTP/2 connection, it
calls free(3) to release memory allocated for the connection and
immediately after then touches the memory. No malloc-related
operation is performed by the same thread between the time it calls
free and the time the memory is touched. Fixed by Frederik
Deweerdt.</p>
</blockquote>
</body>
</description>
<references>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-06-01</entry>
</dates>
</vuln>
<vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in worker process crash</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.4.0</ge><lt>1.8.1_3,2</lt></range>
<range><ge>1.10.0,2</ge><lt>1.10.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.3.9</ge><lt>1.9.15_1</lt></range>
<range><ge>1.10.0</ge><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html">
<p>A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted
request might result in worker process crash due to a NULL
pointer dereference while writing client request body to a
temporary file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html</url>
<cvename>CVE-2016-4450</cvename>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-05-31</entry>
<modified>2016-06-05</modified>
</dates>
</vuln>
<vuln vid="6167b341-250c-11e6-a6fb-003048f2e514">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8h.php">
<p>Changelog</p>
<ul>
<li>bug:0002667: Cacti SQL Injection Vulnerability</li>
<li>bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection
Vulnerability</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access (regression)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3659</cvename>
<url>http://www.cacti.net/release_notes_0_8_8h.php</url>
<url>http://bugs.cacti.net/view.php?id=2673</url>
<url>http://seclists.org/fulldisclosure/2016/Apr/4</url>
<url>http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html</url>
</references>
<dates>
<discovery>2016-04-04</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="b53bbf58-257f-11e6-9f4d-20cf30e32f6d">
<topic>openvswitch -- MPLS buffer overflow</topic>
<affects>
<package>
<name>openvswitch</name>
<range><ge>2.2.0</ge><lt>2.3.3</lt></range>
<range><ge>2.4.0</ge><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Open vSwitch reports:</p>
<blockquote cite="http://openvswitch.org/pipermail/announce/2016-March/000082.html">
<p>Multiple versions of Open vSwitch are vulnerable to remote buffer
overflow attacks, in which crafted MPLS packets could overflow the
buffer reserved for MPLS labels in an OVS internal data structure.
The MPLS packets that trigger the vulnerability and the potential for
exploitation vary depending on version:</p>
<p>Open vSwitch 2.1.x and earlier are not vulnerable.</p>
<p>In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
exploited for arbitrary remote code execution.</p>
<p>In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead
to a remote code execution exploit, but testing shows that it can allow a
remote denial of service. See the mitigation section for details.</p>
<p>Open vSwitch 2.5.x is not vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2074</cvename>
<url>http://openvswitch.org/pipermail/announce/2016-March/000082.html</url>
<url>http://openvswitch.org/pipermail/announce/2016-March/000083.html</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-05-29</entry>
<modified>2016-07-03</modified>
</dates>
</vuln>
<vuln vid="1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html">
<p>42 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1673</cvename>
<cvename>CVE-2016-1674</cvename>
<cvename>CVE-2016-1675</cvename>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1677</cvename>
<cvename>CVE-2016-1678</cvename>
<cvename>CVE-2016-1679</cvename>
<cvename>CVE-2016-1680</cvename>
<cvename>CVE-2016-1681</cvename>
<cvename>CVE-2016-1682</cvename>
<cvename>CVE-2016-1685</cvename>
<cvename>CVE-2016-1686</cvename>
<cvename>CVE-2016-1687</cvename>
<cvename>CVE-2016-1688</cvename>
<cvename>CVE-2016-1689</cvename>
<cvename>CVE-2016-1690</cvename>
<cvename>CVE-2016-1691</cvename>
<cvename>CVE-2016-1692</cvename>
<cvename>CVE-2016-1693</cvename>
<cvename>CVE-2016-1694</cvename>
<cvename>CVE-2016-1695</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html</url>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-28</entry>
<modified>2016-06-20</modified>
</dates>
</vuln>
<vuln vid="4dfafa16-24ba-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[605910] High CVE-2016-1668: Same origin bypass in Blink V8
bindings. Credit to Mariusz Mlynski.</li>
<li>[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to
Choongwoo Han.</li>
<li>[578882] Medium CVE-2016-1670: Race condition in loader. Credit
to anonymous.</li>
<li>[586657] Medium CVE-2016-1671: Directory traversal using the
file scheme on Android. Credit to Jann Horn.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1667</cvename>
<cvename>CVE-2016-1668</cvename>
<cvename>CVE-2016-1669</cvename>
<cvename>CVE-2016-1670</cvename>
<cvename>CVE-2016-1671</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="7da1da96-24bb-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html">
<p>9 security fixes in this release, including:</p>
<ul>
<li>[574802] High CVE-2016-1660: Out-of-bounds write in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[601629] High CVE-2016-1661: Memory corruption in cross-process
frames. Credit to Wadih Matar.</li>
<li>[603732] High CVE-2016-1662: Use-after-free in extensions.
Credit to Rob Wu.</li>
<li>[603987] High CVE-2016-1663: Use-after-free in Blink's V8
bindings. Credit to anonymous.</li>
<li>[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to
Wadih Matar.</li>
<li>[606181] Medium CVE-2016-1665: Information leak in V8. Credit
to HyungSeok Han.</li>
<li>[607652] CVE-2016-1666: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1660</cvename>
<cvename>CVE-2016-1661</cvename>
<cvename>CVE-2016-1662</cvename>
<cvename>CVE-2016-1663</cvename>
<cvename>CVE-2016-1664</cvename>
<cvename>CVE-2016-1665</cvename>
<cvename>CVE-2016-1666</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="6b110175-246d-11e6-8dd3-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70-gd</name>
<name>php70-intl</name>
<range><lt>7.0.7</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<range><lt>5.6.22</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-phar</name>
<range><lt>5.5.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.36">
<ul><li>Core:
<ul>
<li>Fixed bug #72114 (Integer underflow / arbitrary null write in
fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)</li>
<li>Fixed bug #72135 (Integer Overflow in php_html_entities).
(CVE-2016-5094) (PHP 5.5/5.6 only)</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #72227 (imagescale out-of-bounds read).
(CVE-2013-7456)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
(CVE-2016-5093)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71331 (Uninitialized pointer in
phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5096</cvename>
<cvename>CVE-2016-5094</cvename>
<cvename>CVE-2013-7456</cvename>
<cvename>CVE-2016-5093</cvename>
<cvename>CVE-2016-4343</cvename>
<freebsdpr>ports/209779</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.7</url>
<url>http://php.net/ChangeLog-5.php#5.6.22</url>
<url>http://php.net/ChangeLog-5.php#5.5.36</url>
</references>
<dates>
<discovery>2016-05-26</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="00ec1be1-22bb-11e6-9ead-6805ca0b3d42">
<topic>phpmyadmin -- XSS and sensitive data leakage</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-14/">
<h2>Description</h2>
<p>Because user SQL queries are part of the URL, sensitive
information made as part of a user query can be exposed by
clicking on external links to attackers monitoring user GET
query parameters or included in the webserver logs.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-16/">
<h2>Description</h2>
<p>A specially crafted attack could allow for special HTML
characters to be passed as URL encoded values and displayed
back as special characters in the page.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-14/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-16/</url>
<cvename>CVE-2016-5097</cvename>
<cvename>CVE-2016-5099</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-25</entry>
<modified>2016-05-26</modified>
</dates>
</vuln>
<vuln vid="b50f53ce-2151-11e6-8dd3-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.14</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><le>1.24.6</le></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.6</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html">
<p>Security fixes:</p>
<p>T122056: Old tokens are remaining valid within a new session</p>
<p>T127114: Login throttle can be tricked using non-canonicalized
usernames</p>
<p>T123653: Cross-domain policy regexp is too narrow</p>
<p>T123071: Incorrectly identifying http link in a's href
attributes, due to m modifier in regex</p>
<p>T129506: MediaWiki:Gadget-popups.js isn't renderable</p>
<p>T125283: Users occasionally logged in as different users after
SessionManager deployment</p>
<p>T103239: Patrol allows click catching and patrolling of any
page</p>
<p>T122807: [tracking] Check php crypto primatives</p>
<p>T98313: Graphs can leak tokens, leading to CSRF</p>
<p>T130947: Diff generation should use PoolCounter</p>
<p>T133507: Careless use of $wgExternalLinkTarget is insecure</p>
<p>T132874: API action=move is not rate limited</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html</url>
</references>
<dates>
<discovery>2016-05-20</discovery>
<entry>2016-05-24</entry>
</dates>
</vuln>
<vuln vid="967b852b-1e28-11e6-8dd3-002590263bf5">
<topic>hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_2</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2016-1/psk-parameter-config-update.txt">
<p>psk configuration parameter update allowing arbitrary data to be
written (2016-1 - CVE-2016-4476/CVE-2016-4477).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4476</cvename>
<cvename>CVE-2016-4477</cvename>
<freebsdpr>ports/209564</freebsdpr>
<url>http://w1.fi/security/2016-1/psk-parameter-config-update.txt</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-20</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="57b3aba7-1e25-11e6-8dd3-002590263bf5">
<topic>expat -- denial of service vulnerability on malformed input</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1</lt></range>
</package>
<package>
<name>linux-c6-expat</name>
<range><lt>2.0.1_3</lt></range>
</package>
<package>
<name>linux-c7-expat</name>
<range><lt>2.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/17/12">
<p>The Expat XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<freebsdpr>ports/209360</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2016/05/17/12</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-05-20</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="036d6c38-1c5b-11e6-b9e0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.12</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.11/">
<p>A specially crafted bug summary could trigger XSS in dependency graphs.
Due to an incorrect parsing of the image map generated by the dot script,
a specially crafted bug summary could trigger XSS in dependency graphs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2803</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1253263</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-17</entry>
</dates>
</vuln>
<vuln vid="0dc8be9e-19af-11e6-8de0-080027ef73ec">
<topic>OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.11</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://sourceforge.net/p/openvpn/mailman/message/35076507/">
<p>OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug
with DoS potential and a buffer overflow by user supplied data when
using pam authentication.[...]</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/openvpn/mailman/message/35076507/</url>
<url>https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-14</entry>
</dates>
</vuln>
<vuln vid="82b702e0-1907-11e6-857b-00221503d280">
<topic>imagemagick -- buffer overflow</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.4.1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ImageMagick reports:</p>
<blockquote cite="http://legacy.imagemagick.org/script/changelog.php">
<p>Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().</p>
</blockquote>
</body>
</description>
<references>
<url>http://legacy.imagemagick.org/script/changelog.php</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-05-13</entry>
</dates>
</vuln>
<vuln vid="e387834a-17ef-11e6-9947-7054d2909b71">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins2</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.651.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11">
<h1>Description</h1>
<h5>SECURITY-170 / CVE-2016-3721</h5>
<p>Arbitrary build parameters are passed to build scripts as environment variables</p>
<h5>SECURITY-243 / CVE-2016-3722</h5>
<p>Malicious users with multiple user accounts can prevent other users from logging in</p>
<h5>SECURITY-250 / CVE-2016-3723</h5>
<p>Information on installed plugins exposed via API</p>
<h5>SECURITY-266 / CVE-2016-3724</h5>
<p>Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration</p>
<h5>SECURITY-273 / CVE-2016-3725</h5>
<p>Regular users can trigger download of update site metadata</p>
<h5>SECURITY-276 / CVE-2016-3726</h5>
<p>Open redirect to scheme-relative URLs</p>
<h5>SECURITY-281 / CVE-2016-3727</h5>
<p>Granting the permission to read node configurations allows access to overall system configuration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3721</cvename>
<cvename>CVE-2016-3722</cvename>
<cvename>CVE-2016-3723</cvename>
<cvename>CVE-2016-3724</cvename>
<cvename>CVE-2016-3725</cvename>
<cvename>CVE-2016-3726</cvename>
<cvename>CVE-2016-3727</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-12</entry>
</dates>
</vuln>
<vuln vid="d9f99491-1656-11e6-94fa-002590263bf5">
<topic>perl5 -- taint mechanism bypass vulnerability</topic>
<affects>
<package>
<name>perl5</name>
<range><lt>5.18.4_21</lt></range>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl5.18</name>
<range><ge>5.18.0</ge><lt>5.18.4_21</lt></range>
</package>
<package>
<name>perl5.20</name>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
</package>
<package>
<name>perl5.22</name>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2381">
<p>Perl might allow context-dependent attackers to bypass the taint
protection mechanism in a child process via duplicate environment
variables in envp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2381</cvename>
<freebsdpr>ports/208879</freebsdpr>
</references>
<dates>
<discovery>2016-04-08</discovery>
<entry>2016-05-10</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="3686917b-164d-11e6-94fa-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Helen Hou-Sandi reports:</p>
<blockquote cite="https://wordpress.org/news/2016/05/wordpress-4-5-2/">
<p>WordPress 4.5.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.1 and earlier are affected by a SOME
vulnerability through Plupload, the third-party library WordPress
uses for uploading files. WordPress versions 4.2 through 4.5.1 are
vulnerable to reflected XSS using specially crafted URIs through
MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing
these issues.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4566</cvename>
<cvename>CVE-2016-4567</cvename>
<url>https://wordpress.org/news/2016/05/wordpress-4-5-2/</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/07/7</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-10</entry>
</dates>
</vuln>
<vuln vid="2b4c8e1f-1609-11e6-b55e-b499baebfeaf">
<topic>libarchive -- RCE vulnerability</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libarchive project reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7">
<p>Heap-based buffer overflow in the zip_read_mac_metadata function
in archive_read_support_format_zip.c in libarchive before 3.2.0
allows remote attackers to execute arbitrary code via crafted
entry-size values in a ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1541</cvename>
<url>https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-09</entry>
<modified>2016-05-10</modified>
</dates>
</vuln>
<vuln vid="25e5205b-1447-11e6-9ead-6805ca0b3d42">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.0</ge><lt>3.5.18</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid development team reports:</p>
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<cvename>CVE-2016-4553</cvename>
<cvename>CVE-2016-4554</cvename>
<cvename>CVE-2016-4555</cvename>
<cvename>CVE-2016-4556</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_7.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_8.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_9.txt</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-07</entry>
<modified>2016-05-09</modified>
</dates>
</vuln>
<vuln vid="0d724b05-687f-4527-9c03-af34d3b094ec">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.3.9_1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/03/18">
<p>Insufficient filtering for filename passed to delegate's command
allows remote code execution during conversion of several file
formats. Any service which uses ImageMagick to process user
supplied images and uses default delegates.xml / policy.xml,
may be vulnerable to this issue.</p>
<p>It is possible to make ImageMagick perform a HTTP GET or FTP
request</p>
<p>It is possible to delete files by using ImageMagick's 'ephemeral'
pseudo protocol which deletes files after reading.</p>
<p>It is possible to move image files to file with any extension
in any folder by using ImageMagick's 'msl' pseudo protocol.
msl.txt and image.gif should exist in known location - /tmp/
for PoC (in real life it may be web service written in PHP,
which allows to upload raw txt files and process images with
ImageMagick).</p>
<p>It is possible to get content of the files from the server
by using ImageMagick's 'label' pseudo protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3714</cvename>
<cvename>CVE-2016-3715</cvename>
<cvename>CVE-2016-3716</cvename>
<cvename>CVE-2016-3717</cvename>
<cvename>CVE-2016-3718</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/05/03/18</url>
<url>https://imagetragick.com/</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-06</entry>
<modified>2016-05-07</modified>
</dates>
</vuln>
<vuln vid="a6cd01fa-11bd-11e6-bb3c-9cb654ea3e1c">
<topic>jansson -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>jansson</name>
<range><lt>2.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>QuickFuzz reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/01/5">
<p>A crash caused by stack exhaustion parsing a JSON was found.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/5</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/02/1</url>
<cvename>CVE-2016-4425</cvename>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-04</entry>
</dates>
</vuln>
<vuln vid="01d729ca-1143-11e6-b55e-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_11</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_8</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.3.0</ge><lt>2.3.4</lt></range>
<range><lt>2.2.7</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.3.4</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_2</lt></range>
<range><ge>10.2</ge><lt>10.2_16</lt></range>
<range><ge>10.1</ge><lt>10.1_33</lt></range>
<range><ge>9.3</ge><lt>9.3_41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160503.txt">
<p>Memory corruption in the ASN.1 encoder</p>
<p>Padding oracle in AES-NI CBC MAC check</p>
<p>EVP_EncodeUpdate overflow</p>
<p>EVP_EncryptUpdate overflow</p>
<p>ASN.1 BIO excessive memory allocation</p>
<p>EBCDIC overread (OpenSSL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160503.txt</url>
<url>https://marc.info/?l=openbsd-tech&m=146228598730414</url>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-2106</cvename>
<cvename>CVE-2016-2107</cvename>
<cvename>CVE-2016-2108</cvename>
<cvename>CVE-2016-2109</cvename>
<cvename>CVE-2016-2176</cvename>
<freebsdsa>SA-16:17.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95564990-1138-11e6-b55e-b499baebfeaf">
<cancelled superseded="01d729ca-1143-11e6-b55e-b499baebfeaf"/>
</vuln>
<vuln vid="be72e773-1131-11e6-94fa-002590263bf5">
<topic>gitlab -- privilege escalation via "impersonate" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.2.0</ge><lt>8.2.5</lt></range>
<range><ge>8.3.0</ge><lt>8.3.9</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.12</lt></range>
<range><ge>8.6.0</ge><lt>8.6.8</lt></range>
<range><ge>8.7.0</ge><lt>8.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/">
<p>During an internal code review, we discovered a critical security
flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2,
this feature was intended to allow an administrator to simulate
being logged in as any other user.</p>
<p>A part of this feature was not properly secured and it was possible
for any authenticated user, administrator or not, to "log in" as any
other user, including administrators. Please see the issue for more
details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4340</cvename>
<freebsdpr>ports/209225</freebsdpr>
<url>https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/</url>
<url>https://gitlab.com/gitlab-org/gitlab-ce/issues/15548</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="5764c634-10d2-11e6-94fa-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-bcmath</name>
<name>php70-exif</name>
<name>php70-gd</name>
<name>php70-xml</name>
<range><lt>7.0.6</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-bcmath</name>
<name>php56-exif</name>
<name>php56-gd</name>
<name>php56-xml</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-bcmath</name>
<name>php55-exif</name>
<name>php55-gd</name>
<name>php55-xml</name>
<range><lt>5.5.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.35">
<ul><li>BCMath:
<ul>
<li>Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
_one_ definition).</li>
</ul></li>
<li>Exif:
<ul>
<li>Fixed bug #72094 (Out of bounds heap read access in exif header
processing).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #71912 (libgd: signedness vulnerability).
(CVE-2016-3074)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos
with negative offset).</li>
</ul></li>
<li>XML:
<ul>
<li>Fixed bug #72099 (xml_parse_into_struct segmentation fault).
</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3074</cvename>
<freebsdpr>ports/209145</freebsdpr>
<url>http://www.php.net/ChangeLog-7.php#7.0.6</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.21</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.35</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="a1134048-10c6-11e6-94fa-002590263bf5">
<topic>libksba -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>libksba</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/29/5">
<p>Denial of Service due to stack overflow in src/ber-decoder.c.</p>
<p>Integer overflow in the BER decoder src/ber-decoder.c.</p>
<p>Integer overflow in the DN decoder src/dn.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4353</cvename>
<cvename>CVE-2016-4354</cvename>
<cvename>CVE-2016-4355</cvename>
<cvename>CVE-2016-4356</cvename>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3</url>
<url>https://security.gentoo.org/glsa/201604-04</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/04/29/5</mlist>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="7e36c369-10c0-11e6-94fa-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-19</p>
<p>The NCP dissector could crash. (Bug 11591)</p></li>
<li><p>wnpa-sec-2016-20</p>
<p>TShark could crash due to a packet reassembly bug. (Bug 11799)
</p></li>
<li><p>wnpa-sec-2016-21</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
</p></li>
<li><p>wnpa-sec-2016-22</p>
<p>The PKTC dissector could crash. (Bug 12206)</p></li>
<li><p>wnpa-sec-2016-23</p>
<p>The PKTC dissector could crash. (Bug 12242)</p></li>
<li><p>wnpa-sec-2016-24</p>
<p>The IAX2 dissector could go into an infinite loop. (Bug
12260)</p></li>
<li><p>wnpa-sec-2016-25</p>
<p>Wireshark and TShark could exhaust the stack. (Bug 12268)</p>
</li>
<li><p>wnpa-sec-2016-26</p>
<p>The GSM CBCH dissector could crash. (Bug 12278)</p></li>
<li><p>wnpa-sec-2016-27</p>
<p>MS-WSP dissector crash. (Bug 12341)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4076</cvename>
<cvename>CVE-2016-4077</cvename>
<cvename>CVE-2016-4078</cvename>
<cvename>CVE-2016-4079</cvename>
<cvename>CVE-2016-4080</cvename>
<cvename>CVE-2016-4081</cvename>
<cvename>CVE-2016-4006</cvename>
<cvename>CVE-2016-4082</cvename>
<cvename>CVE-2016-4083</cvename>
<cvename>CVE-2016-4084</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/25/2</url>
</references>
<dates>
<discovery>2016-04-22</discovery>
<entry>2016-05-02</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="78abc022-0fee-11e6-9a1c-0014a5a57822">
<topic>mercurial -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>3.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29">
<p>CVE-2016-3105: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3105</cvename>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-01</entry>
</dates>
</vuln>
<vuln vid="8c2b2f11-0ebe-11e6-b55e-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.25</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.12</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>percona-server</name>
<range><lt>5.6.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL">
<p>Critical Patch Update contains 31 new security fixes for Oracle MySQL
5.5.48, 5.6.29, 5.7.11 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/</url>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0639</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2016-0640</cvename>
<cvename>CVE-2016-0641</cvename>
<cvename>CVE-2016-3461</cvename>
<cvename>CVE-2016-2047</cvename>
<cvename>CVE-2016-0642</cvename>
<cvename>CVE-2016-0643</cvename>
<cvename>CVE-2016-0644</cvename>
<cvename>CVE-2016-0646</cvename>
<cvename>CVE-2016-0647</cvename>
<cvename>CVE-2016-0648</cvename>
<cvename>CVE-2016-0649</cvename>
<cvename>CVE-2016-0650</cvename>
<cvename>CVE-2016-0652</cvename>
<cvename>CVE-2016-0653</cvename>
<cvename>CVE-2016-0654</cvename>
<cvename>CVE-2016-0655</cvename>
<cvename>CVE-2016-0656</cvename>
<cvename>CVE-2016-0657</cvename>
<cvename>CVE-2016-0658</cvename>
<cvename>CVE-2016-0651</cvename>
<cvename>CVE-2016-0659</cvename>
<cvename>CVE-2016-0661</cvename>
<cvename>CVE-2016-0662</cvename>
<cvename>CVE-2016-0663</cvename>
<cvename>CVE-2016-0665</cvename>
<cvename>CVE-2016-0666</cvename>
<cvename>CVE-2016-0667</cvename>
<cvename>CVE-2016-0668</cvename>
</references>
<dates>
<discovery>2016-04-19</discovery>
<entry>2016-04-30</entry>
</dates>
</vuln>
<vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
<topic>logstash -- password disclosure vulnerability</topic>
<affects>
<package>
<name>logstash</name>
<range><ge>2.1.0</ge><lt>2.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Logstash developers report:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
<h2>Passwords Printed in Log Files under Some Conditions</h2>
<p>It was discovered that, in Logstash 2.1.0+, log messages
generated by a stalled pipeline during shutdown will print
plaintext contents of password fields. While investigating
this issue we also discovered that debug logging has
included this data for quite some time. Our latest releases
fix both leaks. You will want to scrub old log files if this
is of particular concern to you. This was fixed in issue
#4965</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
<url>https://github.com/elastic/logstash/pull/4965</url>
</references>
<dates>
<discovery>2016-04-01</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
<p>svnserve, the svn:// protocol server, can optionally use the Cyrus
SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL
would permit the remote user to specify a realm string which is
a prefix of the expected realm string.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
<p>Subversion's httpd servers are vulnerable to a remotely triggerable crash
in the mod_authz_svn module. The crash can occur during an authorization
check for a COPY or MOVE request with a specially crafted header value.</p>
<p>This allows remote attackers to cause a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2167</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
<cvename>CVE-2016-2168</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
</references>
<dates>
<discovery>2016-04-21</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p7</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.92</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_1</lt></range>
<range><ge>10.2</ge><lt>10.2_15</lt></range>
<range><ge>10.1</ge><lt>10.1_32</lt></range>
<range><ge>9.3</ge><lt>9.3_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p7, released on Tuesday, 26 April 2016:</p>
<ul>
<li>Bug 3020 / CVE-2016-1551: Refclock impersonation
vulnerability, AKA: refclock-peering. Reported by
Matt Street and others of Cisco ASIG</li>
<li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
ephemeral association attack, AKA: ntp-sybil -
MITIGATION ONLY. Reported by Matthew Van Gundy
of Cisco ASIG</li>
<li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
unconfig directives will cause an assertion botch.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3010 / CVE-2016-2517: Remote configuration
trustedkey/requestkey values are not properly
validated. Reported by Yihan Lian of the Cloud
Security Team, Qihoo 360</li>
<li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
hmode > 7 causes array wraparound with MATCH_ASSOC.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
value not always checked. Reported by Yihan Lian
of the Cloud Security Team, Qihoo 360</li>
<li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
AKA: nak-dos. Reported by Stephen Gray and
Matthew Van Gundy of Cisco ASIG</li>
<li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
MITIGATION ONLY. Reported by Miroslav Lichvar of
RedHat and separately by Jonathan Gardner of
Cisco ASIG.</li>
<li>Bug 2952 / CVE-2015-7704: KoD fix: peer
associations were broken by the fix for
NtpBug2901, AKA: Symmetric active/passive mode
is broken. Reported by Michael Tatarinov,
NTP Project Developer Volunteer</li>
<li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
Origin Timestamp Bypass, AKA: Additional KoD Checks.
Reported by Jonathan Gardner of Cisco ASIG</li>
<li>Bug 2879 / CVE-2016-1550: Improve NTP security
against buffer comparison timing attacks,
authdecrypt-timing, AKA: authdecrypt-timing.
Reported independently by Loganaden Velvindron,
and Matthew Van Gundy and Stephen Gray of
Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:16.ntp</freebsdsa>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2016-1547</cvename>
<cvename>CVE-2016-1548</cvename>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2016-1550</cvename>
<cvename>CVE-2016-1551</cvename>
<cvename>CVE-2016-2516</cvename>
<cvename>CVE-2016-2517</cvename>
<cvename>CVE-2016-2518</cvename>
<cvename>CVE-2016-2519</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>46.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.43</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
<range><lt>38.8.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>39.0</ge><lt>45.1.0</lt></range>
<range><lt>38.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
<p>MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
rv:45.1 / rv:38.8)</p>
<p>MFSA 2016-42 Use-after-free and buffer overflow
in Service Workers</p>
<p>MFSA 2016-44 Buffer overflow in libstagefright with
CENC offsets</p>
<p>MFSA 2016-45 CSP not applied to pages sent with
multipart/x-mixed-replace</p>
<p>MFSA 2016-46 Elevation of privilege with
chrome.tabs.update API in web extensions</p>
<p>MFSA 2016-47 Write to invalid HashMap entry through
JavaScript.watch()</p>
<p>MFSA 2016-48 Firefox Health Reports could accept events
from untrusted domains</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2804</cvename>
<cvename>CVE-2016-2805</cvename>
<cvename>CVE-2016-2806</cvename>
<cvename>CVE-2016-2807</cvename>
<cvename>CVE-2016-2808</cvename>
<cvename>CVE-2016-2811</cvename>
<cvename>CVE-2016-2812</cvename>
<cvename>CVE-2016-2814</cvename>
<cvename>CVE-2016-2816</cvename>
<cvename>CVE-2016-2817</cvename>
<cvename>CVE-2016-2820</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-26</entry>
</dates>
</vuln>
<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
<topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
<p>The vulnerability exists due to application does not properly
verify origin of HTTP requests in "Interface Translation"
functionality.: A remote unauthenticated attacker can create
a specially crafted malicious web page with CSRF exploit, trick
a logged-in administrator to visit the page, spoof the HTTP
request, as if it was coming from the legitimate user, inject
and execute arbitrary PHP code on the target system with privileges
of the webserver.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
<url>https://www.htbridge.com/advisory/HTB23300</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-23</entry>
</dates>
</vuln>
<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
<topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Libtasn1 NEWS reports:</p>
<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
<p>Fixes to avoid an infinite recursion when decoding without the
ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4008</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
<url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:5 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
<p>Due to incorrect buffer management Squid cachemgr.cgi tool is
vulnerable to a buffer overflow when processing remotely supplied
inputs relayed to it from Squid.</p>
<p>This problem allows any client to seed the Squid manager reports
with data that will cause a buffer overflow when processed by the
cachemgr.cgi tool. However, this does require manual administrator
actions to take place. Which greatly reduces the impact and
possible uses.</p>
</blockquote>
<p>Squid security advisory 2016:6 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
<p>Due to buffer overflow issues Squid is vulnerable to a denial of
service attack when processing ESI responses. Due to incorrect input
validation Squid is vulnerable to public information disclosure of
the server stack layout when processing ESI responses. Due to
incorrect input validation and buffer overflow Squid is vulnerable
to remote code execution when processing ESI responses.</p>
<p>These problems allow ESI components to be used to perform a denial
of service attack on the Squid service and all other services on the
same machine. Under certain build conditions these problems allow
remote clients to view large sections of the server memory. However,
the bugs are exploitable only if you have built and configured the
ESI features to be used by a reverse-proxy and if the ESI components
being processed by Squid can be controlled by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4051</cvename>
<cvename>CVE-2016-4052</cvename>
<cvename>CVE-2016-4053</cvename>
<cvename>CVE-2016-4054</cvename>
<freebsdpr>ports/208939</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
</references>
<dates>
<discovery>2016-04-20</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
<topic>ansible -- use of predictable paths in lxc_container</topic>
<affects>
<package>
<name>ansible</name>
<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
</package>
<package>
<name>ansible1</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
<p>CVE-2016-3096: do not use predictable paths in lxc_container</p>
<ul>
<li>do not use a predictable filename for the LXC attach
script</li>
<li>don't use predictable filenames for LXC attach script
logging</li>
<li>don't set a predictable archive_path</li>
</ul>
<p>this should prevent symlink attacks which could result
in</p>
<ul>
<li>data corruption</li>
<li>data leakage</li>
<li>privilege escalation</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3096</cvename>
<url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
</references>
<dates>
<discovery>2016-04-02</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
<topic>proftpd -- vulnerability in mod_tls</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5b</lt></range>
<range><eq>1.3.6.r1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
<p>The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
might cause a weaker than intended Diffie-Hellman (DH) key to be used
and consequently allow attackers to have unspecified impact via
unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3125</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
<p>20 security fixes in this release, including:</p>
<ul>
<li>[590275] High CVE-2016-1652: Universal XSS in extension
bindings. Credit to anonymous.</li>
<li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
to Choongwoo Han.</li>
<li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
JPEG2000 decoding. Credit to kdot working with HP's Zero Day
Initiative.</li>
<li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
media. Credit to Atte Kettunen of OUSPG.</li>
<li>[582008] Medium CVE-2016-1655: Use-after-free related to
extensions. Credit to Rob Wu.</li>
<li>[570750] Medium CVE-2016-1656: Android downloaded file path
restriction bypass. Credit to Dzmitry Lukyanenko.</li>
<li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
Luan Herrera.</li>
<li>[573317] Low CVE-2016-1658: Potential leak of sensitive
information to malicious extensions. Credit to Antonio Sanso
(@asanso) of Adobe.</li>
<li>[602697] CVE-2016-1659: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1651</cvename>
<cvename>CVE-2016-1652</cvename>
<cvename>CVE-2016-1653</cvename>
<cvename>CVE-2016-1654</cvename>
<cvename>CVE-2016-1655</cvename>
<cvename>CVE-2016-1656</cvename>
<cvename>CVE-2016-1657</cvename>
<cvename>CVE-2016-1658</cvename>
<cvename>CVE-2016-1659</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
</references>
<dates>
<discovery>2016-04-13</discovery>
<entry>2016-04-19</entry>
</dates>
</vuln>
<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_1</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
<p>wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
CVE-2015-5310)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
<p>EAP-pwd missing last fragment length validation. (2015-7 -
CVE-2015-5315)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
<p>EAP-pwd peer error path failure on unexpected Confirm message.
(2015-8 - CVE-2015-5316)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5310</cvename>
<cvename>CVE-2015-5315</cvename>
<cvename>CVE-2015-5316</cvename>
<freebsdpr>ports/208482</freebsdpr>
<url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
<url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
<url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2016-04-19</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
<p>The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
in dhcpcd 5.x in Android before 5.1 and other products, does not
validate the relationship between length fields and the amount of
data, which allows remote DHCP servers to execute arbitrary code or
cause a denial of service (memory corruption) via a large length
value of an option in a DHCPACK message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7912</cvename>
<url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
</references>
<dates>
<discovery>2015-06-19</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
<p>The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
products, misinterprets the return value of the snprintf function,
which allows remote DHCP servers to execute arbitrary code or cause
a denial of service (memory corruption) via a crafted message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7913</cvename>
<freebsdpr>ports/208702</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
<topic>PJSIP -- TCP denial of service in PJProject</topic>
<affects>
<package>
<name>pjsip</name>
<range><le>2.4.5</le></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><le>2.4.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>PJProject has a limit on the number of TCP connections
that it can accept. Furthermore, PJProject does not close
TCP connections it accepts. By default, this value is
approximately 60.</p>
<p>An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no
data to Asterisk.</p>
<p>If PJProject has been compiled in debug mode, then
once the number of allowed TCP connections has been
depleted, the next attempted TCP connection to Asterisk
will crash due to an assertion in PJProject.</p>
<p>If PJProject has not been compiled in debug mode, then
any further TCP connection attempts will be rejected.
This makes Asterisk unable to process TCP SIP traffic.</p>
<p>Note that this only affects TCP/TLS, since UDP is
connectionless.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
<topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may crash when processing an incoming REGISTER
request if that REGISTER contains a Contact header with
a lengthy URI.</p>
<p>This crash will only happen for requests that pass
authentication. Unauthenticated REGISTER requests will
not result in a crash occurring.</p>
<p>This vulnerability only affects Asterisk when using
PJSIP as its SIP stack. The chan_sip module does not have
this problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
<topic>go -- remote denial of service</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.6.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
<p>Go has an infinite loop in several big integer routines that makes
Go programs vulnerable to remote denial of service attacks. Programs
using HTTPS client authentication or the Go ssh server libraries are
both exposed to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3959</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
<url>https://golang.org/cl/21533</url>
</references>
<dates>
<discovery>2016-04-05</discovery>
<entry>2016-04-14</entry>
</dates>
</vuln>
<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
<p>[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.</p>
<p>[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
A man in the middle is able to clear even required flags, especially
NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.</p>
<p>[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints, and obtain
sensitive session information, by running a crafted application and leveraging
the ability to sniff network traffic.</p>
<p>[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
to no integrity protection.</p>
<p>[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).</p>
<p>[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.</p>
<p>[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited from the underlying SMB connection.</p>
<p>[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
between a client and a server in order to impersonate the client and get the same privileges
as the authenticated user account. This is most problematic against active directory domain controllers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5370</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
<cvename>CVE-2016-2110</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
<cvename>CVE-2016-2111</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
<cvename>CVE-2016-2112</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
<cvename>CVE-2016-2113</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
<cvename>CVE-2016-2114</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
<cvename>CVE-2016-2115</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
<cvename>CVE-2016-2118</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
</references>
<dates>
<discovery>2016-04-12</discovery>
<entry>2016-04-12</entry>
<modified>2016-04-12</modified>
</dates>
</vuln>
<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-fileinfo</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-snmp</name>
<range><lt>7.0.5</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-fileinfo</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-snmp</name>
<range><lt>5.6.20</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-fileinfo</name>
<name>php55-mbstring</name>
<name>php55-phar</name>
<name>php55-snmp</name>
<range><lt>5.5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
<ul><li>Fileinfo:
<ul>
<li>Fixed bug #71527 (Buffer over-write in finfo_open with
malformed magic file).</li>
</ul></li>
<li>mbstring:
<ul>
<li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
in mbfl_strcut).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71860 (Invalid memory write in phar on filename with
\0 in name).</li>
</ul></li>
<li>SNMP:
<ul>
<li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/208465</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.5</url>
<url>http://php.net/ChangeLog-5.php#5.6.20</url>
<url>http://php.net/ChangeLog-5.php#5.5.34</url>
</references>
<dates>
<discovery>2016-03-31</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
<p>The pcre_compile2 function in pcre_compile.c in PCRE 8.38
mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/
pattern and related patterns with named subgroups, which allows
remote attackers to cause a denial of service (heap-based buffer
overflow) or possibly have unspecified other impact via a crafted
regular expression, as demonstrated by a JavaScript RegExp object
encountered by Konqueror.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1283</cvename>
<freebsdpr>ports/208260</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
</references>
<dates>
<discovery>2016-02-27</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
<topic>py-djblets -- Self-XSS vulnerability</topic>
<affects>
<package>
<name>py27-djblets</name>
<name>py32-djblets</name>
<name>py33-djblets</name>
<name>py34-djblets</name>
<name>py35-djblets</name>
<range><lt>0.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Djblets Release Notes reports:</p>
<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
<p>A recently-discovered vulnerability in the datagrid templates allows an
attacker to generate a URL to any datagrid page containing malicious code
in a column sorting value. If the user visits that URL and then clicks
that column, the code will execute.</p>
<p>The cause of the vulnerability was due to a template not escaping
user-provided values.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.11</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.5</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0003: Incorrect capability check when displaying
users emails in Participants list</p></li>
<li><p>MSA-16-0004: XSS from profile fields from external db</p>
</li>
<li><p>MSA-16-0005: Reflected XSS in mod_data advanced search</p>
</li>
<li><p>MSA-16-0006: Hidden courses are shown to students in Event
Monitor</p></li>
<li><p>MSA-16-0007: Non-Editing Instructor role can edit exclude
checkbox in Single View</p></li>
<li><p>MSA-16-0008: External function get_calendar_events return
events that pertains to hidden activities</p></li>
<li><p>MSA-16-0009: CSRF in Assignment plugin management page</p>
</li>
<li><p>MSA-16-0010: Enumeration of category details possible without
authentication</p></li>
<li><p>MSA-16-0011: Add no referrer to links with _blank target
attribute</p></li>
<li><p>MSA-16-0012: External function mod_assign_save_submission
does not check due dates</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2151</cvename>
<cvename>CVE-2016-2152</cvename>
<cvename>CVE-2016-2153</cvename>
<cvename>CVE-2016-2154</cvename>
<cvename>CVE-2016-2155</cvename>
<cvename>CVE-2016-2156</cvename>
<cvename>CVE-2016-2157</cvename>
<cvename>CVE-2016-2158</cvename>
<cvename>CVE-2016-2190</cvename>
<cvename>CVE-2016-2159</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-03-21</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
<p>Due to a buffer overrun Squid pinger binary is vulnerable to
denial of service or information leak attack when processing
ICMPv6 packets.</p>
<p>This bug also permits the server response to manipulate other
ICMP and ICMPv6 queries processing to cause information leak.</p>
<p>This bug allows any remote server to perform a denial of service
attack on the Squid service by crashing the pinger. This may
affect Squid HTTP routing decisions. In some configurations,
sub-optimal routing decisions may result in serious service
degradation or even transaction failures.</p>
<p>If the system does not contain buffer-overrun protection leading
to that crash this bug will instead allow attackers to leak
arbitrary amounts of information from the heap into Squid log
files. This is of higher importance than usual because the pinger
process operates with root priviliges.</p>
</blockquote>
<p>Squid security advisory 2016:4 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>This problem allows a malicious client script and remote server
delivering certain unusual HTTP response syntax to trigger a
denial of service for all clients accessing the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3947</cvename>
<cvename>CVE-2016-3948</cvename>
<freebsdpr>ports/208463</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-04-02</entry>
</dates>
</vuln>
<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql95-server</name>
<name>postgresql95-contrib</name>
<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1656/">
<p>Security Fixes for RLS, BRIN</p>
<p>
This release closes security hole CVE-2016-2193
(https://access.redhat.com/security/cve/CVE-2016-2193), where a query
plan might get reused for more than one ROLE in the same session.
This could cause the wrong set of Row Level Security (RLS) policies to
be used for the query.</p>
<p>
The update also fixes CVE-2016-3065
(https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
bug triggered by using `pageinspect` with BRIN index pages. Since an
attacker might be able to expose a few bytes of server memory, this
crash is being treated as a security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2193</cvename>
<cvename>CVE-2016-3065</cvename>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.577</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
<p>These updates resolve integer overflow vulnerabilities that
could lead to code execution (CVE-2016-0963, CVE-2016-0993,
CVE-2016-1010).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-0987, CVE-2016-0988,
CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
CVE-2016-1000).</p>
<p>These updates resolve a heap overflow vulnerability that could
lead to code execution (CVE-2016-1001).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2016-0960, CVE-2016-0961,
CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
CVE-2016-1002, CVE-2016-1005).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0960</cvename>
<cvename>CVE-2016-0961</cvename>
<cvename>CVE-2016-0962</cvename>
<cvename>CVE-2016-0963</cvename>
<cvename>CVE-2016-0986</cvename>
<cvename>CVE-2016-0987</cvename>
<cvename>CVE-2016-0988</cvename>
<cvename>CVE-2016-0989</cvename>
<cvename>CVE-2016-0990</cvename>
<cvename>CVE-2016-0991</cvename>
<cvename>CVE-2016-0992</cvename>
<cvename>CVE-2016-0993</cvename>
<cvename>CVE-2016-0994</cvename>
<cvename>CVE-2016-0995</cvename>
<cvename>CVE-2016-0996</cvename>
<cvename>CVE-2016-0997</cvename>
<cvename>CVE-2016-0998</cvename>
<cvename>CVE-2016-0999</cvename>
<cvename>CVE-2016-1000</cvename>
<cvename>CVE-2016-1001</cvename>
<cvename>CVE-2016-1002</cvename>
<cvename>CVE-2016-1005</cvename>
<cvename>CVE-2016-1010</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
<topic>Multiple vulnerabilities in Botan</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/security.html">
<p>Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.</p>
<p>Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.</p>
<p>The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.</p>
<p>The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.</p>
<p>On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2016-2194</cvename>
<cvename>CVE-2016-2195</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
<topic>Botan BER Decoder vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/">
<p>Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.</p>
<p>Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2015-5726</cvename>
<cvename>CVE-2015-5727</cvename>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
<topic>mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
<p>CVE-2016-3630: Remote code execution in binary delta decoding</p>
<p>CVE-2016-3068: Arbitrary code execution with Git subrepos</p>
<p>CVE-2016-3069: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3630</cvename>
<cvename>CVE-2016-3068</cvename>
<cvename>CVE-2016-3069</cvename>
<url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
</references>
<dates>
<discovery>2016-03-29</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
<p>[594574] High CVE-2016-1646: Out-of-bounds read in V8.</p>
<p>[590284] High CVE-2016-1647: Use-after-free in Navigation.</p>
<p>[590455] High CVE-2016-1648: Use-after-free in Extensions.</p>
<p>[597518] CVE-2016-1650: Various fixes from internal audits,
fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed at the tip of the
4.9 branch</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1646</cvename>
<cvename>CVE-2016-1647</cvename>
<cvename>CVE-2016-1648</cvename>
<cvename>CVE-2016-1649</cvename>
<cvename>CVE-2016-1650</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2016-03-24</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.87</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
<p>[589838] High CVE-2016-1643: Type confusion in Blink.</p>
<p>[590620] High CVE-2016-1644: Use-after-free in Blink.</p>
<p>[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1643</cvename>
<cvename>CVE-2016-1644</cvename>
<cvename>CVE-2016-1645</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01351">
<p>A response containing multiple DNS cookies causes servers with
cookie support enabled to exit with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2088</cvename>
<url>https://kb.isc.org/article/AA-01351</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01353">
<p>A problem parsing resource record signatures for DNAME resource
records can lead to an assertion failure in resolver.c or db.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1286</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01353</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01352">
<p>An error parsing input received by the rndc control channel can
cause an assertion failure in sexpr.c or alist.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1285</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01352</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
<topic>salt -- Insecure configuration of PAM external authentication service</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><lt>2015.5.10</lt></range>
<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
<p>This issue affects all Salt versions prior to 2015.8.8/2015.5.10
when PAM external authentication is enabled. This issue involves
passing an alternative PAM authentication service with a command
that is sent to LocalClient, enabling the attacker to bypass the
configured authentication service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3176</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
</references>
<dates>
<discovery>2016-03-17</discovery>
<entry>2016-03-27</entry>
</dates>
</vuln>
<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Unsafe deserialization</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
<p>JMS Object messages depends on Java Serialization for
marshaling/unmashaling of the message payload. There are a couple of places
inside the broker where deserialization can occur, like web console or stomp
object message transformation. As deserialization of untrusted data can lead to
security flaws as demonstrated in various reports, this leaves the broker
vulnerable to this attack vector. Additionally, applications that consume
ObjectMessage type of messages can be vulnerable as they deserialize objects on
ObjectMessage.getObject() calls.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
<cvename>CVE-2015-5254</cvename>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Clickjacking</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Furman reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
<p>The web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be embedded
in a frame or iframe which could then be used to cause a user to perform an
unintended action in the console.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
<cvename>CVE-2016-0734</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Cross-Site Scripting</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vladimir Ivanov (Positive Technologies) reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
<p>Several instances of cross-site scripting vulnerabilities were
identified to be present in the web based administration console as well as the
ability to trigger a Java memory dump into an arbitrary folder. The root cause
of these issues are improper user data output validation and incorrect
permissions configured on Jolokia.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
<cvename>CVE-2016-0782</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
<topic>pcre -- stack buffer overflow</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38</lt></range>
</package>
<package>
<name>pcre2</name>
<range><lt>10.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philip Hazel reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
<p>PCRE does not validate that handling the (*ACCEPT) verb
will occur within the bounds of the cworkspace stack buffer, leading to
a stack buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
<cvename>CVE-2016-3191</cvename>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-03-21</entry>
<modified>2016-03-21</modified>
</dates>
</vuln>
<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
<topic>kamailio -- SEAS Module Heap overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>4.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stelios Tsampas reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
<p>A (remotely exploitable) heap overflow vulnerability was found in
Kamailio v4.3.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2385</cvename>
<url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
<url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
<url>http://seclists.org/oss-sec/2016/q1/338</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
<modified>2016-04-03</modified>
</dates>
</vuln>
<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
<topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
<affects>
<package>
<name>hadoop2</name>
<range><ge>2.6</ge><lt>2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arun Suresh reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
<p>RPC traffic from clients, potentially including authentication
credentials, may be intercepted by a malicious user with access to
run tasks or containers on a cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1776</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
</dates>
</vuln>
<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
<topic>git -- integer overflow</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
<p>integer overflow due to a loop which adds more to "len".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2324</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
<url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-03-18</entry>
</dates>
</vuln>
<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
<topic>git -- potential code execution</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
<p>"int" is the wrong data type for ... nlen assignment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2315</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
<url>https://marc.info/?l=oss-security&m=145809217306686&w=2</url>
<url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2016-03-17</entry>
</dates>
</vuln>
<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
<topic>node -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>5.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremiah Senkpiel reports:</p>
<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
<ul>
<li><p>Fix a double-free defect in parsing malformed DSA keys
that may potentially be used for DoS or memory corruption attacks.</p></li>
<li><p>Fix a defect that can cause memory corruption in
certain very rare cases</p></li>
<li><p>Fix a defect that makes the CacheBleed Attack possible</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
<topic>dropbear -- authorized_keys command= bypass</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnson reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Validate X11 forwarding input. Could allow bypass of
authorized_keys command= restrictions</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2016-3116</cvename>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
<topic>jpgraph2 -- XSS vulnerability</topic>
<affects>
<package>
<name>jpgraph2</name>
<range><lt>3.0.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Barbella reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
<p>JpGraph is an object oriented library for PHP that can be used to create
various types of graphs which also contains support for client side
image maps.
The GetURLArguments function for the JpGraph's Graph class does not
properly sanitize the names of get and post variables, leading to a
cross site scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
</references>
<dates>
<discovery>2009-12-22</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
<topic>php7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-soap</name>
<range><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
<ul><li>Core:
<ul>
<li>Fixed bug #71637 (Multiple Heap Overflow due to integer
overflows in xml/filter_url/addcslashes).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
make_http_soap_request()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.4</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.33</lt></range>
</package>
<package>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
<ul><li>Phar:
<ul>
<li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
Deserialize).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.19</url>
<url>http://php.net/ChangeLog-5.php#5.5.33</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
<topic>openssh -- command injection when X11Forwarding is enabled</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.2.p2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_14</lt></range>
<range><ge>10.1</ge><lt>10.1_31</lt></range>
<range><ge>9.3</ge><lt>9.3_39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
<p>Missing sanitisation of untrusted input allows an
authenticated user who is able to request X11 forwarding
to inject commands to xauth(1).
</p>
<p>Injection of xauth commands grants the ability to read
arbitrary files under the authenticated user's privilege,
Other xauth commands allow limited information leakage,
file overwrite, port probing and generally expose xauth(1),
which was not written with a hostile user in mind, as an
attack surface.
</p>
<p>Mitigation:</p>
<p>Set X11Forwarding=no in sshd_config. This is the default.</p>
<p>For authorized_keys that specify a "command" restriction,
also set the "restrict" (available in OpenSSH >=7.2) or
"no-x11-forwarding" restrictions.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/x11fwd.adv</url>
<cvename>CVE-2016-3115</cvename>
<freebsdsa>SA-16:14.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
<topic>quagga -- stack based buffer overflow vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.0.20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Donald Sharp reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
<p>A malicious BGP peer may execute arbitrary code in
particularly configured remote bgpd hosts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/270232</url>
<url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
<cvename>CVE-2016-2342</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
<topic>ricochet -- information disclosure</topic>
<affects>
<package>
<name>ricochet</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>special reports:</p>
<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
<p>By sending a nickname with some HTML tags in a contact
request, an attacker could cause Ricochet to make network requests
without Tor after the request is accepted, which would reveal the user's
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
<topic>pidgin-otr -- use after free</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
<p>The pidgin-otr plugin version 4.0.2 fixes a heap use after
free error.
The bug is triggered when a user tries to authenticate a buddy and
happens in the function create_smp_dialog.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q1/572</url>
<url>https://bugs.otr.im/issues/88</url>
<url>https://bugs.otr.im/issues/128</url>
<cvename>CVE-2015-8833</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
<topic>libotr -- integer overflow</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>4.1.1</lt></range>
</package>
<package>
<name>libotr3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X41 D-Sec reports:</p>
<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
<p>A remote attacker may crash or execute arbitrary code in
libotr by sending large OTR messages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
<cvename>CVE-2016-2851</cvename>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-03-09</entry>
<modified>2016-03-09</modified>
</dates>
</vuln>
<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
<topic>brotli -- buffer overflow</topic>
<affects>
<package>
<name>brotli</name>
<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
<range><lt>0.2.0_2</lt></range>
</package>
<package>
<name>libbrotli</name>
<range><lt>0.3.0_3</lt></range>
</package>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p>
</blockquote>
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
<p>Security researcher Luke Li reported a pointer underflow
bug in the Brotli library's decompression that leads to a
buffer overflow. This results in a potentially exploitable
crash when triggered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1624</cvename>
<cvename>CVE-2016-1968</cvename>
<url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
<url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
<url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
<p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
/ rv:38.7)</p>
<p>MFSA 2016-17 Local file overwriting and potential
privilege escalation through CSP reports</p>
<p>MFSA 2016-18 CSP reports fail to strip location
information for embedded iframe pages</p>
<p>MFSA 2016-19 Linux video memory DOS with Intel
drivers</p>
<p>MFSA 2016-20 Memory leak in libstagefright when deleting
an array during MP4 processing</p>
<p>MFSA 2016-21 Displayed page address can be overridden</p>
<p>MFSA 2016-22 Service Worker Manager out-of-bounds read in
Service Worker Manager</p>
<p>MFSA 2016-23 Use-after-free in HTML5 string parser</p>
<p>MFSA 2016-24 Use-after-free in SetBody</p>
<p>MFSA 2016-25 Use-after-free when using multiple WebRTC
data channels</p>
<p>MFSA 2016-26 Memory corruption when modifying a file
being read by FileReader</p>
<p>MFSA 2016-27 Use-after-free during XML
transformations</p>
<p>MFSA 2016-28 Addressbar spoofing though history
navigation and Location protocol property</p>
<p>MFSA 2016-29 Same-origin policy violation using
perfomance.getEntries and history navigation with session
restore</p>
<p>MFSA 2016-31 Memory corruption with malicious NPAPI
plugin</p>
<p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
through code inspection</p>
<p>MFSA 2016-33 Use-after-free in GetStaticInstance in
WebRTC</p>
<p>MFSA 2016-34 Out-of-bounds read in HTML parser following
a failed allocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1952</cvename>
<cvename>CVE-2016-1953</cvename>
<cvename>CVE-2016-1954</cvename>
<cvename>CVE-2016-1955</cvename>
<cvename>CVE-2016-1956</cvename>
<cvename>CVE-2016-1957</cvename>
<cvename>CVE-2016-1958</cvename>
<cvename>CVE-2016-1959</cvename>
<cvename>CVE-2016-1960</cvename>
<cvename>CVE-2016-1961</cvename>
<cvename>CVE-2016-1962</cvename>
<cvename>CVE-2016-1963</cvename>
<cvename>CVE-2016-1964</cvename>
<cvename>CVE-2016-1965</cvename>
<cvename>CVE-2016-1966</cvename>
<cvename>CVE-2016-1967</cvename>
<cvename>CVE-2016-1970</cvename>
<cvename>CVE-2016-1971</cvename>
<cvename>CVE-2016-1972</cvename>
<cvename>CVE-2016-1973</cvename>
<cvename>CVE-2016-1974</cvename>
<cvename>CVE-2016-1975</cvename>
<cvename>CVE-2016-1976</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
<topic>graphite2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.6</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
<p>Security researcher Holger Fuhrmannek and Mozilla
security engineer Tyson Smith reported a number of security
vulnerabilities in the Graphite 2 library affecting version
1.3.5.
The issue reported by Holger Fuhrmannek is a mechanism to
induce stack corruption with a malicious graphite font. This
leads to a potentially exploitable crash when the font is
loaded.
Tyson Smith used the Address Sanitizer tool in concert with
a custom software fuzzer to find a series of uninitialized
memory, out-of-bounds read, and out-of-bounds write errors
when working with fuzzed graphite fonts.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
<p>Security researcher James Clawson used the Address
Sanitizer tool to discover an out-of-bounds write in the
Graphite 2 library when loading a crafted Graphite font
file. This results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
<cvename>CVE-2016-1969</cvename>
<cvename>CVE-2016-1977</cvename>
<cvename>CVE-2016-2790</cvename>
<cvename>CVE-2016-2791</cvename>
<cvename>CVE-2016-2792</cvename>
<cvename>CVE-2016-2793</cvename>
<cvename>CVE-2016-2794</cvename>
<cvename>CVE-2016-2795</cvename>
<cvename>CVE-2016-2796</cvename>
<cvename>CVE-2016-2797</cvename>
<cvename>CVE-2016-2798</cvename>
<cvename>CVE-2016-2799</cvename>
<cvename>CVE-2016-2800</cvename>
<cvename>CVE-2016-2801</cvename>
<cvename>CVE-2016-2802</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-14</modified>
</dates>
</vuln>
<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.21.1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.21.0_1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
<p>Security researcher Francis Gabriel reported a heap-based
buffer overflow in the way the Network Security Services
(NSS) libraries parsed certain ASN.1 structures. An attacker
could create a specially-crafted certificate which, when
parsed by NSS, would cause it to crash or execute arbitrary
code with the permissions of the user.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
<p>Mozilla developer Tim Taubert used the Address Sanitizer
tool and software fuzzing to discover a use-after-free
vulnerability while processing DER encoded keys in the
Network Security Services (NSS) libraries. The vulnerability
overwrites the freed memory with zeroes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1950</cvename>
<cvename>CVE-2016-1979</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
<url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
<url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-09-05</modified>
</dates>
</vuln>
<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><lt>3.21</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
<p>Security researcher Hanno Böck reported that calculations
with mp_div and mp_exptmod in Network Security Services
(NSS) can produce wrong results in some circumstances. These
functions are used within NSS for a variety of cryptographic
division functions, leading to potential cryptographic
weaknesses.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
<p>Mozilla developer Eric Rescorla reported that a failed
allocation during DHE and ECDHE handshakes would lead to a
use-after-free vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1938</cvename>
<cvename>CVE-2016-1978</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
<url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
<url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py32-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>Malicious redirect and possible XSS attack via user-supplied
redirect URLs containing basic auth</p>
<p>User enumeration through timing difference on password hasher work
factor upgrade</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2512</cvename>
<cvename>CVE-2016-2513</cvename>
<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
<p>WordPress 4.4.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4.1 and earlier are affected by two security
issues: a possible SSRF for certain local URIs, reported by Ronni
Skansing; and an open redirection attack, reported by Shailesh
Suthar.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2221</cvename>
<cvename>CVE-2016-2222</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
<url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
<topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.67</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
<p>Many versions of PSCP prior to 0.67 have a stack corruption
vulnerability in their treatment of the 'sink' direction (i.e.
downloading from server to client) of the old-style SCP protocol.
</p>
<p>In order for this vulnerability to be exploited, the user must
connect to a malicious server and attempt to download any file.[...]
you can work around it in a vulnerable PSCP by using the -sftp
option to force the use of the newer SFTP protocol, provided your
server supports that protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
<cvename>CVE-2016-2563</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-07</entry>
</dates>
</vuln>
<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
<topic>websvn -- reflected cross-site scripting</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Delafond reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
<p>Jakub Palaczynski discovered that websvn, a web viewer for
Subversion repositories, does not correctly sanitize user-supplied
input, which allows a remote user to run reflected cross-site
scripting attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2511</cvename>
<url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
<url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
<topic>websvn -- information disclosure</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
<p>James Clawson reported:</p>
<p>"Arbitrary files with a known path can be accessed in websvn by
committing a symlink to a repository and then downloading the file
(using the download link).</p>
<p>An attacker must have write access to the repo, and the download
option must have been enabled in the websvn config file."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6892</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
</references>
<dates>
<discovery>2015-01-18</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
<p>Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
contain the following important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2097</cvename>
<cvename>CVE-2016-2098</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
<url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
<p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
<p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
<p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
<p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
<p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
<p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
<p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
<p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
<p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
<p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
<p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
<p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
<p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1630</cvename>
<cvename>CVE-2016-1631</cvename>
<cvename>CVE-2016-1632</cvename>
<cvename>CVE-2016-1633</cvename>
<cvename>CVE-2016-1634</cvename>
<cvename>CVE-2016-1635</cvename>
<cvename>CVE-2016-1636</cvename>
<cvename>CVE-2016-1637</cvename>
<cvename>CVE-2016-1638</cvename>
<cvename>CVE-2016-1639</cvename>
<cvename>CVE-2016-1640</cvename>
<cvename>CVE-2016-1641</cvename>
<cvename>CVE-2016-1642</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
<topic>libssh -- weak Diffie-Hellman secret generation</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
<p>libssh versions 0.1 and above have a bits/bytes confusion bug and
generate an abnormally short ephemeral secret for the
diffie-hellman-group1 and diffie-hellman-group14 key exchange
methods. The resulting secret is 128 bits long, instead of the
recommended sizes of 1024 and 2048 bits respectively. There are
practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
solve this problem in O(2^63) operations.</p>
<p>Both client and server are are vulnerable, pre-authentication.
This vulnerability could be exploited by an eavesdropper with enough
resources to decrypt or intercept SSH sessions. The bug was found
during an internal code review by Aris Adamantiadis of the libssh
team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0739</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
<url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
<topic>exim -- local privillege escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.86.2</lt></range>
<range><lt>4.85.2</lt></range>
<range><lt>4.84.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim development team reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
<p>All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally <strong>any</strong> user) can gain root
privileges. If you do not use 'perl_startup' you <strong>should</strong> be safe.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1531</cvename>
<url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
<p>Changelog</p>
<ul>
<li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
<li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
host_new_graphs_save function in graphs_new.php</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8377</cvename>
<cvename>CVE-2015-8604</cvename>
<cvename>CVE-2016-2313</cvename>
<url>http://www.cacti.net/release_notes_0_8_8g.php</url>
<url>http://bugs.cacti.net/view.php?id=2652</url>
<url>http://bugs.cacti.net/view.php?id=2655</url>
<url>http://bugs.cacti.net/view.php?id=2656</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
</references>
<dates>
<discovery>2016-02-21</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
<topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
<p>XSS vulnerability in SQL parser.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
<p>Multiple XSS vulnerabilities.</p>
<p>By sending a specially crafted URL as part of the HOST
header, it is possible to trigger an XSS attack.</p>
<p>A weakness was found that allows an XSS attack with Internet
Explorer versions older than 8 and Safari on Windows using a
specially crafted URL.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in user accounts page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in zoom search page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
<p>Multiple XSS vulnerabilities.</p>
<p>With a crafted table/column name it is possible to trigger
an XSS attack in the database normalization page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in the database structure page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in central columns page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
<p>Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be exploited
to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
<cvename>CVE-2016-2559</cvename>
<cvename>CVE-2016-2560</cvename>
<cvename>CVE-2016-2561</cvename>
<cvename>CVE-2016-2562</cvename>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-02</p>
<p>ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</p></li>
<li><p>wnpa-sec-2016-03</p>
<p>DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</p></li>
<li><p>wnpa-sec-2016-04</p>
<p>X.509AF dissector crash. (Bug 12002) CVE-2016-2524</p></li>
<li><p>wnpa-sec-2016-05</p>
<p>HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</p></li>
<li><p>wnpa-sec-2016-06</p>
<p>HiQnet dissector crash. (Bug 11983) CVE-2016-2526</p></li>
<li><p>wnpa-sec-2016-07</p>
<p>3GPP TS 32.423 Trace file parser crash. (Bug 11982)
</p>CVE-2016-2527</li>
<li><p>wnpa-sec-2016-08</p>
<p>LBMC dissector crash. (Bug 11984) CVE-2016-2528</p></li>
<li><p>wnpa-sec-2016-09</p>
<p>iSeries file parser crash. (Bug 11985) CVE-2016-2529</p></li>
<li><p>wnpa-sec-2016-10</p>
<p>RSL dissector crash. (Bug 11829) CVE-2016-2530
CVE-2016-2531</p></li>
<li><p>wnpa-sec-2016-11</p>
<p>LLRP dissector crash. (Bug 12048) CVE-2016-2532</p></li>
<li><p>wnpa-sec-2016-12</p>
<p>Ixia IxVeriWave file parser crash. (Bug 11795)</p></li>
<li><p>wnpa-sec-2016-13</p>
<p>IEEE 802.11 dissector crash. (Bug 11818)</p></li>
<li><p>wnpa-sec-2016-14</p>
<p>GSM A-bis OML dissector crash. (Bug 11825)</p></li>
<li><p>wnpa-sec-2016-15</p>
<p>ASN.1 BER dissector crash. (Bug 12106)</p></li>
<li><p>wnpa-sec-2016-16</p>
<p>SPICE dissector large loop. (Bug 12151)</p></li>
<li><p>wnpa-sec-2016-17</p>
<p>NFS dissector crash.</p></li>
<li><p>wnpa-sec-2016-18</p>
<p>ASN.1 BER dissector crash. (Bug 11822)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2522</cvename>
<cvename>CVE-2016-2523</cvename>
<cvename>CVE-2016-2524</cvename>
<cvename>CVE-2016-2525</cvename>
<cvename>CVE-2016-2526</cvename>
<cvename>CVE-2016-2527</cvename>
<cvename>CVE-2016-2528</cvename>
<cvename>CVE-2016-2529</cvename>
<cvename>CVE-2016-2530</cvename>
<cvename>CVE-2016-2531</cvename>
<cvename>CVE-2016-2532</cvename>
<cvename>CVE-2016-4415</cvename>
<cvename>CVE-2016-4416</cvename>
<cvename>CVE-2016-4417</cvename>
<cvename>CVE-2016-4418</cvename>
<cvename>CVE-2016-4419</cvename>
<cvename>CVE-2016-4420</cvename>
<cvename>CVE-2016-4421</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/1</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-01</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2015-31</p>
<p>NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)</p>
</li>
<li><p>wnpa-sec-2015-37</p>
<p>NLM dissector crash.</p></li>
<li><p>wnpa-sec-2015-39</p>
<p>BER dissector crash.</p></li>
<li><p>wnpa-sec-2015-40</p>
<p>Zlib decompression crash. (Bug 11548)</p></li>
<li><p>wnpa-sec-2015-41</p>
<p>SCTP dissector crash. (Bug 11767)</p></li>
<li><p>wnpa-sec-2015-42</p>
<p>802.11 decryption crash. (Bug 11790, Bug 11826)</p></li>
<li><p>wnpa-sec-2015-43</p>
<p>DIAMETER dissector crash. (Bug 11792)</p></li>
<li><p>wnpa-sec-2015-44</p>
<p>VeriWave file parser crashes. (Bug 11789, Bug 11791)</p></li>
<li><p>wnpa-sec-2015-45</p>
<p>RSVP dissector crash. (Bug 11793)</p></li>
<li><p>wnpa-sec-2015-46</p>
<p>ANSI A and GSM A dissector crashes. (Bug 11797)</p></li>
<li><p>wnpa-sec-2015-47</p>
<p>Ascend file parser crash. (Bug 11794)</p></li>
<li><p>wnpa-sec-2015-48</p>
<p>NBAP dissector crash. (Bug 11815)</p></li>
<li><p>wnpa-sec-2015-49</p>
<p>RSL dissector crash. (Bug 11829)</p></li>
<li><p>wnpa-sec-2015-50</p>
<p>ZigBee ZCL dissector crash. (Bug 11830)</p></li>
<li><p>wnpa-sec-2015-51</p>
<p>Sniffer file parser crash. (Bug 11827)</p></li>
<li><p>wnpa-sec-2015-52</p>
<p>NWP dissector crash. (Bug 11726)</p></li>
<li><p>wnpa-sec-2015-53</p>
<p>BT ATT dissector crash. (Bug 11817)</p></li>
<li><p>wnpa-sec-2015-54</p>
<p>MP2T file parser crash. (Bug 11820)</p></li>
<li><p>wnpa-sec-2015-55</p>
<p>MP2T file parser crash. (Bug 11821)</p></li>
<li><p>wnpa-sec-2015-56</p>
<p>S7COMM dissector crash. (Bug 11823)</p></li>
<li><p>wnpa-sec-2015-57</p>
<p>IPMI dissector crash. (Bug 11831)</p></li>
<li><p>wnpa-sec-2015-58</p>
<p>TDS dissector crash. (Bug 11846)</p></li>
<li><p>wnpa-sec-2015-59</p>
<p>PPI dissector crash. (Bug 11876)</p></li>
<li><p>wnpa-sec-2015-60</p>
<p>MS-WSP dissector crash. (Bug 11931)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
</references>
<dates>
<discovery>2015-12-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5346 Apache Tomcat Session fixation</p></li>
<li><p>CVE-2015-5351 Apache Tomcat CSRF token leak</p></li>
<li><p>CVE-2016-0763 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2015-5351</cvename>
<cvename>CVE-2016-0763</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.45</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5345 Apache Tomcat Directory disclosure</p></li>
<li><p>CVE-2016-0706 Apache Tomcat Security Manager bypass</p></li>
<li><p>CVE-2016-0714 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
<cvename>CVE-2015-5345</cvename>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2016-0706</cvename>
<cvename>CVE-2016-0714</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
<topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
<p>The Xerces-C XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0729</cvename>
<url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
</references>
<dates>
<discovery>2016-02-25</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
<topic>django -- regression in permissions model</topic>
<affects>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
<p>User with "change" but not "add" permission can create
objects for ModelAdmin’s with save_as=True</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
<cvename>CVE-2016-2048</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
<p>VMX refuses attempts to enter a guest with an instruction pointer
which doesn't satisfy certain requirements. In particular, the
instruction pointer needs to be canonical when entering a guest
currently in 64-bit mode. This is the case even if the VM entry
information specifies an exception to be injected immediately (in
which case the bad instruction pointer would possibly never get used
for other than pushing onto the exception handler's stack).
Provided the guest OS allows user mode to map the virtual memory
space immediately below the canonical/non-canonical address
boundary, a non-canonical instruction pointer can result even from
normal user mode execution. VM entry failure, however, is fatal to
the guest.</p>
<p>Malicious HVM guest user mode code may be able to crash the
guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2271</cvename>
<url>http://xenbits.xen.org/xsa/advisory-170.html</url>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
<p>While INVLPG does not cause a General Protection Fault when used on
a non-canonical address, INVVPID in its "individual address"
variant, which is used to back the intercepted INVLPG in certain
cases, fails in such cases. Failure of INVVPID results in a
hypervisor bug check.</p>
<p>A malicious guest can crash the host, leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1571</cvename>
<url>http://xenbits.xen.org/xsa/advisory-168.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>3.4.0</eq></range>
<range><eq>3.4.1</eq></range>
<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
<p>The PV superpage functionality lacks certain validity checks on
data being passed to the hypervisor by guests. This is the case
for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
well as for various forms of page table updates.</p>
<p>Use of the feature, which is disabled by default, may have unknown
effects, ranging from information leaks through Denial of Service to
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1570</cvename>
<url>http://xenbits.xen.org/xsa/advisory-167.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.4</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0001: Two enrolment-related web services don't
check course visibility</p></li>
<li><p>MSA-16-0002: XSS Vulnerability in course management
search</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/security/</url>
<cvename>CVE-2016-0724</cvename>
<cvename>CVE-2016-0725</cvename>
</references>
<dates>
<discovery>2016-01-18</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
<topic>pitivi -- code execution</topic>
<affects>
<package>
<name>pitivi</name>
<range><lt>0.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
<p>Double-clicking a file in the user's media library with a
specially-crafted path or filename allows for arbitrary code execution
with the permissions of the user running Pitivi.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
<url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
<cvename>CVE-2015-0855</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
<topic>giflib -- heap overflow</topic>
<affects>
<package>
<name>giflib</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hans Jerry Illikainen reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
<p>A heap overflow may occur in the giffix utility included in
giflib-5.1.1 when processing records of the type
`IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
equaling the value of the logical screen width, `GifFileIn->SWidth',
while subsequently having `GifFileIn->Image.Width' bytes of data written
to it.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/bugtraq/2015/Dec/114</url>
<cvename>CVE-2015-7555</cvename>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.38</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.43</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
<ul>
<li><p>File upload access bypass and denial of service (File
module - Drupal 7 and 8 - Moderately Critical)</p></li>
<li><p>Brute force amplification attacks via XML-RPC (XML-RPC
server - Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Open redirect via path manipulation (Base system -
Drupal 6, 7 and 8 - Moderately Critical) </p></li>
<li><p>Form API ignores access restrictions on submit buttons
(Form API - Drupal 6 - Critical)</p></li>
<li><p>HTTP header injection using line breaks (Base system -
Drupal 6 - Moderately Critical)</p></li>
<li><p>Open redirect via double-encoded 'destination'
parameter (Base system - Drupal 6 - Moderately Critical)</p></li>
<li><p>Reflected file download vulnerability (System module -
Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Saving user accounts can sometimes grant the user all
roles (User module - Drupal 6 and 7 - Less Critical)</p></li>
<li><p>Email address can be matched to an account (User module
- Drupal 7 and 8 - Less Critical)</p></li>
<li><p>Session data truncation can lead to unserialization of
user provided data (Base system - Drupal 6 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2016-001</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.650</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.642.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
<h1>Description</h1>
<h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
<p>A vulnerability in the Jenkins remoting module allowed
unauthenticated remote attackers to open a JRMP listener on the
server hosting the Jenkins master process, which allowed arbitrary
code execution.</p>
<h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
<p>An HTTP response splitting vulnerability in the CLI command
documentation allowed attackers to craft Jenkins URLs that serve
malicious content.</p>
<h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
<p>The verification of user-provided API tokens with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
API tokens using brute-force methods.</p>
<h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
<p>The verification of user-provided CSRF crumbs with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
CSRF crumbs using brute-force methods.</p>
<h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
<p>Jenkins has several API endpoints that allow low-privilege users
to POST XML files that then get deserialized by Jenkins.
Maliciously crafted XML files sent to these API endpoints could
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
<topic>squid -- remote DoS in HTTP response processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>These problems allow remote servers delivering certain unusual
HTTP response syntax to trigger a denial of service for all
clients accessing the Squid service.</p>
<p>HTTP responses containing malformed headers that trigger this
issue are becoming common. We are not certain at this time if
that is a sign of malware or just broken server scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2569</cvename>
<cvename>CVE-2016-2570</cvename>
<cvename>CVE-2016-2571</cvename>
<freebsdpr>ports/207454</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-24</entry>
<modified>2016-02-28</modified>
</dates>
</vuln>
<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
<topic>bsh -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bsh</name>
<range><lt>2.0.b6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stian Soiland-Reyes reports:</p>
<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
<p>This release fixes a remote code execution vulnerability that was
identified in BeanShell by Alvaro Muñoz and Christian Schneider.
The BeanShell team would like to thank them for their help and
contributions to this fix!</p>
<p>An application that includes BeanShell on the classpath may be
vulnerable if another part of the application uses Java
serialization or XStream to deserialize data from an untrusted
source.</p>
<p>A vulnerable application could be exploited for remote code
execution, including executing arbitrary shell commands.</p>
<p>This update fixes the vulnerability in BeanShell, but it is worth
noting that applications doing such deserialization might still be
insecure through other libraries. It is recommended that application
developers take further measures such as using a restricted class
loader when deserializing. See notes on Java serialization security
XStream security and How to secure deserialization from untrusted
input without using encryption or sealing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2510</cvename>
<freebsdpr>ports/207334</freebsdpr>
<url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
<topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
<affects>
<package>
<name>libsrtp</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libsrtp reports:</p>
<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
<p>Prevent potential DoS attack due to lack of bounds checking on RTP
header CSRC count and extension header length. Credit goes to
Randell Jesup and the Firefox team for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6360</cvename>
<freebsdpr>ports/207003</freebsdpr>
<url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
<url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
<url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
<url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
<url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
</references>
<dates>
<discovery>2015-11-02</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
<p>The library is affected by a double-free vulnerability in function
jas_iccattrval_destroy()
as well as a heap-based buffer overflow in function jp2_decode().
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
<p>The library is affected by an off-by-one error in a buffer boundary check
in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
stack overflow.
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
<p>Multiple off-by-one flaws, leading to heap-based buffer overflows, were
found in the way JasPer decoded JPEG 2000 files. A specially crafted file
could cause an application using JasPer to crash or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>limingxing reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
<p>A vulnerability was found in the way the JasPer's jas_matrix_clip()
function parses certain JPEG 2000 image files. A specially crafted file
could cause an application using JasPer to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
<url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
<url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
<url>http://seclists.org/oss-sec/2016/q1/233</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
<cvename>CVE-2014-8137</cvename>
<cvename>CVE-2014-8138</cvename>
<cvename>CVE-2014-8157</cvename>
<cvename>CVE-2014-8158</cvename>
<cvename>CVE-2014-9029</cvename>
<cvename>CVE-2016-2089</cvename>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-02-20</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
<topic>chromium -- same origin bypass</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
<p>[583431] Critical CVE-2016-1629: Same-origin bypass in Blink
and Sandbox escape in Chrome. Credit to anonymous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1629</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
<topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<name>linux_base-c6_64</name>
<range><lt>6.7_1</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabio Olive Leite reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
<p>A stack-based buffer overflow was found in libresolv when invoked
from nss_dns, allowing specially crafted DNS responses to seize
control of EIP in the DNS client. The buffer overflow occurs in the
functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
AF_INET6 in some cases) triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of
the buffers used for those queries could result in the response of
a query writing beyond the alloca allocated buffer created by
__res_nquery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7547</cvename>
<freebsdpr>ports/207272</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
<url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
<url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
<url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
<topic>squid -- SSL/TLS processing remote DoS</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
<p>Due to incorrectly handling server errors Squid is vulnerable to a
denial of service attack when connecting to TLS or SSL servers.</p>
<p>This problem allows any trusted client to perform a denial of
service attack on the Squid service regardless of whether TLS or
SSL is configured for use in the proxy.</p>
<p>Misconfigured client or server software may trigger this issue
to perform a denial of service unintentionally.</p>
<p>However, the bug is exploitable only if Squid is built using the
--with-openssl option.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-2390</cvename>
<freebsdpr>ports/207294</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- remote code execution</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
<p>Fix remote code execution in SQLite query</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
</references>
<dates>
<discovery>2016-02-06</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
<p>Fix XSS in indexes (non-MySQL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
</references>
<dates>
<discovery>2015-11-08</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
<p>Fix XSS in alter table</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
<p>Fix XSS in login form</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
<url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
</references>
<dates>
<discovery>2015-01-30</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on ECDH</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
<p>Mitigate side-channel attack on ECDH with Weierstrass curves.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7511</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
<topic>xdelta3 -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>xdelta3</name>
<range><lt>3.0.9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stepan Golosunov reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
<p>Buffer overflow was found and fixed in xdelta3 binary diff tool
that allows arbitrary code execution from input files at least on
some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9765</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
<url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
</references>
<dates>
<discovery>2014-10-08</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
<topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
<p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
responses to plugin network requests made through the browser. Plugins which
make security decisions based on the content of network requests can have these
decisions subverted if a service worker forges responses to those requests. For
example, a forged crossdomain.xml could allow a malicious site to violate the
same-origin policy using the Flash plugin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1949</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
</references>
<dates>
<discovery>2016-02-11</discovery>
<entry>2016-02-15</entry>
</dates>
</vuln>
<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
due to unlimited incoming HTTP header fields.</p>
<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
for the incoming HTTP header field. If peer sends specially crafted HTTP/2
HEADERS frames and CONTINUATION frames, they will crash with out of memory
error.</p>
<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
<cvename>CVE-2016-1544</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-13</entry>
</dates>
</vuln>
<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
<topic>horde -- XSS vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<range><lt>5.2.9</lt></range>
</package>
<package>
<name>pear-Horde_Core</name>
<range><lt>2.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde Team reports:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
<p>Fixed XSS vulnerabilities in menu bar and form renderer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8807</cvename>
<cvename>CVE-2016-2228</cvename>
<url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
<url>https://bugs.horde.org/ticket/14213</url>
<url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
<url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
<url>http://lists.horde.org/archives/announce/2016/001149.html</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-14</entry>
</dates>
</vuln>
<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1644/">
<p>
Security Fixes for Regular Expressions, PL/Java
</p>
<ul>
<li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
an issue with regular expression (regex) parsing. Prior code allowed
users to pass in expressions which included out-of-range Unicode
characters, triggering a backend crash. This issue is critical for
PostgreSQL systems with untrusted users or which generate regexes
based on user input.
</li>
<li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
escalation issue for users of PL/Java. Certain custom configuration
settings (GUCS) for PL/Java will now be modifiable only by the
database superuser
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0773</cvename>
<cvename>CVE-2016-0766</cvename>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-12</entry>
</dates>
</vuln>
<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.569</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2016-0985).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-0973, CVE-2016-0974,
CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).</p>
<p>These updates resolve a heap buffer overflow vulnerability
that could lead to code execution (CVE-2016-0971).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2016-0964,
CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
CVE-2016-0981).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0964</cvename>
<cvename>CVE-2016-0965</cvename>
<cvename>CVE-2016-0966</cvename>
<cvename>CVE-2016-0967</cvename>
<cvename>CVE-2016-0968</cvename>
<cvename>CVE-2016-0969</cvename>
<cvename>CVE-2016-0970</cvename>
<cvename>CVE-2016-0971</cvename>
<cvename>CVE-2016-0972</cvename>
<cvename>CVE-2016-0973</cvename>
<cvename>CVE-2016-0974</cvename>
<cvename>CVE-2016-0975</cvename>
<cvename>CVE-2016-0976</cvename>
<cvename>CVE-2016-0977</cvename>
<cvename>CVE-2016-0978</cvename>
<cvename>CVE-2016-0979</cvename>
<cvename>CVE-2016-0980</cvename>
<cvename>CVE-2016-0981</cvename>
<cvename>CVE-2016-0982</cvename>
<cvename>CVE-2016-0983</cvename>
<cvename>CVE-2016-0984</cvename>
<cvename>CVE-2016-0985</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-10</entry>
</dates>
</vuln>
<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
<topic>dnscrypt-proxy -- code execution</topic>
<affects>
<package>
<name>dnscrypt-proxy</name>
<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Denis reports:</p>
<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
<p>Malformed packets could lead to denial of service or code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-10</entry>
<modified>2016-02-14</modified>
</dates>
</vuln>
<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>6 security fixes in this release, including:</p>
<ul>
<li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
Credit to anonymous.</li>
<li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
Instant. Credit to Jann Horn.</li>
<li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
Credit to anonymous, working with HP's Zero Day Initiative.</li>
<li>[585517] CVE-2016-1627: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1622</cvename>
<cvename>CVE-2016-1623</cvename>
<cvename>CVE-2016-1625</cvename>
<cvename>CVE-2016-1626</cvename>
<cvename>CVE-2016-1627</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
<topic>graphite2 -- code execution vulnerability</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.5</lt></range>
</package>
<package>
<name>silgraphite</name>
<range><lt>2.3.1_4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
<ul>
<li><p>An exploitable denial of service vulnerability exists
in the font handling of Libgraphite. A specially crafted font can cause
an out-of-bounds read potentially resulting in an information leak or
denial of service.</p></li>
<li><p>A specially crafted font can cause a buffer overflow
resulting in potential code execution.</p></li>
<li><p>An exploitable NULL pointer dereference exists in the
bidirectional font handling functionality of Libgraphite. A specially
crafted font can cause a NULL pointer dereference resulting in a
crash.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
<url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
<cvename>CVE-2016-1521</cvename>
<cvename>CVE-2016-1522</cvename>
<cvename>CVE-2016-1523</cvename>
<cvename>CVE-2016-1526</cvename>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>J.C. Cleaver reports:</p>
<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
<ul>
<li><p>CVE-2016-2054: Buffer overflow in xymond handling of
"config" command</p></li>
<li><p> CVE-2016-2055: Access to possibly confidential files
in the Xymon configuration directory</p></li>
<li><p>CVE-2016-2056: Shell command injection in the
"useradm" and "chpasswd" web applications</p></li>
<li><p>CVE-2016-2057: Incorrect permissions on IPC queues
used by the xymond daemon can bypass IP access filtering</p></li>
<li><p>CVE-2016-2058: Javascript injection in "detailed status
webpage" of monitoring items; XSS vulnerability via malformed
acknowledgment messages</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
<cvename>CVE-2016-2054</cvename>
<cvename>CVE-2016-2055</cvename>
<cvename>CVE-2016-2056</cvename>
<cvename>CVE-2016-2057</cvename>
<cvename>CVE-2016-2058</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.32</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
<ul><li>Core:
<ul>
<li>Fixed bug #71039 (exec functions ignore length but look for NULL
termination).</li>
<li>Fixed bug #71323 (Output of stream_get_meta_data can be
falsified by its input).</li>
<li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
<li>Fixed bug #71391 (NULL Pointer Dereference in
phar_tar_setupmetadata()).</li>
<li>Fixed bug #71488 (Stack overflow when decompressing tar
archives). (CVE-2016-2554)</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71335 (Type Confusion in WDDX Packet
Deserialization).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8383</cvename>
<cvename>CVE-2015-8386</cvename>
<cvename>CVE-2015-8387</cvename>
<cvename>CVE-2015-8389</cvename>
<cvename>CVE-2015-8390</cvename>
<cvename>CVE-2015-8391</cvename>
<cvename>CVE-2015-8393</cvename>
<cvename>CVE-2015-8394</cvename>
<cvename>CVE-2016-2554</cvename>
<url>http://php.net/ChangeLog-5.php#5.6.18</url>
<url>http://php.net/ChangeLog-5.php#5.5.32</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-13</modified>
</dates>
</vuln>
<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, PcdDecode.c has a buffer overflow error.</p>
<p>The state.buffer for PcdDecode.c is allocated based on a 3 bytes
per pixel sizing, where PcdDecode.c wrote into the buffer assuming
4 bytes per pixel. This writes 768 bytes beyond the end of the
buffer into other Python object storage. In some cases, this causes
a segfault, in others an internal Python malloc error.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
<url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
<url>https://github.com/python-pillow/Pillow/issues/568</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Integer overflow in Resample.c</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>If a large value was passed into the new size for an image, it is
possible to overflow an int32 value passed into malloc, leading the
malloc’d buffer to be undersized. These allocations are followed by
a loop that writes out of bounds. This can lead to corruption on
the heap of the Python process with attacker controlled float
data.</p>
<p>This issue was found by Ned Williamson.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
<url>https://github.com/python-pillow/Pillow/issues/1710</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, FliDecode.c has a buffer overflow error.</p>
<p>There is a memcpy error where x is added to a target buffer
address. X is used in several internal temporary variable roles,
but can take a value up to the width of the image. Im->image[y]
is a set of row pointers to segments of memory that are the size of
the row. At the max y, this will write the contents of the line off
the end of the memory buffer, causing a segfault.</p>
<p>This issue was found by Alyssa Besseling at Atlassian.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0775</cvename>
<url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on
x64 may overflow a buffer when reading a specially crafted tiff
file.</p>
<p>Specifically, libtiff >= 4.0.0 changed the return type of
TIFFScanlineSize from int32 to machine dependent int32|64. If the
scanline is sized so that it overflows an int32, it may be
interpreted as a negative number, which will then pass the size check
in TiffDecode.c line 236. To do this, the logical scanline size has
to be > 2gb, and for the test file, the allocated buffer size is 64k
against a roughly 4gb scan line size. Any image data over 64k is
written over the heap, causing a segfault.</p>
<p>This issue was found by security researcher FourOne.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0740</cvename>
<url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
<topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>2.8.6,1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 2.8.6 fixes the following vulnerabilities:
CVE-2016-2213</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2213</cvename>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-02-06</entry>
</dates>
</vuln>
<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
<topic>shotwell -- not verifying certificates</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.22.0.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Catanzaro reports:</p>
<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
<p>Shotwell has a serious security issue ("Shotwell does not
verify TLS certificates"). Upstream is no longer active and
I do not expect any further upstream releases unless someone
from the community steps up to maintain it.</p>
<p>What is the impact of the issue? If you ever used any of
the publish functionality (publish to Facebook, publish to
Flickr, etc.), your passwords may have been stolen; changing
them is not a bad idea.</p>
<p>What is the risk of the update? Regressions. The easiest
way to validate TLS certificates was to upgrade WebKit; it
seems to work but I don't have accounts with the online
services it supports, so I don't know if photo publishing
still works properly on all the services.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-02-05</entry>
</dates>
</vuln>
<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
<topic>webkit -- UI spoof</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><lt>2.4.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>webkit reports:</p>
<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
<p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
in Blink, as used in Google Chrome before 35.0.1916.114, allows
remote attackers to spoof the UI by extending scrollbar painting
into the parent frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1748</cvename>
<url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
<affects>
<package>
<name>py27-rsa</name>
<name>py32-rsa</name>
<name>py33-rsa</name>
<name>py34-rsa</name>
<name>py35-rsa</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Filippo Valsorda reports:</p>
<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
<p>
python-rsa is vulnerable to a straightforward variant of the
Bleichenbacher'06 attack against RSA signature verification
with low public exponent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1494</cvename>
<url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
<url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3_5</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.21.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2016-001 - BEAST vulnerability in HTTP server</p>
<p>AST-2016-002 - File descriptor exhaustion in chan_sip</p>
<p>AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
<cvename>CVE-2011-3389</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
<cvename>CVE-2016-2316</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
<cvename>CVE-2016-2232</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-04</entry>
<modified>2016-03-07</modified>
</dates>
</vuln>
<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
<topic>salt -- code execution</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
<p>Improper handling of clear messages on the minion, which
could result in executing commands not sent by the master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
<url>https://github.com/saltstack/salt/pull/30613/files</url>
<cvename>CVE-2016-1866</cvename>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-03</entry>
</dates>
</vuln>
<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activemodel4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-activerecord4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
<p>Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
released! These contain important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7576</cvename>
<cvename>CVE-2015-7577</cvename>
<cvename>CVE-2015-7581</cvename>
<cvename>CVE-2016-0751</cvename>
<cvename>CVE-2016-0752</cvename>
<cvename>CVE-2016-0753</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
<url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-02</entry>
</dates>
</vuln>
<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
<topic>socat -- diffie hellman parameter was not prime</topic>
<affects>
<package>
<name>socat</name>
<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>socat reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
<p>In the OpenSSL address implementation the hard coded 1024
bit DH p parameter was not prime. The effective cryptographic strength
of a key exchange using these parameters was weaker than the one one
could get by using a prime p. Moreover, since there is no indication of
how these parameters were chosen, the existence of a trapdoor that makes
possible for an eavesdropper to recover the shared secret from a key
exchange that uses them cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.6.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
<p>MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
/ rv:38.6)</p>
<p>MFSA 2016-02 Out of Memory crash when parsing GIF format
images</p>
<p>MFSA 2016-03 Buffer overflow in WebGL after out of memory
allocation</p>
<p>MFSA 2016-04 Firefox allows for control characters to be
set in cookie names</p>
<p>MFSA 2016-06 Missing delay following user click events in
protocol handler dialog</p>
<p>MFSA 2016-09 Addressbar spoofing attacks</p>
<p>MFSA 2016-10 Unsafe memory manipulation found through
code inspection</p>
<p>MFSA 2016-11 Application Reputation service disabled in
Firefox 43</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2016-1930</cvename>
<cvename>CVE-2016-1931</cvename>
<cvename>CVE-2016-1933</cvename>
<cvename>CVE-2016-1935</cvename>
<cvename>CVE-2016-1937</cvename>
<cvename>CVE-2016-1939</cvename>
<cvename>CVE-2016-1942</cvename>
<cvename>CVE-2016-1943</cvename>
<cvename>CVE-2016-1944</cvename>
<cvename>CVE-2016-1945</cvename>
<cvename>CVE-2016-1946</cvename>
<cvename>CVE-2016-1947</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-02-01</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
<topic>gdcm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gdcm</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CENSUS S.A. reports:</p>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an integer overflow vulnerability which leads to a buffer
overflow and potentially to remote code execution.</p>
</blockquote>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an out-of-bounds read vulnerability due to missing checks.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8396</cvename>
<cvename>CVE-2015-8397</cvename>
<url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
<url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.8.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
<p>Several problems in nginx resolver were identified, which
might allow an attacker to cause worker process crash, or might have
potential other impact if the "resolver" directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
<cvename>CVE-2016-0742</cvename>
<cvename>CVE-2016-0746</cvename>
<cvename>CVE-2016-0747</cvename>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-01-30</entry>
</dates>
</vuln>
<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.1</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 Security Team reports:</p>
<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
<p>It has been discovered that TYPO3 CMS is susceptible to
Cross-Site Scripting and Cross-Site Flashing.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
<topic>nghttp2 -- use after free</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
<p>This release fixes heap-use-after-free bug in idle stream
handling code. We strongly recommend to upgrade the older installation
to this latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
<cvename>CVE-2015-8659</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
<topic>owncloud -- multiple vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Owncloud reports:</p>
<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
<ul>
<li><p>Reflected XSS in OCS provider discovery
(oC-SA-2016-001)</p></li>
<li><p>Information Exposure Through Directory Listing in the
file scanner (oC-SA-2016-002)</p></li>
<li><p>Disclosure of files that begin with ".v" due to
unchecked return value (oC-SA-2016-003)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
<cvename>CVE-2016-1498</cvename>
<cvename>CVE-2016-1499</cvename>
<cvename>CVE-2016-1500</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
<topic>radicale -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-radicale</name>
<name>py32-radicale</name>
<name>py33-radicale</name>
<name>py34-radicale</name>
<range><lt>1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Radicale reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
<p>The multifilesystem backend allows access to arbitrary
files on all platforms.</p>
<p>Prevent regex injection in rights management.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
<cvename>CVE-2015-8747</cvename>
<cvename>CVE-2015-8748</cvename>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
<p>With a crafted SQL query, it is possible to trigger an
XSS attack in the SQL editor.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
<cvename>CVE-2016-2045</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
<p>By calling a particular script that is part of phpMyAdmin
in an unexpected way, it is possible to trigger phpMyAdmin
to display a PHP error message which contains the full path
of the directory where phpMyAdmin is installed.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
<cvename>CVE-2016-2044</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
<p>With a crafted table name it is possible to trigger an
XSS attack in the database normalization page.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
<cvename>CVE-2016-2043</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
<cvename>CVE-2016-2042</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
<p>The comparison of the XSRF/CSRF token parameter with the
value saved in the session is vulnerable to timing
attacks. Moreover, the comparison could be bypassed if the
XSRF/CSRF token matches a particular pattern.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
<cvename>CVE-2016-2041</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
<p>Password suggestion functionality uses Math.random()
which does not provide cryptographically secure random
numbers.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
<cvename>CVE-2016-1927</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
<ul>
<li>With a crafted table name it is possible to trigger
an XSS attack in the database search page.</li>
<li>With a crafted SET value or a crafted search query, it
is possible to trigger an XSS attacks in the zoom search
page.</li>
<li>With a crafted hostname header, it is possible to
trigger an XSS attacks in the home page.</li>
</ul>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
<cvename>CVE-2016-2040</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
<p>The XSRF/CSRF token is generated with a weak algorithm
using functions that do not return cryptographically secure
values.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
<cvename>CVE-2016-2039</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
<cvename>CVE-2016-2038</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
<topic>prosody -- user impersonation vulnerability</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody team reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20160127/">
<p>Adopt key generation algorithm from XEP-0185, to
prevent impersonation attacks (CVE-2016-0756)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/206707</freebsdpr>
<cvename>CVE-2016-0756</cvename>
<url>https://prosody.im/security/advisory_20160127/</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_7</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_12</lt></range>
<range><ge>10.1</ge><lt>10.1_29</lt></range>
<range><ge>9.3</ge><lt>9.3_36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
<ol>
<li>Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.
(CVE-2016-0701)</li>
<li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:11.openssl</freebsdsa>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2015-3197</cvename>
<url>https://www.openssl.org/news/secadv/20160128.txt</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
<topic>curl -- Credentials not checked</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
<p>libcurl will reuse NTLM-authenticated proxy connections
without properly making sure that the connection was
authenticated with the same credentials as set for this
transfer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20160127A.html</url>
<cvename>CVE-2016-0755</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-27</entry>
<modified>2017-02-06</modified>
</dates>
</vuln>
<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Jorbin reports:</p>
<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
<p>WordPress 4.4.1 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4 and earlier are affected by a cross-site
scripting vulnerability that could allow a site to be compromised.
This was reported by Crtc4L.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1564</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
<url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-01-26</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
<p>Prevent invalid reads in case of corrupt chunk-encoded content.
CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
</p>
<p>Remove empty Host headers in client requests. Previously they
would result in invalid reads. CVE-2016-1983. Bug discovered with
afl-fuzz and AddressSanitizer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1982</cvename>
<cvename>CVE-2016-1983</cvename>
<freebsdpr>ports/206504</freebsdpr>
<url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
<p>Fixed a DoS issue in case of client requests with incorrect
chunk-encoded body. When compiled with assertions enabled (the
default) they could previously cause Privoxy to abort(). Reported
by Matthew Daley. CVE-2015-1380.</p>
<p>Fixed multiple segmentation faults and memory leaks in the pcrs
code. This fix also increases the chances that an invalid pcrs
command is rejected as such. Previously some invalid commands would
be loaded without error. Note that Privoxy's pcrs sources (action
and filter files) are considered trustworthy input and should not be
writable by untrusted third-parties. CVE-2015-1381.</p>
<p>Fixed an 'invalid read' bug which could at least theoretically
cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1380</cvename>
<cvename>CVE-2015-1381</cvename>
<cvename>CVE-2015-1382</cvename>
<freebsdpr>ports/197089</freebsdpr>
<url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
</references>
<dates>
<discovery>2015-01-26</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
<p>Fixed a memory leak when rejecting client connections due to the
socket limit being reached (CID 66382). This affected Privoxy 3.0.21
when compiled with IPv6 support (on most platforms this is the
default).</p>
<p>Fixed an immediate-use-after-free bug (CID 66394) and two
additional unconfirmed use-after-free complaints made by Coverity
scan (CID 66391, CID 66376).</p>
</blockquote>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
<p>Privoxy before 3.0.22 allows remote attackers to cause a denial
of service (file descriptor consumption) via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1030</cvename>
<cvename>CVE-2015-1031</cvename>
<cvename>CVE-2015-1201</cvename>
<freebsdpr>ports/195468</freebsdpr>
<url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
</references>
<dates>
<discovery>2015-01-10</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
<topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
<p>Proxy authentication headers are removed unless the new directive
enable-proxy-authentication-forwarding is used. Forwarding the
headers potentially allows malicious sites to trick the user into
providing them with login information. Reported by Chris John Riley.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2503</cvename>
<freebsdpr>ports/176813</freebsdpr>
<url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
<topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
<p>sudoedit in Sudo before 1.8.15 allows local users to gain
privileges via a symlink attack on a file whose full path is defined
using multiple wildcards in /etc/sudoers, as demonstrated by
"/home/*/*/file.txt."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5602</cvename>
<freebsdpr>ports/206590</freebsdpr>
<url>https://www.exploit-db.com/exploits/37710/</url>
<url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
<url>http://www.sudo.ws/stable.html#1.8.15</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
<topic>imlib2 -- denial of service vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Enlightenment reports:</p>
<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
<p>GIF loader: Fix segv on images without colormap</p>
<p>Prevent division-by-zero crashes.</p>
<p>Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
<url>http://seclists.org/oss-sec/2016/q1/162</url>
<cvename>CVE-2014-9762</cvename>
<cvename>CVE-2014-9763</cvename>
<cvename>CVE-2014-9764</cvename>
</references>
<dates>
<discovery>2013-12-21</discovery>
<entry>2016-01-22</entry>
</dates>
</vuln>
<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01335">
<p>Specific APL data could trigger an INSIST in apl_42.c</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01335</url>
<cvename>CVE-2015-8704</cvename>
<freebsdsa>SA-16:08.bind</freebsdsa>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-22</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
<p>This update includes 37 security fixes, including:</p>
<ul>
<li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
<li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
<li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
<li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
<li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
<li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
CSP.</li>
<li>[552749] Medium CVE-2016-1618: Weak random number generator in
Blink.</li>
<li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
PDFium.</li>
<li>[579625] CVE-2016-1620: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
branch.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1612</cvename>
<cvename>CVE-2016-1613</cvename>
<cvename>CVE-2016-1614</cvename>
<cvename>CVE-2016-1615</cvename>
<cvename>CVE-2016-1616</cvename>
<cvename>CVE-2016-1617</cvename>
<cvename>CVE-2016-1618</cvename>
<cvename>CVE-2016-1619</cvename>
<cvename>CVE-2016-1620</cvename>
<url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
</dates>
</vuln>
<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p6</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.90</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p6, released on Tuesday, 19 January 2016:</p>
<ul>
<li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
in ntpq. Reported by Cisco ASIG.</li>
<li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
Timestamp Bypass. Reported by Cisco ASIG.</li>
<li>Bug 2942 / CVE-2015-7979: Off-path Denial of
Service (DoS) attack on authenticated broadcast
mode. Reported by Cisco ASIG.</li>
<li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
recursive traversal of restriction list.
Reported by Cisco ASIG.</li>
<li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
dereference. Reported by Cisco ASIG.</li>
<li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
allows dangerous characters in filenames.
Reported by Cisco ASIG.</li>
<li>Bug 2937 / CVE-2015-7975: nextvar() missing length
check. Reported by Cisco ASIG.</li>
<li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
key check allows impersonation between authenticated
peers. Reported by Cisco ASIG.</li>
<li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
authenticated broadcast mode. Reported by Cisco ASIG.</li>
</ul>
<p>Additionally, mitigations are published for the following
two issues:</p>
<ul>
<li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
attacks. Reported by Cisco ASIG.</li>
<li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
disclose origin. Reported by Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:09.ntp</freebsdsa>
<cvename>CVE-2015-7973</cvename>
<cvename>CVE-2015-7974</cvename>
<cvename>CVE-2015-7975</cvename>
<cvename>CVE-2015-7976</cvename>
<cvename>CVE-2015-7977</cvename>
<cvename>CVE-2015-7978</cvename>
<cvename>CVE-2015-7979</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2015-8139</cvename>
<cvename>CVE-2015-8140</cvename>
<cvename>CVE-2015-8158</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
<topic>cgit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
<p>Reflected Cross Site Scripting and Header Injection in Mimetype
Query String.</p>
<p>Stored Cross Site Scripting and Header Injection in Filename
Parameter.</p>
<p>Integer Overflow resulting in Buffer Overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1899</cvename>
<cvename>CVE-2016-1900</cvename>
<cvename>CVE-2016-1901</cvename>
<freebsdpr>ports/206417</freebsdpr>
<url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-20</entry>
</dates>
</vuln>
<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01336">
<p>Problems converting OPT resource records and ECS options to
text format can cause BIND to terminate</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01336</url>
<cvename>CVE-2015-8705</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-20</entry>
<modified>2016-01-22</modified>
</dates>
</vuln>
<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
<topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>3.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DrWhax reports:</p>
<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
<p>So in codeconv.c there is a function for Japanese character set
conversion called conv_jistoeuc(). There is no bounds checking on
the output buffer, which is created on the stack with alloca()
Bug can be triggered by sending an email to TAILS_luser@riseup.net
or whatever.
Since my C is completely rusty, you might be able to make a better
judgment on the severity of this issue. Marking critical for now.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8614</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2016-01-19</entry>
</dates>
</vuln>
<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.1.2_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
<p>Integer signedness error in the archive_write_zip_data function in
archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
running on 64-bit machines, allows context-dependent attackers to
cause a denial of service (crash) via unspecified vectors, which
triggers an improper conversion between unsigned and signed types,
leading to a buffer overflow.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
<p>Absolute path traversal vulnerability in bsdcpio in libarchive
3.1.2 and earlier allows remote attackers to write to arbitrary
files via a full pathname in an archive.</p>
</blockquote>
<p>Libarchive issue tracker reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
<p>Using a crafted tar file bsdtar can perform an out-of-bounds memory
read which will lead to a SEGFAULT. The issue exists when the
executable skips data in the archive. The amount of data to skip is
defined in byte offset [16-19] If ASLR is disabled, the issue can
lead to an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0211</cvename>
<cvename>CVE-2015-2304</cvename>
<freebsdpr>ports/200176</freebsdpr>
<freebsdsa>SA-16:22.libarchive</freebsdsa>
<freebsdsa>SA-16:23.libarchive</freebsdsa>
<url>https://github.com/libarchive/libarchive/pull/110</url>
<url>https://github.com/libarchive/libarchive/commit/5935715</url>
<url>https://github.com/libarchive/libarchive/commit/2253154</url>
<url>https://github.com/libarchive/libarchive/issues/502</url>
<url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
<url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
<url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-01-18</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
<topic>go -- information disclosure vulnerability</topic>
<affects>
<package>
<name>go</name>
<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
<p>A security-related issue has been reported in Go's math/big
package. The issue was introduced in Go 1.5. We recommend that all
users upgrade to Go 1.5.3, which fixes the issue. Go programs must
be recompiled with Go 1.5.3 in order to receive the fix.</p>
<p>The Go team would like to thank Nick Craig-Wood for identifying the
issue.</p>
<p>This issue can affect RSA computations in crypto/rsa, which is used
by crypto/tls. TLS servers on 32-bit systems could plausibly leak
their RSA private key due to this issue. Other protocol
implementations that create many RSA signatures could also be
impacted in the same way.</p>
<p>Specifically, incorrect results in one part of the RSA Chinese
Remainder computation can cause the result to be incorrect in such a
way that it leaks one of the primes. While RSA blinding should
prevent an attacker from crafting specific inputs that trigger the
bug, on 32-bit systems the bug can be expected to occur at random
around one in 2^26 times. Thus collecting around 64 million
signatures (of known data) from an affected server should be enough
to extract the private key used.</p>
<p>On 64-bit systems, the frequency of the bug is so low (less than
one in 2^50) that it would be very difficult to exploit.
Nonetheless, everyone is strongly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8618</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
<url>https://go-review.googlesource.com/#/c/17672/</url>
<url>https://go-review.googlesource.com/#/c/18491/</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-18</entry>
</dates>
</vuln>
<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
<topic>isc-dhcpd -- Denial of Service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_10,2</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
<package>
<name>isc-dhcp41-relay</name>
<range><lt>4.1.e_6,2</lt></range>
</package>
<package>
<name>isc-dhcp42-client</name>
<name>isc-dhcp42-server</name>
<name>isc-dhcp42-relay</name>
<range><ge>0</ge></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<name>isc-dhcp43-server</name>
<name>isc-dhcp43-relay</name>
<range><lt>4.3.3.p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01334">
<p>A badly formed packet with an invalid IPv4 UDP length field
can cause a DHCP server, client, or relay program to terminate
abnormally.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01334</url>
<cvename>CVE-2015-8605</cvename>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-01-12</entry>
</dates>
</vuln>
<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
<topic>libproxy -- stack-based buffer overflow</topic>
<affects>
<!-- libproxy-python is not affected. It only installs a .py file that
dlopen()s libproxy.so. -->
<package>
<name>libproxy</name>
<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
</package>
<package>
<name>libproxy-gnome</name>
<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
</package>
<package>
<name>libproxy-kde</name>
<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
</package>
<package>
<name>libproxy-perl</name>
<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
</package>
<package>
<name>libproxy-webkit</name>
<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
<p>A buffer overflow flaw was discovered in the libproxy's
url::get_pac() used to download proxy.pac proxy auto-configuration
file. A malicious host hosting proxy.pac, or a man in the middle
attacker, could use this flaw to trigger a stack-based buffer
overflow in an application using libproxy, if proxy configuration
instructed it to download proxy.pac file from a remote HTTP
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4504</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
<url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
<mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
</references>
<dates>
<discovery>2012-10-10</discovery>
<entry>2016-01-17</entry>
<modified>2016-01-18</modified>
</dates>
</vuln>
<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
<topic>ffmpeg -- remote attacker can access local files</topic>
<affects>
<package>
<name>ffmpeg</name>
<range>
<gt>2.0,1</gt>
<lt>2.8.5,1</lt>
</range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_2</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arch Linux reports:</p>
<blockquote cite="https://bugs.archlinux.org/task/47738">
<p>ffmpeg has a vulnerability in the current version that allows the
attacker to create a specially crafted video file, downloading which
will send files from a user PC to a remote attacker server. The
attack does not even require the user to open that file — for
example, KDE Dolphin thumbnail generation is enough.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1897</cvename>
<cvename>CVE-2016-1898</cvename>
<freebsdpr>ports/206282</freebsdpr>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-17</entry>
</dates>
</vuln>
<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo OKU reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When redirect directive is used, this flaw allows a remote
attacker to inject response headers into an HTTP redirect response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1133</cvename>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-15</entry>
</dates>
</vuln>
<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
<topic>openssh -- information disclosure</topic>
<affects>
<package>
<name>openssh-portable</name>
<range>
<gt>5.4.p0,1</gt>
<lt>7.1.p2,1</lt>
</range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_10</lt></range>
<range><ge>10.1</ge><lt>10.1_27</lt></range>
<range><ge>9.3</ge><lt>9.3_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSH reports:</p>
<blockquote cite="http://www.openssh.com/security.html">
<p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
information disclosure that may allow a malicious server to retrieve
information including under some circumstances, user's private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/security.html</url>
<cvename>CVE-2016-0777</cvename>
<cvename>CVE-2016-0778</cvename>
<freebsdsa>SA-16:07</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
<topic>prosody -- multiple vulnerabilities</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody Team reports:</p>
<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
<p>Fix path traversal vulnerability in mod_http_files
(CVE-2016-1231)</p>
<p>Fix use of weak PRNG in generation of dialback secrets
(CVE-2016-1232)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1231</cvename>
<cvename>CVE-2016-1232</cvename>
<freebsdpr>ports/206150</freebsdpr>
<url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-01-14</entry>
</dates>
</vuln>
<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
<topic>kibana4 -- XSS vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>kibana42</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>kibana43</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
<p>Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
for responsibly reporting.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205961</freebsdpr>
<freebsdpr>ports/205962</freebsdpr>
<freebsdpr>ports/205963</freebsdpr>
<url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-13</entry>
</dates>
</vuln>
<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
<topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
<affects>
<package>
<name>p5-PathTools</name>
<range>
<gt>3.4000</gt>
<lt>3.6200</lt>
</range>
</package>
<package>
<name>perl5</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5-devel</name>
<range><ge>5.19.9</ge><lt>5.20.2</lt></range>
<range><ge>5.21.0</ge><lt>5.22.2</lt></range>
<range><ge>5.23.0</ge><lt>5.23.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ricardo Signes reports:</p>
<blockquote>
<p>Beginning in PathTools 3.47 and/or perl 5.20.0, the
File::Spec::canonpath() routine returned untained strings even if
passed tainted input. This defect undermines the guarantee of taint
propagation, which is sometimes used to ensure that unvalidated
user input does not reach sensitive code.</p>
<p>This defect was found and reported by David Golden of MongoDB.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8607</cvename>
<url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
</references>
<dates>
<discovery>2016-01-11</discovery>
<entry>2016-01-12</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-wddx</name>
<name>php55-xmlrpc</name>
<range><lt>5.5.31</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-soap</name>
<name>php56-wddx</name>
<name>php56-xmlrpc</name>
<range><lt>5.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
<ul><li>Core:
<ul>
<li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
Index Out of Bounds).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
</ul></li>
<li>Wddx
<ul>
<li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
Deserialization).</li>
<li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
Confusion Vulnerability).</li>
</ul></li>
<li>XMLRPC:
<ul>
<li>Fixed bug #70728 (Type Confusion Vulnerability in
PHP_to_XMLRPC_worker()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
</references>
<dates>
<discovery>2016-01-07</discovery>
<entry>2016-01-11</entry>
</dates>
</vuln>
<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
<topic>pygments -- shell injection vulnerability</topic>
<affects>
<package>
<name>py27-pygments</name>
<name>py32-pygments</name>
<name>py33-pygments</name>
<name>py34-pygments</name>
<name>py35-pygments</name>
<range><lt>2.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
<p>The FontManager._get_nix_font_path function in formatters/img.py
in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
arbitrary commands via shell metacharacters in a font name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8557</cvename>
<mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
<url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
</references>
<dates>
<discovery>2015-09-28</discovery>
<entry>2016-01-09</entry>
</dates>
</vuln>
<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
<topic>polkit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Walters reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
<ul>
<li><p>Integer overflow in the
authentication_agent_new_cookie function in PolicyKit (aka polkit)
before 0.113 allows local users to gain privileges by creating a large
number of connections, which triggers the issuance of a duplicate cookie
value.</p></li>
<li><p>The authentication_agent_new function in
polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
polkit) before 0.113 allows local users to cause a denial of service
(NULL pointer dereference and polkitd daemon crash) by calling
RegisterAuthenticationAgent with an invalid object path.</p></li>
<li><p>The polkit_backend_action_pool_init function in
polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
0.113 might allow local users to gain privileges via duplicate action
IDs in action descriptions.</p></li>
<li><p>PolicyKit (aka polkit) before 0.113 allows local
users to cause a denial of service (memory corruption and polkitd daemon
crash) and possibly gain privileges via unspecified vectors, related to
"javascript rule evaluation."</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
<cvename>CVE-2015-4625</cvename>
<cvename>CVE-2015-3218</cvename>
<cvename>CVE-2015-3255</cvename>
<cvename>CVE-2015-3256</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
<topic>librsync -- collision vulnerability</topic>
<affects>
<package>
<name>librsync</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Samuel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
<p>librsync before 1.0.0 uses a truncated MD4 checksum to
match blocks, which makes it easier for remote attackers to modify
transmitted data via a birthday attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
<cvename>CVE-2014-8242</cvename>
</references>
<dates>
<discovery>2014-07-28</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
<topic>ntp -- denial of service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p5</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.78</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
<p>NTF's NTP Project has been notified of the following
1 medium-severity vulnerability that is fixed in
ntp-4.2.8p5, released on Thursday, 7 January 2016:</p>
<p>NtpBug2956: Small-step/Big-step CVE-2015-5300</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:02.ntp</freebsdsa>
<cvename>CVE-2015-5300</cvename>
<url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
<url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2016-01-08</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
<topic>dhcpcd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
<p>heap overflow via malformed dhcp responses later in print_option
(via dhcp_envoption1) due to incorrect option length values.
Exploitation is non-trivial, but I'd love to be proven wrong.</p>
<p>invalid read/crash via malformed dhcp responses. not exploitable
beyond DoS as far as I can judge.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1503</cvename>
<cvename>CVE-2016-1504</cvename>
<freebsdpr>ports/206015</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
<url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
<topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
<affects>
<package>
<name>polarssl13</name>
<range><lt>1.3.16</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
<p>MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
on TLS 1.2 server authentication. They have been disabled by default.
Other attacks from the SLOTH paper do not apply to any version of mbed
TLS or PolarSSL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-07</entry>
</dates>
</vuln>
<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
<topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
<p>Single memory accesses in source code can be translated to multiple
ones in machine code by the compiler, requiring special caution when
accessing shared memory. Such precaution was missing from the
hypervisor code inspecting the state of I/O requests sent to the
device model for assistance.</p>
<p>Due to the offending field being a bitfield, it is however believed
that there is no issue in practice, since compilers, at least when
optimizing (which is always the case for non-debug builds), should find
it more expensive to extract the bit field value twice than to keep the
calculated value in a register.</p>
<p>This vulnerability is exposed to malicious device models. In
conventional Xen systems this means the qemu which service an HVM
domain. On such systems this vulnerability can only be exploited if
the attacker has gained control of the device model qemu via another
vulnerability.</p>
<p>Privilege escalation, host crash (Denial of Service), and leaked
information all cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-166.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
<topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
<p>When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM
registers seen by the guest upon first use are those left there by
the previous user of those registers.</p>
<p>A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8555</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-165.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
<topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
<p>When constructing a guest which is configured to use a PV
bootloader which runs as a userspace process in the toolstack domain
(e.g. pygrub) libxl creates a mapping of the files to be used as
kernel and initial ramdisk when building the guest domain.</p>
<p>However if building the domain subsequently fails these mappings
would not be released leading to a leak of virtual address space in
the calling process, as well as preventing the recovery of the
temporary disk files containing the kernel and initial ramdisk.</p>
<p>For toolstacks which manage multiple domains within the same
process, an attacker who is able to repeatedly start a suitable
domain (or many such domains) can cause an out-of-memory condition in the
toolstack process, leading to a denial of service.</p>
<p>Under the same circumstances an attacker can also cause files to
accumulate on the toolstack domain filesystem (usually under /var in
dom0) used to temporarily store the kernel and initial ramdisk,
perhaps leading to a denial of service against arbitrary other
services using that filesystem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8341</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-160.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
<topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
<p>Error handling in the operation may involve handing back pages to
the domain. This operation may fail when in parallel the domain gets
torn down. So far this failure unconditionally resulted in the host
being brought down due to an internal error being assumed. This is
CVE-2015-8339.</p>
<p>Furthermore error handling so far wrongly included the release of a
lock. That lock, however, was either not acquired or already released
on all paths leading to the error handling sequence. This is
CVE-2015-8340.</p>
<p>A malicious guest administrator may be able to deny service by
crashing the host or causing a deadlock.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8339</cvename>
<cvename>CVE-2015-8340</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-159.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zzf of Alibaba discovered an out-of-bounds vulnerability in the code
processing the LogLUV and CIE Lab image format files. An attacker
could create a specially-crafted TIFF file that could cause libtiff
to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8683</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
tif_getimage.c. An attacker could create a specially-crafted TIFF
file that could cause libtiff to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8665</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
<topic>unzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
<p>Two issues were found in unzip 6.0:</p>
<p> * A heap overflow triggered by unzipping a file with password
(e.g unzip -p -P x sigsegv.zip).</p>
<p> * A denegation of service with a file that never finishes unzipping
(e.g. unzip sigxcpu.zip).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
<freebsdpr>ports/204413</freebsdpr>
<cvename>CVE-2015-7696</cvename>
<cvename>CVE-2015-7697</cvename>
</references>
<dates>
<discovery>2015-09-26</discovery>
<entry>2016-01-04</entry>
</dates>
</vuln>
<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
<topic>cacti -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.8f_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
<p>SQL injection vulnerability in include/top_graph_header.php in
Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
SQL commands via the rra_id parameter in a properties action to
graph.php.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8369</cvename>
<url>http://bugs.cacti.net/view.php?id=2646</url>
<url>http://svn.cacti.net/viewvc?view=rev&revision=7767</url>
<mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
<topic>kea -- unexpected termination while handling a malformed packet</topic>
<affects>
<package>
<name>kea</name>
<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC Support reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
<p>ISC Kea may terminate unexpectedly (crash) while handling
a malformed client packet. Related defects in the kea-dhcp4
and kea-dhcp6 servers can cause the server to crash during
option processing if a client sends a malformed packet.
An attacker sending a crafted malformed packet can cause
an ISC Kea server providing DHCP services to IPv4 or IPv6
clients to exit unexpectedly.</p>
<ul>
<li><p>The kea-dhcp4 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when logging
at debug level 40 or higher. Servers running kea-dhcp4
versions 0.9.1 or lower, and servers which are not
logging or are logging at debug level 39 or below are
not vulnerable.</p></li>
<li><p>The kea-dhcp6 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when
logging at debug level 45 or higher. Servers running
kea-dhcp6 versions 0.9.1 or lower, and servers
which are not logging or are logging at debug level 44
or below are not vulnerable.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8373</cvename>
<url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-04</entry>
<modified>2016-01-05</modified>
</dates>
</vuln>
<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
<topic>mini_httpd -- buffer overflow via snprintf</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ACME Updates reports:</p>
<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
<p>mini_httpd 1.21 and earlier allows remote attackers to obtain
sensitive information from process memory via an HTTP request with
a long protocol string, which triggers an incorrect response size
calculation and an out-of-bounds read.</p>
<p>(rene) ACME, the author, claims that the vulnerability is fixed
*after* version 1.22, released on 2015-12-28</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1548</cvename>
<url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
<url>http://acme.com/updates/archive/192.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
<p>Qemu emulator built with the Rocker switch emulation support is
vulnerable to an off-by-one error. It happens while processing
transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
</p>
<p>A privileged user inside guest could use this flaw to cause memory
leakage on the host or crash the Qemu process instance resulting in
DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8701</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
<p>Qemu emulator built with the Q35 chipset based pc system emulator
is vulnerable to a heap based buffer overflow. It occurs during VM
guest migration, as more(16 bytes) data is moved into allocated
(8 bytes) memory area.</p>
<p>A privileged guest user could use this issue to corrupt the VM
guest image, potentially leading to a DoS. This issue affects q35
machine types.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8666</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
</references>
<dates>
<discovery>2015-11-19</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
<p>Qemu emulator built with the Human Monitor Interface(HMP) support
is vulnerable to an OOB write issue. It occurs while processing
'sendkey' command in hmp_sendkey routine, if the command argument is
longer than the 'keyname_buf' buffer size.</p>
<p>A user/process could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8619</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
<p>Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
support is vulnerable to a stack buffer overflow issue. It occurs
while processing the SCSI controller's CTRL_GET_INFO command. A
privileged guest user could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8613</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
<p>Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
support is vulnerable to a memory leakage flaw. It occurs when a
guest repeatedly tries to activate the vmxnet3 device.</p>
<p>A privileged guest user could use this flaw to leak host memory,
resulting in DoS on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8567</cvename>
<cvename>CVE-2015-8568</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
<p>Qemu emulator built with the USB EHCI emulation support is
vulnerable to an infinite loop issue. It occurs during communication
between host controller interface(EHCI) and a respective device
driver. These two communicate via a isochronous transfer descriptor
list(iTD) and an infinite loop unfolds if there is a closed loop in
this list.</p>
<p>A privileges user inside guest could use this flaw to consume
excessive CPU cycles & resources on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8558</cvename>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MSI-X support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
<p>Qemu emulator built with the PCI MSI-X support is vulnerable to
null pointer dereference issue. It occurs when the controller
attempts to write to the pending bit array(PBA) memory region.
Because the MSI-X MMIO support did not define the .write method.</p>
<p>A privileges used inside guest could use this flaw to crash the
Qemu process resulting in DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7549</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to an arithmetic exception flaw. It occurs on the VNC
server side while processing the 'SetPixelFormat' messages from a
client.</p>
<p>A privileged remote client could use this flaw to crash the guest
resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8504</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
<topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
<p>Qemu emulator built with the AMD PC-Net II Ethernet Controller
support is vulnerable to a heap buffer overflow flaw. While
receiving packets in the loopback mode, it appends CRC code to the
receive buffer. If the data size given is same as the receive buffer
size, the appended CRC code overwrites 4 bytes beyond this
's->buffer' array.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS or potentially execute
arbitrary code with privileges of the Qemu process on the host.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
<p>The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
from a remote host(non-loopback mode), fails to validate the
received data size, thus resulting in a buffer overflow issue. It
could potentially lead to arbitrary code execution on the host, with
privileges of the Qemu process. It requires the guest NIC to have
larger MTU limit.</p>
<p>A remote user could use this flaw to crash the guest instance
resulting in DoS or potentially execute arbitrary code on a remote
host with privileges of the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7504</cvename>
<cvename>CVE-2015-7512</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>http://xenbits.xen.org/xsa/advisory-162.html</url>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2016-01-03</entry>
<modified>2016-01-06</modified>
</dates>
</vuln>
<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
<p>Qemu emulator built with the i8255x (PRO100) emulation support is
vulnerable to an infinite loop issue. It could occur while
processing a chain of commands located in the Command Block List
(CBL). Each Command Block(CB) points to the next command in the
list. An infinite loop unfolds if the link to the next CB points
to the same block or there is a closed loop in the chain.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8345</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in virtio-net support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
<p>Qemu emulator built with the Virtual Network Device(virtio-net)
support is vulnerable to a DoS issue. It could occur while receiving
large packets over the tuntap/macvtap interfaces and when guest's
virtio-net driver did not support big/mergeable receive buffers.</p>
<p>An attacker on the local network could use this flaw to disable
guest's networking by sending a large number of jumbo frames to the
guest, exhausting all receive buffers and thus leading to a DoS
situation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7295</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur when receiving
packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to a heap buffer overflow issue. It could occur when
receiving packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance or potentially execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5278</cvename>
<cvename>CVE-2015-5279</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
<p>Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
support is vulnerable to a divide by zero issue. It could occur
while executing an IDE command WIN_READ_NATIVE_MAX to determine
the maximum size of a drive.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6855</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
<p>Qemu emulator built with the e1000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur while
processing transmit descriptor data when sending a network packet.
</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6815</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.1.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.2.50.g20141230</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
<p>Qemu emulator built with the VNC display driver is vulnerable to an
infinite loop issue. It could occur while processing a
CLIENT_CUT_TEXT message with specially crafted payload message.</p>
<p>A privileged guest user could use this flaw to crash the Qemu
process on the host, resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5239</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
</references>
<dates>
<discovery>2014-06-30</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20151011</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to a buffer overflow flaw leading to a heap memory
corruption issue. It could occur while refreshing the server
display surface via routine vnc_refresh_server_surface().</p>
<p>A privileged guest user could use this flaw to corrupt the heap
memory and crash the Qemu process instance OR potentially use it
to execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5225</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
<p>Qemu emulator built with the virtio-serial vmchannel support is
vulnerable to a buffer overflow issue. It could occur while
exchanging virtio control messages between guest and the host.</p>
<p>A malicious guest could use this flaw to corrupt few bytes of Qemu
memory area, potentially crashing the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5745</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
<p>Qemu emulator built with the SCSI device emulation support is
vulnerable to a stack buffer overflow issue. It could occur while
parsing SCSI command descriptor block with an invalid operation
code.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5158</cvename>
<url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- code execution on host machine</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Matousek of Red Hat Inc. reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
<p>Due converting PIO to the new memory read/write api we no longer
provide separate I/O region lenghts for read and write operations.
As a result, reading from PIT Mode/Command register will end with
accessing pit->channels with invalid index and potentially cause
memory corruption and/or minor information leak.</p>
<p>A privileged guest user in a guest with QEMU PIT emulation enabled
could potentially (tough unlikely) use this flaw to execute
arbitrary code on the host with the privileges of the hosting QEMU
process.</p>
<p>Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
emulation and are thus not vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3214</cvename>
<url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
<topic>mono -- DoS and code execution</topic>
<affects>
<package>
<name>mono</name>
<range><lt>4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NCC Group reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
<p>An attacker who can cause a carefully-chosen string to be
converted to a floating-point number can cause a crash and potentially
induce arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q4/543</url>
<cvename>CVE-2009-0689</cvename>
</references>
<dates>
<discovery>2015-12-19</discovery>
<entry>2015-12-31</entry>
</dates>
</vuln>
<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.559</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8644).</p>
<p>These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8651).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8634, CVE-2015-8635,
CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2015-8459,
CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8459</cvename>
<cvename>CVE-2015-8460</cvename>
<cvename>CVE-2015-8634</cvename>
<cvename>CVE-2015-8636</cvename>
<cvename>CVE-2015-8638</cvename>
<cvename>CVE-2015-8639</cvename>
<cvename>CVE-2015-8640</cvename>
<cvename>CVE-2015-8641</cvename>
<cvename>CVE-2015-8642</cvename>
<cvename>CVE-2015-8643</cvename>
<cvename>CVE-2015-8644</cvename>
<cvename>CVE-2015-8645</cvename>
<cvename>CVE-2015-8646</cvename>
<cvename>CVE-2015-8647</cvename>
<cvename>CVE-2015-8648</cvename>
<cvename>CVE-2015-8649</cvename>
<cvename>CVE-2015-8650</cvename>
<cvename>CVE-2015-8651</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2015-12-29</entry>
</dates>
</vuln>
<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
<topic>inspircd -- DoS</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Inspircd reports:</p>
<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
<p>This release fixes the issues discovered since 2.0.18,
containing multiple important stability and correctness related
improvements, including a fix for a bug which allowed malformed DNS
records to cause netsplits on a network.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
<url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
<url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
<cvename>CVE-2015-8702</cvename>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-12-29</entry>
<modified>2015-12-29</modified>
</dates>
</vuln>
<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
<range><lt>2.7.4,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><le>2.6.11</le></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.2.r20151219 has ffmpeg-2.8.3 -->
<range><lt>1.2.r20151219_1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
<p>The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
FFmpeg before 2.8.4 does not validate the number of
decomposition levels before proceeding with Discrete Wavelet
Transform decoding, which allows remote attackers to cause a
denial of service (out-of-bounds array access) or possibly
have unspecified other impact via crafted JPEG 2000
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
<p>The ff_get_buffer function in libavcodec/utils.c in
FFmpeg before 2.8.4 preserves width and height values after
a failure, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via a crafted .mov file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8662</cvename>
<cvename>CVE-2015-8663</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-12-20</discovery>
<entry>2015-12-28</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
<topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.20.2</lt></range>
<range><lt>3.19.2.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0.2,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
<p>Security researcher Karthikeyan Bhargavan reported an
issue in Network Security Services (NSS) where MD5
signatures in the server signature within the TLS 1.2
ServerKeyExchange message are still accepted. This is an
issue since NSS has officially disallowed the accepting MD5
as a hash algorithm in signatures since 2011. This issues
exposes NSS based clients such as Firefox to theoretical
collision-based forgery attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7575</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
<url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-28</entry>
</dates>
</vuln>
<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
<topic>phpMyAdmin -- path disclosure vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
<cvename>CVE-2015-8669</cvename>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2015-12-26</entry>
</dates>
</vuln>
<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
<topic>dpkg -- stack-based buffer overflow</topic>
<affects>
<package>
<name>dpkg</name>
<range><lt>1.16.17</lt></range>
<range><lt>1.17.26</lt></range>
<range><lt>1.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in the
dpkg-deb component of dpkg, the Debian package management system.
This flaw could potentially lead to arbitrary code execution if a
user or an automated system were tricked into processing a specially
crafted Debian binary package (.deb) in the old style Debian binary
package format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0860</cvename>
<url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
<url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
</references>
<dates>
<discovery>2015-11-26</discovery>
<entry>2015-12-25</entry>
</dates>
</vuln>
<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
<topic>mantis -- information disclosure vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
<p>CVE-2015-5059: documentation in private projects can be seen by
every user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5059</cvename>
<freebsdpr>ports/201106</freebsdpr>
<url>https://mantisbt.org/bugs/view.php?id=19873</url>
<url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.12</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.5</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.4</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
<p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative
paths that do not begin with a slash. This enabled trivial XSS
attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
not and will now throw an error.</p>
<p>(T119309) SECURITY: Use hash_compare() for edit token comparison.
</p>
<p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters
starting with '@' as file uploads.</p>
<p>(T115522) SECURITY: Passwords generated by User::randomPassword()
can no longer be shorter than $wgMinimalPasswordLength.</p>
<p>(T97897) SECURITY: Improve IP parsing and trimming. Previous
behavior could result in improper blocks being issued.</p>
<p>(T109724) SECURITY: Special:MyPage, Special:MyTalk,
Special:MyContributions and related pages no longer use HTTP
redirects and are now redirected by MediaWiki.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8622</cvename>
<cvename>CVE-2015-8623</cvename>
<cvename>CVE-2015-8624</cvename>
<cvename>CVE-2015-8625</cvename>
<cvename>CVE-2015-8626</cvename>
<cvename>CVE-2015-8627</cvename>
<cvename>CVE-2015-8628</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
<url>https://phabricator.wikimedia.org/T117899</url>
<url>https://phabricator.wikimedia.org/T119309</url>
<url>https://phabricator.wikimedia.org/T118032</url>
<url>https://phabricator.wikimedia.org/T115522</url>
<url>https://phabricator.wikimedia.org/T97897</url>
<url>https://phabricator.wikimedia.org/T109724</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
</references>
<dates>
<discovery>2015-12-18</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
<topic>Ruby -- unsafe tainted string vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developer reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
<p>There is an unsafe tainted string vulnerability in Fiddle and DL.
This issue was originally reported and fixed with CVE-2009-5147 in
DL, but reappeared after DL was reimplemented using Fiddle and
libffi.</p>
<p>And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
fixed at other branches, then rubies which bundled DL except Ruby
1.9.1 are still vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
<cvename>CVE-2015-7551</cvename>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.11</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
<p>During the generation of a dependency graph, the code for
the HTML image map is generated locally if a local dot
installation is used. With escaped HTML characters in a bug
summary, it is possible to inject unfiltered HTML code in
the map file which the CreateImagemap function generates.
This could be used for a cross-site scripting attack.</p>
<p>If an external HTML page contains a <script> element with
its src attribute pointing to a buglist in CSV format, some
web browsers incorrectly try to parse the CSV file as valid
JavaScript code. As the buglist is generated based on the
privileges of the user logged into Bugzilla, the external
page could collect confidential data contained in the CSV
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8508</cvename>
<cvename>CVE-2015-8509</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
crash an application was found in librsvg2 while parsing SVG file.
It has been fixed in 2.40.12 by many commits that has rewritten the
checks for cyclic references.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7558</cvename>
<freebsdpr>ports/205502</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://bugzilla.redhat.com/1268243</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
parsing SVG file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7557</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Schweitzer reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
<p>Any client sending the command "/op *" in a query will
cause the Quassel core to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
<cvename>CVE-2015-8547</cvename>
</references>
<dates>
<discovery>2015-11-22</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
<topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
<affects>
<package>
<name>libvirt</name>
<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Libvit development team reports:</p>
<blockquote cite="http://security.libvirt.org/2015/0004.html">
<p>Various virStorageVol* API operate on user-supplied volume names by
concatenating the volume name to the pool location. Note that the
virStoragePoolListVolumes API, when used on a storage pool backed by
a directory in a file system, will only list volumes immediately in
that directory (there is no traversal into subdirectories). However,
other APIs such as virStorageVolCreateXML were not checking if a
potential volume name represented one of the volumes that could be
returned by virStoragePoolListVolumes; because they were not rejecting
the use of '/' in a volume name.</p>
<p>Because no checking was done on volume names, a user could supply
a potential volume name of something like '../../../etc/passwd' to
attempt to access a file not belonging to the storage pool. When
fine-grained Access Control Lists (ACL) are in effect, a user with
storage_vol:create ACL permission but lacking domain:write permission
could thus abuse virStorageVolCreateXML and similar APIs to gain
access to files not normally permitted to that user. Fortunately, it
appears that the only APIs that could leak information or corrupt
files require read-write connection to libvirtd; and when ACLs are not
in use (the default without any further configuration), a user with
read-write access can already be considered to have full access to the
machine, and without an escalation of privilege there is no security
problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5313</cvename>
<url>http://security.libvirt.org/2015/0004.html</url>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-20</entry>
</dates>
</vuln>
<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
</package>
<package>
<name>ldb</name>
<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
<p>[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.</p>
<p>[CVE-2015-5330] Malicious request can cause Samba LDAP server
to return uninitialized memory that should not be part of the reply.</p>
<p>[CVE-2015-5296] Requesting encryption should also request
signing when setting up the connection to protect against man-in-the-middle attacks.</p>
<p>[CVE-2015-5299] A missing access control check in the VFS
shadow_copy2 module could allow unauthorized users to access snapshots.</p>
<p>[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.</p>
<p>[CVE-2015-8467] Samba can expose Windows DCs to MS15-096
Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).</p>
<p>[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3223</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
<cvename>CVE-2015-5252</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
<cvename>CVE-2015-5296</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
<cvename>CVE-2015-5299</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
<cvename>CVE-2015-5330</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
<cvename>CVE-2015-7540</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
<cvename>CVE-2015-8467</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-19</entry>
<modified>2016-02-05</modified>
</dates>
</vuln>
<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.106</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[569486] CVE-2015-6792: Fixes from internal audits and
fuzzing.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6792</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Till Kamppeter reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
<p>Cups Filters/Foomatic Filters does not consider semicolon
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
<cvename>CVE-2015-8560</cvename>
</references>
<dates>
<discovery>2015-12-12</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
<p>Cups Filters/Foomatic Filters does not consider backtick
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
<cvename>CVE-2015-8327</cvename>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
<topic>py-amf -- input sanitization errors</topic>
<affects>
<package>
<name>py27-amf</name>
<name>py32-amf</name>
<name>py33-amf</name>
<name>py34-amf</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
<p>A specially crafted AMF payload, containing malicious
references to XML external entities, can be used to trigger Denial of
Service (DoS) conditions or arbitrarily return the contents of files
that are accessible with the running application privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
<cvename>CVE-2015-8549</cvename>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html">
<h2>[20151201] - Core - Remote Code Execution Vulnerability</h2>
<p>Browser information is not filtered properly while saving the
session values into the database which leads to a Remote Code
Execution vulnerability.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html">
<h2>[20151202] - Core - CSRF Hardening</h2>
<p>Add additional CSRF hardening in com_templates.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html">
<h2>[20151203] - Core - Directory Traversal</h2>
<p>Failure to properly sanitize input data from the XML install file
located within an extension's package archive allows for directory
traversal.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html">
<h2>[20151204] - Core - Directory Traversal</h2>
<p>Inadequate filtering of request data leads to a Directory Traversal
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
<cvename>CVE-2015-8562</cvename>
<cvename>CVE-2015-8563</cvename>
<cvename>CVE-2015-8564</cvename>
<cvename>CVE-2015-8565</cvename>
<url>https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html</url>
<url>https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html</url>
<url>https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2015-12-17</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
<topic>bind -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20151215</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
<p>Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.</p>
<p>Incorrect reference counting could result in an INSIST
failure if a socket error occurred while performing a lookup. This flaw
is disclosed in CVE-2015-8461. [RT#40945]</p>
<p>Insufficient testing when parsing a message allowed records
with an incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed in
CVE-2015-8000. [RT #40987]</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
<url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
<url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-8000</cvename>
<cvename>CVE-2015-8461</cvename>
<freebsdsa>SA-15:27.bind</freebsdsa>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-12-16</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.5.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-134 Miscellaneous memory safety hazards
(rv:43.0 / rv:38.5)</p>
<p>MFSA 2015-135 Crash with JavaScript variable assignment
with unboxed objects</p>
<p>MFSA 2015-136 Same-origin policy violation using
perfomance.getEntries and history navigation</p>
<p>MFSA 2015-137 Firefox allows for control characters to be
set in cookies</p>
<p>MFSA 2015-138 Use-after-free in WebRTC when datachannel
is used after being destroyed</p>
<p>MFSA 2015-139 Integer overflow allocating extremely large
textures</p>
<p>MFSA 2015-140 Cross-origin information leak through web
workers error events</p>
<p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p>
<p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p>
<p>MFSA 2015-143 Linux file chooser crashes on malformed
images due to flaws in Jasper library</p>
<p>MFSA 2015-144 Buffer overflows found through code
inspection</p>
<p>MFSA 2015-145 Underflow through code inspection</p>
<p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
versions</p>
<p>MFSA 2015-147 Integer underflow and buffer overflow
processing MP4 metadata in libstagefright</p>
<p>MFSA 2015-148 Privilege escalation vulnerabilities in
WebExtension APIs</p>
<p>MFSA 2015-149 Cross-site reading attack through data and
view-source URIs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7201</cvename>
<cvename>CVE-2015-7202</cvename>
<cvename>CVE-2015-7203</cvename>
<cvename>CVE-2015-7204</cvename>
<cvename>CVE-2015-7205</cvename>
<cvename>CVE-2015-7207</cvename>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2015-7210</cvename>
<cvename>CVE-2015-7211</cvename>
<cvename>CVE-2015-7212</cvename>
<cvename>CVE-2015-7213</cvename>
<cvename>CVE-2015-7214</cvename>
<cvename>CVE-2015-7215</cvename>
<cvename>CVE-2015-7216</cvename>
<cvename>CVE-2015-7217</cvename>
<cvename>CVE-2015-7218</cvename>
<cvename>CVE-2015-7219</cvename>
<cvename>CVE-2015-7220</cvename>
<cvename>CVE-2015-7221</cvename>
<cvename>CVE-2015-7222</cvename>
<cvename>CVE-2015-7223</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
<topic>java -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjdk8</name>
<name>openjdk8-jre</name>
<range><lt>8.66.17</lt></range>
</package>
<package>
<name>openjdk7</name>
<name>openjdk7-jre</name>
<range><lt>7.91.02,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
<p>This Critical Patch Update contains 25 new security fixes
for Oracle Java SE. 24 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without the need for a username and password.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
<cvename>CVE-2015-4835</cvename>
<cvename>CVE-2015-4881</cvename>
<cvename>CVE-2015-4843</cvename>
<cvename>CVE-2015-4883</cvename>
<cvename>CVE-2015-4860</cvename>
<cvename>CVE-2015-4805</cvename>
<cvename>CVE-2015-4844</cvename>
<cvename>CVE-2015-4901</cvename>
<cvename>CVE-2015-4868</cvename>
<cvename>CVE-2015-4810</cvename>
<cvename>CVE-2015-4806</cvename>
<cvename>CVE-2015-4871</cvename>
<cvename>CVE-2015-4902</cvename>
<cvename>CVE-2015-4840</cvename>
<cvename>CVE-2015-4882</cvename>
<cvename>CVE-2015-4842</cvename>
<cvename>CVE-2015-4734</cvename>
<cvename>CVE-2015-4903</cvename>
<cvename>CVE-2015-4803</cvename>
<cvename>CVE-2015-4893</cvename>
<cvename>CVE-2015-4911</cvename>
<cvename>CVE-2015-4872</cvename>
<cvename>CVE-2015-4906</cvename>
<cvename>CVE-2015-4916</cvename>
<cvename>CVE-2015-4908</cvename>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2015-12-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion17</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
<package>
<name>mod_dav_svn</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Remotely triggerable heap overflow and out-of-bounds read caused
by integer overflow in the svn:// protocol parser.</p>
<p>Remotely triggerable heap overflow and out-of-bounds read in
mod_dav_svn caused by integer overflow when parsing skel-encoded
request bodies.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5343</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
<cvename>CVE-2015-5259</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
<p>7 security fixes in this release, including:</p>
<ul>
<li>[548273] High CVE-2015-6788: Type confusion in extensions.
Credit to anonymous.</li>
<li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
cloudfuzzer.</li>
<li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[567513] CVE-2015-6791: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6788</cvename>
<cvename>CVE-2015-6789</cvename>
<cvename>CVE-2015-6790</cvename>
<cvename>CVE-2015-6791</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
<topic>freeimage -- multiple integer overflows</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pcheng pcheng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
<p>An integer overflow issue in the FreeImage project was
reported and fixed recently.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0852</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
</references>
<dates>
<discovery>2015-08-28</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.9</lt></range>
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Data disclosure in atom feed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8537</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2015-12-10</entry>
<modified>2015-12-11</modified>
</dates>
</vuln>
<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.8</lt></range>
<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential changeset message disclosure in issues API.</p>
<p>Data disclosure on the time logging form</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8346</cvename>
<cvename>CVE-2015-8473</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
<range><eq>3.1.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8474</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
</references>
<dates>
<discovery>2015-09-20</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- potential XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential XSS vulnerability when rendering some flash messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8477</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
</references>
<dates>
<discovery>2015-02-19</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.6</lt></range>
<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential data leak (project names) in the invalid form
authenticity token error screen.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2014-07-06</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.5</lt></range>
<range><eq>2.5.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1985</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
</references>
<dates>
<discovery>2014-03-29</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2012-09-30</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Mass-assignment vulnerability that would allow an attacker to
bypass part of the security checks.</p>
<p>Persistent XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0327</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://jvn.jp/en/jp/JVN93406632/</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
<topic>redmine -- CSRF protection bypass</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Vulnerability that would allow an attacker to bypass the CSRF
protection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.641</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.625.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
<h1>Description</h1>
<h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
<p>In certain configurations, low privilege users were able to
create e.g. HTML files in workspaces and archived artifacts that
could result in XSS when accessed by other users. Jenkins now sends
Content-Security-Policy headers that enables sandboxing and
prohibits script execution by default.</p>
<h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
<p>Several administration/configuration related URLs could be
accessed using GET, which allowed attackers to circumvent CSRF
protection.</p>
<h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
<p>Malicious users were able to circumvent CSRF protection on any
URL by sending specially crafted POST requests.</p>
<h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
<p>While the Jenkins update site data is digitally signed, and the
signature verified by Jenkins, Jenkins did not verify the provided
SHA-1 checksums for the plugin files referenced in the update site
data. This enabled MITM attacks on the plugin manager, resulting
in installation of attacker-provided plugins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
</references>
<dates>
<discovery>2015-12-09</discovery>
<entry>2015-12-09</entry>
</dates>
</vuln>
<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.554</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
<p>
These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-8438, CVE-2015-8446).</p>
<p>
These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-8444, CVE-2015-8443,
CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
CVE-2015-8419, CVE-2015-8408).</p>
<p>
These updates resolve security bypass vulnerabilities
(CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).</p>
<p>
These updates resolve a stack overflow vulnerability that
could lead to code execution (CVE-2015-8407).</p>
<p>
These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8439).</p>
<p>
These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8445).</p>
<p>
These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-8415).</p>
<p>
These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8050, CVE-2015-8049,
CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
CVE-2015-8442, CVE-2015-8447).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
<cvename>CVE-2015-8045</cvename>
<cvename>CVE-2015-8047</cvename>
<cvename>CVE-2015-8048</cvename>
<cvename>CVE-2015-8049</cvename>
<cvename>CVE-2015-8050</cvename>
<cvename>CVE-2015-8051</cvename>
<cvename>CVE-2015-8052</cvename>
<cvename>CVE-2015-8053</cvename>
<cvename>CVE-2015-8054</cvename>
<cvename>CVE-2015-8055</cvename>
<cvename>CVE-2015-8056</cvename>
<cvename>CVE-2015-8057</cvename>
<cvename>CVE-2015-8058</cvename>
<cvename>CVE-2015-8059</cvename>
<cvename>CVE-2015-8060</cvename>
<cvename>CVE-2015-8061</cvename>
<cvename>CVE-2015-8062</cvename>
<cvename>CVE-2015-8063</cvename>
<cvename>CVE-2015-8064</cvename>
<cvename>CVE-2015-8065</cvename>
<cvename>CVE-2015-8066</cvename>
<cvename>CVE-2015-8067</cvename>
<cvename>CVE-2015-8068</cvename>
<cvename>CVE-2015-8069</cvename>
<cvename>CVE-2015-8070</cvename>
<cvename>CVE-2015-8071</cvename>
<cvename>CVE-2015-8401</cvename>
<cvename>CVE-2015-8402</cvename>
<cvename>CVE-2015-8403</cvename>
<cvename>CVE-2015-8404</cvename>
<cvename>CVE-2015-8405</cvename>
<cvename>CVE-2015-8406</cvename>
<cvename>CVE-2015-8407</cvename>
<cvename>CVE-2015-8408</cvename>
<cvename>CVE-2015-8409</cvename>
<cvename>CVE-2015-8410</cvename>
<cvename>CVE-2015-8411</cvename>
<cvename>CVE-2015-8412</cvename>
<cvename>CVE-2015-8413</cvename>
<cvename>CVE-2015-8414</cvename>
<cvename>CVE-2015-8415</cvename>
<cvename>CVE-2015-8416</cvename>
<cvename>CVE-2015-8417</cvename>
<cvename>CVE-2015-8419</cvename>
<cvename>CVE-2015-8420</cvename>
<cvename>CVE-2015-8421</cvename>
<cvename>CVE-2015-8422</cvename>
<cvename>CVE-2015-8423</cvename>
<cvename>CVE-2015-8424</cvename>
<cvename>CVE-2015-8425</cvename>
<cvename>CVE-2015-8426</cvename>
<cvename>CVE-2015-8427</cvename>
<cvename>CVE-2015-8428</cvename>
<cvename>CVE-2015-8429</cvename>
<cvename>CVE-2015-8430</cvename>
<cvename>CVE-2015-8431</cvename>
<cvename>CVE-2015-8432</cvename>
<cvename>CVE-2015-8433</cvename>
<cvename>CVE-2015-8434</cvename>
<cvename>CVE-2015-8435</cvename>
<cvename>CVE-2015-8436</cvename>
<cvename>CVE-2015-8437</cvename>
<cvename>CVE-2015-8438</cvename>
<cvename>CVE-2015-8439</cvename>
<cvename>CVE-2015-8440</cvename>
<cvename>CVE-2015-8441</cvename>
<cvename>CVE-2015-8442</cvename>
<cvename>CVE-2015-8443</cvename>
<cvename>CVE-2015-8444</cvename>
<cvename>CVE-2015-8445</cvename>
<cvename>CVE-2015-8446</cvename>
<cvename>CVE-2015-8447</cvename>
<cvename>CVE-2015-8448</cvename>
<cvename>CVE-2015-8449</cvename>
<cvename>CVE-2015-8450</cvename>
<cvename>CVE-2015-8451</cvename>
<cvename>CVE-2015-8452</cvename>
<cvename>CVE-2015-8453</cvename>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
<topic>libressl -- NULL pointer dereference</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.5</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenBSD project reports:</p>
<blockquote cite="https://marc.info/?l=openbsd-announce&t=144920914600002">
<p>A NULL pointer deference could be triggered by a crafted
certificate sent to services configured to verify client
certificates on TLS/SSL connections.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://marc.info/?l=openbsd-announce&t=144920914600002</url>
<cvename>CVE-2015-3194</cvename>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
<topic>KeePassX -- information disclosure</topic>
<affects>
<package>
<name>KeePassX</name>
<range><lt>0.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yves-Alexis Perez reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
<p>Starting an export (using File / Export to / KeepassX XML file) and
cancelling it leads to KeepassX saving a cleartext XML file in
~/.xml without any warning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8378</cvename>
<freebsdpr>ports/205105</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
<topic>passenger -- client controlled header overwriting</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
<range><lt>4.0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Knoppel reports:</p>
<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
<p>It was discovered by the SUSE security team that it was possible,
in some cases, for clients to overwrite headers set by the server,
resulting in a medium level security issue. CVE-2015-7519 has been
assigned to this issue.</p>
<p>Affected use-cases:</p>
<p>Header overwriting may occur if all of the following conditions are met:</p>
<ul>
<li>Apache integration mode, or standalone+builtin engine without
a filtering proxy</li>
<li>Ruby or Python applications only (Passenger 5); or any
application (Passenger 4)</li>
<li>The app depends on a request header containing a dash (-)</li>
<li>The header is supposed to be trusted (set by the server)</li>
<li>The client correctly guesses the header name</li>
</ul>
<p>This vulnerability has been fixed by filtering out client headers
that do not consist of alphanumeric/dash characters (Nginx already
did this, so Passenger+Nginx was not affected). If your application
depends on headers that don't conform to this, you can add a
workaround in Apache specifically for those to convert them to a
dash-based format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7519</cvename>
<url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
</references>
<dates>
<discovery>2015-12-07</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
<topic>Salt -- information disclosure</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes report:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
<p>CVE-2015-8034: Saving state.sls cache data to disk with insecure
permissions</p>
<p>This affects users of the state.sls function. The state run cache
on the minion was being created with incorrect permissions. This
file could potentially contain sensitive data that was inserted via
jinja into the state SLS files. The permissions for this file are
now being set correctly. Thanks to @zmalone for bringing this issue
to our attention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8034</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
</references>
<dates>
<discovery>2015-11-25</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
<topic>libraw -- memory objects not properly initialized</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8367, LibRaw's phase_one_correct function does not
handle memory initialization correctly, which may cause other
problems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8367</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
<topic>libraw -- index overflow in smal_decode_segment</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8366, LibRaw's smal_decode_segment function does not
handle indexes carefully, which can cause an index overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8366</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_5</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_8</lt></range>
<range><ge>10.1</ge><lt>10.1_25</lt></range>
<range><ge>9.3</ge><lt>9.3_31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
<ol>
<li>BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193)</li>
<li>Certificate verify crash with missing PSS parameter
(CVE-2015-3194)</li>
<li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
<li>Race condition handling PSK identify hint
(CVE-2015-3196)</li>
<li>Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:26.openssl</freebsdsa>
<cvename>CVE-2015-1794</cvename>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2015-3195</cvename>
<cvename>CVE-2015-3196</cvename>
<url>https://www.openssl.org/news/secadv/20151203.txt</url>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
<topic>PHPmailer -- SMTP injection vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer changelog reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
<p>Fix vulnerability that allowed email addresses with
line breaks (valid in RFC5322) to pass to SMTP, permitting
message injection at the SMTP level. Mitigated in both
the address validator and in the lower-level SMTP class.
Thanks to Takeshi Terada.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
</references>
<dates>
<discovery>2015-11-05</discovery>
<entry>2015-12-03</entry>
</dates>
</vuln>
<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
<range><lt>2.7.3,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.5</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><le>2.6.11</le></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150822_6 has ffmpeg-2.8.2 -->
<range><lt>1.1.r20150822_7</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
<p>The update_dimensions function in libavcodec/vp8.c in
FFmpeg through 2.8.1, as used in Google Chrome before
46.0.2490.71 and other products, relies on a
coefficient-partition count during multi-threaded operation,
which allows remote attackers to cause a denial of service
(race condition and memory corruption) or possibly have
unspecified other impact via a crafted WebM file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
<p>The ljpeg_decode_yuv_scan function in
libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
width and height checks, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted MJPEG
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
<p>The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
FFmpeg before 2.8.2 does not validate the Chroma Format
Indicator, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via crafted High Efficiency Video
Coding (HEVC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
<p>The decode_uncompressed function in libavcodec/faxcompr.c
in FFmpeg before 2.8.2 does not validate uncompressed runs,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted CCITT FAX data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
<p>The init_tile function in libavcodec/jpeg2000dec.c in
FFmpeg before 2.8.2 does not enforce minimum-value and
maximum-value constraints on tile coordinates, which allows
remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via
crafted JPEG 2000 data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
<p>The jpeg2000_read_main_headers function in
libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
before 2.7.3, and 2.8.x through 2.8.2 does not enforce
uniqueness of the SIZ marker in a JPEG 2000 image, which
allows remote attackers to cause a denial of service
(out-of-bounds heap-memory access) or possibly have
unspecified other impact via a crafted image with two or
more of these markers.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
<p>Integer overflow in the ff_ivi_init_planes function in
libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
and 2.8.x through 2.8.2 allows remote attackers to cause a
denial of service (out-of-bounds heap-memory access) or
possibly have unspecified other impact via crafted image
dimensions in Indeo Video Interactive data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
<p>The smka_decode_frame function in libavcodec/smacker.c in
FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
2.8.2 does not verify that the data size is consistent with
the number of channels, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted Smacker
data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-8216</cvename>
<cvename>CVE-2015-8217</cvename>
<cvename>CVE-2015-8218</cvename>
<cvename>CVE-2015-8219</cvename>
<cvename>CVE-2015-8363</cvename>
<cvename>CVE-2015-8364</cvename>
<cvename>CVE-2015-8365</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-11-27</discovery>
<entry>2015-12-02</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
<p>41 security fixes in this release, including:</p>
<ul>
<li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
Credit to Mariusz Mlynski.</li>
<li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[544991] High CVE-2015-6771: Out of bounds access in v8.
Credit to anonymous.</li>
<li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[554946] High CVE-2015-6764: Out of bounds access in v8.
Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
<li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
Credit to cloudfuzzer.</li>
<li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
Credit to anonymous.</li>
<li>[529012] High CVE-2015-6775: Type confusion in PDFium.
Credit to Atte Kettunen of OUSPG.</li>
<li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
Credit to Hanno Böck.</li>
<li>[544020] High CVE-2015-6777: Use-after-free in DOM.
Credit to Long Liu of Qihoo 360Vulcan Team.</li>
<li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
Credit to Karl Skomski.</li>
<li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
Credit to Til Jasper Ullrich.</li>
<li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
Credit to Khalil Zhani.</li>
<li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
Credit to miaubiz.</li>
<li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
Credit to Luan Herrera.</li>
<li>[537205] Medium CVE-2015-6783: Signature validation issue in
Android Crazy Linker. Credit to Michal Bednarski.</li>
<li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
Credit to Michael Ficarra / Shape Security.</li>
<li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
Michael Ficarra / Shape Security.</li>
<li>[563930] CVE-2015-6787: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6765</cvename>
<cvename>CVE-2015-6766</cvename>
<cvename>CVE-2015-6767</cvename>
<cvename>CVE-2015-6768</cvename>
<cvename>CVE-2015-6769</cvename>
<cvename>CVE-2015-6770</cvename>
<cvename>CVE-2015-6771</cvename>
<cvename>CVE-2015-6772</cvename>
<cvename>CVE-2015-6773</cvename>
<cvename>CVE-2015-6774</cvename>
<cvename>CVE-2015-6775</cvename>
<cvename>CVE-2015-6776</cvename>
<cvename>CVE-2015-6777</cvename>
<cvename>CVE-2015-6778</cvename>
<cvename>CVE-2015-6779</cvename>
<cvename>CVE-2015-6780</cvename>
<cvename>CVE-2015-6781</cvename>
<cvename>CVE-2015-6782</cvename>
<cvename>CVE-2015-6783</cvename>
<cvename>CVE-2015-6784</cvename>
<cvename>CVE-2015-6785</cvename>
<cvename>CVE-2015-6786</cvename>
<cvename>CVE-2015-6787</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
<topic>piwik -- multiple vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik changelog reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
<p>This release is rated critical.
We are grateful for Security researchers who disclosed
security issues privately to the Piwik Security Response
team: Elamaran Venkatraman, Egidio Romano and Dmitriy
Shcherbatov. The following vulnerabilities were fixed:
XSS, CSRF, possible file inclusion in older PHP versions
(low impact), possible Object Injection Vulnerability
(low impact).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7815</cvename>
<cvename>CVE-2015-7816</cvename>
<url>http://piwik.org/changelog/piwik-2-15-0/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
<topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
<affects>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
</package>
<package>
<name>cyrus-imapd24</name>
<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 2.5.7 Release Note states:</p>
<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
<p>CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8078</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
<cvename>CVE-2015-8077</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-12-01</entry>
</dates>
</vuln>
<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
<topic>django -- information leak vulnerability</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.11</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>If an application allows users to specify an unvalidated
format for dates and passes this format to the date filter, e.g. {{
last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application's settings by specifying a settings
key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
<cvename>CVE-2015-8213</cvename>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-11-30</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
<topic>kibana4 -- CSRF vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
</package>
<package>
<name>kibana42</name>
<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security/">
<p>Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
are vulnerable to a CSRF attack.</p>
<p>Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8131</cvename>
<url>https://www.elastic.co/community/security/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
<topic>a2ps -- format string vulnerability</topic>
<affects>
<package>
<name>a2ps</name>
<range><lt>4.13b_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jong-Gwon Kim reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
<p>When user runs a2ps with malicious crafted pro(a2ps prologue) file,
an attacker can execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8107</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
<topic>libxslt -- DoS vulnerability due to type confusing error</topic>
<affects>
<package>
<name>libsxlt</name>
<range><lt>1.1.28_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxslt maintainer reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
<p>CVE-2015-7995:
http://www.openwall.com/lists/oss-security/2015/10/27/10
We need to check that the parent node is an element before
dereferencing its namespace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7995</cvename>
<url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://xmlsoft.org/news.html">
<p>CVE-2015-5312 Another entity expansion issue (David Drysdale).</p>
<p>CVE-2015-7497 Avoid an heap buffer overflow in
xmlDictComputeFastQKey (David Drysdale).</p>
<p>CVE-2015-7498 Avoid processing entities after encoding
conversion failures (Daniel Veillard).</p>
<p>CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
(Daniel Veillard).</p>
<p>CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
Veillard).</p>
<p>CVE-2015-7500 Fix memory access error due to incorrect
entities boundaries (Daniel Veillard).</p>
<p>CVE-2015-7941 (1) Stop parsing on entities boundaries
errors (Daniel Veillard).</p>
<p>CVE-2015-7941 (2) Cleanup conditional section error
handling (Daniel Veillard).</p>
<p>CVE-2015-7942 Another variation of overflow in
Conditional sections (Daniel Veillard).</p>
<p>CVE-2015-7942 (2) Fix an error in previous Conditional
section patch (Daniel Veillard).</p>
<p>CVE-2015-8035 Fix XZ compression support loop
(Daniel Veillard).</p>
<p>CVE-2015-8242 Buffer overead with HTML parser in push
mode (Hugh Davenport)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5312</cvename>
<cvename>CVE-2015-7497</cvename>
<cvename>CVE-2015-7498</cvename>
<cvename>CVE-2015-7499</cvename>
<cvename>CVE-2015-7500</cvename>
<cvename>CVE-2015-7941</cvename>
<cvename>CVE-2015-7942</cvename>
<cvename>CVE-2015-8035</cvename>
<cvename>CVE-2015-8241</cvename>
<cvename>CVE-2015-8242</cvename>
<url>http://xmlsoft.org/news.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
</references>
<dates>
<discovery>2015-11-20</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>linux-c6-nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.20.1</lt></range>
<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
<range><lt>3.19.2.1</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.4.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-133 NSS and NSPR memory corruption issues</p>
<p>MFSA 2015-132 Mixed content WebSocket policy bypass
through workers</p>
<p>MFSA 2015-131 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-130 JavaScript garbage collection crash with
Java applet</p>
<p>MFSA 2015-129 Certain escaped characters in host of
Location-header are being treated as non-escaped</p>
<p>MFSA 2015-128 Memory corruption in libjar through zip
files</p>
<p>MFSA 2015-127 CORS preflight is bypassed when
non-standard Content-Type headers are received</p>
<p>MFSA 2015-126 Crash when accessing HTML tables with
accessibility tools on OS X</p>
<p>MFSA 2015-125 XSS attack through intents on Firefox for
Android</p>
<p>MFSA 2015-124 Android intents can be used on Firefox for
Android to open privileged files</p>
<p>MFSA 2015-123 Buffer overflow during image interactions
in canvas</p>
<p>MFSA 2015-122 Trailing whitespace in IP address hostnames
can bypass same-origin policy</p>
<p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has
no effect</p>
<p>MFSA 2015-120 Reading sensitive profile files through
local HTML file on Android</p>
<p>MFSA 2015-119 Firefox for Android addressbar can be
removed after fullscreen mode</p>
<p>MFSA 2015-118 CSP bypass due to permissive Reader mode
whitelist</p>
<p>MFSA 2015-117 Information disclosure through NTLM
authentication</p>
<p>MFSA 2015-116 Miscellaneous memory safety hazards
(rv:42.0 / rv:38.4)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4513</cvename>
<cvename>CVE-2015-4514</cvename>
<cvename>CVE-2015-4515</cvename>
<cvename>CVE-2015-4518</cvename>
<cvename>CVE-2015-7181</cvename>
<cvename>CVE-2015-7182</cvename>
<cvename>CVE-2015-7183</cvename>
<cvename>CVE-2015-7185</cvename>
<cvename>CVE-2015-7186</cvename>
<cvename>CVE-2015-7187</cvename>
<cvename>CVE-2015-7188</cvename>
<cvename>CVE-2015-7189</cvename>
<cvename>CVE-2015-7190</cvename>
<cvename>CVE-2015-7191</cvename>
<cvename>CVE-2015-7192</cvename>
<cvename>CVE-2015-7193</cvename>
<cvename>CVE-2015-7194</cvename>
<cvename>CVE-2015-7195</cvename>
<cvename>CVE-2015-7196</cvename>
<cvename>CVE-2015-7197</cvename>
<cvename>CVE-2015-7198</cvename>
<cvename>CVE-2015-7199</cvename>
<cvename>CVE-2015-7200</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-19</entry>
<modified>2016-04-13</modified>
</dates>
</vuln>
<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
<topic>gdm -- lock screen bypass when holding escape key</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>3.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ray Strode reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
<p>CVE-2015-7496 - lock screen bypass when holding escape key.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7496</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
</references>
<dates>
<discovery>2015-11-12</discovery>
<entry>2015-11-18</entry>
</dates>
</vuln>
<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
<topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
was caused by insufficient verification of the internal state when handling
MSCHAPv2 Success messages received by the client.
This vulnerability has been registered as CVE-2015-8023.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8023</cvename>
<url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.11</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
<p>MSA-15-0037 Possible to send a message to a user who blocked
messages from non contacts</p>
<p>MSA-15-0038 DDoS possibility in Atto</p>
<p>MSA-15-0039 CSRF in site registration form</p>
<p>MSA-15-0040 Student XSS in survey</p>
<p>MSA-15-0041 XSS in flash video player</p>
<p>MSA-15-0042 CSRF in lesson login form</p>
<p>MSA-15-0043 Web service core_enrol_get_enrolled_users does not
respect course group mode</p>
<p>MSA-15-0044 Capability to view available badges is not
respected</p>
<p>MSA-15-0045 SCORM module allows to bypass access restrictions based
on date</p>
<p>MSA-15-0046 Choice module closing date can be bypassed</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
</references>
<dates>
<discovery>2015-11-09</discovery>
<entry>2015-11-16</entry>
<modified>2015-12-21</modified>
</dates>
</vuln>
<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
<topic>xen-kernel -- CPU lockup during exception delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant,
perhaps indefinite period. If a host watchdog (Xen or dom0) is in
use, this can lead to a watchdog timeout and consequently a reboot
of the host. If another, innocent, guest, is configured with a
watchdog, this issue can lead to a reboot of such a guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5307</cvename>
<cvename>CVE-2015-8104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-156.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
<topic>libpng buffer overflow in png_set_PLTE</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libpng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
<p>CVE for a vulnerability in libpng, all versions, in the
png_set_PLTE/png_get_PLTE functions. These functions failed to check for
an out-of-range palette when reading or writing PNG files with a bit_depth
less than 8. Some applications might read the bit depth from the IHDR
chunk and allocate memory for a 2^N entry palette, while libpng can return
a palette with up to 256 entries even when the bit depth is less than 8.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
<cvename>CVE-2015-8126</cvename>
<cvename>CVE-2015-8472</cvename>
</references>
<dates>
<discovery>2015-11-15</discovery>
<entry>2015-11-15</entry>
<modified>2015-12-08</modified>
</dates>
</vuln>
<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.548</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-7659).</p>
<p>These updates resolve a security bypass vulnerability that
could be exploited to write arbitrary data to the file
system under user permissions (CVE-2015-7662).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7651, CVE-2015-7652,
CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
CVE-2015-8046).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
<cvename>CVE-2015-7651</cvename>
<cvename>CVE-2015-7652</cvename>
<cvename>CVE-2015-7653</cvename>
<cvename>CVE-2015-7654</cvename>
<cvename>CVE-2015-7655</cvename>
<cvename>CVE-2015-7656</cvename>
<cvename>CVE-2015-7657</cvename>
<cvename>CVE-2015-7658</cvename>
<cvename>CVE-2015-7659</cvename>
<cvename>CVE-2015-7660</cvename>
<cvename>CVE-2015-7661</cvename>
<cvename>CVE-2015-7662</cvename>
<cvename>CVE-2015-7663</cvename>
<cvename>CVE-2015-8043</cvename>
<cvename>CVE-2015-8044</cvename>
<cvename>CVE-2015-8046</cvename>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-14</entry>
</dates>
</vuln>
<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
<p>[520422] High CVE-2015-1302: Information leak in PDF viewer.
Credit to Rob Wu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1302</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
<topic>MySQL - Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb-client</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4802</cvename>
<cvename>CVE-2015-4807</cvename>
<cvename>CVE-2015-4815</cvename>
<cvename>CVE-2015-4826</cvename>
<cvename>CVE-2015-4830</cvename>
<cvename>CVE-2015-4836</cvename>
<cvename>CVE-2015-4858</cvename>
<cvename>CVE-2015-4861</cvename>
<cvename>CVE-2015-4870</cvename>
<cvename>CVE-2015-4913</cvename>
<cvename>CVE-2015-4792</cvename>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
<url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
<url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
<topic>jenkins -- remote code execution via unsafe deserialization</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.638</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.625.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Developers report:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
<p>Unsafe deserialization allows unauthenticated remote attackers to
run arbitrary code on the Jenkins master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
<url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
<url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
<topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
<affects>
<package>
<name>owncloudclient</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>owncloud.org reports:</p>
<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
<p>The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.</p>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
<cvename>CVE-2015-7298</cvename>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
<topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
<p>Guests configured with PoD might be unstable, especially under
load. In an affected guest, an unprivileged guest user might be
able to cause a guest crash, perhaps simply by applying load so
as to cause heavy memory pressure within the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7972</cvename>
<url>http://xenbits.xen.org/xsa/advisory-153.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
<topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
<p>HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
attempts at invalid operations. These log messages are not
rate-limited, even though they can be triggered by guests.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7971</cvename>
<url>http://xenbits.xen.org/xsa/advisory-152.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
<p>A domain's xenoprofile state contains an array of per-vcpu
information... This array is leaked on domain teardown. This memory
leak could -- over time -- exhaust the host's memory.</p>
<p>The following parties can mount a denial of service attack
affecting the whole system:</p>
<ul>
<li>A malicious guest administrator via XENOPROF_get_buffer.</li>
<li>A domain given suitable privilege over another domain via
XENOPROF_set_passive (this would usually be a domain being
used to profile another domain, eg with the xenoprof tool).</li>
</ul>
<p>The ability to also restart or create suitable domains is also
required to fully exploit the issue. Without this the leak is
limited to a small multiple of the maximum number of vcpus for the
domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-151.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
<p>When running an HVM domain in Populate-on-Demand mode, Xen would
sometimes search the domain for memory to reclaim, in response to
demands for population of other pages in the same domain. This
search runs without preemption. The guest can, by suitable
arrangement of its memory contents, create a situation where this
search is a time-consuming linear scan of the guest's address
space.</p>
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant
period.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7970</cvename>
<url>http://xenbits.xen.org/xsa/advisory-150.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
<p>A domain's primary array of vcpu pointers can be allocated by a
toolstack exactly once in the lifetime of a domain via the
XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
teardown. This memory leak could -- over time -- exhaust the host's
memory.</p>
<p>A domain given partial management control via XEN_DOMCTL_max_vcpus
can mount a denial of service attack affecting the whole system. The
ability to also restart or create suitable domains is also required
to fully exploit the issue. Without this the leak is limited to a
small multiple of the maximum number of vcpus for the domain. The
maximum leak is 64kbytes per domain (re)boot (less on ARM).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-149.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
<p>The code to validate level 2 page table entries is bypassed when
certain conditions are satisfied. This means that a PV guest can
create writable mappings using super page mappings. Such writable
mappings can violate Xen intended invariants for pages which Xen is
supposed to keep read-only. This is possible even if the
"allowsuperpage" command line option is not used.</p>
<p>Malicious PV guest administrators can escalate privilege so as to
control the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7835</cvename>
<url>http://xenbits.xen.org/xsa/advisory-148.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
<topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
<p>Callers of libxl can specify that a disk should be read-only to the
guest. However, there is no code in libxl to pass this information
to qemu-xen (the upstream-based qemu); and indeed there is no way in
qemu to make a disk read-only.</p>
<p>The vulnerability is exploitable only via devices emulated by the
device model, not the parallel PV devices for supporting PVHVM.
Normally the PVHVM device unplug protocol renders the emulated
devices inaccessible early in boot.</p>
<p>Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.</p>
<p>CDROM devices (that is, devices specified to be presented to the
guest as CDROMs, regardless of the nature of the backing storage on
the host) are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7311</cvename>
<url>http://xenbits.xen.org/xsa/advisory-142.html</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
<topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
<affects>
<package>
<name>p5-HTML-Scrubber</name>
<range><lt>0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
<p>Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
module before 0.15 for Perl, when the comment feature is enabled,
allows remote attackers to inject arbitrary web script or HTML via
a crafted comment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5667</cvename>
<url>https://metacpan.org/release/HTML-Scrubber</url>
<url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
<url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
</references>
<dates>
<discovery>2015-10-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
<topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
<p>Security researcher Khalil Zhani reported that a
maliciously crafted vp9 format video could be used to
trigger a buffer overflow while parsing the file. This leads
to a potentially exploitable crash due to a flaw in the
libvpx library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4506</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-10</entry>
</dates>
</vuln>
<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
<topic>powerdns -- Denial of Service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
<p>A bug was found using afl-fuzz in our packet parsing code.
This bug, when exploited, causes an assertion error and consequent
termination of the the pdns_server process, causing a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
<cvename>CVE-2015-5311</cvename>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
<topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.54</ge><lt>0.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Harris reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
<p>Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
potentially memory-corrupting integer overflow in the handling of
the ECH (erase characters) control sequence in the terminal
emulator.</p>
<p>To exploit a vulnerability in the terminal emulator, an attacker
must be able to insert a carefully crafted escape sequence into the
terminal stream. For a PuTTY SSH session, this must be before
encryption, so the attacker likely needs access to the server you're
connecting to. For instance, an attacker on a multi-user machine
that you connect to could trick you into running cat on a file they
control containing a malicious escape sequence. (Unix write(1) is
not a vector for this, if implemented correctly.)</p>
<p>Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
not include the terminal emulator, so cannot be exploited this
way.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
<cvename>CVE-2015-5309</cvename>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
<topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1705368,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
<p>A vulnerability in OpenOffice settings of OpenDocument Format
files and templates allows silent access to files that are
readable from an user account, over-riding the user's default
configuration settings. Once these files are imported into a
maliciously-crafted document, the data can be silently hidden
in the document and possibly exported to an external party
without being observed. </p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
<p>A crafted ODF document can be used to create a buffer that is
too small for the amount of data loaded into it, allowing an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
<p>A crafted Microsoft Word DOC file can be used to specify a
document buffer that is too small for the amount of data
provided for it. Failure to detect the discrepancy allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
<p>A crafted Microsoft Word DOC can contain invalid bookmark
positions leading to memory corruption when the document is
loaded or bookmarks are manipulated. The defect allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4551</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
<cvename>CVE-2015-5212</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
<cvename>CVE-2015-5213</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
<cvename>CVE-2015-5214</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-11-05</entry>
<modified>2015-11-05</modified>
</dates>
</vuln>
<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed an XSS attack vector in Security Library method
xss_clean().</p>
<p>Changed Config Library method base_url() to fallback to
``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
injections.</p>
<p>Changed CAPTCHA Helper to try to use the operating system's PRNG
first.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-31</discovery>
<entry>2015-11-01</entry>
</dates>
</vuln>
<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
<topic>openafs -- information disclosure</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
<p>When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
implementations do not initialize three octets of data that are padding
in the C language structure and were inadvertently included in the wire
protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
a variable-length padding at the end of the ACK packet, in an attempt to
detect the path MTU, but only four octets of the additional padding are
initialized (CVE-2015-7763).</p>
</blockquote>
</body>
</description>
<references>
<url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
<cvename>CVE-2015-7762</cvename>
<cvename>CVE-2015-7763</cvename>
</references>
<dates>
<discovery>2015-10-28</discovery>
<entry>2015-10-28</entry>
</dates>
</vuln>
<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
<topic>xscreensaver - lock bypass</topic>
<affects>
<package>
<name>xscreensaver</name>
<name>xscreensaver-gnome</name>
<name>xscreensaver-gnome-hacks</name>
<range><lt>5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat bugzilla reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
<p>In dual screen configurations, unplugging one screen will cause
xscreensaver to crash, leaving the screen unlocked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jwz.org/xscreensaver/changelog.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
<cvename>CVE-2015-8025</cvename>
</references>
<dates>
<discovery>2015-10-24</discovery>
<entry>2015-10-27</entry>
<modified>2015-11-04</modified>
</dates>
</vuln>
<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
<topic>lldpd -- Buffer overflow/Denial of service</topic>
<affects>
<package>
<name>lldpd</name>
<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The lldpd developer Vincent Bernat reports:</p>
<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
<p>A buffer overflow may allow arbitrary code execution
only if hardening was disabled.</p>
</blockquote>
<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
<p>Malformed packets should not make lldpd crash. Ensure we can
handle them by not using assert() in this part.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8011</cvename>
<cvename>CVE-2015-8012</cvename>
<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-26</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
<topic>wireshark -- Pcapng file parser crash</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
<p>The following vulnerability has been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-30</p>
<p>Pcapng file parser crash. (Bug 11455)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
<cvename>CVE-2015-7830</cvename>
</references>
<dates>
<discovery>2015-10-14</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
<h2>[20151001] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
<h2>[20151002] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_contenthistory provide potential read
access to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7297</cvename>
<cvename>CVE-2015-7857</cvename>
<cvename>CVE-2015-7858</cvename>
<cvename>CVE-2015-7859</cvename>
<url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
<url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
<h2>[20151003] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7899</cvename>
<url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
<h2>[20150908] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in login module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6939</cvename>
<url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
<h2>[20150602] - Core - CSRF Protection</h2>
<p>Lack of CSRF checks potentially enabled uploading malicious code.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5397</cvename>
<url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Open Redirect vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
<h2>[20150601] - Core - Open Redirect</h2>
<p>Inadequate checking of the return value allowed to redirect to an
external page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5608</cvename>
<url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.6</lt></range>
<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
</package>
<package>
<name>joomla2</name>
<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
<h2>[20140903] - Core - Remote File Inclusion</h2>
<p>Inadequate checking allowed the potential for remote files to be
executed.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
<h2>[20140904] - Core - Denial of Service</h2>
<p>Inadequate checking allowed the potential for a denial of service
attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7228</cvename>
<cvename>CVE-2014-7229</cvename>
<url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
<url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
<url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Unauthorized Login vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
<package>
<name>joomla2</name>
<range><lt>2.5.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
<h2>[20140902] - Core - Unauthorized Logins</h2>
<p>Inadequate checking allowed unauthorized logins via LDAP
authentication.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6632</cvename>
<url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
<h2>[20140901] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_media.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6631</cvename>
<url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
<topic>drupal -- open redirect vulnerability</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
<p>The Overlay module in Drupal core displays administrative pages
as a layer over the current page (using JavaScript), rather than
replacing the page in the browser window. The Overlay module does
not sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only be
used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.
</p>
<p>An incomplete fix for this issue was released as part of
SA-CORE-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7943</cvename>
<url>https://www.drupal.org/SA-CORE-2015-004</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-24</entry>
</dates>
</vuln>
<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
<topic>phpMyAdmin -- Content spoofing vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
<p>This vulnerability allows an attacker to perform a
content spoofing attack using the phpMyAdmin's redirection
mechanism to external sites.</p>
<p>We consider this vulnerability to be non critical since
the spoofed content is escaped and no HTML injection is
possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
<cvename>CVE-2015-7873</cvename>
</references>
<dates>
<discovery>2015-10-23</discovery>
<entry>2015-10-23</entry>
</dates>
</vuln>
<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.11</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.4</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
<p>Wikipedia user RobinHood70 reported two issues in the chunked
upload API. The API failed to correctly stop adding new chunks to
the upload when the reported size was exceeded (T91203), allowing
a malicious users to upload add an infinite number of chunks for a
single file upload. Additionally, a malicious user could upload
chunks of 1 byte for very large files, potentially creating a very
large number of files on the server's filesystem (T91205).</p>
<p>Internal review discovered that it is not possible to throttle file
uploads.</p>
<p>Internal review discovered a missing authorization check when
removing suppression from a revision. This allowed users with the
'viewsuppressed' user right but not the appropriate
'suppressrevision' user right to unsuppress revisions.</p>
<p>Richard Stanway from teamliquid.net reported that thumbnails of PNG
files generated with ImageMagick contained the local file path in
the image metadata.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8001</cvename>
<cvename>CVE-2015-8002</cvename>
<cvename>CVE-2015-8003</cvename>
<cvename>CVE-2015-8004</cvename>
<cvename>CVE-2015-8005</cvename>
<cvename>CVE-2015-8006</cvename>
<cvename>CVE-2015-8007</cvename>
<cvename>CVE-2015-8008</cvename>
<cvename>CVE-2015-8009</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
<url>https://phabricator.wikimedia.org/T91203</url>
<url>https://phabricator.wikimedia.org/T91205</url>
<url>https://phabricator.wikimedia.org/T91850</url>
<url>https://phabricator.wikimedia.org/T95589</url>
<url>https://phabricator.wikimedia.org/T108616</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-23</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
<topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p4</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.76</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_7</lt></range>
<range><ge>10.1</ge><lt>10.1_24</lt></range>
<range><ge>9.3</ge><lt>9.3_30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
<p>NTF's NTP Project has been notified of the following 13 low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p4, released on Wednesday, 21 October 2015:</p>
<ul>
<li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
association authentication bypass via crypto-NAK
(Cisco ASIG)</li>
<li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
instead of returning FAIL on some bogus values (IDA)</li>
<li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
custom refclock driver could cause a buffer overflow.
(Cisco TALOS)</li>
<li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
Vulnerability. (OpenVMS) (Cisco TALOS)</li>
<li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
(Cisco TALOS)</li>
<li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
(Cisco TALOS)</li>
<li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
(Cisco TALOS)</li>
<li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
(Tenable)</li>
<li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
and "driftfile" should only be allowed locally. (RedHat)</li>
<li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
receive a KoD should validate the origin timestamp field.
(Boston University)</li>
<li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Incomplete autokey data packet length checks. (Tenable)</li>
</ul>
<p>The only generally-exploitable bug in the above list is the
crypto-NAK bug, which has a CVSS2 score of 6.4.</p>
<p>Additionally, three bugs that have already been fixed in
ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
have a security component, but are all below 1.8 CVSS score,
so we're reporting them here:</p>
<ul>
<li>Bug 2382 : Peer precision < -31 gives division by zero</li>
<li>Bug 1774 : Segfaults if cryptostats enabled when built
without OpenSSL</li>
<li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:25.ntp</freebsdsa>
<cvename>CVE-2015-7691</cvename>
<cvename>CVE-2015-7692</cvename>
<cvename>CVE-2015-7701</cvename>
<cvename>CVE-2015-7702</cvename>
<cvename>CVE-2015-7703</cvename>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-7705</cvename>
<cvename>CVE-2015-7848</cvename>
<cvename>CVE-2015-7849</cvename>
<cvename>CVE-2015-7850</cvename>
<cvename>CVE-2015-7851</cvename>
<cvename>CVE-2015-7852</cvename>
<cvename>CVE-2015-7853</cvename>
<cvename>CVE-2015-7854</cvename>
<cvename>CVE-2015-7855</cvename>
<cvename>CVE-2015-7871</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
<topic>codeigniter -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed a number of XSS attack vectors in Security Library method
xss_clean (thanks to Frans Rosén from Detectify.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-20</entry>
</dates>
</vuln>
<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
<topic>Git -- Execute arbitrary code</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git release notes:</p>
<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
<p>Some protocols (like git-remote-ext) can execute arbitrary code
found in the URL. The URLs that submodules use may come from
arbitrary sources (e.g., .gitmodules files in a remote
repository), and can hurt those who blindly enable recursive
fetch. Restrict the allowed protocols to well known and safe
ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7545</cvename>
<url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
</references>
<dates>
<discovery>2015-09-23</discovery>
<entry>2015-10-19</entry>
<modified>2015-12-12</modified>
</dates>
</vuln>
<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
<topic>Salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
<p>CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log</p>
<p>Updated the Git state and execution modules to no longer display HTTPS basic
authentication credentials in loglevel debug output on the Salt master. These
credentials are now replaced with REDACTED in the debug output. Thanks to
Andreas Stieger for bringing this to our attention.</p>
<p>CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
log</p>
<p>Updated the win_useradd module return data to no longer include the password
of the newly created user. The password is now replaced with the string
XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
win_password and sudo_password authentication credentials. Also updated the
Linode driver to no longer display authentication credentials in debug logs.
These credentials are now replaced with REDACTED in the debug output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
<cvename>CVE-2015-6918</cvename>
<cvename>CVE-2015-6941</cvename>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-17</entry>
</dates>
</vuln>
<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
<topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firefox Developers report:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
<p>Security researcher Abdulrahman Alqabandi reported that the fetch()
API did not correctly implement the Cross-Origin Resource Sharing
(CORS) specification, allowing a malicious page to access private
data from other origins. Mozilla developer Ben Kelly independently reported the
same issue.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
<cvename>CVE-2015-7184</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.540</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
<p>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2015-7645, CVE-2015-7647,
CVE-2015-7648).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7645</cvename>
<cvename>CVE-2015-7647</cvename>
<cvename>CVE-2015-7648</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
<topic>LibreSSL -- Memory leak and buffer overflow</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualys reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
<p>During the code review of OpenSMTPD a memory leak and buffer overflow
(an off-by-one, usually stack-based) were discovered in LibreSSL's
OBJ_obj2txt() function. This function is called automatically during
a TLS handshake (both client-side, unless an anonymous mode is used,
and server-side, if client authentication is requested).</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.info/?l=openbsd-announce&m=144495690528446</url>
<cvename>CVE-2015-5333</cvename>
<cvename>CVE-2015-5334</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
<modified>2015-10-26</modified>
</dates>
</vuln>
<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
<topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
<p>When the client creates its ClientHello message, due to
insufficient bounds checking it can overflow the heap-based buffer
containing the message while writing some extensions. Two extensions in
particular could be used by a remote attacker to trigger the overflow:
the session ticket extension and the server name indication (SNI)
extension.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
<cvename>CVE-2015-5291</cvename>
</references>
<dates>
<discovery>2015-10-05</discovery>
<entry>2015-10-15</entry>
</dates>
</vuln>
<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
<topic>magento -- multiple vulnerabilities</topic>
<affects>
<package>
<name>magento</name>
<range><lt>1.9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Magento, Inc. reports:</p>
<blockquote cite="https://www.magentocommerce.com/download">
<p>SUPEE-6482 - This patch addresses two issues related to APIs and
two cross-site scripting risks.</p>
<p>SUPEE-6285 - This patch provides protection against several types
of security-related issues, including information leaks, request
forgeries, and cross-site scripting.</p>
<p>SUPEE-5994 - This patch addresses multiple security
vulnerabilities in Magento Community Edition software, including
issues that can put customer information at risk.</p>
<p>SUPEE-5344 - Addresses a potential remote code execution
exploit.</p>
<p>SUPEE-1533 - Addresses two potential remote code execution
exploits.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/201709</freebsdpr>
<url>https://www.magentocommerce.com/download</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
</references>
<dates>
<discovery>2014-10-03</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
<topic>pear-twig -- remote code execution</topic>
<affects>
<package>
<name>pear-twig-twig</name>
<range><lt>1.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabien Potencier reports:</p>
<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
<p>End users can craft valid Twig code that allows them to
execute arbitrary code (RCEs) via the _self variable, which is always
available, even in sandboxed templates.</p>
</blockquote>
</body>
</description>
<references>
<url>http://symfony.com/blog/security-release-twig-1-20-0</url>
<cvename>CVE-2015-7809</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
<topic>miniupnpc -- buffer overflow</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
<range><lt>1.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
<p>An exploitable buffer overflow vulnerability exists in the
XML parser functionality of the MiniUPnP library. A specially crafted
XML response can lead to a buffer overflow on the stack resulting in
remote code execution. An attacker can set up a server on the local
network to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6031</cvename>
<url>http://talosintel.com/reports/TALOS-2015-0035/</url>
<url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-14</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.535</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
<p>These updates resolve a vulnerability that could be exploited
to bypass the same-origin-policy and lead to information
disclosure (CVE-2015-7628).</p>
<p>These updates include a defense-in-depth feature in the Flash
broker API (CVE-2015-5569).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7629, CVE-2015-7631,
CVE-2015-7643, CVE-2015-7644).</p>
<p>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-7632).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-7625, CVE-2015-7626,
CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5569</cvename>
<cvename>CVE-2015-7625</cvename>
<cvename>CVE-2015-7626</cvename>
<cvename>CVE-2015-7627</cvename>
<cvename>CVE-2015-7628</cvename>
<cvename>CVE-2015-7629</cvename>
<cvename>CVE-2015-7630</cvename>
<cvename>CVE-2015-7631</cvename>
<cvename>CVE-2015-7632</cvename>
<cvename>CVE-2015-7633</cvename>
<cvename>CVE-2015-7634</cvename>
<cvename>CVE-2015-7643</cvename>
<cvename>CVE-2015-7644</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
<p>24 security fixes in this release, including:</p>
<ul>
<li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
to anonymous.</li>
<li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
Credit to Collin Payne.</li>
<li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
Kettunen of OUSPG.</li>
<li>[514076] Medium CVE-2015-6759: Information leakage in
LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
<li>[519642] Medium CVE-2015-6760: Improper error handling in
libANGLE. Credit to lastland.net.</li>
<li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
<li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
to Muneaki Nishimura (nishimunea).</li>
<li> [542517] CVE-2015-6763: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
branch (currently 4.6.85.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6755</cvename>
<cvename>CVE-2015-6756</cvename>
<cvename>CVE-2015-6757</cvename>
<cvename>CVE-2015-6758</cvename>
<cvename>CVE-2015-6759</cvename>
<cvename>CVE-2015-6760</cvename>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-6762</cvename>
<cvename>CVE-2015-6763</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-13</entry>
</dates>
</vuln>
<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
<topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
<affects>
<package>
<name>p5-UI-Dialog</name>
<range><lt>1.09_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthijs Kooijman reports:</p>
<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
<p>It seems that the whiptail, cdialog and kdialog backends apply
some improper escaping in their shell commands, causing special
characters present in menu item titles to be interpreted by the
shell. This includes the backtick evaluation operator, so this
constitutes a security issue, allowing execution of arbitrary
commands if an attacker has control over the text displayed in
a menu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-7315</cvename>
<freebsdpr>ports/203667</freebsdpr>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
<url>https://bugs.debian.org/496448</url>
<url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
</references>
<dates>
<discovery>2008-08-24</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
<topic>devel/ipython -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Bussonnier reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
<p>Summary: Local folder name was used in HTML templates without
escaping, allowing XSS in said pages by carefully crafting folder
name and URL to access it.</p>
<p>URI with issues:</p>
<ul>
<li>GET /tree/**</li>
</ul>
</blockquote>
<p>Benjamin RK reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
<p>Vulnerability: A maliciously forged file opened for editing can
execute javascript, specifically by being redirected to /files/ due
to a failure to treat the file as plain text.</p>
<p>URI with issues:</p>
<ul>
<li>GET /edit/**</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203668</freebsdpr>
<cvename>CVE-2015-6938</cvename>
<cvename>CVE-2015-7337</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
<url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
<url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1615/">
<p>
Two security issues have been fixed in this release which affect
users of specific PostgreSQL features.
</p>
<ul>
<li>CVE-2015-5289 json or jsonb input values constructed from
arbitrary user input can crash the PostgreSQL server and cause a denial of
service.
</li>
<li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
extension could be exploited to read a few additional bytes of memory.
No working exploit for this issue has been developed.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5289</cvename>
<cvename>CVE-2015-5288</cvename>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-08</entry>
</dates>
</vuln>
<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
<topic>ZendFramework1 -- SQL injection vulnerability</topic>
<affects>
<package>
<name>ZendFramework1</name>
<range><lt>1.12.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zend Framework developers report:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
<p>The PDO adapters of Zend Framework 1 do not filter null bytes values
in SQL statements. A PDO adapter can treat null bytes in a query as a
string terminator, allowing an attacker to add arbitrary SQL
following a null byte, and thus create a SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7695</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
<url>http://framework.zend.com/security/advisory/ZF2015-08</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-06</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
<p>fix an mda buffer truncation bug which allows a user to create
forward files that pass session checks but fail delivery later down
the chain, within the user mda</p>
<p>fix remote buffer overflow in unprivileged pony process</p>
<p>reworked offline enqueue to better protect against hardlink
attacks</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
<url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
<p>Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
for PKCS#1 v1.5 signatures. These releases include countermeasures
against that attack.</p>
<p>Fabian Foerg of Gotham Digital Science found a possible client-side
NULL pointer dereference, using the AFL Fuzzer. This dereference can
only occur when misusing the API, although a fix has still been
implemented.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
<p>In order to strengthen the minimum requirements for connections and
to protect against the Logjam attack, the minimum size of
Diffie-Hellman parameters accepted by the client has been increased
to 1024 bits.</p>
<p>In addition the default size for the Diffie-Hellman parameters on
the server are increased to 2048 bits. This can be changed with
ssl_set_dh_params() in case this is necessary.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
<topic>gdk-pixbuf2 -- head overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.32.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of tga file.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
<p>We found a heap overflow in the gdk-pixbuf implementation
triggered by the scaling of gif file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7673</cvename>
<cvename>CVE-2015-7674</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
<topic>plone -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plone</name>
<range><lt>4.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
<p>Versions Affected: All current Plone versions.</p>
<p>Versions Not Affected: None.</p>
<p>Nature of vulnerability: Allows creation of members by anonymous
users on sites that have self-registration enabled, allowing bypass
of CAPTCHA and similar protections against scripted attacks.</p>
<p>The patch can be added to buildouts as Products.PloneHotfix20150910
(available from PyPI) or downloaded from Plone.org.</p>
<p>Immediate Measures You Should Take: Disable self-registration until
you have applied the patch.</p>
</blockquote>
<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
<p>Plone's URL checking infrastructure includes a method for checking
if URLs valid and located in the Plone site. By passing HTML into
this specially crafted url, XSS can be achieved.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203255</freebsdpr>
<url>https://plone.org/products/plone-hotfix/releases/20150910</url>
<url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
<url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
<url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-phar</name>
<range><le>5.4.45</le></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.30</lt></range>
</package>
<package>
<name>php56-phar</name>
<range><lt>5.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
<p>Phar:</p>
<ul>
<li>Fixed bug #69720 (Null pointer dereference in
phar_get_fp_offset()).</li>
<li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
when zip entry filename is "/").</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203541</freebsdpr>
<cvename>CVE-2015-7803</cvename>
<cvename>CVE-2015-7804</cvename>
<url>http://php.net/ChangeLog-5.php#5.5.30</url>
<url>http://php.net/ChangeLog-5.php#5.6.14</url>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
<p>an oversight in the portable version of fgetln() that allows
attackers to read and write out-of-bounds memory</p>
<p>multiple denial-of-service vulnerabilities that allow local users
to kill or hang OpenSMTPD</p>
<p>a stack-based buffer overflow that allows local users to crash
OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
user</p>
<p>a hardlink attack (or race-conditioned symlink attack) that allows
local users to unset the chflags() of arbitrary files</p>
<p>a hardlink attack that allows local users to read the first line of
arbitrary files (for example, root's hash from /etc/master.passwd)
</p>
<p>a denial-of-service vulnerability that allows remote attackers to
fill OpenSMTPD's queue or mailbox hard-disk partition</p>
<p>an out-of-bounds memory read that allows remote attackers to crash
OpenSMTPD, or leak information and defeat the ASLR protection</p>
<p>a use-after-free vulnerability that allows remote attackers to
crash OpenSMTPD, or execute arbitrary code as the non-chrooted
_smtpd user</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
<cvename>CVE-2015-7687</cvename>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-06</modified>
</dates>
</vuln>
<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
<topic>james -- multiple vulnerabilities</topic>
<affects>
<package>
<name>james</name>
<range><lt>2.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache James Project reports:</p>
<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
<p>This release has many enhancements and bug fixes over the previous
release. See the Release Notes for a detailed list of changes. Some
of the earlier defects could turn a James mail server into an Open
Relay and allow files to be written on disk. All users of James
Server are urged to upgrade to version v2.3.2.1 as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203461</freebsdpr>
<certvu>988628</certvu>
<cvename>CVE-2015-7611</cvename>
<url>http://james.apache.org/download.cgi#Apache_James_Server</url>
<url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
</references>
<dates>
<discovery>2015-09-30</discovery>
<entry>2015-10-01</entry>
<modified>2015-10-04</modified>
</dates>
</vuln>
<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
<topic>otrs -- Scheduler Process ID File Access</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
<p>An attacker with valid LOCAL credentials could access and
manipulate the process ID file for bin/otrs.schduler.pl from the
CLI.</p>
<p>The Proc::Daemon module 0.14 for Perl uses world-writable
permissions for a file that stores a process ID, which allows local
users to have an unspecified impact by modifying this file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
<cvename>CVE-2015-6842</cvename>
<cvename>CVE-2013-7135</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2015-09-30</entry>
</dates>
</vuln>
<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.521</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2015-5573).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).</p>
<p>These updates resolve buffer overflow vulnerabilities that could
lead to code execution (CVE-2015-6676, CVE-2015-6678).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5575, CVE-2015-5577,
CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
CVE-2015-6677).</p>
<p>These updates include additional validation checks to ensure
that Flash Player rejects malicious content from vulnerable
JSONP callback APIs (CVE-2015-5571).</p>
<p>These updates resolve a memory leak vulnerability
(CVE-2015-5576).</p>
<p>These updates include further hardening to a mitigation to
defend against vector length corruptions (CVE-2015-5568).</p>
<p>These updates resolve stack corruption vulnerabilities that
could lead to code execution (CVE-2015-5567, CVE-2015-5579).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2015-5587).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-5572).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-6679).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5567</cvename>
<cvename>CVE-2015-5568</cvename>
<cvename>CVE-2015-5570</cvename>
<cvename>CVE-2015-5571</cvename>
<cvename>CVE-2015-5572</cvename>
<cvename>CVE-2015-5573</cvename>
<cvename>CVE-2015-5574</cvename>
<cvename>CVE-2015-5575</cvename>
<cvename>CVE-2015-5576</cvename>
<cvename>CVE-2015-5577</cvename>
<cvename>CVE-2015-5578</cvename>
<cvename>CVE-2015-5588</cvename>
<cvename>CVE-2015-6676</cvename>
<cvename>CVE-2015-6677</cvename>
<cvename>CVE-2015-6678</cvename>
<cvename>CVE-2015-6679</cvename>
<cvename>CVE-2015-6682</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Fixed an SQL injection vulnerability in Active Record
method offset().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- mysql database driver vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Removed a fallback to mysql_escape_string() in the mysql
database driver (escape_str() method) when there's no active database
connection.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-07-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Added HTTP "Host" header character validation to prevent
cache poisoning attacks when base_url auto-detection is used.</p>
<p>Security: Added FSCommand and seekSegmentTime to the "evil
attributes" list in CI_Security::xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: The xor_encode() method in the Encrypt Class has been
removed. The Encrypt Class now requires the Mcrypt extension to be
installed.</p>
<p>Security: The Session Library now uses HMAC authentication instead
of a simple MD5 checksum.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>An improvement was made to the MySQL and MySQLi drivers to prevent
exposing a potential vector for SQL injection on sites using
multi-byte character sets in the database client connection.</p>
<p>An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7
with mysql_set_charset() creates a situation where using multi-byte
character sets on these environments may potentially expose a SQL
injection attack vector. Latin-1, UTF-8, and other "low ASCII"
character sets are unaffected on all environments.</p>
<p>If you are running or considering running a multi-byte character
set for your database connection, please pay close attention to the
server environment you are deploying on to ensure you are not
vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/156486</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2011-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>45.0.2454.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
<p>Two vulnerabilities were fixed in this release:</p>
<ul>
<li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
to Mariusz Mlynski.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1303</cvename>
<cvename>CVE-2015-1304</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2015-09-27</entry>
</dates>
</vuln>
<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
<topic>libssh2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.5.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mariusz Ziulek reports:</p>
<blockquote cite="http://www.libssh2.org/adv_20150311.html">
<p>A malicious attacker could man in the middle a real server
and cause libssh2 using clients to crash (denial of service) or
otherwise read and use completely unintended memory areas in this
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libssh2.org/adv_20150311.html</url>
<url>https://trac.libssh2.org/ticket/294</url>
<cvename>CVE-2015-1782</cvename>
</references>
<dates>
<discovery>2015-01-25</discovery>
<entry>2015-09-22</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.3.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
/ rv:38.3)</p>
<p>MFSA 2015-97 Memory leak in mozTCPSocket to servers</p>
<p>MFSA 2015-98 Out of bounds read in QCMS library with ICC
V4 profile attributes</p>
<p>MFSA 2015-99 Site attribute spoofing on Android by
pasting URL with unknown scheme</p>
<p>MFSA 2015-100 Arbitrary file manipulation by local user
through Mozilla updater</p>
<p>MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
format video</p>
<p>MFSA 2015-102 Crash when using debugger with SavedStacks
in JavaScript</p>
<p>MFSA 2015-103 URL spoofing in reader mode</p>
<p>MFSA 2015-104 Use-after-free with shared workers and
IndexedDB</p>
<p>MFSA 2015-105 Buffer overflow while decoding WebM
video</p>
<p>MFSA 2015-106 Use-after-free while manipulating HTML
media content</p>
<p>MFSA 2015-107 Out-of-bounds read during 2D canvas display
on Linux 16-bit color depth systems</p>
<p>MFSA 2015-108 Scripted proxies can access inner
window</p>
<p>MFSA 2015-109 JavaScript immutable property enforcement
can be bypassed</p>
<p>MFSA 2015-110 Dragging and dropping images exposes final
URL after redirects</p>
<p>MFSA 2015-111 Errors in the handling of CORS preflight
request headers</p>
<p>MFSA 2015-112 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-113 Memory safety errors in libGLES in the
ANGLE graphics library</p>
<p>MFSA 2015-114 Information disclosure via the High
Resolution Time API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4476</cvename>
<cvename>CVE-2015-4500</cvename>
<cvename>CVE-2015-4501</cvename>
<cvename>CVE-2015-4502</cvename>
<cvename>CVE-2015-4503</cvename>
<cvename>CVE-2015-4504</cvename>
<cvename>CVE-2015-4505</cvename>
<cvename>CVE-2015-4506</cvename>
<cvename>CVE-2015-4507</cvename>
<cvename>CVE-2015-4508</cvename>
<cvename>CVE-2015-4509</cvename>
<cvename>CVE-2015-4510</cvename>
<cvename>CVE-2015-4512</cvename>
<cvename>CVE-2015-4516</cvename>
<cvename>CVE-2015-4517</cvename>
<cvename>CVE-2015-4519</cvename>
<cvename>CVE-2015-4520</cvename>
<cvename>CVE-2015-4521</cvename>
<cvename>CVE-2015-4522</cvename>
<cvename>CVE-2015-7174</cvename>
<cvename>CVE-2015-7175</cvename>
<cvename>CVE-2015-7176</cvename>
<cvename>CVE-2015-7177</cvename>
<cvename>CVE-2015-7178</cvename>
<cvename>CVE-2015-7179</cvename>
<cvename>CVE-2015-7180</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-09-22</entry>
</dates>
</vuln>
<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.90</lt></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><lt>2.7.2,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.8</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.11</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150403 has ffmpeg-2.7.0+ (snapshot, c299fbb) -->
<range><lt>1.1.r20150822</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
(aka image header) chunk in a PNG image, which allows remote
attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via a
crafted image with two or more of these chunks.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
<p>Multiple integer underflows in the ff_mjpeg_decode_frame
function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
allow remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted MJPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
<p>The ff_sbr_apply function in libavcodec/aacsbr.c in
FFmpeg before 2.7.2 does not check for a matching AAC frame
syntax element before proceeding with Spectral Band
Replication calculations, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted AAC
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
<p>The ff_mpv_common_init function in libavcodec/mpegvideo.c
in FFmpeg before 2.7.2 does not properly maintain the
encoding context, which allows remote attackers to cause a
denial of service (invalid pointer access) or possibly have
unspecified other impact via crafted MPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
<p>The destroy_buffers function in libavcodec/sanm.c in
FFmpeg before 2.7.2 does not properly maintain height and
width values in the video context, which allows remote
attackers to cause a denial of service (segmentation
violation and application crash) or possibly have
unspecified other impact via crafted LucasArts Smush video
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
<p>The allocate_buffers function in libavcodec/alac.c in
FFmpeg before 2.7.2 does not initialize certain context
data, which allows remote attackers to cause a denial of
service (segmentation violation) or possibly have
unspecified other impact via crafted Apple Lossless Audio
Codec (ALAC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
<p>The sws_init_context function in libswscale/utils.c in
FFmpeg before 2.7.2 does not initialize certain pixbuf data
structures, which allows remote attackers to cause a denial
of service (segmentation violation) or possibly have
unspecified other impact via crafted video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
<p>The ff_frame_thread_init function in
libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
certain memory-allocation failures, which allows remote
attackers to cause a denial of service (invalid pointer
access) or possibly have unspecified other impact via a
crafted file, as demonstrated by an AVI file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
<p>The ff_rv34_decode_init_thread_copy function in
libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
certain structure members, which allows remote attackers to
cause a denial of service (invalid pointer access) or
possibly have unspecified other impact via crafted (1) RV30
or (2) RV40 RealVideo data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6818</cvename>
<cvename>CVE-2015-6819</cvename>
<cvename>CVE-2015-6820</cvename>
<cvename>CVE-2015-6821</cvename>
<cvename>CVE-2015-6822</cvename>
<cvename>CVE-2015-6823</cvename>
<cvename>CVE-2015-6824</cvename>
<cvename>CVE-2015-6825</cvename>
<cvename>CVE-2015-6826</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-09-05</discovery>
<entry>2015-09-20</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.8</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
<p>MSA-15-0030: Students can re-attempt answering questions in the
lesson (CVE-2015-5264)</p>
<p>MSA-15-0031: Teacher in forum can still post to "all participants"
and groups they are not members of (CVE-2015-5272 - 2.7.10 only)</p>
<p>MSA-15-0032: Users can delete files uploaded by other users in wiki
(CVE-2015-5265)</p>
<p>MSA-15-0033: Meta course synchronization enrolls suspended students
as managers for a short period of time (CVE-2015-5266)</p>
<p>MSA-15-0034: Vulnerability in password recovery mechanism
(CVE-2015-5267)</p>
<p>MSA-15-0035: Rating component does not check separate groups
(CVE-2015-5268)</p>
<p>MSA-15-0036: XSS in grouping description (CVE-2015-5269)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5264</cvename>
<cvename>CVE-2015-5272</cvename>
<cvename>CVE-2015-5265</cvename>
<cvename>CVE-2015-5266</cvename>
<cvename>CVE-2015-5267</cvename>
<cvename>CVE-2015-5268</cvename>
<cvename>CVE-2015-5269</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
<url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-18</entry>
<modified>2015-09-24</modified>
</dates>
</vuln>
<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
<topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Amos Jeffries, release manager of the Squid-3 series, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
<p>Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
built with OpenSSL and configured for "SSL-Bump" decryption.</p>
<p>Integer overflows can lead to invalid pointer math reading from
random memory on some CPU architectures. In the best case this leads
to wrong TLS extensions being used for the client, worst-case a
crash of the proxy terminating all active transactions.</p>
<p>Incorrect message size checks and assumptions about the existence
of TLS extensions in the SSL/TLS handshake message can lead to very
high CPU consumption (up to and including 'infinite loop'
behaviour).</p>
<p>The above can be triggered remotely. Though there is one layer of
authorization applied before this processing to check that the
client is allowed to use the proxy, that check is generally weak. MS
Skype on Windows XP is known to trigger some of these.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<freebsdpr>ports/203186</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-09-18</entry>
<modified>2016-02-18</modified>
</dates>
</vuln>
<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
<topic>remind -- buffer overflow with malicious reminder file input</topic>
<affects>
<package>
<name>remind</name>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dianne Skoll reports:</p>
<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
<p>BUG FIX: Fix a buffer overflow found by Alexander Keller.</p>
</blockquote>
<p>The bug can be manifested by an extended DUMP command using a system
variable (that is a special variable whose name begins with '$')</p>
</body>
</description>
<references>
<cvename>CVE-2015-5957</cvename>
<freebsdpr>ports/202942</freebsdpr>
<url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-09-18</entry>
</dates>
</vuln>
<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
<topic>shutter -- arbitrary code execution</topic>
<affects>
<package>
<name>shutter</name>
<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
<p>In the "Shutter" screenshot application, I discovered that using the
"Show in folder" menu option while viewing a file with a
specially-crafted path allows for arbitrary code execution with the
permissions of the user running Shutter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/541</url>
<url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
<cvename>CVE-2015-0854</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
<topic>openjpeg -- use-after-free vulnerability</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
<p>Use-after-free was found in openjpeg. The vuln is fixed in
version 2.1.1 and was located in opj_j2k_write_mco function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/550</url>
<url>https://github.com/uclouvain/openjpeg/issues/563</url>
</references>
<dates>
<discovery>2015-08-14</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><le>0.6.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
<p>We found a use-after-free causing an invalid/double free in
optipng 0.6.4.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/556</url>
<cvename>CVE-2015-7801</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
<topic>openslp -- denial of service vulnerability</topic>
<affects>
<package>
<name>openslp</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
<p>The function ParseExtension() in openslp 1.2.1 contains
vulnerability: an attacker can cause a denial of service
(infinite loop) via a packet with crafted "nextoffset"
value and "extid" value.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/559</url>
<cvename>CVE-2015-5155</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
<topic>p7zip -- directory traversal vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>9.38.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Cherepanov reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
<p>7z (and 7zr) is susceptible to a directory traversal vulnerability.
While extracting an archive, it will extract symlinks and then follow
them if they are referenced in further entries. This can be exploited by
a rogue archive to write files outside the current directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
<url>http://sourceforge.net/p/p7zip/bugs/147/</url>
<cvename>CVE-2015-1038</cvename>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo reports:</p>
<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
<p>H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
normalization logic.</p>
<p>When file.dir directive is used, this flaw
allows a remote attacker to retrieve arbitrary files that exist
outside the directory specified by the directive.</p>
<p>H2O version 1.4.5 and version 1.5.0-beta2 have been released
to address this vulnerability.</p>
<p>Users are advised to upgrade their servers immediately.</p>
<p>The vulnerability was reported by: Yusuke OSUMI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5638</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
<p>WordPress 4.3.1 is now available. This is a security
release for all previous versions and we strongly
encourage you to update your sites immediately.</p>
<ul>
<li>WordPress versions 4.3 and earlier are vulnerable
to a cross-site scripting vulnerability when processing
shortcode tags (CVE-2015-5714). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
<li>A separate cross-site scripting vulnerability was found
in the user list table. Reported by Ben Bidner of the
WordPress security team.</li>
<li>Finally, in certain cases, users without proper
permissions could publish private posts and make
them sticky (CVE-2015-5715). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5714</cvename>
<cvename>CVE-2015-5715</cvename>
<cvename>CVE-2015-7989</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
<url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-09-15</entry>
<modified>2015-10-29</modified>
</dates>
</vuln>
<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
<p>Login names (usually an email address) longer than 127
characters are silently truncated in MySQL which could
cause the domain name of the email address to be
corrupted. An attacker could use this vulnerability to
create an account with an email address different from the
one originally requested. The login name could then be
automatically added to groups based on the group's regular
expression setting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4499</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-09-14</entry>
</dates>
</vuln>
<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
<topic>openldap -- denial of service vulnerability</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.42_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
<p>By sending a crafted packet, an attacker may cause the
OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
<url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
<cvename>CVE-2015-6908</cvename>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2015-09-12</entry>
<modified>2015-09-13</modified>
</dates>
</vuln>
<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
<topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.4.0_10,3</lt></range>
</package>
<package>
<name>opus-tools</name>
<range><lt>0.1.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>I discovered an integer overflow issue in oggenc,
related to the number of channels in the input WAV file.
The issue triggers an out-of-bounds memory access which
causes oggenc to crash.</p>
</blockquote>
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>A crafted WAV file with number of channels set to 0
will cause oggenc to crash due to a division by zero
issue.</p>
</blockquote>
<p>pengsu reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2212">
<p>I discovered an buffer overflow issue in oggenc/audio.c
when it tries to open invalid aiff file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202941</freebsdpr>
<url>https://trac.xiph.org/ticket/2136</url>
<cvename>CVE-2014-9639</cvename>
<url>https://trac.xiph.org/ticket/2137</url>
<cvename>CVE-2014-9638</cvename>
<url>https://trac.xiph.org/ticket/2212</url>
<cvename>CVE-2015-6749</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-09-09</entry>
<modified>2015-09-09</modified>
</dates>
</vuln>
<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
<topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><eq>1.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
<p>New auth_user functionality introduced in 1.6 allows login as
auth_user when client presents unknown username. It's quite likely
auth_user is superuser. Affects only setups that have enabled
auth_user in their config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6817</cvename>
<url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
<url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-09</entry>
</dates>
</vuln>
<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
<topic>phpMyAdmin -- reCaptcha bypass</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
<p>This vulnerability allows to complete the reCaptcha test
and subsequently perform a brute force attack to guess user
credentials without having to complete further reCaptcha
tests.</p>
<p>We consider this vulnerability to be non critical since
reCaptcha is an additional opt-in security measure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
<cvename>CVE-2015-6830</cvename>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-soap</name>
<name>php5-xsl</name>
<range><lt>5.4.45</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-soap</name>
<name>php55-xsl</name>
<range><lt>5.5.29</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-soap</name>
<name>php56-xsl</name>
<range><lt>5.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
<ul><li>Core:
<ul>
<li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
<li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
</ul></li>
<li>EXIF:
<ul>
<li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
</ul></li>
<li>hash:
<ul>
<li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
<li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
</ul></li>
<li>XSLT:
<ul>
<li>Fixed bug #69782 (NULL pointer dereference).</li>
</ul></li>
<li>ZIP:
<ul>
<li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.45</url>
<url>http://php.net/ChangeLog-5.php#5.5.29</url>
<url>http://php.net/ChangeLog-5.php#5.6.13</url>
<cvename>CVE-2015-6834</cvename>
<cvename>CVE-2015-6835</cvename>
<cvename>CVE-2015-6836</cvename>
<cvename>CVE-2015-6837</cvename>
<cvename>CVE-2015-6838</cvename>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
<topic>ganglia-webfrontend -- auth bypass</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ivan Novikov reports:</p>
<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
<p>It's easy to bypass auth by using boolean serialization...</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ganglia/ganglia-web/issues/267</url>
<cvename>CVE-2015-6816</cvename>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-21</p>
<p>Protocol tree crash. (Bug 11309)</p></li>
<li><p>wnpa-sec-2015-22</p>
<p>Memory manager crash. (Bug 11373)</p></li>
<li><p>wnpa-sec-2015-23</p>
<p>Dissector table crash. (Bug 11381)</p></li>
<li><p>wnpa-sec-2015-24</p>
<p>ZigBee crash. (Bug 11389)</p></li>
<li><p>wnpa-sec-2015-25</p>
<p>GSM RLC/MAC infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-26</p>
<p>WaveAgent crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-27</p>
<p>OpenFlow infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-28</p>
<p>Ptvcursor crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-29</p>
<p>WCCP crash. (Bug 11358)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
<cvename>CVE-2015-6241</cvename>
<cvename>CVE-2015-6242</cvename>
<cvename>CVE-2015-6243</cvename>
<cvename>CVE-2015-6244</cvename>
<cvename>CVE-2015-6245</cvename>
<cvename>CVE-2015-6246</cvename>
<cvename>CVE-2015-6247</cvename>
<cvename>CVE-2015-6248</cvename>
<cvename>CVE-2015-6249</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
<topic>screen -- stack overflow</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.3.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kuang-che Wu reports:</p>
<blockquote cite="https://savannah.gnu.org/bugs/?45713">
<p>screen will recursively call MScrollV to depth n/256. This
is time consuming and will overflow stack if n is huge.</p>
</blockquote>
</body>
</description>
<references>
<url>https://savannah.gnu.org/bugs/?45713</url>
<cvename>CVE-2015-6806</cvename>
</references>
<dates>
<discovery>2015-08-07</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
<topic>libvncserver -- memory corruption</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Pisar reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
<p>libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
<url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
<topic>gdk-pixbuf2 -- integer overflows</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Clasen reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
<p>Fix several integer overflows.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-04</entry>
</dates>
</vuln>
<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
<p>An incorrect boundary check in openpgpkey_61.c can cause
named to terminate due to a REQUIRE assertion failure. This defect can
be deliberately exploited by an attacker who can provide a maliciously
constructed response in answer to a query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
<cvename>CVE-2015-5986</cvename>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
</dates>
</vuln>
<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
<p>Parsing a malformed DNSSEC key can cause a validating
resolver to exit due to a failed assertion in buffer.c. It is possible
for a remote attacker to deliberately trigger this condition, for
example by using a query which requires a response from a zone
containing a deliberately malformed key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
<cvename>CVE-2015-5722</cvename>
<freebsdsa>SA-15:23.bind</freebsdsa>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-npapi</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-pulse</name>
<range><lt>45.0.2454.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[522791] High CVE-2015-1292: Cross-origin bypass in
ServiceWorker. Credit to Mariusz Mlynski.</li>
<li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
to cloudfuzzer.</li>
<li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
to anonymous.</li>
<li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
Credit to zcorpan.</li>
<li>[510802] Medium CVE-2015-1297: Permission scoping error in
Webrequest. Credit to Alexander Kashev.</li>
<li>[518827] Medium CVE-2015-1298: URL validation error in
extensions. Credit to Rob Wu.</li>
<li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
to taro.suzuki.dev.</li>
<li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
to cgvwzq.</li>
<li>[526825] CVE-2015-1301: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1291</cvename>
<cvename>CVE-2015-1292</cvename>
<cvename>CVE-2015-1293</cvename>
<cvename>CVE-2015-1294</cvename>
<cvename>CVE-2015-1295</cvename>
<cvename>CVE-2015-1296</cvename>
<cvename>CVE-2015-1297</cvename>
<cvename>CVE-2015-1298</cvename>
<cvename>CVE-2015-1299</cvename>
<cvename>CVE-2015-1300</cvename>
<cvename>CVE-2015-1301</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
<topic>powerdns -- denial of service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
<p>A bug was found in our DNS packet parsing/generation code,
which, when exploited, can cause individual threads (disabling service)
or whole processes (allowing a supervisor to restart them) to crash with
just one or a few query packets.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
<cvename>CVE-2015-5230</cvename>
</references>
<dates>
<discovery>2015-09-02</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
<topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
<affects>
<package>
<name>ghostscript7</name>
<name>ghostscript7-nox11</name>
<name>ghostscript7-base</name>
<name>ghostscript7-x11</name>
<range><lt>7.07_32</lt></range>
</package>
<package>
<name>ghostscript8</name>
<name>ghostscript8-nox11</name>
<name>ghostscript8-base</name>
<name>ghostscript8-x11</name>
<range><lt>8.71_19</lt></range>
</package>
<package>
<name>ghostscript9</name>
<name>ghostscript9-nox11</name>
<name>ghostscript9-base</name>
<name>ghostscript9-x11</name>
<range><lt>9.06_11</lt></range>
</package>
<package>
<name>ghostscript9-agpl</name>
<name>ghostscript9-agpl-nox11</name>
<range><lt>9.15_2</lt></range>
</package>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
<p>Integer overflow in the gs_heap_alloc_bytes function in
base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted
Postscript (ps) file, as demonstrated by using the ps2pdf command,
which triggers an out-of-bounds read or write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3228</cvename>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
<url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-09-01</entry>
<modified>2015-09-02</modified>
</dates>
</vuln>
<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
<topic>ffmpeg -- out-of-bounds array access</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.2</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.6</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.8</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg1</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20141223 has ffmpeg-2.5.1+ (snapshot, 03b84f2) -->
<range><lt>1.1.r20150403</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
<p>The msrle_decode_pal4 function in msrledec.c in Libav
before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
and 2.6.x before 2.6.2 allows remote attackers to have
unspecified impact via a crafted image, related to a pixel
pointer, which triggers an out-of-bounds array access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3395</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
<url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
<topic>ffmpeg -- use-after-free</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.0</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<range><lt>2.3.6</lt></range>
</package>
<package>
<name>ffmpeg1</name>
<range><lt>1.2.11</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
<p>Use-after-free vulnerability in the ff_h264_free_tables
function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
remote attackers to cause a denial of service or possibly
have unspecified other impact via crafted H.264 data in an
MP4 file, as demonstrated by an HTML VIDEO element that
references H.264 data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3417</cvename>
<!-- ffmpeg and libav fixes are different -->
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
<topic>graphviz -- format string vulnerability</topic>
<affects>
<package>
<name>graphviz</name>
<range><lt>2.38.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joshua Rogers reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
<p>A format string vulnerability has been found in `graphviz'.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q4/784</url>
<url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2015-08-29</entry>
</dates>
</vuln>
<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-95 Add-on notification bypass through data URLs</p>
<p>MFSA 2015-94 Use-after-free when resizing canvas element
during restyling</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4497</cvename>
<cvename>CVE-2015-4498</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
</references>
<dates>
<discovery>2015-08-27</discovery>
<entry>2015-08-28</entry>
</dates>
</vuln>
<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.4.3,1</lt></range>
</package>
<package>
<name>go14</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel, Go Product Manager, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
<p>CVE-2015-5739 - "Content Length" treated as valid header</p>
<p>CVE-2015-5740 - Double content-length headers does not return 400
error</p>
<p>CVE-2015-5741 - Additional hardening, not sending Content-Length
w/Transfer-Encoding, Closing connections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5739</cvename>
<cvename>CVE-2015-5740</cvename>
<cvename>CVE-2015-5741</cvename>
<url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
<url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
<url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
<url>http://seclists.org/oss-sec/2015/q3/237</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-25</entry>
</dates>
</vuln>
<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
<topic>libtremor -- memory corruption</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20120120</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
<p>Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative the possibility of memory
corruption during the decoding of Ogg Vorbis files. This can
cause a crash during decoding and has the potential for
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0444</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
<topic>libtremor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20101013</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RedHat Project reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
<p>Will Drewry of the Google Security Team reported multiple
issues in OGG Vorbis and Tremor libraries, that could cause
application using those libraries to crash (NULL pointer
dereference or divide by zero), enter an infinite loop or
cause heap overflow caused by integer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1418</cvename>
<cvename>CVE-2008-1419</cvename>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2008-1423</cvename>
<cvename>CVE-2008-2009</cvename>
<url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
</references>
<dates>
<discovery>2008-03-19</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guanxing Wen reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
<p>PCRE library is prone to a vulnerability which leads to
Heap Overflow.
During the compilation of a malformed regular expression, more data is
written on the malloced block than the expected size output by
compile_regex().
The Heap Overflow vulnerability is caused by the following regular
expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/</p>
<p>A dry run of this particular regular expression with pcretest will
reports "double free or corruption (!prev)".
But it is actually a heap overflow problem.
The overflow only affects pcre 8.x branch, pcre2 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/295</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-24</entry>
</dates>
</vuln>
<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.37</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
<p>This security advisory fixes multiple vulnerabilities.
See below for a list.</p>
<h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
<p>A vulnerability was found that allows a malicious
user to perform a cross-site scripting attack by
invoking Drupal.ajax() on a whitelisted HTML element.</p>
<p>This vulnerability is mitigated on sites that do not
allow untrusted users to enter HTML.</p>
<h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
<p>A cross-site scripting vulnerability was found in
the autocomplete functionality of forms. The
requested URL is not sufficiently sanitized.</p>
<p>This vulnerability is mitigated by the fact that
the malicious user must be allowed to upload files.</p>
<h3>SQL Injection - Database API - Drupal 7</h3>
<p>A vulnerability was found in the SQL comment
filtering system which could allow a user with
elevated permissions to inject malicious code in
SQL comments.</p>
<p>This vulnerability is mitigated by the fact that
only one contributed module that the security team
found uses the comment filtering system in a way
that would trigger the vulnerability. That module
requires you to have a very high level of access
in order to perform the attack.</p>
<h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
<p>A vulnerability was discovered in Drupal's form API
that could allow file upload value callbacks to run
with untrusted input, due to form token validation
not being performed early enough. This vulnerability
could allow a malicious user to upload files to the
site under another user's account.</p>
<p>This vulnerability is mitigated by the fact that
the uploaded files would be temporary, and Drupal
normally deletes temporary files automatically
after 6 hours.</p>
<h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
<p>Users without the "access content" permission
can see the titles of nodes that they do not have
access to, if the nodes are added to a menu on the
site that the users have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2015-003</url>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-08-22</entry>
</dates>
</vuln>
<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PAM vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.0.p1,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_2</lt></range>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.0">
<p>OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
Local attackers may be able to write arbitrary messages to
logged-in users, including terminal escape sequences. Reported
by Nikolay Edigaryev.</p>
<p>Fixed a privilege separation
weakness related to PAM support. Attackers who could successfully
compromise the pre-authentication process for remote code
execution and who had valid credentials on the host could
impersonate other users.</p>
<p>Fixed a use-after-free bug
related to PAM support that was reachable by attackers who could
compromise the pre-authentication process for remote code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.0</url>
<cvename>CVE-2015-6563</cvename>
<cvename>CVE-2015-6564</cvename>
<cvename>CVE-2015-6565</cvename>
<freebsdsa>SA-15:22.openssh</freebsdsa>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><eq>7.0.p1,1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.1">
<p>OpenSSH 7.0 contained a logic error in PermitRootLogin=
prohibit-password/without-password that could, depending on
compile-time configuration, permit password authentication to
root while preventing other forms of authentication. This problem
was reported by Mantas Mikulenas.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.1</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
<topic>tarsnap -- buffer overflow and local DoS</topic>
<affects>
<package>
<name>tarsnap</name>
<range><lt>1.0.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
<p>1. SECURITY FIX: When constructing paths of objects being archived, a buffer
could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
paths. Theoretically this could be exploited by an unprivileged user whose
files are being archived; I do not believe it is exploitable in practice,
but I am offering a $1000 bounty for the first person who can prove me wrong:
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</p>
<p>2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
and control of the tarsnap service, could make tarsnap allocate a large
amount of memory upon listing archives or reading an archive the attacker
created; on 32-bit machines, tarsnap can be caused to crash under the
aforementioned conditions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
<url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
<topic>vlc -- arbitrary pointer dereference vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.1_5,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
<p>The stable VLC version suffers from an arbitrary pointer
dereference vulnerability.</p>
<p>The vulnerability affects the 3GP file format parser,
insufficient restrictions on a writable buffer can be
exploited to execute arbitrary code via the heap memory.
A specific 3GP file can be crafted to trigger the
vulnerability.</p>
<p>Credit: vulnerability reported by Loren Maggiore of
Trail of Bits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5949</cvename>
<url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
<url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-20</entry>
</dates>
</vuln>
<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
<topic>libpgf -- use-after-free</topic>
<affects>
<package>
<name>libpgf</name>
<range><le>6.14.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pengsu Cheng reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
<p>An use-after-free issue in Decoder.cpp was reported to
upstream. The problem is due to lack of validation of ColorTableSize.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/404</url>
<url>https://sourceforge.net/p/libpgf/code/147/</url>
<url>https://sourceforge.net/p/libpgf/code/148/</url>
<cvename>CVE-2015-6673</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-08-20</entry>
<modified>2015-08-26</modified>
</dates>
</vuln>
<vuln vid="f5b8b670-465c-11e5-a49d-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4491</cvename>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-08-19</entry>
</dates>
</vuln>
<vuln vid="b0e54dc1-45d2-11e5-adde-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.4</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.10</lt></range>
</package>
<package>
<name>py27-django14</name>
<name>py32-django14</name>
<name>py33-django14</name>
<name>py34-django14</name>
<range><lt>1.4.22</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/aug/18/security-releases/">
<p>Denial-of-service possibility in logout() view by filling
session store</p>
<p>Previously, a session could be created when anonymously
accessing the django.contrib.auth.views.logout view
(provided it wasn't decorated with django.contrib.auth.decorators.login_required
as done in the admin). This could allow an attacker to
easily create many new session records by sending repeated
requests, potentially filling up the session store or
causing other users' session records to be evicted.</p>
<p>The django.contrib.sessions.middleware.SessionMiddleware
has been modified to no longer create empty session records.</p>
<p>This portion of the fix has been assigned CVE-2015-5963.</p>
<p>Additionally, on the 1.4 and 1.7 series only, the
contrib.sessions.backends.base.SessionBase.flush() and
cache_db.SessionStore.flush() methods have been modified
to avoid creating a new empty session. Maintainers of
third-party session backends should check if the same
vulnerability is present in their backend and correct
it if so.</p>
<p>This portion of the fix has been assigned CVE-2015-5964.
Anyone reporting a similar vulnerability in a third-party
session backend should not use this CVE ID.</p>
<p>Thanks Lin Hua Cheng for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/aug/18/security-releases/</url>
<cvename>CVE-2015-5963</cvename>
<cvename>CVE-2015-5964</cvename>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="0ecc1f55-45d0-11e5-adde-14dae9d210b8">
<topic>unreal -- denial of service</topic>
<affects>
<package>
<name>Unreal</name>
<range><ge>3.2.10</ge><lt>3.2.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unreal reports:</p>
<blockquote cite="https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt">
<p>Summary: If SASL support is enabled in UnrealIRCd (this is
not the default) and is also enabled in your services
package then a malicious user with a services account can cause
UnrealIRCd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt</url>
<url>http://seclists.org/oss-sec/2015/q3/367</url>
</references>
<dates>
<discovery>2015-08-13</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="f1692469-45ce-11e5-adde-14dae9d210b8">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0">
<p>A double free flaw was found in the way JasPer's
jasper_image_stop_load() function parsed certain JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to
crash.</p>
</blockquote>
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/408">
<p>A new use-after-free was found in Jasper JPEG-200. The
use-after-free appears in the function mif_process_cmpt of the
src/libjasper/mif/mif_cod.c file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0</url>
<url>http://seclists.org/oss-sec/2015/q3/366</url>
<url>http://seclists.org/oss-sec/2015/q3/408</url>
<cvename>CVE-2015-5203</cvename>
<cvename>CVE-2015-5221</cvename>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2015-08-18</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="a59e263a-45cd-11e5-adde-14dae9d210b8">
<topic>freexl -- integer overflow</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/06/7">
<p>There's an integer overflow in the allocate_cells() function
when trying to allocate the memory for worksheet with specially
crafted row/column dimensions. This can be exploited to cause a
heap memory corruption. The most likely outcome of this is a crash
when trying to initialize the cells later in the function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/07/06/7</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="ac98d090-45cc-11e5-adde-14dae9d210b8">
<topic>freexl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jodie Cunningham reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/03/25/1">
<p>#1: A flaw was found in the way FreeXL reads sectors from
the input file. A specially crafted file could possibly
result in stack corruption near freexl.c:3752.</p>
<p>#2: A flaw was found in the function allocate_cells(). A
specially crafted file with invalid workbook dimensions
could possibly result in stack corruption near freexl.c:1074</p>
<p>#3: A flaw was found in the way FreeXL handles a premature EOF. A
specially crafted input file could possibly result in stack corruption
near freexl.c:1131</p>
<p>#4: FreeXL 1.0.0g did not properly check requests for workbook memory
allocation. A specially crafted input file could cause a Denial of
Service, or possibly write onto the stack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/03/25/1</url>
<cvename>CVE-2015-2776</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="47aa4343-44fa-11e5-9daa-14dae9d210b8">
<topic>mod_jk -- information disclosure</topic>
<affects>
<package>
<name>ap22-mod_jk</name>
<name>ap24-mod_jk</name>
<range><lt>1.2.41,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="http://www.cvedetails.com/cve/CVE-2014-8111/">
<p>Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores
JkUnmount rules for subtrees of previous JkMount rules, which allows
remote attackers to access otherwise restricted artifacts via
unspecified vectors. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html</url>
<url>http://readlist.com/lists/tomcat.apache.org/users/27/135512.html</url>
<url>http://www.cvedetails.com/cve/CVE-2014-8111/</url>
<cvename>CVE-2014-8111</cvename>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-08-17</entry>
</dates>
</vuln>
<vuln vid="f06f20dc-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-140.html">
<p>The QEMU model of the RTL8139 network card did not sufficiently
validate inputs in the C+ mode offload emulation. This results in
uninitialized memory from the QEMU process's heap being leaked to
the domain as well as to the network.</p>
<p>A guest may be able to read sensitive host-level data relating to
itself which resides in the QEMU process.</p>
<p>Such information may include things such as information relating to
real devices backing emulated devices or passwords which the host
administrator does not intend to share with the guest admin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5165</cvename>
<url>http://xenbits.xen.org/xsa/advisory-140.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="ee99899d-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-139.html">
<p>When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug
the device a second time using a previously freed pointer.</p>
<p>An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5166</cvename>
<url>http://xenbits.xen.org/xsa/advisory-139.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="787ef75e-44da-11e5-93ad-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-openssl</name>
<name>php5-phar</name>
<name>php5-soap</name>
<range><lt>5.4.44</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-openssl</name>
<name>php55-phar</name>
<name>php55-soap</name>
<range><lt>5.5.28</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-openssl</name>
<name>php56-phar</name>
<name>php56-soap</name>
<range><lt>5.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php">
<p>Core:</p>
<ul>
<li>Fixed bug #69793 (Remotely triggerable stack exhaustion via
recursive method calls).</li>
<li>Fixed bug #70121 (unserialize() could lead to unexpected methods
execution / NULL pointer deref).</li>
</ul>
<p>OpenSSL:</p>
<ul>
<li>Fixed bug #70014 (openssl_random_pseudo_bytes() is not
cryptographically secure).</li>
</ul>
<p>Phar:</p>
<ul>
<li>Improved fix for bug #69441.</li>
<li>Fixed bug #70019 (Files extracted from archive may be placed
outside of destination directory).</li>
</ul>
<p>SOAP:</p>
<ul>
<li>Fixed bug #70081 (SoapClient info leak / null pointer
dereference via multiple type confusions).</li>
</ul>
<p>SPL:</p>
<ul>
<li>Fixed bug #70068 (Dangling pointer in the unserialization of
ArrayObject items).</li>
<li>Fixed bug #70166 (Use After Free Vulnerability in unserialize()
with SPLArrayObject).</li>
<li>Fixed bug #70168 (Use After Free Vulnerability in unserialize()
with SplObjectStorage).</li>
<li>Fixed bug #70169 (Use After Free Vulnerability in unserialize()
with SplDoublyLinkedList).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.44</url>
<url>http://php.net/ChangeLog-5.php#5.5.28</url>
<url>http://php.net/ChangeLog-5.php#5.6.12</url>
<cvename>CVE-2015-6831</cvename>
<cvename>CVE-2015-6832</cvename>
<cvename>CVE-2015-6833</cvename>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-17</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.10</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.3</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">
<p>Internal review discovered that Special:DeletedContributions did
not properly protect the IP of autoblocked users. This fix makes
the functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.</p>
<p>Internal review discovered that watchlist anti-csrf tokens were not
being compared in constant time, which could allow various timing
attacks. This could allow an attacker to modify a user's watchlist
via csrf</p>
<p>John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6727</cvename>
<cvename>CVE-2013-7444</cvename>
<cvename>CVE-2015-6728</cvename>
<cvename>CVE-2015-6729</cvename>
<cvename>CVE-2015-6730</cvename>
<cvename>CVE-2015-6731</cvename>
<cvename>CVE-2015-6733</cvename>
<cvename>CVE-2015-6734</cvename>
<cvename>CVE-2015-6735</cvename>
<cvename>CVE-2015-6736</cvename>
<cvename>CVE-2015-6737</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>
<url>https://phabricator.wikimedia.org/T106893</url>
<url>https://phabricator.wikimedia.org/T94116</url>
<url>https://phabricator.wikimedia.org/T97391</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/27/6</url>
</references>
<dates>
<discovery>2015-08-10</discovery>
<entry>2015-08-14</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8">
<topic>freeradius3 -- insufficient validation on packets</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://freeradius.org/security.html#eap-pwd-2015">
<p>The EAP-PWD module performed insufficient validation on
packets received from an EAP peer. This module is not enabled in the
default configuration. Administrators must manually enable it for their
server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security.html#eap-pwd-2015</url>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="ec6a2a1e-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- double free in certificate DN decoding</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">
<p>Kurt Roeckx reported that decoding a specific certificate with very
long DistinguishedName (DN) entries leads to double free, which may
result to a denial of service. Since the DN decoding occurs in almost
all applications using certificates it is recommended to upgrade the
latest GnuTLS version fixing the issue. Recommendation: Upgrade to
GnuTLS 3.4.4, or 3.3.17.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</url>
<mlist>http://seclists.org/oss-sec/2015/q3/308</mlist>
<url>https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</url>
<cvename>CVE-2015-6251</cvename>
</references>
<dates>
<discovery>2015-07-20</discovery>
<entry>2015-08-14</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="3de36a19-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- MD5 downgrade in TLS signatures</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Karthikeyan Bhargavan reports:</p>
<blockquote cite="http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132">
<p>GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5
signature-hash algorithm needs to be explicitly enabled using the
priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE
profiles, GnuTLS clients do not offer RSA-MD5 in the signature
algorithms extension. However, we find that all GnuTLS clients still
accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still
accept RSA-MD5 in the ClientCertificateVerify.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132</mlist>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-2</url>
<mlist>http://seclists.org/oss-sec/2015/q2/367</mlist>
</references>
<dates>
<discovery>2015-04-25</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="9ee72858-4159-11e5-93ad-002590263bf5">
<topic>froxlor -- database password information leak</topic>
<affects>
<package>
<name>froxlor</name>
<range><lt>0.9.33.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security-list@demlak.de reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/238">
<p>An unauthenticated remote attacker is able to get the database
password via webaccess due to wrong file permissions of the /logs/
folder in froxlor version 0.9.33.1 and earlier. The plain SQL
password and username may be stored in the /logs/sql-error.log file.
This directory is publicly reachable under the default
configuration/setup.</p>
</blockquote>
<p>Note that froxlor 0.9.33.2 prevents future logging of passwords but
does not retroactively remove passwords already logged. Michael
Kaufmann, the Froxlor lead developer reports:</p>
<blockquote cite="http://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/#entry30025">
<p>Removing all .log files from the directory should do the job,
alternatively just use the class.ConfigIO.php from Github</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5959</cvename>
<freebsdpr>ports/202262</freebsdpr>
<url>http://seclists.org/oss-sec/2015/q3/238</url>
<url>https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-13</entry>
</dates>
</vuln>
<vuln vid="83b38a2c-413e-11e5-bfcf-6805ca0b3d42">
<topic>RT -- two XSS vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html">
<p>RT 4.0.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the user and group rights
management pages. This vulnerability is assigned
CVE-2015-5475. It was discovered and reported by Marcin
Kopec at Data Reliance Shared Service Center.</p>
<p>RT 4.2.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the cryptography interface.
This vulnerability could allow an attacker with a
carefully-crafted key to inject JavaScript into RT's user
interface. Installations which use neither GnuPG nor
S/MIME are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5475</cvename>
<cvename>CVE-2015-6506</cvename>
<url>http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-08-12</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="09fff0d9-4126-11e5-9f01-14dae9d210b8">
<topic>py-foolscap -- local file inclusion</topic>
<affects>
<package>
<name>py27-foolscap</name>
<name>py32-foolscap</name>
<name>py33-foolscap</name>
<name>py34-foolscap</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Warner reports:</p>
<blockquote cite="https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS">
<p>The "flappserver" feature was found to have a vulnerability in the
service-lookup code which, when combined with an attacker who has the ability
to write files to a location where the flappserver process could read them,
would allow that attacker to obtain control of the flappserver process.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS</url>
<url>http://foolscap.lothar.com/trac/ticket/226</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="42c98cef-62b1-4b8b-9065-f4621e08d526">
<topic>libvpx -- out-of-bounds write</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.1.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2014-77/">
<p>Using the Address Sanitizer tool, security researcher
Abhishek Arya (Inferno) of the Google Chrome Security Team
found an out-of-bounds write when buffering WebM format
video containing frames with invalid tile sizes. This can
lead to a potentially exploitable crash during WebM video
playback.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1578</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2014-77/</url>
<url>https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba</url>
</references>
<dates>
<discovery>2014-10-14</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="f3778328-d288-4b39-86a4-65877331eaf7">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-19.html">
<p>Adobe has released security updates for Adobe Flash Player.
These updates address critical vulnerabilities that could
potentially allow an attacker to take control of the affected
system.</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2015-5128, CVE-2015-5554,
CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).</p>
<p>These updates include further hardening to a mitigation
introduced in version 18.0.0.209 to defend against vector
length corruptions (CVE-2015-5125).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5550, CVE-2015-5551,
CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134,
CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124,
CVE-2015-5564).</p>
<p>These updates resolve heap buffer overflow vulnerabilities
that could lead to code execution (CVE-2015-5129,
CVE-2015-5541).</p>
<p>These updates resolve buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-5131, CVE-2015-5132,
CVE-2015-5133).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5544, CVE-2015-5545,
CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549,
CVE-2015-5552, CVE-2015-5553).</p>
<p>These updates resolve an integer overflow vulnerability that
could lead to code execution (CVE-2015-5560).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-5124</cvename>
<cvename>CVE-2015-5125</cvename>
<cvename>CVE-2015-5127</cvename>
<cvename>CVE-2015-5128</cvename>
<cvename>CVE-2015-5129</cvename>
<cvename>CVE-2015-5130</cvename>
<cvename>CVE-2015-5131</cvename>
<cvename>CVE-2015-5132</cvename>
<cvename>CVE-2015-5133</cvename>
<cvename>CVE-2015-5134</cvename>
<cvename>CVE-2015-5539</cvename>
<cvename>CVE-2015-5540</cvename>
<cvename>CVE-2015-5541</cvename>
<cvename>CVE-2015-5544</cvename>
<cvename>CVE-2015-5545</cvename>
<cvename>CVE-2015-5546</cvename>
<cvename>CVE-2015-5547</cvename>
<cvename>CVE-2015-5548</cvename>
<cvename>CVE-2015-5549</cvename>
<cvename>CVE-2015-5550</cvename>
<cvename>CVE-2015-5551</cvename>
<cvename>CVE-2015-5552</cvename>
<cvename>CVE-2015-5553</cvename>
<cvename>CVE-2015-5554</cvename>
<cvename>CVE-2015-5555</cvename>
<cvename>CVE-2015-5556</cvename>
<cvename>CVE-2015-5557</cvename>
<cvename>CVE-2015-5558</cvename>
<cvename>CVE-2015-5559</cvename>
<cvename>CVE-2015-5560</cvename>
<cvename>CVE-2015-5561</cvename>
<cvename>CVE-2015-5562</cvename>
<cvename>CVE-2015-5563</cvename>
<cvename>CVE-2015-5564</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-19.html</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="34e60332-2448-4ed6-93f0-12713749f250">
<topic>libvpx -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-89/">
<p>Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to
discover two buffer overflow issues in the Libvpx library
used for WebM video when decoding a malformed WebM video
file. These buffer overflows result in potentially
exploitable crashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4485</cvename>
<cvename>CVE-2015-4486</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-89/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-14</modified>
</dates>
</vuln>
<vuln vid="c66a5632-708a-4727-8236-d65b2d5b2739">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0
/ rv:38.2)</p>
<p>MFSA 2015-80 Out-of-bounds read with malformed MP3
file</p>
<p>MFSA 2015-81 Use-after-free in MediaStream playback</p>
<p>MFSA 2015-82 Redefinition of non-configurable JavaScript object properties</p>
<p>MFSA 2015-83 Overflow issues in libstagefright</p>
<p>MFSA 2015-84 Arbitrary file overwriting through Mozilla
Maintenance Service with hard links</p>
<p>MFSA 2015-85 Out-of-bounds write with Updater and
malicious MAR file</p>
<p>MFSA 2015-86 Feed protocol with POST bypasses mixed
content protections</p>
<p>MFSA 2015-87 Crash when using shared memory in
JavaScript</p>
<p>MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling
bitmap images</p>
<p>MFSA 2015-90 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-91 Mozilla Content Security Policy allows for
asterisk wildcards in violation of CSP specification</p>
<p>MFSA 2015-92 Use-after-free in XMLHttpRequest with shared
workers</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4473</cvename>
<cvename>CVE-2015-4474</cvename>
<cvename>CVE-2015-4475</cvename>
<cvename>CVE-2015-4477</cvename>
<cvename>CVE-2015-4478</cvename>
<cvename>CVE-2015-4479</cvename>
<cvename>CVE-2015-4480</cvename>
<cvename>CVE-2015-4481</cvename>
<cvename>CVE-2015-4482</cvename>
<cvename>CVE-2015-4483</cvename>
<cvename>CVE-2015-4484</cvename>
<cvename>CVE-2015-4487</cvename>
<cvename>CVE-2015-4488</cvename>
<cvename>CVE-2015-4489</cvename>
<cvename>CVE-2015-4490</cvename>
<cvename>CVE-2015-4491</cvename>
<cvename>CVE-2015-4492</cvename>
<cvename>CVE-2015-4493</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-79/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-80/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-81/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-82/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-83/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-84/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-87/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-88/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-90/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-91/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-92/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-22</modified>
</dates>
</vuln>
<vuln vid="dd7f29cc-3ee9-11e5-93ad-002590263bf5">
<topic>lighttpd -- Log injection vulnerability in mod_auth</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200">
<p>mod_auth in lighttpd before 1.4.36 allows remote attackers to
inject arbitrary log entries via a basic HTTP authentication string
without a colon character, as demonstrated by a string containing a
NULL and new line character.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3200</cvename>
<url>http://redmine.lighttpd.net/issues/2646</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="ff0acfb4-3efa-11e5-93ad-002590263bf5">
<topic>pcre -- heap overflow vulnerability in '(?|' situations</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1667">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During the compilation of a malformed regular expression,
more data is written on the malloced block than the expected size
output by compile_regex. Exploits with advanced Heap Fengshui
techniques may allow an attacker to execute arbitrary code in the
context of the user running the affected application.</p>
<p>Latest version of PCRE is prone to a Heap Overflow vulnerability
which could caused by the following regular expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202209</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1667</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="8eee06d4-c21d-4f07-a669-455151ff426f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-78 Same origin violation and local file
stealing via PDF reader</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4495</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-78/</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-07</entry>
</dates>
</vuln>
<vuln vid="ac5ec8e3-3c6c-11e5-b921-00a0986f28c4">
<topic>wordpress -- Multiple vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/">
<p>WordPress 4.2.4 fixes three cross-site scripting vulnerabilities
and a potential SQL injection that could be used to compromise a
site.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/</url>
<cvename>CVE-2015-2213</cvename>
<cvename>CVE-2015-5730</cvename>
<cvename>CVE-2015-5731</cvename>
<cvename>CVE-2015-5732</cvename>
<cvename>CVE-2015-5733</cvename>
<cvename>CVE-2015-5734</cvename>
</references>
<dates>
<discovery>2015-08-04</discovery>
<entry>2015-08-06</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="57bb5e3d-3c4f-11e5-a4d4-001e8c75030d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.8.0</ge><lt>1.8.14</lt></range>
<range><ge>1.7.0</ge><lt>1.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion reports:</p>
<blockquote cite="http://svn.haxx.se/dev/archive-2015-08/0024.shtml">
<p>CVE-2015-3184:<br/>
Subversion's mod_authz_svn does not properly restrict anonymous access
in some mixed anonymous/authenticated environments when
using Apache httpd 2.4.</p>
<p>CVE-2015-3187:<br/>
Subversion servers, both httpd and svnserve, will reveal some
paths that should be hidden by path-based authz.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3184</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3184-advisory.txt</url>
<cvename>CVE-2015-3187</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3187-advisory.txt</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-06</entry>
</dates>
</vuln>
<vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- directory traversal attack via snapshot API</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
are vulnerable to a directory traversal attack.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or later, or
constrain access to the snapshot API to trusted sources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5531</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- remote code execution via transport protocol</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
vulnerable to an attack that can result in remote code execution.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
Alternately, ensure that only trusted applications have access to
the transport protocol port.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5377</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="da451130-365d-11e5-a4a5-002590263bf5">
<topic>qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-138.html">
<p>A heap overflow flaw was found in the way QEMU's IDE subsystem
handled I/O buffer access while processing certain ATAPI
commands.</p>
<p>A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host's QEMU process corresponding to
the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5154</cvename>
<url>http://xenbits.xen.org/xsa/advisory-138.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-04</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="4622635f-37a1-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmptrapd crash</topic>
<affects>
<package>
<name>net-snmp</name>
<range><ge>5.7.0</ge><le>5.7.2.1</le></range>
<range><ge>5.6.0</ge><le>5.6.2.1</le></range>
<range><ge>5.5.0</ge><le>5.5.2.1</le></range>
<range><ge>5.4.0</ge><le>5.4.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Murray McAllister reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/473">
<p>A remote denial-of-service flaw was found in the way
snmptrapd handled certain SNMP traps when started with the
"-OQ" option. If an attacker sent an SNMP trap containing a
variable with a NULL type where an integer variable type was
expected, it would cause snmptrapd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/473</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/</url>
<url>https://sourceforge.net/p/net-snmp/official-patches/48/</url>
<cvename>CVE-2014-3565</cvename>
</references>
<dates>
<discovery>2014-07-31</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="381183e8-3798-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmp_pdu_parse() function incomplete initialization</topic>
<affects>
<package>
<name>net-snmp</name>
<range><le>5.7.3_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/116">
<p>Incompletely initialized vulnerability exists in the function
‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
leak, DOS and possible command executions by sending malicious packets.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q2/116</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1212408</url>
<cvename>CVE-2015-5621</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="731cdeaa-3564-11e5-9970-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P3</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P2</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01272/">
<p>An error in the handling of TKEY queries can be exploited
by an attacker for use as a denial-of-service vector, as a constructed
packet can use the defect to trigger a REQUIRE assertion failure,
causing BIND to exit.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:17.bind</freebsdsa>
<cvename>CVE-2015-5477</cvename>
<url>https://kb.isc.org/article/AA-01272/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5b74a5bc-348f-11e5-ba05-c80aa9043978">
<topic>OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>6.9.p1_2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://access.redhat.com/security/cve/CVE-2015-5600">
<p>It was discovered that the OpenSSH sshd daemon did not check the
list of keyboard-interactive authentication methods for duplicates.
A remote attacker could use this flaw to bypass the MaxAuthTries
limit, making it easier to perform password guessing attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/CVE-2015-5600</url>
<cvename>CVE-2015-5600</cvename>
<freebsdsa>SA-15:16.openssh</freebsdsa>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c470bcc7-33fe-11e5-a4a5-002590263bf5">
<topic>logstash -- SSL/TLS vulnerability with Lumberjack input</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.4</lt></range>
<range><ge>1.5.0</ge><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Logstash versions prior to 1.5.2 that
use Lumberjack input (in combination with Logstash Forwarder agent)
are vulnerable to a SSL/TLS security issue called the FREAK attack.
This allows an attacker to intercept communication and access secure
data. Users should upgrade to 1.5.3 or 1.4.4.</p>
<p>Remediation Summary: Users that do not want to upgrade can address
the vulnerability by disabling the Lumberjack input.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5378</cvename>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-27</entry>
</dates>
</vuln>
<vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>44.0.2403.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>43 security fixes in this release, including:</p>
<ul>
<li>[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium.
Credit to cloudfuzzer.</li>
<li>[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium.
Credit to makosoft.</li>
<li>[461858] High CVE-2015-1274: Settings allowed executable files
to run immediately after download. Credit to andrewm.bpi.</li>
<li>[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit
to WangTao(neobyte) of Baidu X-Team.</li>
<li>[472614] High CVE-2015-1276: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium.
Credit to mlafon.</li>
<li>[486947] High CVE-2015-1280: Memory corruption in skia. Credit
to cloudfuzzer.</li>
<li>[487155] High CVE-2015-1281: CSP bypass. Credit to Masato
Kinugawa.</li>
<li>[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit
to Chamal de Silva.</li>
<li>[492052] High CVE-2015-1283: Heap-buffer-overflow in expat.
Credit to sidhpurwala.huzaifa.</li>
<li>[493243] High CVE-2015-1284: Use-after-free in blink. Credit to
Atte Kettunen of OUSPG.</li>
<li>[504011] High CVE-2015-1286: UXSS in blink. Credit to
anonymous.</li>
<li>[505374] High CVE-2015-1290: Memory corruption in V8. Credit to
Yongjun Liu of NSFOCUS Security Team.</li>
<li>[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to
filedescriptor.</li>
<li>[444573] Medium CVE-2015-1270: Uninitialized memory read in
ICU. Credit to Atte Kettunen of OUSPG.</li>
<li>[451456] Medium CVE-2015-1272: Use-after-free related to
unexpected GPU process termination. Credit to Chamal de
Silva.</li>
<li>[479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.</li>
<li>[482380] Medium CVE-2015-1278: URL spoofing using pdf files.
Credit to Chamal de Silva.</li>
<li>[498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.</li>
<li>[479162] Low CVE-2015-1288: Spell checking dictionaries fetched
over HTTP. Credit to mike@michaelruddy.com.</li>
<li>[512110] CVE-2015-1289: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1270</cvename>
<cvename>CVE-2015-1271</cvename>
<cvename>CVE-2015-1272</cvename>
<cvename>CVE-2015-1273</cvename>
<cvename>CVE-2015-1274</cvename>
<cvename>CVE-2015-1275</cvename>
<cvename>CVE-2015-1276</cvename>
<cvename>CVE-2015-1277</cvename>
<cvename>CVE-2015-1278</cvename>
<cvename>CVE-2015-1279</cvename>
<cvename>CVE-2015-1280</cvename>
<cvename>CVE-2015-1281</cvename>
<cvename>CVE-2015-1282</cvename>
<cvename>CVE-2015-1283</cvename>
<cvename>CVE-2015-1284</cvename>
<cvename>CVE-2015-1285</cvename>
<cvename>CVE-2015-1286</cvename>
<cvename>CVE-2015-1287</cvename>
<cvename>CVE-2015-1288</cvename>
<cvename>CVE-2015-1289</cvename>
<cvename>CVE-2015-1290</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-25</entry>
</dates>
</vuln>
<vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc">
<topic>shibboleth-sp -- DoS vulnerability</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.5.5</lt></range>
</package>
<package>
<name>opensaml2</name>
<range><lt>2.5.5</lt></range>
</package>
<package>
<name>shibboleth-sp</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt">
<p>
Shibboleth SP software crashes on well-formed but invalid XML.
</p>
<p>
The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.
</p>
<p>
You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or
later. The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url>
<cvename>CVE-2015-2684</cvename>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/07/wordpress-4-2-3/">
<p>WordPress versions 4.2.2 and earlier are affected by a
cross-site scripting vulnerability, which could allow users with the
Contributor or Author role to compromise a site. This was reported by
Jon Cave and fixed by Robert Chapin, both of the WordPress security
team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/07/wordpress-4-2-3/</url>
<cvename>CVE-2015-5622</cvename>
<cvename>CVE-2015-5623</cvename>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2015-07-23</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="4caf01e2-30e6-11e5-a4a5-002590263bf5">
<topic>libidn -- out-of-bounds read issue with invalid UTF-8 input</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31">
<p>stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function
has always been documented to not validate that the input UTF-8
string is actually valid UTF-8...
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2059</cvename>
<url>http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31</url>
</references>
<dates>
<discovery>2015-02-09</discovery>
<entry>2015-07-23</entry>
<modified>2015-08-03</modified>
</dates>
</vuln>
<vuln vid="9dd761ff-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- memory corruption vulnerabilities</topic>
<affects>
<package>
<name>sox</name>
<range><le>14.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michele Spagnuolo, Google Security Team, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/167">
<p>The write heap buffer overflows are related to ADPCM handling in
WAV files, while the read heap buffer overflow is while opening a
.VOC.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/167</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="92cda470-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- input sanitization errors</topic>
<affects>
<package>
<name>sox</name>
<range><lt>14.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-010.html">
<p>The sox command line tool is affected by two heap-based buffer
overflows, respectively located in functions start_read() and
AdpcmReadBlock().</p>
<p>A specially crafted wav file can be used to trigger the
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<bid>71774</bid>
<cvename>CVE-2014-8145</cvename>
<url>http://www.ocert.org/advisories/ocert-2014-010.html</url>
</references>
<dates>
<discovery>2014-11-20</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="95eee71d-3068-11e5-a9b5-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gustavo.grieco@imag.fr reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-22</entry>
</dates>
</vuln>
<vuln vid="8a1d0e63-1e07-11e5-b43d-002590263bf5">
<topic>pcre -- Heap Overflow Vulnerability in find_fixedlength()</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1651">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During subpattern calculation of a malformed regular
expression, an offset that is used as an array index is fully
controlled and can be large enough so that unexpected heap
memory regions are accessed.</p>
<p>One could at least exploit this issue to read objects nearby of
the affected application's memory.</p>
<p>Such information disclosure may also be used to bypass memory
protection method such as ASLR.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5073</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1651</url>
<url>http://vcs.pcre.org/pcre?view=revision&revision=1571</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/1</mlist>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0bfda05f-2e6f-11e5-a4a5-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8e.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulnerabilities</li>
<li>CVE-2015-4634 - SQL injection in graphs.php</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed various SQL Injection vectors</li>
<li>bug#0002574: SQL Injection Vulnerabilities in graph items and
graph template items</li>
<li>bug#0002577: CVE-2015-4634 - SQL injection in graphs.php</li>
<li>bug#0002579: SQL Injection Vulnerabilities in data sources</li>
<li>bug#0002580: SQL Injection in cdef.php</li>
<li>bug#0002582: SQL Injection in data_templates.php</li>
<li>bug#0002583: SQL Injection in graph_templates.php</li>
<li>bug#0002584: SQL Injection in host_templates.php</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4634</cvename>
<freebsdpr>ports/201702</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8e.php</url>
<mlist>http://seclists.org/oss-sec/2015/q3/150</mlist>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-20</entry>
</dates>
</vuln>
<vuln vid="8b1f53f3-2da5-11e5-86ff-14dae9d210b8">
<topic>php-phar -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56-phar</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-phar</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/141">
<p>Segfault in Phar::convertToData on invalid file.</p>
<p>Buffer overflow and stack smashing error in phar_fix_filepath.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/141</mlist>
<url>https://bugs.php.net/bug.php?id=69958</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf</url>
<url>https://bugs.php.net/bug.php?id=69923</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f</url>
<cvename>CVE-2015-5589</cvename>
<cvename>CVE-2015-5590</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-18</entry>
<modified>2015-12-18</modified>
</dates>
</vuln>
<vuln vid="43891162-2d5e-11e5-a4a5-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.9</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.7</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/94">
<p>MSA-15-0026: Possible phishing when redirecting to external site
using referer header. (CVE-2015-3272)</p>
<p>MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not
respected when using 'Post a copy to all groups' in forum
(CVE-2015-3273)</p>
<p>MSA-15-0028: Possible XSS through custom text profile fields in Web
Services (CVE-2015-3274)</p>
<p>MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3272</cvename>
<cvename>CVE-2015-3273</cvename>
<cvename>CVE-2015-3274</cvename>
<cvename>CVE-2015-3275</cvename>
<mlist>http://seclists.org/oss-sec/2015/q3/94</mlist>
<url>https://docs.moodle.org/dev/Moodle_2.7.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.7_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.1_release_notes</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-18</entry>
<modified>2015-07-19</modified>
</dates>
</vuln>
<vuln vid="29083f8e-2ca8-11e5-86ff-14dae9d210b8">
<topic>apache22 -- chunk header parsing defect</topic>
<affects>
<package>
<name>apache22</name>
<name>apache22-event-mpm</name>
<name>apache22-itk-mpm</name>
<name>apache22-peruser-mpm</name>
<name>apache22-worker-mpm</name>
<range><le>2.2.29_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Foundation reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>CVE-2015-3183 core: Fix chunk header parsing defect. Remove
apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN
filter, parse chunks in a single pass with zero copy. Limit accepted
chunk-size to 2^63-1 and be strict about chunk-ext authorized
characters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
<url>https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e</url>
<cvename>CVE-2015-3183</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-17</entry>
</dates>
</vuln>
<vuln vid="5c399624-2bef-11e5-86ff-14dae9d210b8">
<topic>zenphoto -- multiple vulnerabilities</topic>
<affects>
<package>
<name>zenphoto</name>
<range><lt>1.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zenphoto reports:</p>
<blockquote cite="http://www.zenphoto.org/news/zenphoto-1.4.9">
<p>Fixes several SQL Injection, XSS and path traversal
security issues</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.zenphoto.org/news/zenphoto-1.4.9</url>
<mlist>http://seclists.org/oss-sec/2015/q3/123</mlist>
<url>https://github.com/zenphoto/zenphoto/pull/935</url>
<cvename>CVE-2015-5591</cvename>
<cvename>CVE-2015-5592</cvename>
<cvename>CVE-2015-5593</cvename>
<cvename>CVE-2015-5594</cvename>
<cvename>CVE-2015-5595</cvename>
</references>
<dates>
<discovery>2015-05-24</discovery>
<entry>2015-07-16</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="67b3fef2-2bea-11e5-86ff-14dae9d210b8">
<topic>groovy -- remote execution of untrusted code</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cédric Champeau reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/121">
<p>Description</p>
<p>When an application has Groovy on the classpath and that
it uses standard Java serialization mechanism to communicate
between servers, or to store local data, it is possible for
an attacker to bake a special serialized object that will
execute code directly when deserialized. All applications
which rely on serialization and do not isolate the code which
deserializes objects are subject to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/121</mlist>
<url>http://groovy-lang.org/security.html</url>
<url>https://issues.apache.org/jira/browse/GROOVY-7504</url>
<cvename>CVE-2015-3253</cvename>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="a928960a-2bdc-11e5-86ff-14dae9d210b8">
<topic>libav -- divide by zero</topic>
<affects>
<package>
<name>libav</name>
<range><le>11.3_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/">
<p>libav: divide-by-zero in ff_h263_decode_mba()</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f</url>
<cvename>CVE-2015-5479</cvename>
</references>
<dates>
<discovery>2015-06-21</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="44d9daee-940c-4179-86bb-6e3ffd617869">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.8.0,1</lt></range>
<range><ge>38.0,1</ge><lt>38.1.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0
/ rv:31.8 / rv:38.1)</p>
<p>MFSA 2015-60 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA 2015-61 Type confusion in Indexed Database
Manager</p>
<p>MFSA 2015-62 Out-of-bound read while computing an
oscillator rendering range in Web Audio</p>
<p>MFSA 2015-63 Use-after-free in Content Policy due to
microtask execution error</p>
<p>MFSA 2015-64 ECDSA signature validation fails to handle
some signatures correctly</p>
<p>MFSA 2015-65 Use-after-free in workers while using
XMLHttpRequest</p>
<p>MFSA 2015-66 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-67 Key pinning is ignored when overridable
errors are encountered</p>
<p>MFSA 2015-68 OS X crash reports may contain entered key
press information</p>
<p>MFSA 2015-69 Privilege escalation through internal
workers</p>
<p>MFSA 2015-70 NSS accepts export-length DHE keys with
regular DHE cipher suites</p>
<p>MFSA 2015-71 NSS incorrectly permits skipping of
ServerKeyExchange</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2721</cvename>
<cvename>CVE-2015-2722</cvename>
<cvename>CVE-2015-2724</cvename>
<cvename>CVE-2015-2725</cvename>
<cvename>CVE-2015-2726</cvename>
<cvename>CVE-2015-2727</cvename>
<cvename>CVE-2015-2728</cvename>
<cvename>CVE-2015-2729</cvename>
<cvename>CVE-2015-2730</cvename>
<cvename>CVE-2015-2731</cvename>
<cvename>CVE-2015-2733</cvename>
<cvename>CVE-2015-2734</cvename>
<cvename>CVE-2015-2735</cvename>
<cvename>CVE-2015-2736</cvename>
<cvename>CVE-2015-2737</cvename>
<cvename>CVE-2015-2738</cvename>
<cvename>CVE-2015-2739</cvename>
<cvename>CVE-2015-2740</cvename>
<cvename>CVE-2015-2741</cvename>
<cvename>CVE-2015-2742</cvename>
<cvename>CVE-2015-2743</cvename>
<cvename>CVE-2015-4000</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-60/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-61/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-62/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-63/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-64/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-65/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-66/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-67/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-68/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-69/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-70/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-71/</url>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-16</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="d3216606-2b47-11e5-a668-080027ef73ec">
<topic>PolarSSL -- Security Fix Backports</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Bakker reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released">
<p>PolarSSL 1.2.14 fixes one remotely-triggerable issues that was
found by the Codenomicon Defensics tool, one potential remote crash
and countermeasures against the "Lucky 13 strikes back" cache-based
attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="ca139c7f-2a8c-11e5-a4a5-002590263bf5">
<topic>libwmf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwmf</name>
<range><lt>0.2.8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941">
<p>Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
and earlier may allow remote attackers to execute arbitrary code via
malformed image files that trigger the overflows due to improper
calls to the gdMalloc function, a different set of vulnerabilities
than CVE-2004-0990.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455">
<p>Buffer overflow in the gdImageStringFTEx function in gdft.c in GD
Graphics Library 2.0.33 and earlier allows remote attackers to cause
a denial of service (application crash) and possibly execute
arbitrary code via a crafted string with a JIS encoded font.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">
<p>The gdPngReadData function in libgd 2.0.34 allows user-assisted
attackers to cause a denial of service (CPU consumption) via a
crafted PNG image with truncated data, which causes an infinite loop
in the png_read_info function in libpng.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">
<p>Integer overflow in gdImageCreateTrueColor function in the GD
Graphics Library (libgd) before 2.0.35 allows user-assisted remote
attackers to have unspecified attack vectors and impact.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">
<p>The gdImageCreateXbm function in the GD Graphics Library (libgd)
before 2.0.35 allows user-assisted remote attackers to cause a
denial of service (crash) via unspecified vectors involving a
gdImageCreate failure.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">
<p>The (a) imagearc and (b) imagefilledarc functions in GD Graphics
Library (libgd) before 2.0.35 allow attackers to cause a denial of
service (CPU consumption) via a large (1) start or (2) end angle
degree value.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before
5.3.1, and the GD Graphics Library 2.x, does not properly verify a
certain colorsTotal structure member, which might allow remote
attackers to conduct buffer overflow or buffer over-read attacks via
a crafted GD file, a different vulnerability than CVE-2009-3293.
NOTE: some of these details are obtained from third party
information.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848">
<p>Heap-based buffer overflow in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) or possibly execute
arbitrary code via a crafted BMP image.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695">
<p>meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial
of service (out-of-bounds read) via a crafted WMF file.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696">
<p>Use-after-free vulnerability in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) via a crafted WMF
file to the (1) wmf2gd or (2) wmf2eps command.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588">
<p>Heap-based buffer overflow in the DecodeImage function in libwmf
0.2.8.4 allows remote attackers to cause a denial of service (crash)
or possibly execute arbitrary code via a crafted "run-length count"
in an image in a WMF file.</p>
</blockquote>
</body>
</description>
<references>
<bid>11663</bid>
<bid>22289</bid>
<bid>24089</bid>
<bid>24651</bid>
<bid>36712</bid>
<freebsdpr>ports/201513</freebsdpr>
<cvename>CVE-2004-0941</cvename>
<cvename>CVE-2007-0455</cvename>
<cvename>CVE-2007-2756</cvename>
<cvename>CVE-2007-3472</cvename>
<cvename>CVE-2007-3473</cvename>
<cvename>CVE-2007-3477</cvename>
<cvename>CVE-2009-3546</cvename>
<cvename>CVE-2015-0848</cvename>
<cvename>CVE-2015-4695</cvename>
<cvename>CVE-2015-4696</cvename>
<cvename>CVE-2015-4588</cvename>
</references>
<dates>
<discovery>2004-10-12</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="a12494c1-2af4-11e5-86ff-14dae9d210b8">
<topic>apache24 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jim Jagielski reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E">
<p>CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters.</p>
<p>CVE-2015-3185 (cve.mitre.org)
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
with new ap_some_authn_required and ap_force_authn hook.</p>
<p>CVE-2015-0253 (cve.mitre.org)
core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
with the INCLUDES filter active, introduced in 2.4.11. PR 57531.</p>
<p>CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.</p>
</blockquote>
</body>
</description>
<references>
<mlist>https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E</mlist>
<cvename>CVE-2015-3183</cvename>
<cvename>CVE-2015-3185</cvename>
<cvename>CVE-2015-0253</cvename>
<cvename>CVE-2015-0228</cvename>
</references>
<dates>
<discovery>2015-02-04</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="8d2d6bbd-2a02-11e5-a0af-bcaec565249c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-18.html">
<p>Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have
been identified. Successful exploitation could cause a crash
and potentially allow an attacker to take control of the
affected system. Adobe is aware of reports that exploits
targeting these vulnerabilities have been published publicly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5122</cvename>
<cvename>CVE-2015-5123</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-18.html</url>
</references>
<dates>
<discovery>2015-07-10</discovery>
<entry>2015-07-14</entry>
<modified>2015-07-16</modified>
</dates>
</vuln>
<vuln vid="3d39e927-29a2-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56-sqlite3</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-sqlite3</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-sqlite3</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69972">
<p>Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69972</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="af7fbd91-29a1-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69970">
<p>Use-after-free vulnerability in spl_recursive_it_move_forward_ex()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69970</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="5a1d5d74-29a0-11e5-86ff-14dae9d210b8">
<topic>php -- arbitrary code execution</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cmb reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69768">
<p>When delayed variable substitution is enabled (can be set in the
Registry, for instance), !ENV! works similar to %ENV%, and the
value of the environment variable ENV will be subsituted.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69768</url>
</references>
<dates>
<discovery>2015-06-07</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="36bd352d-299b-11e5-86ff-14dae9d210b8">
<topic>mysql -- SSL Downgrade</topic>
<affects>
<package>
<name>php56-mysql</name>
<name>php56-mysqli</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-mysql</name>
<name>php55-mysqli</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-mysql</name>
<name>php5-mysqli</name>
<range><lt>5.4.43</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.44</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Duo Security reports:</p>
<blockquote cite="https://www.duosecurity.com/blog/backronym-mysql-vulnerability">
<p>Researchers have identified a serious vulnerability in some
versions of Oracle’s MySQL database product that allows an attacker to
strip SSL/TLS connections of their security wrapping transparently.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69669</url>
<url>https://www.duosecurity.com/blog/backronym-mysql-vulnerability</url>
<url>http://www.ocert.org/advisories/ocert-2015-003.html</url>
<url>https://mariadb.atlassian.net/browse/MDEV-7937</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/</url>
<cvename>CVE-2015-3152</cvename>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="81326883-2905-11e5-a4a5-002590263bf5">
<topic>devel/ipython -- CSRF possible remote execution vulnerability</topic>
<affects>
<package>
<name>ipython</name>
<range><ge>0.12</ge><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/92">
<p>Summary: POST requests exposed via the IPython REST API are
vulnerable to cross-site request forgery (CSRF). Web pages on
different domains can make non-AJAX POST requests to known IPython
URLs, and IPython will honor them. The user's browser will
automatically send IPython cookies along with the requests. The
response is blocked by the Same-Origin Policy, but the request
isn't.</p>
<p>API paths with issues:</p>
<ul>
<li>POST /api/contents/<path>/<file></li>
<li>POST /api/contents/<path>/<file>/checkpoints</li>
<li>POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id></li>
<li>POST /api/kernels</li>
<li>POST /api/kernels/<kernel_id>/<action></li>
<li>POST /api/sessions</li>
<li>POST /api/clusters/<cluster_id>/<action></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5607</cvename>
<url>http://seclists.org/oss-sec/2015/q3/92</url>
<url>http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-22</modified>
</dates>
</vuln>
<vuln vid="379788f3-2900-11e5-a4a5-002590263bf5">
<topic>freeradius -- insufficient CRL application vulnerability</topic>
<affects>
<package>
<name>freeradius2</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>freeradius3</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-008.html">
<p>The FreeRADIUS server relies on OpenSSL to perform certificate
validation, including Certificate Revocation List (CRL) checks. The
FreeRADIUS usage of OpenSSL, in CRL application, limits the checks
to leaf certificates, therefore not detecting revocation of
intermediate CA certificates.</p>
<p>An unexpired client certificate, issued by an intermediate CA with
a revoked certificate, is therefore accepted by FreeRADIUS.</p>
<p>Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL
for CRL checks on the complete trust chain.</p>
<p>The FreeRADIUS project advises that the recommended configuration
is to use self-signed CAs for all EAP-TLS methods.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4680</cvename>
<freebsdpr>ports/201058</freebsdpr>
<freebsdpr>ports/201059</freebsdpr>
<url>http://www.ocert.org/advisories/ocert-2015-008.html</url>
<url>http://freeradius.org/security.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="f1deed23-27ec-11e5-a4a5-002590263bf5">
<topic>xen-tools -- xl command line config handling stack overflow</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-137.html">
<p>The xl command line utility mishandles long configuration values
when passed as command line arguments, with a buffer overrun.</p>
<p>A semi-trusted guest administrator or controller, who is intended
to be able to partially control the configuration settings for a
domain, can escalate their privileges to that of the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3259</cvename>
<url>http://xenbits.xen.org/xsa/advisory-137.html</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="8c31b288-27ec-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- vulnerability in the iret hypercall handler</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.1</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-136.html">
<p>A buggy loop in Xen's compat_iret() function iterates the wrong way
around a 32-bit index. Any 32-bit PV guest kernel can trigger this
vulnerability by attempting a hypercall_iret with EFLAGS.VM set.</p>
<p>Given the use of __get/put_user(), and that the virtual addresses
in question are contained within the lower canonical half, the guest
cannot clobber any hypervisor data. Instead, Xen will take up to
2^33 pagefaults, in sequence, effectively hanging the host.</p>
<p>Malicious guest administrators can cause a denial of service
affecting the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4164</cvename>
<url>http://xenbits.xen.org/xsa/advisory-136.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="80e846ff-27eb-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.2</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-134.html">
<p>With the introduction of version 2 grant table operations, a
version check became necessary for most grant table related
hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a
check. As a result, the subsequent code behaved as if version 2 was
in use, when a guest issued this hypercall without a prior
GNTTABOP_setup_table or GNTTABOP_set_version.</p>
<p>The effect is a possible NULL pointer dereferences. However, this
cannot be exploited to elevate privileges of the attacking domain,
as the maximum memory address that can be wrongly accessed this way
is bounded to far below the start of hypervisor memory.</p>
<p>Malicious or buggy guest domain kernels can mount a denial of
service attack which, if successful, can affect the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4163</cvename>
<url>http://xenbits.xen.org/xsa/advisory-134.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ce658051-27ea-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-132.html">
<p>The handler for XEN_DOMCTL_gettscinfo failed to initialize a
padding field subsequently copied to guest memory.</p>
<p>A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
being addressed here regardless of that operation being declared
unsafe for disaggregation by XSA-77.</p>
<p>Malicious or buggy stub domain kernels or tool stacks otherwise
living outside of Domain0 may be able to read sensitive data
relating to the hypervisor or other guests not under the control of
that domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3340</cvename>
<url>http://xenbits.xen.org/xsa/advisory-132.html</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="3d657340-27ea-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-131.html">
<p>Qemu allows guests to not only read, but also write all parts of
the PCI config space (but not extended config space) of passed
through PCI devices not explicitly dealt with for (partial)
emulation purposes.</p>
<p>Since the effect depends on the specific purpose of the the config
space field, it's not possible to give a general statement about the
exact impact on the host or other guests. Privilege escalation,
host crash (Denial of Service), and leaked information all cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4106</cvename>
<url>http://xenbits.xen.org/xsa/advisory-131.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="cbe1a0f9-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Guest triggerable qemu MSI-X pass-through error messages</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-130.html">
<p>Device model code dealing with guest PCI MSI-X interrupt management
activities logs messages on certain (supposedly) invalid guest
operations.</p>
<p>A buggy or malicious guest repeatedly invoking such operations may
result in the host disk to fill up, possibly leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4105</cvename>
<url>http://xenbits.xen.org/xsa/advisory-130.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="4db8a0f4-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- PCI MSI mask bits inadvertently exposed to guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-129.html">
<p>The mask bits optionally available in the PCI MSI capability
structure are used by the hypervisor to occasionally suppress
interrupt delivery. Unprivileged guests were, however, nevertheless
allowed direct control of these bits.</p>
<p>Interrupts may be observed by Xen at unexpected times, which may
lead to a host crash and therefore a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-129.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="af38cfec-27e7-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Potential unintended writes to host MSI message data field via qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-128.html">
<p>Logic is in place to avoid writes to certain host config space
fields when the guest must nevertheless be able to access their
virtual counterparts. A bug in how this logic deals with accesses
spanning multiple fields allows the guest to write to the host MSI
message data field.</p>
<p>While generally the writes write back the values previously read,
their value in config space may have got changed by the host between
the qemu read and write. In such a case host side interrupt handling
could become confused, possibly losing interrupts or allowing
spurious interrupt injection into other guests.</p>
<p>Certain untrusted guest administrators may be able to confuse host
side interrupt handling, leading to a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4103</cvename>
<url>http://xenbits.xen.org/xsa/advisory-128.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="103a47d5-27e7-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Certain domctl operations may be abused to lock up the host</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.3</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-127.html">
<p>XSA-77 put the majority of the domctl operations on a list
excepting them from having security advisories issued for them if
any effects their use might have could hamper security. Subsequently
some of them got declared disaggregation safe, but for a small
subset this was not really correct: Their (mis-)use may result in
host lockups.</p>
<p>As a result, the potential security benefits of toolstack
disaggregation are not always fully realised.</p>
<p>Domains deliberately given partial management control may be able
to deny service to the entire host.</p>
<p>As a result, in a system designed to enhance security by radically
disaggregating the management, the security may be reduced. But,
the security will be no worse than a non-disaggregated design.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2751</cvename>
<url>http://xenbits.xen.org/xsa/advisory-127.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="79f401cd-27e6-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI command register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-126.html">
<p>HVM guests are currently permitted to modify the memory and I/O
decode bits in the PCI command register of devices passed through to
them. Unless the device is an SR-IOV virtual function, after
disabling one or both of these bits subsequent accesses to the MMIO
or I/O port ranges would - on PCI Express devices - lead to
Unsupported Request responses. The treatment of such errors is
platform specific.</p>
<p>Furthermore (at least) devices under control of the Linux pciback
driver in the host are handed to guests with the aforementioned bits
turned off. This means that such accesses can similarly lead to
Unsupported Request responses until these flags are set as needed by
the guest.</p>
<p>In the event that the platform surfaces aforementioned UR responses
as Non-Maskable Interrupts, and either the OS is configured to treat
NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to
treat these errors as fatal, the host would crash, leading to a
Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2756</cvename>
<url>http://xenbits.xen.org/xsa/advisory-126.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="d40c66cb-27e4-11e5-a4a5-002590263bf5">
<topic>xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-125.html">
<p>The XEN_DOMCTL_memory_mapping hypercall allows long running
operations without implementing preemption.</p>
<p>This hypercall is used by the device model as part of the emulation
associated with configuration of PCI devices passed through to HVM
guests and is therefore indirectly exposed to those guests.</p>
<p>This can cause a physical CPU to become busy for a significant
period, leading to a host denial of service in some cases.</p>
<p>If a host denial of service is not triggered then it may instead be
possible to deny service to the domain running the device model,
e.g. domain 0.</p>
<p>This hypercall is also exposed more generally to all toolstacks.
However the uses of it in libxl based toolstacks are not believed
to open up any avenue of attack from an untrusted guest. Other
toolstacks may be vulnerable however.</p>
<p>The vulnerability is exposed via HVM guests which have a PCI device
assigned to them. A malicious HVM guest in such a configuration can
mount a denial of service attack affecting the whole system via its
associated device model (qemu-dm).</p>
<p>A guest is able to trigger this hypercall via operations which it
is legitimately expected to perform, therefore running the device
model as a stub domain does not offer protection against the host
denial of service issue. However it does offer some protection
against secondary issues such as denial of service against dom0.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2752</cvename>
<url>http://xenbits.xen.org/xsa/advisory-125.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="83a28417-27e3-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-123.html">
<p>Instructions with register operands ignore eventual segment
overrides encoded for them. Due to an insufficiently conditional
assignment such a bogus segment override can, however, corrupt a
pointer used subsequently to store the result of the instruction.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests, or to cause denial of service on the host. Arbitrary
code execution, and therefore privilege escalation, cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2151</cvename>
<url>http://xenbits.xen.org/xsa/advisory-123.html</url>
</references>
<dates>
<discovery>2015-03-10</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ef9d041e-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through version information hypercall</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-122.html">
<p>The code handling certain sub-operations of the
HYPERVISOR_xen_version hypercall fails to fully initialize all
fields of structures subsequently copied back to guest memory. Due
to this hypervisor stack contents are copied into the destination of
the operation, thus becoming visible to the guest.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2045</cvename>
<url>http://xenbits.xen.org/xsa/advisory-122.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="5023f559-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak via internal x86 system device emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-121.html">
<p>Emulation routines in the hypervisor dealing with certain system
devices check whether the access size by the guest is a supported
one. When the access size is unsupported these routines failed to
set the data to be returned to the guest for read accesses, so that
hypervisor stack contents are copied into the destination of the
operation, thus becoming visible to the guest.</p>
<p>A malicious HVM guest might be able to read sensitive data relating
to other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2044</cvename>
<url>http://xenbits.xen.org/xsa/advisory-121.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="0d732fd1-27e0-11e5-a4a5-002590263bf5">
<topic>xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-119.html">
<p>When instantiating an emulated VGA device for an x86 HVM guest qemu
will by default enable a backend to expose that device, either SDL
or VNC depending on the version of qemu and the build time
configuration.</p>
<p>The libxl toolstack library does not explicitly disable these
default backends when they are not enabled, leading to an unexpected
backend running.</p>
<p>If either SDL or VNC is explicitly enabled in the guest
configuration then only the expected backends will be enabled.</p>
<p>This affects qemu-xen and qemu-xen-traditional differently.</p>
<p>If qemu-xen was compiled with SDL support then this would result in
an SDL window being opened if $DISPLAY is valid, or a failure to
start the guest if not.</p>
<p>If qemu-xen was compiled without SDL support then qemu would
instead start a VNC server listening on ::1 (IPv6 localhost) or
127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC
password will not be configured even if one is present in the guest
configuration.</p>
<p>qemu-xen-traditional will never start a vnc backend unless
explicitly configured. However by default it will start an SDL
backend if it was built with SDL support and $DISPLAY is valid.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2152</cvename>
<url>http://xenbits.xen.org/xsa/advisory-119.html</url>
</references>
<dates>
<discovery>2015-03-13</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="912cb7f7-27df-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-118.html">
<p>On ARM systems the code which deals with virtualizing the GIC
distributor would, under various circumstances, log messages on a
guest accessible code path without appropriate rate limiting.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1563</cvename>
<url>http://xenbits.xen.org/xsa/advisory-118.html</url>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="785c86b1-27d6-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.5</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-117.html">
<p>When decoding a guest write to a specific register in the virtual
interrupt controller Xen would treat an invalid value as a critical
error and crash the host.</p>
<p>By writing an invalid value to the GICD.SGIR register a guest can
crash the host, resulting in a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0268</cvename>
<url>http://xenbits.xen.org/xsa/advisory-117.html</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="7313b0e3-27b4-11e5-a15a-50af736ef1c0">
<topic>pivotx -- Multiple unrestricted file upload vulnerabilities</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>Multiple unrestricted file upload vulnerabilities in fileupload.php
in PivotX before 2.3.9 allow remote authenticated users to execute
arbitrary PHP code by uploading a file with a (1) .php or (2) .php#
extension, and then accessing it via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="14d846d6-27b3-11e5-a15a-50af736ef1c0">
<topic>pivotx -- cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>cross-site scripting (XSS) vulnerability in the nickname (and
possibly the email) field. Mitigated by the fact that an attacker
must have a PivotX account.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="c93c9395-25e1-11e5-a4a5-002590263bf5">
<topic>wpa_supplicant -- WPS_NFC option payload length validation vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt">
<p>Incomplete WPS and P2P NFC NDEF record payload length
validation. (2015-5)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8041</cvename>
<url>http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-07-09</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="075952fe-267e-11e5-9d03-3c970e169bc2">
<topic>openssl -- alternate chains certificate forgery vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.2_2</ge><lt>1.0.2_4</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.2b</ge><lt>1.0.2d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150709.txt">
<p>During certificate verification, OpenSSL (starting from version
1.0.1n and 1.0.2b) will attempt to find an alternative certificate
chain if the first attempt to build such a chain fails. An error
in the implementation of this logic can mean that an attacker could
cause certain checks on untrusted certificates to be bypassed,
such as the CA flag, enabling them to use a valid leaf certificate
to act as a CA and "issue" an invalid certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1793</cvename>
<url>https://www.openssl.org/news/secadv_20150709.txt</url>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="37ed8e9c-2651-11e5-86ff-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py32-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py33-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py34-django-devel</name>
<range><le>20150531,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jul/08/security-releases/">
<p>In accordance with our security release policy, the Django
team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3.
These releases are now available on PyPI and our download page. These
releases address several security issues detailed below. We encourage
all users of Django to upgrade as soon as possible. The Django master
branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jul/08/security-releases/</url>
<url>https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680</url>
<url>https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44</url>
<url>https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e</url>
<cvename>CVE-2015-5143</cvename>
<cvename>CVE-2015-5144</cvename>
<cvename>CVE-2015-5145</cvename>
</references>
<dates>
<discovery>2015-06-10</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="348bfa69-25a2-11e5-ade1-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html">
<p>
Adobe has released security updates for Adobe Flash Player. These
updates address critical vulnerabilities that could potentially
allow an attacker to take control of the affected system. Adobe is
aware of a report that an exploit targeting CVE-2015-5119 has been
publicly published.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-16.html</url>
<cvename>CVE-2015-5119</cvename>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-08</entry>
</dates>
</vuln>
<vuln vid="c93533a3-24f1-11e5-8b74-3c970e169bc2">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P2</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P1</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_19</lt></range>
<range><ge>8.4</ge><lt>8.4_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01267/">
<p>A very uncommon combination of zone data has been found
that triggers a bug in BIND, with the result that named
will exit with a "REQUIRE" failure in name.c when validating
the data returned in answer to a recursive query.</p>
<p>A recursive resolver that is performing DNSSEC validation
can be deliberately terminated by any attacker who can
cause a query to be performed against a maliciously
constructed zone. This will result in a denial of
service to clients who rely on that resolver.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:11.bind</freebsdsa>
<cvename>CVE-2015-4620</cvename>
<url>https://kb.isc.org/article/AA-01267/</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-07</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="cbfa8bd7-24b6-11e5-86ff-14dae9d210b8">
<topic>haproxy -- information leak vulnerability</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.5.0</ge><lt>1.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAProxy reports:</p>
<blockquote cite="http://www.haproxy.org/news.html">
<p>A vulnerability was found when HTTP pipelining is used. In
some cases, a client might be able to cause a buffer alignment issue and
retrieve uninitialized memory contents that exhibit data from a past
request or session. I want to address sincere congratulations to Charlie
Smurthwaite of aTech Media for the really detailed traces he provided
which made it possible to find the cause of this bug. Every user of
1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev
snapshot to fix this issue, or use the backport of the fix provided by
their operating system vendors. CVE-2015-3281 was assigned to this bug.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.haproxy.org/news.html</url>
<url>http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4</url>
<mlist>http://seclists.org/oss-sec/2015/q3/61</mlist>
<cvename>CVE-2015-3281</cvename>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="038a5808-24b3-11e5-b0c8-bf4d8935d4fa">
<topic>roundcube -- multiple vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/">
<p>We just published updates to both stable versions 1.0 and
1.1 after fixing many minor bugs and adding some security improvements
to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes
from the more recent version to ensure proper long term support
especially in regards of security and compatibility.<br/>
<br/>
The security-related fixes in particular are:<br/>
<br/>
* XSS vulnerability in _mbox argument<br/>
* security improvement in contact photo handling<br/>
* potential info disclosure from temp directory</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5381</cvename>
<cvename>CVE-2015-5383</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/07/06/10</mlist>
<url>https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/</url>
</references>
<dates>
<discovery>2015-05-30</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="543b5939-2067-11e5-a4a5-002590263bf5">
<topic>turnserver -- SQL injection vulnerability</topic>
<affects>
<package>
<name>turnserver</name>
<range><lt>4.4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oleg Moskalenko reports:</p>
<blockquote cite="http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog">
<p>SQL injection security hole fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog</url>
<mlist>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J</mlist>
</references>
<dates>
<discovery>2015-06-20</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="150d1538-23fa-11e5-a4a5-002590263bf5">
<topic>squid -- Improper Protection of Alternate Path with CONNECT requests</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_2.txt">
<p>Squid configured with cache_peer and operating on explicit proxy
traffic does not correctly handle CONNECT method peer responses.</p>
<p>The bug is important because it allows remote clients to bypass
security in an explicit gateway proxy.</p>
<p>However, the bug is exploitable only if you have configured
cache_peer to receive CONNECT requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_2.txt</url>
<cvename>CVE-2015-5400</cvename>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-17</modified>
</dates>
</vuln>
<vuln vid="b6da24da-23f7-11e5-a4a5-002590263bf5">
<topic>squid -- client-first SSL-bump does not correctly validate X509 server certificate</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5</ge><lt>3.5.4</lt></range>
<range><ge>3.4</ge><lt>3.4.13</lt></range>
</package>
<package>
<name>squid33</name>
<range><ge>3.3</ge><lt>3.3.14</lt></range>
</package>
<package>
<name>squid32</name>
<range><ge>3.2</ge><lt>3.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_1.txt">
<p>Squid configured with client-first SSL-bump does not correctly
validate X509 server certificate domain / hostname fields.</p>
<p>The bug is important because it allows remote servers to bypass
client certificate validation. Some attackers may also be able
to use valid certificates for one domain signed by a global
Certificate Authority to abuse an unrelated domain.</p>
<p>However, the bug is exploitable only if you have configured
Squid to perform SSL Bumping with the "client-first" or "bump"
mode of operation.</p>
<p>Sites that do not use SSL-Bump are not vulnerable.</p>
<p>All Squid built without SSL support are not vulnerable to the
problem.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2015-3455</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_1.txt</url>
</references>
<dates>
<discovery>2015-05-01</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="72fccfdf-2061-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Ensure that hostnames match certificate names when using HTTPS -
resolved in Ansible 1.9.2</p>
<p>Improper symlink handling in zone, jail, and chroot connection
plugins could lead to escape from confined environment - resolved
in Ansible 1.9.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3908</cvename>
<cvename>CVE-2015-6240</cvename>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md</url>
</references>
<dates>
<discovery>2015-06-25</discovery>
<entry>2015-07-02</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="e308c61a-2060-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
local data when using a legacy Ansible syntax - resolved in
Ansible 1.7</p>
<p>ansible-galaxy command when used on local tarballs (and not
galaxy.ansible.com) can install a malformed tarball if so provided
- resolved in Ansible 1.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="9dae9d62-205f-11e5-a4a5-002590263bf5">
<topic>ansible -- code execution from compromised remote host data or untrusted local data</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
untrusted local data - resolved in Ansible 1.6.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4966</cvename>
<bid>68794</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-07-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="2c493ac8-205e-11e5-a4a5-002590263bf5">
<topic>ansible -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Incomplete Fix Remote Code Execution Vulnerability - Fixed in
Ansible 1.6.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4678</cvename>
<bid>68335</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a6a9f9d5-205c-11e5-a4a5-002590263bf5">
<topic>ansible -- local symlink exploits</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259">
<p>runner/connection_plugins/ssh.py in Ansible before 1.2.3, when
using ControlPersist, allows local users to redirect a ssh session
via a symlink attack on a socket file with a predictable name in
/tmp/.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260">
<p>lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3,
when playbook does not run due to an error, allows local users to
overwrite arbitrary files via a symlink attack on a retry file with
a predictable name in /var/tmp/ansible/.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4259</cvename>
<cvename>CVE-2013-4260</cvename>
<url>http://www.ansible.com/security</url>
<url>https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg</url>
</references>
<dates>
<discovery>2013-08-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a478421e-2059-11e5-a4a5-002590263bf5">
<topic>ansible -- enable host key checking in paramiko connection type</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible changelog reports:</p>
<blockquote cite="https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md">
<p>Host key checking is on by default. Disable it if you like by
adding host_key_checking=False in the [default] section of
/etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting
ANSIBLE_HOST_KEY_CHECKING=False.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2233</cvename>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
<url>http://www.ansible.com/security</url>
<url>https://github.com/ansible/ansible/issues/857</url>
</references>
<dates>
<discovery>2012-08-13</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="d7b9a28d-238c-11e5-86ff-14dae9d210b8">
<topic>bitcoin -- denial of service</topic>
<affects>
<package>
<name>bitcoin</name>
<range><lt>0.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gregory Maxwell reports:</p>
<blockquote cite="http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core">
<p>On July 7th I will be making public details of several
serious denial of service vulnerabilities which have fixed in recent
versions of Bitcoin Core, including including CVE-2015-3641.
I strongly recommend anyone running production nodes exposed to inbound
connections from the internet upgrade to 0.10.2 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3641</cvename>
<url>http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core</url>
<url>https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures</url>
</references>
<dates>
<discovery>2015-06-27</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="864e6f75-2372-11e5-86ff-14dae9d210b8">
<topic>node, iojs, and v8 -- denial of service</topic>
<affects>
<package>
<name>node</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>node-devel</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>iojs</name>
<range><lt>2.3.3</lt></range>
</package>
<package>
<name>v8</name>
<range><le>3.18.5</le></range>
</package>
<package>
<name>v8-devel</name>
<range><le>3.27.7_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/">
<p>This release of Node.js fixes a bug that triggers an
out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to
String conversions. This is an important security update as this bug can
be used to cause a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/</url>
<url>https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6</url>
<url>https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676</url>
<url>https://codereview.chromium.org/1226493003</url>
<cvename>CVE-2015-5380</cvename>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-10</modified>
</dates>
</vuln>
<vuln vid="bf1d9331-21b6-11e5-86ff-14dae9d210b8">
<topic>cups-filters -- texttopdf integer overflow</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/03/2">
<p>An integer overflow flaw leading to a heap-based buffer overflow was
discovered in the way the texttopdf utility of cups-filter processed
print jobs with a specially crafted line size. An attacker being able
to submit print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code with the privileges of the 'lp' user.</p>
</blockquote>
<p>Tim Waugh reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365">
<p>The Page allocation is moved into textcommon.c, where it does all the
necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds
for CVE-2015-3259 due to integer overflows for the calloc() call
initializing Page[0] and the memset() call in texttopdf.c's
WritePage() function zeroing the entire array.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3279</cvename>
<url>https://access.redhat.com/security/cve/CVE-2015-3279</url>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365</url>
<mlist>http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html</mlist>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-03</entry>
<modified>2015-07-07</modified>
</dates>
</vuln>
<vuln vid="9c7177ff-1fe1-11e5-9a01-bcaec565249c">
<topic>libxml2 -- Enforce the reader to run in constant memory</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.2_3</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_5</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veilland reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9">
<p>Enforce the reader to run in constant memory. One of the
operation on the reader could resolve entities leading to
the classic expansion issue. Make sure the buffer used for
xmlreader operation is bounded. Introduce a new allocation
type for the buffers for this effect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1819</cvename>
<url>https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9</url>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-07-01</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="2a8b7d21-1ecc-11e5-a4a5-002590263bf5">
<topic>wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension</topic>
<affects>
<package>
<name>wesnoth</name>
<range><lt>1.12.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ignacio R. Morelle reports:</p>
<blockquote cite="http://forums.wesnoth.org/viewtopic.php?t=42776">
<p>As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release
announcements, a security vulnerability targeting add-on authors
was found (bug #23504) which allowed a malicious user to obtain
add-on server passphrases from the client's .pbl files and transmit
them over the network, or store them in saved game files intended
to be shared by the victim. This vulnerability affects all existing
releases up to and including versions 1.12.2 and 1.13.0.
Additionally, version 1.12.3 included only a partial fix that failed
to guard users against attempts to read from .pbl files with an
uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070
have been assigned to the vulnerability affecting .pbl files with a
lowercase extension, and .pbl files with an uppercase or mixed-case
extension, respectively.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5069</cvename>
<cvename>CVE-2015-5070</cvename>
<url>http://forums.wesnoth.org/viewtopic.php?t=42776</url>
<url>http://forums.wesnoth.org/viewtopic.php?t=42775</url>
</references>
<dates>
<discovery>2015-06-28</discovery>
<entry>2015-07-01</entry>
</dates>
</vuln>
<vuln vid="b19da422-1e02-11e5-b43d-002590263bf5">
<topic>cups-filters -- buffer overflow in texttopdf size allocation</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.70</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/26/4">
<p>A heap-based buffer overflow was discovered in the way the
texttopdf utility of cups-filters processed print jobs with a
specially crafted line size. An attacker being able to submit
print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>Till Kamppeter reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363">
<p>texttopdf: Fixed buffer overflow on size allocation of texttopdf
when working with extremely small line sizes, which causes the size
calculation to result in 0 (CVE-2015-3258, thanks to Stefan
Cornelius from Red Hat for the patch).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3258</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/4</mlist>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0d0f3050-1f69-11e5-9ba9-d050996490d0">
<topic>ntp -- control message remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p3</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">
<p>Under limited and specific circumstances an attacker can send a
crafted packet to cause a vulnerable ntpd instance to crash.
This requires each of the following to be true:</p>
<ul>
<li>ntpd set up to allow for remote configuration (not
allowed by default), and</li>
<li>knowledge of the configuration password, and</li>
<li>access to a computer entrusted to perform remote
configuration.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.ntp.org/show_bug.cgi?id=2853</url>
<url>https://www.kb.cert.org/vuls/id/668167</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</url>
</references>
<dates>
<discovery>2015-06-29</discovery>
<entry>2015-06-30</entry>
</dates>
</vuln>
<vuln vid="acd5d037-1c33-11e5-be9c-6805ca1d3bb1">
<topic>qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209)</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_20</lt></range>
<range><ge>0.12</ge><lt>2.3.0_2</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150618_1</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The QEMU security team reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-135.html">
<p>A guest which has access to an emulated PCNET network
device (e.g. with "model=pcnet" in their VIF configuration)
can exploit this vulnerability to take over the qemu
process elevating its privilege to that of the qemu
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-135.html</url>
<cvename>CVE-2015-3209</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-06-26</entry>
<modified>2015-07-11</modified>
</dates>
</vuln>
<vuln vid="23232028-1ba4-11e5-b43d-002590263bf5">
<topic>elasticsearch -- security fix for shared file-system repositories</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions from 1.0.0 to
1.5.2 are vulnerable to an attack that uses Elasticsearch to modify
files read and executed by certain other applications.</p>
<p>Remediation Summary: Users should upgrade to 1.6.0. Alternately,
ensure that other applications are not present on the system, or
that Elasticsearch cannot write into areas where these applications
would read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4165</cvename>
<freebsdpr>ports/201008</freebsdpr>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-6-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="a71e7440-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- directory traversal attack with site plugins</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.5</lt></range>
<range><ge>1.5.0</ge><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions prior to 1.5.2
and 1.4.5 are vulnerable to a directory traversal attack that allows
an attacker to retrieve files from the server running Elasticsearch
when one or more site plugins are installed, or when Windows is the
server OS.</p>
<p>Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users
that do not want to upgrade can address the vulnerability by
disabling site plugins. See the CVE description for additional
options.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3337</cvename>
<bid>74353</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released</url>
<url>https://www.exploit-db.com/exploits/37054/</url>
<url>https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html</url>
<url>http://www.securityfocus.com/archive/1/535385</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="026759e0-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- remote OS command execution via Groovy scripting engine</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.3.0</ge><lt>1.3.8</lt></range>
<range><ge>1.4.0</ge><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and
1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that
were introduced in 1.3.0. The vulnerability allows an attacker to
construct Groovy scripts that escape the sandbox and execute shell
commands as the user running the Elasticsearch Java VM.</p>
<p>Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users
that do not want to upgrade can address the vulnerability by setting
script.groovy.sandbox.enabled to false in elasticsearch.yml and
restarting the node.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1427</cvename>
<bid>72585</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released</url>
<url>http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded</url>
<url>https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html</url>
<url>https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html</url>
</references>
<dates>
<discovery>2015-02-11</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="5951fb49-1ba2-11e5-b43d-002590263bf5">
<topic>elasticsearch -- cross site scripting vulnerability in the CORS functionality</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.x and prior have
a default configuration for CORS that allows an attacker to craft
links that could cause a user's browser to send requests to
Elasticsearch instances on their local network. These requests could
cause data loss or compromise.</p>
<p>Remediation Summary: Users should either set "http.cors.enabled" to
false, or set "http.cors.allow-origin" to the value of the server
that should be allowed access, such as localhost or a server hosting
Kibana. Disabling CORS entirely with the former setting is more
secure, but may not be suitable for all use cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6439</cvename>
<bid>70233</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released</url>
<url>https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html</url>
<url>http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded</url>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="43ac9d42-1b9a-11e5-b43d-002590263bf5">
<topic>elasticsearch and logstash -- remote OS command execution via dynamic scripting</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: In Elasticsearch versions 1.1.x and prior,
dynamic scripting is enabled by default. This could allow an
attacker to execute OS commands.</p>
<p>Remediation Summary: Disable dynamic scripting.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is
vulnerable to CVE-2014-3120. These binaries are used in
Elasticsearch output specifically when using the node protocol.
Since a node client joins the Elasticsearch cluster, the attackers
could use scripts to execute commands on the host OS using the node
client's URL endpoint. With 1.4.3 release, we are packaging Logstash
with Elasticsearch 1.5.2 binaries which by default disables the
ability to run scripts. This also affects users who are using the
configuration option embedded=>true in the Elasticsearch output
which starts a local embedded Elasticsearch cluster. This is
typically used in development environment and proof of concept
deployments. Regardless of this vulnerability, we strongly recommend
not using embedded in production.</p>
<p>Note that users of transport and http protocol are not vulnerable
to this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3120</cvename>
<bid>67731</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-2-0-released</url>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.exploit-db.com/exploits/33370/</url>
<url>http://bouk.co/blog/elasticsearch-rce/</url>
<url>http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce</url>
<url>https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch</url>
</references>
<dates>
<discovery>2014-05-22</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="24bde04f-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Directory traversal vulnerability in the file output plugin</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>An attacker could use the File output plugin with dynamic field
references in the path option to traverse paths outside of Logstash
directory. This technique could also be used to overwrite any files
which can be accessed with permissions associated with Logstash
user. This release sandboxes the paths which can be traversed using
the configuration. We have also disallowed use of dynamic field
references if the path options is pointing to an absolute path.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE. We would like to thank Colin Coghill for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4152</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="2184ccad-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-2">
<p>The vulnerability impacts deployments that use the either the
zabbix or the nagios_nsca outputs. In these cases, an attacker
with an ability to send crafted events to any source of data for
Logstash could execute operating system commands with the
permissions of the Logstash process.</p>
<p>Deployments that do not use the zabbix or the nagios_nsca outputs
are not vulnerable and do not need to upgrade for this reason.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE.</p>
<p>We would like to thank Jan Karwowski and Danila Borisiuk for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4326</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-2</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="ad4d3871-1a0d-11e5-b43d-002590263bf5">
<topic>logstash-forwarder and logstash -- susceptibility to POODLE vulnerability</topic>
<affects>
<package>
<name>logstash-forwarder</name>
<range><lt>0.4.0.20150507</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>The combination of Logstash Forwarder and Lumberjack input (and
output) was vulnerable to the POODLE attack in SSLv3 protocol. We
have disabled SSLv3 for this combination and set the minimum version
to be TLSv1.0. We have added this vulnerability to our CVE page and
are working on filling out the CVE.</p>
<p>Thanks to Tray Torrance, Marc Chadwick, and David Arena for
reporting this.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-forwarder-0-4-0-released">
<p>SSLv3 is no longer supported; TLS 1.0+ is required (compatible
with Logstash 1.4.2+).</p>
</blockquote>
</body>
</description>
<references>
<!-- POODLE CVE pending -->
<freebsdpr>ports/201065</freebsdpr>
<freebsdpr>ports/201065</freebsdpr>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/blog/logstash-forwarder-0-4-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
<modified>2015-06-24</modified>
</dates>
</vuln>
<vuln vid="d02f6b01-1a3f-11e5-8bd6-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address a critical
vulnerability (CVE-2015-3113) that could potentially allow an
attacker to take control of the affected system.
</p>
<p>
Adobe is aware of reports that CVE-2015-3113 is being actively
exploited in the wild via limited, targeted attacks. Systems running
Internet Explorer for Windows 7 and below, as well as Firefox on
Windows XP, are known targets.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-14.html</url>
<cvename>CVE-2015-3113</cvename>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="f5225b23-192d-11e5-a1cf-002590263bf5">
<topic>rubygem-bson -- DoS and possible injection</topic>
<affects>
<package>
<name>rubygem-bson</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phill MV reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/06/1">
<p>By submitting a specially crafted string to a service relying on
the bson rubygem, an attacker may trigger denials of service or even
inject data into victim's MongoDB instances.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4412</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/06/1</mlist>
<url>http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html</url>
<url>https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="cdff0af2-1492-11e5-a1cf-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-dom</name>
<name>php5-ftp</name>
<name>php5-gd</name>
<name>php5-pgsql</name>
<range><lt>5.4.42</lt></range>
</package>
<package>
<name>php55-dom</name>
<name>php55-ftp</name>
<name>php55-gd</name>
<name>php55-pgsql</name>
<range><lt>5.5.26</lt></range>
</package>
<package>
<name>php56-dom</name>
<name>php56-ftp</name>
<name>php56-gd</name>
<name>php56-psql</name>
<range><lt>5.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>DOM and GD:</p>
<ul>
<li>Fixed bug #69719 (Incorrect handling of paths with NULs).</li>
</ul>
<p>FTP:</p>
<ul>
<li>Improved fix for bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4643)</li>
</ul>
<p>Postgres:</p>
<ul>
<li>Fixed bug #69667 (segfault in php_pgsql_meta_data).
(CVE-2015-4644)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4643</cvename>
<cvename>CVE-2015-4644</cvename>
<url>http://www.php.net/ChangeLog-5.php#5.4.42</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.26</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.10</url>
<mlist>http://openwall.com/lists/oss-security/2015/06/18/3</mlist>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="a4460ac7-192c-11e5-9c01-bcaec55be5e5">
<topic>devel/ipython -- remote execution</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/779">
<p>Summary: JSON error responses from the IPython notebook REST API
contained URL parameters and were incorrectly reported as text/html
instead of application/json. The error messages included some of these
URL params, resulting in a cross site scripting attack. This affects
users on Mozilla Firefox but not Chromium/Google Chrome.</p>
<p>API paths with issues:</p>
<ul>
<li>/api/contents (3.0-3.1)</li>
<li>/api/notebooks (2.0-2.4, 3.0-3.1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4706</cvename>
<cvename>CVE-2015-4707</cvename>
<url>http://seclists.org/oss-sec/2015/q2/779</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="d46ed7b8-1912-11e5-9fdf-00262d5ed8ee">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[464922] High CVE-2015-1266: Scheme validation error in WebUI.
Credit to anonymous.</li>
<li>[494640] High CVE-2015-1268: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink.
Credit to anonymous.</li>
<li>[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP
preload list. Credit to Mike Ruddy.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1266</cvename>
<cvename>CVE-2015-1267</cvename>
<cvename>CVE-2015-1268</cvename>
<cvename>CVE-2015-1269</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0f154810-16e4-11e5-a1cf-002590263bf5">
<topic>rubygem-paperclip -- validation bypass vulnerability</topic>
<affects>
<package>
<name>rubygem-paperclip</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Yurek reports:</p>
<blockquote cite="https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57">
<p>Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.</p>
<p>There is an issue where if an HTML file is uploaded with a .html
extension, but the content type is listed as being `image/jpeg`,
this will bypass a validation checking for images. But it will also
pass the spoof check, because a file named .html and containing
actual HTML passes the spoof check.</p>
<p>This change makes it so that we also check the supplied content
type. So even if the file contains HTML and ends with .html, it
doesn't match the content type of `image/jpeg` and so it fails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2963</cvename>
<url>https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57</url>
<url>https://robots.thoughtbot.com/paperclip-security-release</url>
<url>http://jvn.jp/en/jp/JVN83881261/index.html</url>
</references>
<dates>
<discovery>2015-06-05</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0da404ad-1891-11e5-a1cf-002590263bf5">
<topic>chicken -- Potential buffer overrun in string-translate*</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html">
<p>Using gcc's Address Sanitizer, it was discovered that the string-translate*
procedure from the data-structures unit can scan beyond the input string's
length up to the length of the source strings in the map that's passed to
string-translate*. This issue was fixed in master 8a46020, and it will
make its way into CHICKEN 4.10.</p>
<p>This bug is present in all released versions of CHICKEN.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4556</cvename>
<freebsdpr>ports/200980</freebsdpr>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html</mlist>
</references>
<dates>
<discovery>2015-06-15</discovery>
<entry>2015-06-22</entry>
<modified>2015-07-31</modified>
</dates>
</vuln>
<vuln vid="e7b7f2b5-177a-11e5-ad33-f8d111029e6a">
<topic>chicken -- buffer overrun in substring-index[-ci]</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Moritz Heidkamp reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html">
<p>The substring-index[-ci] procedures of the data-structures unit are
vulnerable to a buffer overrun attack when passed an integer greater
than zero as the optional START argument.</p>
<p>As a work-around you can switch to SRFI 13's
string-contains procedure which also returns the substring's index in
case it is found.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9651</cvename>
<mlist>http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt</mlist>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-06-22</entry>
<modified>2015-06-23</modified>
</dates>
</vuln>
<vuln vid="a3929112-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8d.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulnerabilities</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed SQL injection VN: JVN#78187936 /
TN:JPCERT#98968540</li>
<li>bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting
Vulnerability Notification</li>
<li>bug#0002571: SQL Injection and Location header injection from
cdef id CVE-2015-4342</li>
<li>bug#0002572: SQL injection in graph template</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4342</cvename>
<freebsdpr>ports/200963</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8d.php</url>
<mlist>http://seclists.org/fulldisclosure/2015/Jun/19</mlist>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="a0e74731-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8c.php">
<p>Important Security Fixes</p>
<ul>
<li>CVE-2013-5588 - XSS issue via installer or device editing</li>
<li>CVE-2013-5589 - SQL injection vulnerability in device editing</li>
<li>CVE-2014-2326 - XSS issue via CDEF editing</li>
<li>CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability</li>
<li>CVE-2014-2328 - Remote Command Execution Vulnerability in graph export</li>
<li>CVE-2014-4002 - XSS issues in multiple files</li>
<li>CVE-2014-5025 - XSS issue via data source editing</li>
<li>CVE-2014-5026 - XSS issues in multiple files</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5588</cvename>
<cvename>CVE-2013-5589</cvename>
<cvename>CVE-2014-2326</cvename>
<cvename>CVE-2014-2327</cvename>
<cvename>CVE-2014-2328</cvename>
<cvename>CVE-2014-4002</cvename>
<cvename>CVE-2014-5025</cvename>
<cvename>CVE-2014-5026</cvename>
<freebsdpr>ports/198586</freebsdpr>
<mlist>http://sourceforge.net/p/cacti/mailman/message/33072838/</mlist>
<url>http://www.cacti.net/release_notes_0_8_8c.php</url>
</references>
<dates>
<discovery>2014-11-23</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="968d1e74-1740-11e5-a643-40a8f0757fb4">
<topic>p5-Dancer -- possible to abuse session cookie values</topic>
<affects>
<package>
<name>p5-Dancer</name>
<range><lt>1.3138</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Russell Jenkins reports:</p>
<blockquote cite="INSERT URL HERE">
<p>It was possible to abuse session cookie values so that
file-based session stores such as Dancer::Session::YAML or
Dancer2::Session::YAML would attempt to read/write from
any file on the filesystem with the same extension the
file-based store uses, such as '*.yml' for the YAML
stores.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html</url>
</references>
<dates>
<discovery>2015-06-12</discovery>
<entry>2015-06-20</entry>
</dates>
</vuln>
<vuln vid="d605edb1-1616-11e5-a000-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.36</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-002">
<h3>Impersonation (OpenID module - Drupal 6 and 7 - Critical)</h3>
<p>A vulnerability was found in the OpenID module that allows
a malicious user to log in as other users on the site,
including administrators, and hijack their accounts.</p>
<p>This vulnerability is mitigated by the fact that the victim
must have an account with an associated OpenID identity from
a particular set of OpenID providers (including, but not
limited to, Verisign, LiveJournal, or StackExchange).</p>
<h3>Open redirect (Field UI module - Drupal 7 - Less critical)</h3>
<p>The Field UI module uses a "destinations" query string parameter
in URLs to redirect users to new destinations after completing
an action on a few administration pages. Under certain
circumstances, malicious users can use this parameter to
construct a URL that will trick users into being redirected
to a 3rd party website, thereby exposing the users to potential
social engineering attacks.</p>
<p>This vulnerability is mitigated by the fact that only sites
with the Field UI module enabled are affected.</p>
<p>Drupal 6 core is not affected, but see the similar advisory
for the Drupal 6 contributed CCK module:
<a href="https://www.drupal.org/node/2507753">SA-CONTRIB-2015-126</a></p>
<h3>Open redirect (Overlay module - Drupal 7 - Less critical)</h3>
<p>The Overlay module displays administrative pages as a layer
over the current page (using JavaScript), rather than replacing
the page in the browser window. The Overlay module does not
sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only
be used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.</p>
<h3>Information disclosure (Render cache system - Drupal 7
- Less critical)</h3>
<p>On sites utilizing Drupal 7's render cache system to cache
content on the site by user role, private content viewed by
user 1 may be included in the cache and exposed to non-privileged
users.</p>
<p>This vulnerability is mitigated by the fact that render caching
is not used in Drupal 7 core itself (it requires custom code or
the contributed <a href="https://www.drupal.org/project/render_cache">Render
Cache</a> module to enable) and that it only affects sites that
have user 1 browsing the live site. Exposure is also limited if an
administrative role has been assigned to the user 1 account (which
is done, for example, by the Standard install profile that ships
with Drupal core).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3231</cvename>
<cvename>CVE-2015-3232</cvename>
<cvename>CVE-2015-3233</cvename>
<cvename>CVE-2015-3234</cvename>
<url>https://www.drupal.org/SA-CORE-2015-002</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-19</entry>
</dates>
</vuln>
<vuln vid="2438d4af-1538-11e5-a106-3c970e169bc2">
<topic>cURL -- Multiple Vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.40</ge><lt>7.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617A.html">
<p>libcurl can wrongly send HTTP credentials when re-using
connections.</p>
<p>libcurl allows applications to set credentials for the
upcoming transfer with HTTP Basic authentication, like
with CURLOPT_USERPWD for example. Name and password.
Just like all other libcurl options the credentials
are sticky and are kept associated with the "handle"
until something is made to change the situation.</p>
<p>Further, libcurl offers a curl_easy_reset() function
that resets a handle back to its pristine state in
terms of all settable options. A reset is of course
also supposed to clear the credentials. A reset is
typically used to clear up the handle and prepare
it for a new, possibly unrelated, transfer.</p>
<p>Within such a handle, libcurl can also store a
set of previous connections in case a second transfer
is requested to a host name for which an existing
connection is already kept alive.</p>
<p>With this flaw present, using the handle even
after a reset would make libcurl accidentally use
those credentials in a subsequent request if done
to the same host name and connection as was
previously accessed.</p>
<p>An example case would be first requesting a password
protected resource from one section of a web site, and
then do a second request of a public resource from a
completely different part of the site without
authentication. This flaw would then inadvertently
leak the credentials in the second request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617B.html">
<p>libcurl can get tricked by a malicious SMB server to
send off data it did not intend to.</p>
<p>In libcurl's state machine function handling the SMB
protocol (smb_request_state()), two length and offset
values are extracted from data that has arrived over
the network, and those values are subsequently used
to figure out what data range to send back.</p>
<p>The values are used and trusted without boundary
checks and are just assumed to be valid. This allows
carefully handcrafted packages to trick libcurl
into responding and sending off data that was not
intended. Or just crash if the values cause libcurl
to access invalid memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3236</cvename>
<cvename>CVE-2015-3237</cvename>
<url>http://curl.haxx.se/docs/adv_20150617A.html</url>
<url>http://curl.haxx.se/docs/adv_20150617B.html</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="eb8a8978-8dd5-49ce-87f4-49667b2166dd">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-activesupport4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-jquery-rails</name>
<range><lt>3.1.3</lt></range>
</package>
<package>
<name>rubygem-jquery-rails4</name>
<range><lt>4.0.4</lt></range>
</package>
<package>
<name>rubygem-rack</name>
<range><lt>1.4.6</lt></range>
</package>
<package>
<name>rubygem-rack15</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-web-console</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/">
<p>Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web
console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1840</cvename>
<cvename>CVE-2015-3224</cvename>
<cvename>CVE-2015-3225</cvename>
<cvename>CVE-2015-3226</cvename>
<cvename>CVE-2015-3227</cvename>
<url>http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/</url>
</references>
<dates>
<discovery>2015-06-16</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="c67069dc-0986-11e5-bb90-002590263bf5">
<topic>testdisk -- buffer overflow with malicious disk image</topic>
<affects>
<package>
<name>testdisk</name>
<range><lt>7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CGSecurity TestDisk Changelog reports:</p>
<blockquote cite="http://www.cgsecurity.org/wiki/TestDisk_7.0_Release">
<p>Various fix including security fix, thanks to:</p>
<ul>
<li><p>Coverity scan (Static Analysis of source code)</p></li>
<li><p>afl-fuzz (security-oriented fuzzer).</p></li>
<li><p>Denis Andzakovic from Security Assessment for reporting an
exploitable Stack Buffer Overflow.</p></li>
</ul>
</blockquote>
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf">
<p>A buffer overflow is triggered within the software when a malicious
disk image is attempted to be recovered. This may be leveraged by an
attacker to crash TestDisk and gain control of program execution. An
attacker would have to coerce the victim to run TestDisk against
their malicious image.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cgsecurity.org/wiki/TestDisk_7.0_Release</url>
<url>http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-06-16</entry>
</dates>
</vuln>
<vuln vid="25e0593d-13c0-11e5-9afb-3c970e169bc2">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.44</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.55</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.9</lt></range>
</package>
<package>
<name>hadoop2</name>
<range><le>2.6.0</le></range>
</package>
<package>
<name>oozie</name>
<range><le>4.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44">
<p>Low: Denial of Service CVE-2014-0230</p>
<p>When a response for a request with a request body is
returned to the user agent before the request body is
fully read, by default Tomcat swallows the remaining
request body so that the next request on the connection
may be processed. There was no limit to the size of
request body that Tomcat would swallow. This permitted
a limited Denial of Service as Tomcat would never close
the connection and a processing thread would remain
allocated to the connection.</p>
<p>Moderate: Security Manager bypass CVE-2014-7810</p>
<p>Malicious web applications could use expression
language to bypass the protections of a Security
Manager as expressions were evaluated within a
privileged code section.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0230</cvename>
<cvename>CVE-2014-7810</cvename>
<url>https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-06-16</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="c470db07-1098-11e5-b6a8-002590263bf5">
<topic>security/ossec-hids-* -- root escalation via syscheck feature</topic>
<affects>
<package>
<name>ossec-hids-server</name>
<name>ossec-hids-client</name>
<name>ossec-hids-local</name>
<range><ge>2.7</ge><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSSEC reports:</p>
<blockquote cite="http://www.ossec.net/?p=1198">
<p>The CVE-2015-3222 vulnerability, which allows for root escalation
via sys check has been fixed in OSSEC 2.8.2. This issue does not
affect agents.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3222</cvename>
<freebsdpr>ports/200801</freebsdpr>
<url>http://www.ossec.net/?p=1198</url>
<url>https://github.com/ossec/ossec-hids/releases/tag/2.8.2</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-12</entry>
</dates>
</vuln>
<vuln vid="8305e215-1080-11e5-8ba2-000c2980a9f3">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_2</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2b</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_6</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.1.7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_12</lt></range>
<range><ge>9.3</ge><lt>9.3_16</lt></range>
<range><ge>8.4</ge><lt>8.4_30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150611.txt">
<ul>
<li>Missing DHE man-in-the-middle protection (Logjam)
(CVE-2015-4000)</li>
<li>Malformed ECParameters causes infinite loop (CVE-2015-1788)</li>
<li>Exploitable out-of-bounds read in X509_cmp_time
(CVE-2015-1789)</li>
<li>PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)</li>
<li>CMS verify infinite loop with unknown hash function
(CVE-2015-1792)</li>
<li>Race condition handling NewSessionTicket (CVE-2015-1791)</li>
<li>Invalid free in DTLS (CVE-2014-8176)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8176</cvename>
<cvename>CVE-2015-1788</cvename>
<cvename>CVE-2015-1789</cvename>
<cvename>CVE-2015-1790</cvename>
<cvename>CVE-2015-1791</cvename>
<cvename>CVE-2015-1792</cvename>
<cvename>CVE-2015-4000</cvename>
<freebsdsa>SA-15:10.openssl</freebsdsa>
<url>https://www.openssl.org/news/secadv_20150611.txt</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="1e63db88-1050-11e5-a4df-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-11.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
</p>
<p>
These updates resolve a vulnerability (CVE-2015-3096) that could be
exploited to bypass the fix for CVE-2014-5333.
</p>
<p>
These updates improve memory address randomization of the Flash heap
for the Window 7 64-bit platform (CVE-2015-3097).
</p>
<p>
These updates resolve vulnerabilities that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
</p>
<p>
These updates resolve a stack overflow vulnerability that could lead
to code execution (CVE-2015-3100).
</p>
<p>
These updates resolve a permission issue in the Flash broker for
Internet Explorer that could be exploited to perform privilege
escalation from low to medium integrity level (CVE-2015-3101).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3104).
</p>
<p>
These updates resolve a memory corruption vulnerability that could
lead to code execution (CVE-2015-3105).
</p>
<p>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
</p>
<p>
These updates resolve a memory leak vulnerability that could be used
to bypass ASLR (CVE-2015-3108).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-11.html</url>
<cvename>CVE-2015-3096</cvename>
<cvename>CVE-2015-3097</cvename>
<cvename>CVE-2015-3098</cvename>
<cvename>CVE-2015-3099</cvename>
<cvename>CVE-2015-3100</cvename>
<cvename>CVE-2015-3101</cvename>
<cvename>CVE-2015-3102</cvename>
<cvename>CVE-2015-3103</cvename>
<cvename>CVE-2015-3104</cvename>
<cvename>CVE-2015-3105</cvename>
<cvename>CVE-2015-3106</cvename>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-3108</cvename>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-11</entry>
</dates>
</vuln>
<vuln vid="10a6d0aa-0b1c-11e5-bb90-002590263bf5">
<topic>libzmq4 -- V3 protocol handler vulnerable to downgrade attacks</topic>
<affects>
<package>
<name>libzmq4</name>
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
<range><ge>4.1.0</ge><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pieter Hintjens reports:</p>
<blockquote cite="https://github.com/zeromq/libzmq/issues/1273">
<p>It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by
sending a ZMTP v2 or earlier header. The library accepts such
connections without applying its security mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9721</cvename>
<url>https://github.com/zeromq/libzmq/issues/1273</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/07/8</mlist>
<freebsdpr>ports/200502</freebsdpr>
</references>
<dates>
<discovery>2014-12-04</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="8fbd4187-0f18-11e5-b6a8-002590263bf5">
<topic>pgbouncer -- remote denial of service</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><lt>1.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/">
<p>Fix remote crash - invalid packet order causes lookup of NULL pointer. Not
exploitable, just DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4054</cvename>
<url>https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/21/2</mlist>
<freebsdpr>ports/200507</freebsdpr>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="a40ec970-0efa-11e5-90e4-d050996490d0">
<topic>cups -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CUPS development team reports:</p>
<blockquote cite="https://cups.org/blog.php?L1082">
<p>The new release addresses two security vulnerabilities,
add localizations for German and Russian, and includes
several general bug fixes. Changes include:</p>
<p>Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159
exploiting the dynamic linker (STR #4609)</p>
<p>Security: The scheduler could hang with malformed
gzip data (STR #4602)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1158</cvename>
<cvename>CVE-2015-1159</cvename>
<url>https://cups.org/blog.php?L1082</url>
<url>https://www.kb.cert.org/vuls/id/810572</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="55363e65-0e71-11e5-8027-00167671dd1d">
<topic>strongswan -- Denial-of-service and potential remote code execution vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>5.2.2</ge><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>StrongSwan Project reports</p>
<blockquote cite="https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html">
<p>A denial-of-service and potential remote code execution vulnerability
triggered by crafted IKE messages was discovered in strongSwan. Versions
5.2.2 and 5.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3991</cvename>
<url>https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-06-09</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="10d14955-0e45-11e5-b6a8-002590263bf5">
<topic>strongswan -- Information Leak Vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.3.0</ge><lt>5.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan Project reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html">
<p>An information leak vulnerability was fixed that, in certain IKEv2
setups, allowed rogue servers with a valid certificate accepted by
the client to trick it into disclosing user credentials (even plain
passwords if the client accepts EAP-GTC). This was caused because
constraints against the server's authentication were enforced too
late. All versions since 4.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4171</cvename>
<url>http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html</url>
</references>
<dates>
<discovery>2015-06-08</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="838fa84a-0e25-11e5-90e4-d050996490d0">
<topic>redis -- EVAL Lua Sandbox Escape</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><ge>2.6.0</ge><lt>2.8.21</lt></range>
<range><ge>3.0</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Murphy reports:</p>
<blockquote cite="http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/">
<p>It is possible to break out of the Lua sandbox in
Redis and execute arbitrary code.</p>
<p>This shouldn’t pose a threat to users under the
trusted Redis security model where only trusted
users can connect to the database. However, in real
deployments there could be databases that can be
accessed by untrusted users. The main deployments
that are vulnerable are developers machines, places
where redis servers can be reached via SSRF attacks
and cloud hosting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4335</cvename>
<url>http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-08</entry>
</dates>
</vuln>
<vuln vid="bd1ab7a5-0e01-11e5-9976-a0f3c100ae18">
<topic>tidy -- heap-buffer-overflow</topic>
<affects>
<package>
<name>tidy4</name>
<range><le>20000804_3</le></range>
</package>
<package>
<name>tidy-devel</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-lib</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-html5</name>
<range><lt>4.9.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Geoff McLane reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/633">
<p>tidy is affected by a write out of bounds when processing malformed html files.</p>
<p>This issue could be abused on server side applications that use php-tidy extension with user input.</p>
<p>The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/htacg/tidy-html5/issues/217</url>
<url>http://seclists.org/oss-sec/2015/q2/633</url>
<url>http://seclists.org/oss-sec/2015/q3/116</url>
<cvename>CVE-2015-5522</cvename>
<cvename>CVE-2015-5523</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2015-06-08</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="e69af246-0ae2-11e5-90e4-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1636">
<p>PCRE library is prone to a vulnerability which leads
to Heap Overflow. During the compilation of a malformed
regular expression, more data is written on the malloced
block than the expected size output by compile_regex.</p>
</blockquote>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1638">
<p>PCRE library is prone to a vulnerability which leads to
Stack Overflow. Without enough bound checking inside
match(), the stack memory could be overflowed via a
crafted regular expression.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3210</cvename>
<cvename>CVE-2015-3217</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1636</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1638</url>
</references>
<dates>
<discovery>2015-05-29</discovery>
<entry>2015-06-04</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="bbc0db92-084c-11e5-bb90-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hostapd</name>
<range><lt>2.4_1</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt">
<p>WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2
- CVE-2015-4141)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt">
<p>Integer underflow in AP mode WMM Action frame processing. (2015-3 -
CVE-2015-4142)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt">
<p>EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143,
CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt</url>
<url>http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt</url>
<url>http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt</url>
<cvename>CVE-2015-4141</cvename>
<cvename>CVE-2015-4142</cvename>
<cvename>CVE-2015-4143</cvename>
<cvename>CVE-2015-4144</cvename>
<cvename>CVE-2015-4145</cvename>
<cvename>CVE-2015-4146</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/05/31/6</mlist>
</references>
<dates>
<discovery>2015-05-04</discovery>
<entry>2015-06-01</entry>
</dates>
</vuln>
<vuln vid="65b14d39-d01f-419c-b0b8-5df60b929973">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<name>ffmpeg0</name>
<range><lt>0.7.17,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<cvename>CVE-2012-5150</cvename>
<cvename>CVE-2014-4609</cvename>
<cvename>CVE-2014-8541</cvename>
<cvename>CVE-2014-8542</cvename>
<cvename>CVE-2014-8543</cvename>
<cvename>CVE-2014-8545</cvename>
<cvename>CVE-2014-8547</cvename>
<cvename>CVE-2014-8548</cvename>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2015-1872</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-06-02</entry>
</dates>
</vuln>
<vuln vid="022255be-0895-11e5-a242-5404a68ad561">
<topic>avidemux26 -- multiple vulnerabilities in bundled FFmpeg</topic>
<affects>
<package>
<name>avidemux2</name>
<range><lt>2.6.8</lt></range>
</package>
<package>
<name>avidemux26</name>
<range><lt>2.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mageia project reports:</p>
<blockquote cite="http://advisories.mageia.org/MGASA-2015-0233.html">
<p>Avidemux is built with a bundled set of FFmpeg libraries.
The bundled FFmpeg version has been updated from 1.2.10
to 1.2.12 to fix these security issues and other bugs
fixed upstream in FFmpeg.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2014-9604</cvename>
<cvename>CVE-2015-1872</cvename>
<cvename>CVE-2015-3417</cvename>
<freebsdpr>ports/200507</freebsdpr>
<url>http://advisories.mageia.org/MGASA-2015-0233.html</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-06-01</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="ffe2d86c-07d9-11e5-9a28-001e67150279">
<topic>rest-client -- plaintext password disclosure</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The open sourced vulnerability database reports:</p>
<blockquote cite="http://osvdb.org/show/osvdb/117461">
<p>REST Client for Ruby contains a flaw that is due to the application
logging password information in plaintext. This may allow a local
attacker to gain access to password information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3448</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/349</url>
<url>http://osvdb.org/show/osvdb/117461</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="83a7a720-07d8-11e5-9a28-001e67150279">
<topic>rest-client -- session fixation vulnerability</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Brody reports:</p>
<blockquote cite="https://github.com/rest-client/rest-client/issues/369">
<p>When Ruby rest-client processes an HTTP redirection response,
it blindly passes along the values from any Set-Cookie headers to the
redirection target, regardless of domain, path, or expiration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1820</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/369</url>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="cfb12f02-06e1-11e5-8fda-002590263bf5">
<topic>cabextract -- directory traversal with UTF-8 symbols in filenames</topic>
<affects>
<package>
<name>cabextract</name>
<range><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cabextract ChangeLog reports:</p>
<blockquote cite="http://www.cabextract.org.uk/#changes">
<p>It was possible for cabinet files to extract to absolute file
locations, and it was possible on Cygwin to get around cabextract's
absolute and relative path protections by using backslashes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cabextract.org.uk/#changes</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/02/18/3</mlist>
<cvename>CVE-2015-2060</cvename>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="cc7548ef-06e1-11e5-8fda-002590263bf5">
<topic>libmspack -- frame_end overflow which could cause infinite loop</topic>
<affects>
<package>
<name>libmspack</name>
<range><lt>0.5</lt></range>
</package>
<package>
<name>cabextract</name>
<range><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.</p>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556">
<p>Integer overflow in the qtmd_decompress function in libmspack 0.4
allows remote attackers to cause a denial of service (hang) via a
crafted CAB file, which triggers an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9556</cvename>
<url>https://bugs.debian.org/773041</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/01/07/2</mlist>
</references>
<dates>
<discovery>2014-12-11</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="48504af7-07ad-11e5-879c-00e0814cab4e">
<topic>django -- Fixed session flushing in the cached_db backend</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/may/20/security-release/">
<p>A change to session.flush() in the cached_db session backend in
Django 1.8 mistakenly sets the session key to an empty string
rather than None. An empty string is treated as a valid session key
and the session cookie is set accordingly. Any users with an empty
string in their session cookie will use the same session store.
session.flush() is called by django.contrib.auth.logout() and, more
seriously, by django.contrib.auth.login() when a user switches accounts.
If a user is logged in and logs in again to a different account
(without logging out) the session is flushed to avoid reuse.
After the session is flushed (and its session key becomes '') the
account details are set on the session and the session is saved.
Any users with an empty string in their session cookie will now be
logged into that account.</p>
<p>Thanks to Sam Cooke for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/may/20/security-release/</url>
<cvename>CVE-2015-3982</cvename>
</references>
<dates>
<discovery>2015-05-20</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="9471ec47-05a2-11e5-8fda-002590263bf5">
<topic>proxychains-ng -- current path as the first directory for the library search path</topic>
<affects>
<package>
<name>proxychains-ng</name>
<range><lt>4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mamoru TASAKA reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/430">
<p>proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so
and execvp() the arbitrary command user has specified.
proxychains4 sets the current directory as the first path
to search libproxychains4.so</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/05/12/6</mlist>
<mlist>http://seclists.org/oss-sec/2015/q2/430</mlist>
<cvename>CVE-2015-3887</cvename>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-29</entry>
</dates>
</vuln>
<vuln vid="a13500d0-0570-11e5-aab1-d050996490d0">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-12</p>
<p>The LBMR dissector could go into an infinite loop.
(Bug 11036) CVE-2015-3808, CVE-2015-3809</p></li>
<li><p>wnpa-sec-2015-13</p>
<p>The WebSocket dissector could recurse excessively.
(Bug 10989) CVE-2015-3810</p></li>
<li><p>wnpa-sec-2015-14</p>
<p>The WCP dissector could crash while decompressing data.
(Bug 10978) CVE-2015-3811</p></li>
<li><p>wnpa-sec-2015-15</p>
<p>The X11 dissector could leak memory. (Bug 11088)
CVE-2015-3812</p></li>
<li><p>wnpa-sec-2015-16</p>
<p>The packet reassembly code could leak memory.
(Bug 11129) CVE-2015-3813</p></li>
<li><p>wnpa-sec-2015-17</p>
<p>The IEEE 802.11 dissector could go into an infinite loop.
(Bug 11110) CVE-2015-3814</p></li>
<li><p>wnpa-sec-2015-18</p>
<p>The Android Logcat file parser could crash. Discovered by
Hanno Böck. (Bug 11188) CVE-2015-3815</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3808</cvename>
<cvename>CVE-2015-3809</cvename>
<cvename>CVE-2015-3810</cvename>
<cvename>CVE-2015-3811</cvename>
<cvename>CVE-2015-3812</cvename>
<cvename>CVE-2015-3813</cvename>
<cvename>CVE-2015-3814</cvename>
<cvename>CVE-2015-3815</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-14.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-15.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-16.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-17.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-18.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="406636fe-055d-11e5-aab1-d050996490d0">
<topic>krb5 -- requires_preauth bypass in PKINIT-enabled KDC</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.2</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160">
<p>In MIT krb5 1.12 and later, when the KDC is configured
with PKINIT support, an unauthenticated remote attacker
can bypass the requires_preauth flag on a client principal
and obtain a ciphertext encrypted in the principal's
long-term key. This ciphertext could be used to conduct
an off-line dictionary attack against the user's password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2694</cvename>
<url>http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="27f742f6-03f4-11e5-aab1-d050996490d0">
<topic>cURL -- sensitive HTTP server headers also sent to proxies</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150429.html">
<p>libcurl provides applications a way to set custom HTTP
headers to be sent to the server by using CURLOPT_HTTPHEADER.
A similar option is available for the curl command-line
tool with the '--header' option.</p>
<p>When the connection passes through an HTTP proxy the
same set of headers is sent to the proxy as well by default.
While this is by design, it has not necessarily been clear
nor understood by application programmers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3153</cvename>
<url>http://curl.haxx.se/docs/adv_20150429.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="6294f75f-03f2-11e5-aab1-d050996490d0">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422A.html">
<p>libcurl keeps a pool of its last few connections around
after use to facilitate easy, convenient, and completely
transparent connection re-use for applications.</p>
<p>When doing HTTP requests NTLM authenticated, the entire
connection becomes authenticated and not just the
specific HTTP request which is otherwise how HTTP works.
This makes NTLM special and a subject for special
treatment in the code. With NTLM, once the connection is
authenticated, no further authentication is necessary until
the connection gets closed.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422B.html">
<p>When doing HTTP requests Negotiate authenticated, the
entire connection may become authenticated and not just
the specific HTTP request which is otherwise how HTTP
works, as Negotiate can basically use NTLM under the hood.
curl was not adhering to this fact but would assume that
such requests would also be authenticated per request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422C.html">
<p>libcurl supports HTTP "cookies" as documented in RFC 6265.
Together with each individual cookie there are several
different properties, but for this vulnerability we
focus on the associated "path" element. It tells
information about for which path on a given host the
cookies is valid.</p>
<p>The internal libcurl function called sanitize_cookie_path()
that cleans up the path element as given to it from a
remote site or when read from a file, did not properly
validate the input. If given a path that consisted of a
single double-quote, libcurl would index a newly
allocated memory area with index -1 and assign a zero
to it, thus destroying heap memory it wasn't supposed to.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422D.html">
<p>There is a private function in libcurl called fix_hostname()
that removes a trailing dot from the host name if there is
one. The function is called after the host name has been
extracted from the URL libcurl has been told to act on.</p>
<p>If a URL is given with a zero-length host name, like in
"http://:80" or just ":80", fix_hostname() will index the
host name pointer with a -1 offset (as it blindly assumes
a non-zero length) and both read and assign that address.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20150422A.html</url>
<url>http://curl.haxx.se/docs/adv_20150422B.html</url>
<url>http://curl.haxx.se/docs/adv_20150422C.html</url>
<url>http://curl.haxx.se/docs/adv_20150422D.html</url>
<cvename>CVE-2014-3143</cvename>
<cvename>CVE-2014-3144</cvename>
<cvename>CVE-2014-3145</cvename>
<cvename>CVE-2014-3148</cvename>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="607f4d44-0158-11e5-8fda-002590263bf5">
<topic>cassandra -- remote execution of arbitrary code</topic>
<affects>
<package>
<name>cassandra</name>
<range><ge>1.2.0</ge><le>1.2.19</le></range>
</package>
<package>
<name>cassandra2</name>
<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jake Luciani reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/">
<p>Under its default configuration, Cassandra binds an unauthenticated
JMX/RMI interface to all network interfaces. As RMI is an API for the
transport and remote execution of serialized Java, anyone with access
to this interface can execute arbitrary code as the running user.</p>
<p>Mitigation:</p>
<p>1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade
to a supported version of Cassandra, or manually configure encryption
and authentication of JMX,
(see https://wiki.apache.org/cassandra/JmxSecurity).</p>
<p>2.0.x users should upgrade to 2.0.14</p>
<p>2.1.x users should upgrade to 2.1.4</p>
<p>Alternately, users of any version not wishing to upgrade can
reconfigure JMX/RMI to enable encryption and authentication according
to https://wiki.apache.org/cassandra/JmxSecurityor
http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html</p>
<p>Credit:</p>
<p>This issue was discovered by Georgi Geshev of MWR InfoSecurity</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/</url>
<cvename>CVE-2015-0225</cvename>
</references>
<dates>
<discovery>2015-04-01</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="865863af-fb5e-11e4-8fda-002590263bf5">
<topic>py-salt -- potential shell injection vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colton Myers reports:</p>
<blockquote cite="http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html">
<p>In order to fix potential shell injection vulnerabilities in salt
modules, a change has been made to the various cmd module functions.
These functions now default to python_shell=False, which means that
the commands will not be sent to an actual shell.</p>
<p>The largest side effect of this change is that "shellisms", such as
pipes, will not work by default. The modules shipped with salt have
been audited to fix any issues that might have arisen from this
change. Additionally, the cmd state module has been unaffected, and
use of cmd.run in jinja is also unaffected. cmd.run calls on the
CLI will also allow shellisms.</p>
<p>However, custom execution modules which use shellisms in cmd calls
will break, unless you pass python_shell=True to these calls.</p>
<p>As a temporary workaround, you can set cmd_safe: False in your
minion and master configs. This will revert the default, but is
also less secure, as it will allow shell injection vulnerabilities
to be written in custom code. We recommend you only set this
setting for as long as it takes to resolve these issues in your
custom code, then remove the override.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html</url>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="384fc0b2-0144-11e5-8fda-002590263bf5">
<topic>davmail -- fix potential CVE-2014-3566 vulnerability (POODLE)</topic>
<affects>
<package>
<name>davmail</name>
<range><lt>4.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mickaël Guessant reports:</p>
<blockquote cite="http://sourceforge.net/p/davmail/mailman/message/33279118/">
<p>DavMail 4.6.0 released</p>
<p>Enhancements: Fix potential CVE-2014-3566 vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/p/davmail/mailman/message/33279118/</url>
<url>http://sourceforge.net/p/davmail/code/2322/</url>
<cvename>CVE-2014-3566</cvename>
</references>
<dates>
<discovery>2014-10-27</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="7927165a-0126-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- remotely exploitable buffer overflow in release candidate</topic>
<affects>
<package>
<name>dnsmasq-devel</name>
<range><ge>2.73rc6</ge><lt>2.73rc8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html">
<p>Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a
remotely exploitable buffer overflow in those trees. I just tagged
2.[73]rc8, which includes the fix.
</p>
</blockquote>
<p>(Corrections from second URL.)</p>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html</url>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="37569eb7-0125-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- data exposure and denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.72_1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.73rc4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294"><p>The tcp_request function in Dnsmasq before 2.73rc4
does not properly handle the return value of the setup_reply function,
which allows remote attackers to read process memory and cause a
denial of service (out-of-bounds read and crash) via a malformed DNS
request."</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html</url>
<cvename>CVE-2015-3294</cvename>
<url>http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="4a88e3ed-00d3-11e5-a072-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PCRE development team reports:</p>
<blockquote cite="http://www.pcre.org/original/changelog.txt">
<p>A pattern such as "((?2){0,1999}())?", which has a group
containing a forward reference repeated a large (but limited)
number of times within a repeated outer group that has a zero
minimum quantifier, caused incorrect code to be compiled,
leading to the error "internal error: previously-checked
referenced subpattern not found" when an incorrect memory
address was read. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs and given
the CVE number CVE-2015-2325.</p>
<p>A pattern such as "((?+1)(\1))/" containing a forward
reference subroutine call within a group that also contained
a recursive back reference caused incorrect code to be
compiled. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs,
and given the CVE number CVE-2015-2326.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2325</cvename>
<cvename>CVE-2015-2326</cvename>
<url>http://www.pcre.org/original/changelog.txt</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-05-22</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="31de2e13-00d2-11e5-a072-d050996490d0">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.41</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.25</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="https://php.net/ChangeLog-5.php#5.6.9">
<p>Fixed bug #69364 (PHP Multipart/form-data remote DoS
Vulnerability). (CVE-2015-4024)</p>
<p>Fixed bug #69418 (CVE-2006-7243 fix regressions in
5.4+). (CVE-2015-4025)</p>
<p>Fixed bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4022)</p>
<p>Fixed bug #68598 (pcntl_exec() should not allow null
char). (CVE-2015-4026)</p>
<p>Fixed bug #69453 (Memory Corruption in phar_parse_tarfile
when entry filename starts with null). (CVE-2015-4021)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4021</cvename>
<cvename>CVE-2015-4022</cvename>
<cvename>CVE-2015-4024</cvename>
<cvename>CVE-2015-4025</cvename>
<cvename>CVE-2015-4026</cvename>
<url>https://php.net/ChangeLog-5.php#5.6.9</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="fc38cd83-00b3-11e5-8ebd-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.20</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.16</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.11</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.7</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1587/">
<p>
This update fixes three security vulnerabilities reported in
PostgreSQL over the past few months. Nether of these issues is seen as
particularly urgent. However, users should examine them in case their
installations are vulnerable:.
</p>
<ul>
<li>CVE-2015-3165 Double "free" after authentication timeout.</li>
<li>CVE-2015-3166 Unanticipated errors from the standard library.</li>
<li>CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3165</cvename>
<cvename>CVE-2015-3166</cvename>
<cvename>CVE-2015-3167</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="d0034536-ff24-11e4-a072-d050996490d0">
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ProFTPd development team reports:</p>
<blockquote cite="http://bugs.proftpd.org/show_bug.cgi?id=4169">
<p>Vadim Melihow reported a critical issue with proftpd
installations that use the mod_copy module's SITE CPFR/SITE
CPTO commands; mod_copy allows these commands to be used by
*unauthenticated clients*.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3306</cvename>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4169</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-05-20</entry>
</dates>
</vuln>
<vuln vid="35431f79-fe3e-11e4-ba63-000c292ee6b8">
<topic>ipsec-tools -- Memory leak leading to denial of service</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javantea reports:</p>
<blockquote cite="https://www.altsci.com/ipsec/">
<p>It is a null dereference crash, leading to denial of
service against the IKE daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.altsci.com/ipsec/</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a9d456b4-fe4c-11e4-ad15-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit
to anonymous.</li>
<li>[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[444927] High CVE-2015-1254: Cross-origin bypass in Editing.
Credit to armin@rawsec.net.</li>
<li>[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
to Khalil Zhani.</li>
<li>[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
Atte Kettunen of OUSPG.</li>
<li>[481015] High CVE-2015-1251: Use-after-free in Speech. Credit
to SkyLined working with HP's Zero Day Initiative.</li>
<li>[468519] Medium CVE-2015-1257: Container-overflow in SVG.
Credit to miaubiz.</li>
<li>[450939] Medium CVE-2015-1258: Negative-size parameter in
libvpx. Credit to cloudfuzzer</li>
<li>[468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
Credit to Atte Kettunen of OUSPG</li>
<li>[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
to Khalil Zhani.</li>
<li>[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
Nurminen.</li>
<li>[476647] Medium CVE-2015-1262: Uninitialized value in Blink.
Credit to miaubiz.</li>
<li>[479162] Low CVE-2015-1263: Insecure download of spellcheck
dictionary. Credit to Mike Ruddy.</li>
<li>[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.</li>
<li>[489518] CVE-2015-1265: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.3
branch (currently 4.3.61.21).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html</url>
<cvename>CVE-2015-1251</cvename>
<cvename>CVE-2015-1252</cvename>
<cvename>CVE-2015-1253</cvename>
<cvename>CVE-2015-1254</cvename>
<cvename>CVE-2015-1255</cvename>
<cvename>CVE-2015-1256</cvename>
<cvename>CVE-2015-1257</cvename>
<cvename>CVE-2015-1258</cvename>
<cvename>CVE-2015-1259</cvename>
<cvename>CVE-2015-1260</cvename>
<cvename>CVE-2015-1261</cvename>
<cvename>CVE-2015-1262</cvename>
<cvename>CVE-2015-1263</cvename>
<cvename>CVE-2015-1264</cvename>
<cvename>CVE-2015-1265</cvename>
</references>
<dates>
<discovery>2015-05-19</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="3d0428b2-fdfb-11e4-894f-d050996490d0">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.98.7</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html">
<p>ClamAV 0.98.7 is here! This release contains new
scanning features and bug fixes.</p>
<p>Fix infinite loop condition on crafted y0da cryptor file.
Identified and patch suggested by Sebastian Andrzej Siewior.
CVE-2015-2221.</p>
<p>Fix crash on crafted petite packed file. Reported and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2222.</p>
<p>Fix an infinite loop condition on a crafted "xz" archive
file. This was reported by Dimitri Kirchner and Goulven
Guiheux. CVE-2015-2668.</p>
<p>Apply upstream patch for possible heap overflow in Henry
Spencer's regex library. CVE-2015-2305.</p>
<p>Fix crash in upx decoder with crafted file. Discovered and
patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2170</cvename>
<cvename>CVE-2015-2221</cvename>
<cvename>CVE-2015-2222</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2668</cvename>
<url>http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a0089e18-fc9e-11e4-bc58-001e67150279">
<topic>rubygems -- request hijacking vulnerability</topic>
<affects>
<package>
<name>ruby20-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby21-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby22-gems</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Claudius reports:</p>
<blockquote cite="http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html">
<p>RubyGems provides the ability of a domain to direct clients to a
separate host that is used to fetch gems and make API calls against.
This mechanism is implemented via DNS, specifically a SRV record
_rubygems._tcp under the original requested domain.</p>
<p>RubyGems did not validate the hostname returned in the SRV record
before sending requests to it. This left clients open to a DNS
hijack attack, whereby an attacker could return a SRV of their
choosing and get the client to use it.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/200264</freebsdpr>
<cvename>CVE-2015-3900</cvename>
<url>http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-17</entry>
</dates>
</vuln>
<vuln vid="2780e442-fc59-11e4-b18b-6805ca1d3bb1">
<topic>qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_19</lt></range>
<range><ge>0.12</ge><lt>2.3.0_1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150501_1</lt></range>
</package>
<package>
<name>virtualbox-ose</name>
<range><lt>4.3.28</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><ge>4.5.0</ge><lt>4.5.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Geffner, CrowdStrike Senior Security Researcher reports:</p>
<blockquote cite="http://venom.crowdstrike.com/">
<p>VENOM, CVE-2015-3456, is a security vulnerability in
the virtual floppy drive code used by many computer
virtualization platforms. This vulnerability may allow
an attacker to escape from the confines of an affected
virtual machine (VM) guest and potentially obtain
code-execution access to the host. Absent mitigation,
this VM escape could open access to the host system and
all other VMs running on that host, potentially giving
adversaries significant elevated access to the host's
local network and adjacent systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3456</cvename>
<freebsdpr>ports/200255</freebsdpr>
<freebsdpr>ports/200256</freebsdpr>
<freebsdpr>ports/200257</freebsdpr>
<url>http://venom.crowdstrike.com/</url>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html</url>
<url>http://xenbits.xen.org/xsa/advisory-133.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-17</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="49d9c28c-fbad-11e4-b0fb-00269ee29e57">
<topic>Quassel IRC -- SQL injection vulnerability</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quassel IRC developers report:</p>
<blockquote cite="http://www.quassel-irc.org/node/127">
<p>Restarting a PostgreSQL database while Quassel Core is running
would not properly re-initialize the database session inside Quassel,
bringing back an old security issue (CVE-2013-4422).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283</url>
<cvename>CVE-2015-3427</cvename>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-16</entry>
</dates>
</vuln>
<vuln vid="c368155a-fa83-11e4-bc58-001e67150279">
<topic>rubygem-redcarpet -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-redcarpet</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel LeCheminant reports:</p>
<blockquote cite="https://hackerone.com/reports/46916">
<p>When markdown is being presented as HTML, there seems to be a
strange interaction between _ and @ that lets an attacker insert
malicious tags.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/04/07/11</mlist>
<url>https://hackerone.com/reports/46916</url>
<url>http://danlec.com/blog/bug-in-sundown-and-redcarpet</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-14</entry>
</dates>
</vuln>
<vuln vid="57325ecf-facc-11e4-968f-b888e347c638">
<topic>dcraw -- integer overflow condition</topic>
<affects>
<package>
<name>cinepaint</name>
<!-- no known fixed version -->
<range><ge>0.22.0</ge></range>
</package>
<package>
<name>darktable</name>
<range><lt>1.6.7</lt></range>
</package>
<package>
<name>dcraw</name>
<range><ge>7.00</ge><lt>9.26</lt></range>
</package>
<package>
<name>dcraw-m</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>exact-image</name>
<range><lt>0.9.1</lt></range>
</package>
<package>
<name>flphoto</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>freeimage</name>
<range><ge>3.13.0</ge><lt>3.16.0_1</lt></range>
</package>
<package>
<name>kodi</name>
<range><lt>14.2_1</lt></range>
</package>
<package>
<name>libraw</name>
<range><lt>0.16.1</lt></range>
</package>
<package>
<name>lightzone</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>netpbm</name>
<range><lt>10.35.96</lt></range>
</package>
<package>
<name>opengtl</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>rawstudio</name>
<range><lt>2.0_11</lt></range>
</package>
<package>
<name>ufraw</name>
<range><lt>0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ocert reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-006.html">
<p>The dcraw tool, as well as several other projects re-using its
code, suffers from an integer overflow condition which lead to a
buffer overflow.</p>
<p>The vulnerability concerns the 'len' variable, parsed without
validation from opened images, used in the ljpeg_start()
function.</p>
<p>A maliciously crafted raw image file can be used to trigger the
vulnerability, causing a Denial of Service condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3885</cvename>
<url>http://www.ocert.org/advisories/ocert-2015-006.html</url>
<url>https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e</url>
<url>https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5</url>
<url>https://sourceforge.net/p/netpbm/code/2512/</url>
</references>
<dates>
<discovery>2015-04-24</discovery>
<entry>2015-05-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="c6e31869-f99f-11e4-9f91-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php">
<p>XSRF/CSRF vulnerability in phpMyAdmin setup.</p>
<p>By deceiving a user to click on a crafted URL, it is
possible to alter the configuration file being generated
with phpMyAdmin setup.</p>
<p>This vulnerability only affects the configuration file
generation process and does not affect the effective
configuration file. Moreover, the configuration file being
generated is at risk only during the period when it's
writable.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php">
<p> Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be
exploited to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php</url>
<cvename>CVE-2015-3902</cvename>
<cvename>CVE-2015-3903</cvename>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe recommends users update their product
installations to the latest versions.
</p>
<p>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
CVE-2015-3093).
</p>
<p>
These updates resolve a heap overflow vulnerability that could lead
to code execution (CVE-2015-3088).
</p>
<p>
These updates resolve a time-of-check time-of-use (TOCTOU) race
condition that could be exploited to bypass Protected Mode in
Internet Explorer (CVE-2015-3081).
</p>
<p>
These updates resolve validation bypass issues that could be
exploited to write arbitrary data to the file system under user
permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3087).
</p>
<p>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
</p>
<p>
These updates resolve a use-after-free vulnerability that could lead
to code execution (CVE-2015-3080).
</p>
<p>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
</p>
<p>
These updates resolve a security bypass vulnerability that could lead
to information disclosure (CVE-2015-3079), and provide additional
hardening to protect against CVE-2015-3044.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-3077</cvename>
<cvename>CVE-2015-3078</cvename>
<cvename>CVE-2015-3079</cvename>
<cvename>CVE-2015-3080</cvename>
<cvename>CVE-2015-3081</cvename>
<cvename>CVE-2015-3082</cvename>
<cvename>CVE-2015-3083</cvename>
<cvename>CVE-2015-3084</cvename>
<cvename>CVE-2015-3085</cvename>
<cvename>CVE-2015-3086</cvename>
<cvename>CVE-2015-3087</cvename>
<cvename>CVE-2015-3088</cvename>
<cvename>CVE-2015-3089</cvename>
<cvename>CVE-2015-3090</cvename>
<cvename>CVE-2015-3091</cvename>
<cvename>CVE-2015-3092</cvename>
<cvename>CVE-2015-3093</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0
/ rv:31.7)</p>
<p>MFSA-2015-47 Buffer overflow parsing H.264 video with
Linux Gstreamer</p>
<p>MFSA-2015-48 Buffer overflow with SVG content and CSS</p>
<p>MFSA-2015-49 Referrer policy ignored when links opened by
middle-click and context menu</p>
<p>MFSA-2015-50 Out-of-bounds read and write in asm.js validation</p>
<p>MFSA-2015-51 Use-after-free during text processing with
vertical text enabled</p>
<p>MFSA-2015-52 Sensitive URL encoded information written to
Android logcat</p>
<p>MFSA-2015-53 Use-after-free due to Media Decoder Thread creation
during shutdown</p>
<p>MFSA-2015-54 Buffer overflow when parsing compressed XML</p>
<p>MFSA-2015-55 Buffer overflow and out-of-bounds read while
parsing MP4 video metadata</p>
<p>MFSA-2015-56 Untrusted site hosting trusted page can
intercept webchannel responses</p>
<p>MFSA-2015-57 Privilege escalation through IPC channel messages</p>
<p>MFSA-2015-58 Mozilla Windows updater can be run outside
of application directory</p>
<p>MFSA 2015-93 Integer overflows in libstagefright while processing
MP4 video metadata</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3079</cvename>
<cvename>CVE-2015-0797</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-2708</cvename>
<cvename>CVE-2015-2709</cvename>
<cvename>CVE-2015-2710</cvename>
<cvename>CVE-2015-2711</cvename>
<cvename>CVE-2015-2712</cvename>
<cvename>CVE-2015-2713</cvename>
<cvename>CVE-2015-2714</cvename>
<cvename>CVE-2015-2715</cvename>
<cvename>CVE-2015-2716</cvename>
<cvename>CVE-2015-2717</cvename>
<cvename>CVE-2015-2718</cvename>
<cvename>CVE-2015-2720</cvename>
<cvename>CVE-2015-4496</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-48/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-53/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-55/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-93/</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-12</entry>
<modified>2015-08-28</modified>
</dates>
</vuln>
<vuln vid="fe910ed6-f88d-11e4-9ae3-0050562a4d7b">
<topic>suricata -- TLS/DER Parser Bug (DoS)</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OISF Development Team reports:</p>
<blockquote cite="https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2015-May/003406.html">
<p>The OISF development team is pleased to announce Suricata 2.0.8.
This release fixes a number of issues in the 2.0 series.</p>
<p>The most important issue is a bug in the DER parser which is used to
decode SSL/TLS certificates could crash Suricata. This issue was
reported by Kostya Kortchinsky of the Google Security Team and was fixed
by Pierre Chifflier of ANSSI.</p>
<p>Those processing large numbers of (untrusted) pcap files need to update
as a malformed pcap could crash Suricata. Again, credits go to Kostya
Kortchinsky.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0971</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971</url>
<url>https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7</url>
</references>
<dates>
<discovery>2015-05-06</discovery>
<entry>2015-05-12</entry>
</dates>
</vuln>
<vuln vid="0b040e24-f751-11e4-b24d-5453ed2e2b49">
<topic>libssh -- null pointer dereference</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/">
<p>libssh versions 0.5.1 and above have a logical error in the
handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A
detected error did not set the session into the error state
correctly and further processed the packet which leads to a null
pointer dereference. This is the packet after the initial key
exchange and doesn’t require authentication.</p>
<p>This could be used for a Denial of Service (DoS) attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3146</cvename>
<url>https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-05-10</entry>
</dates>
</vuln>
<vuln vid="b13af778-f4fc-11e4-a95d-ac9e174be3af">
<topic>Vulnerability in HWP document filter</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>4.3.7</lt></range>
</package>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.1_9</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1677190,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1774">
<p>The HWP filter in LibreOffice before 4.3.7 and 4.4.x before
4.4.2 and Apache OpenOffice before 4.1.2 allows remote
attackers to cause a denial of service (crash) or possibly
execute arbitrary code via a crafted HWP document, which
triggers an out-of-bounds write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1774</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-1774.html</url>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
</dates>
</vuln>
<vuln vid="d86890da-f498-11e4-99aa-bcaec565249c">
<topic>wordpress -- 2 cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/05/wordpress-4-2-2/">
<p>The Genericons icon font package, which is used in a number of
popular themes and plugins, contained an HTML file vulnerable to
a cross-site scripting attack. All affected themes and plugins
hosted on WordPress.org (including the Twenty Fifteen default
theme) have been updated today by the WordPress security team
to address this issue by removing this nonessential file. To
help protect other Genericons usage, WordPress 4.2.2
proactively scans the wp-content directory for this HTML
file and removes it. Reported by Robert Abela of Netsparker.</p>
<p>WordPress versions 4.2 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. WordPress 4.2.2 includes a
comprehensive fix for this issue.</p>
<p>The release also includes hardening for a potential cross-site
scripting vulnerability when using the visual editor. This issue
was reported by Mahadev Subedi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/05/wordpress-4-2-2/</url>
</references>
<dates>
<discovery>2015-05-07</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="ba4f9b19-ed9d-11e4-9118-bcaec565249c">
<topic>wordpress -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-2-1/">
<p>WordPress 4.2.1 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>A few hours ago, the WordPress team was made aware of a
cross-site scripting vulnerability, which could enable commenters
to compromise a site. The vulnerability was discovered by Jouko
Pynnöne.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-2-1/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="64e6006e-f009-11e4-98c6-000c292ee6b8">
<topic>powerdns -- Label decompression bug can cause crashes or CPU spikes</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PowerDNS project reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/">
<p>A bug was discovered in our label decompression code, making it
possible for names to refer to themselves, thus causing a loop during
decompression. On some platforms, this bug can be abused to cause
crashes. On all platforms, this bug can be abused to cause
service-affecting CPU spikes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1868</cvename>
<cvename>CVE-2015-5470</cvename>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/07/10/8</mlist>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-01</entry>
<modified>2015-07-12</modified>
</dates>
</vuln>
<vuln vid="210f80b9-ede4-11e4-81c4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to
Saif El-Sherei.</li>
<li>[481777] CVE-2015-1250: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1243</cvename>
<cvename>CVE-2015-1250</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-04-28</entry>
</dates>
</vuln>
<vuln vid="b57f690e-ecc9-11e4-876c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html">
<p>45 new security fixes, including:</p>
<ul>
<li>[456518] High CVE-2015-1235: Cross-origin-bypass in HTML
parser. Credit to anonymous.</li>
<li>[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink.
Credit to Amitay Dobo.</li>
<li>[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to
Khalil Zhani.</li>
<li>[445808] High CVE-2015-1238: Out-of-bounds write in Skia.
Credit to cloudfuzzer.</li>
<li>[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL.
Credit to w3bd3vil.</li>
<li>[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip
Moon and Matt Weston of Sandfield Information Systems.</li>
<li>[460917] High CVE-2015-1242: Type confusion in V8. Credit to
fcole@onshape.com.</li>
<li>[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets.
Credit to Mike Ruddy.</li>
<li>[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit
to Khalil Zhani.</li>
<li>[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch.
Credit to Jann Horn.</li>
<li>[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to
Vittorio Gambaletta (VittGam).</li>
<li>[476786] CVE-2015-1249: Various fixes from internal audits,
fuzzing and other initiatives. Multiple vulnerabilities in V8
fixed at the tip of the 4.2 branch (currently 4.2.77.14).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html</url>
<cvename>CVE-2015-1235</cvename>
<cvename>CVE-2015-1236</cvename>
<cvename>CVE-2015-1237</cvename>
<cvename>CVE-2015-1238</cvename>
<cvename>CVE-2015-1240</cvename>
<cvename>CVE-2015-1241</cvename>
<cvename>CVE-2015-1242</cvename>
<cvename>CVE-2015-1244</cvename>
<cvename>CVE-2015-1245</cvename>
<cvename>CVE-2015-1246</cvename>
<cvename>CVE-2015-1247</cvename>
<cvename>CVE-2015-1248</cvename>
<cvename>CVE-2015-1249</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-27</entry>
</dates>
</vuln>
<vuln vid="cb9d2fcd-eb47-11e4-b03e-002590263bf5">
<topic>wpa_supplicant -- P2P SSID processing vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt">
<p>A vulnerability was found in how wpa_supplicant uses SSID information
parsed from management frames that create or update P2P peer entries
(e.g., Probe Response frame or number of P2P Public Action frames). SSID
field has valid length range of 0-32 octets. However, it is transmitted
in an element that has a 8-bit length field and potential maximum
payload length of 255 octets. wpa_supplicant was not sufficiently
verifying the payload length on one of the code paths using the SSID
received from a peer device.</p>
<p>This can result in copying arbitrary data from an attacker to a fixed
length buffer of 32 bytes (i.e., a possible overflow of up to 223
bytes). The SSID buffer is within struct p2p_device that is allocated
from heap. The overflow can override couple of variables in the struct,
including a pointer that gets freed. In addition about 150 bytes (the
exact length depending on architecture) can be written beyond the end of
the heap allocation.</p>
<p>This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to wpa_supplicant process crash, exposure of memory contents during
GO Negotiation, and potentially arbitrary code execution.</p>
<p>Vulnerable versions/configurations</p>
<p>wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled
(which is not compiled by default).</p>
<p>Attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a suitably constructed
management frame that triggers a P2P peer device information to be
created or updated.</p>
<p>The vulnerability is easiest to exploit while the device has started an
active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control
interface command in progress). However, it may be possible, though
significantly more difficult, to trigger this even without any active
P2P operation in progress.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1863</cvename>
<url>http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt</url>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-04-25</entry>
</dates>
</vuln>
<vuln vid="1e232a0c-eb57-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.40</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.24</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-04-16-2">
<p>The PHP development team announces the immediate
availability of PHP 5.4.40. 14 security-related
bugs were fixed in this release, including
CVE-2014-9709, CVE-2015-2301, CVE-2015-2783,
CVE-2015-1352. All PHP 5.4 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.24. Several bugs have been
fixed, some of them being security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users
are encouraged to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.6.8. Several bugs have been
fixed, some of them being security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users
are encouraged to upgrade to this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-04-16-2</url>
<cvename>CVE-2014-9709</cvename>
<cvename>CVE-2015-2301</cvename>
<cvename>CVE-2015-2783</cvename>
<cvename>CVE-2015-1351</cvename>
<cvename>CVE-2015-1352</cvename>
<freebsdpr>ports/199585</freebsdpr>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-04-25</entry>
<modified>2015-05-22</modified>
</dates>
</vuln>
<vuln vid="505904d3-ea95-11e4-beaf-bcaec565249c">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-1-2/">
<p>WordPress 4.1.2 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>WordPress versions 4.1.1 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. This was reported by Cedric Van
Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew
Nacin of the WordPress security team.</p>
<p>We also fixed three other security issues:</p>
<ul>
<li>In WordPress 4.1 and higher, files with invalid or unsafe
names could be uploaded. Discovered by Michael Kapfer and
Sebastian Kraemer of HSASec.</li>
<li>In WordPress 3.9 and higher, a very limited cross-site
scripting vulnerability could be used as part of a social
engineering attack. Discovered by Jakub Zoczek.</li>
<li>Some plugins were vulnerable to an SQL injection
vulnerability. Discovered by Ben Bidner of the WordPress
security team.</li>
</ul>
<p>We also made four hardening changes, discovered by J.D. Grimes,
Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and
Jeff Bowen.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-1-2/</url>
</references>
<dates>
<discovery>2015-04-21</discovery>
<entry>2015-04-24</entry>
<modified>2015-04-24</modified>
</dates>
</vuln>
<vuln vid="82595123-e8b8-11e4-a008-047d7b492d07">
<topic>libtasn1 -- stack-based buffer overflow in asn1_der_decoding</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3220.en.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in
the asn1_der_decoding function in Libtasn1, a library to
manage ASN.1 structures. A remote attacker could take advantage
of this flaw to cause an application using the Libtasn1 library
to crash, or potentially to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2806</cvename>
<url>https://www.debian.org/security/2015/dsa-3220.en.html</url>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-22</entry>
</dates>
</vuln>
<vuln vid="738fc80d-5f13-4ccb-aa9a-7965699e5a10">
<topic>mozilla -- use-after-free</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-45 Memory corruption during failed plugin
initialization</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2706</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-04-21</entry>
</dates>
</vuln>
<vuln vid="dec3164f-3121-45ef-af18-bb113ac5082f">
<topic>sqlite -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414">
<p>SQLite before 3.8.9 does not properly implement the
dequoting of collation-sequence names, which allows
context-dependent attackers to cause a denial of service
(uninitialized memory access and application crash) or
possibly have unspecified other impact via a crafted
COLLATE clause, as demonstrated by COLLATE"""""""" at the
end of a SELECT statement.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415">
<p>The sqlite3VdbeExec function in vdbe.c in SQLite before
3.8.9 does not properly implement comparison operators,
which allows context-dependent attackers to cause a denial
of service (invalid free operation) or possibly have
unspecified other impact via a crafted CHECK clause, as
demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416">
<p>The sqlite3VXPrintf function in printf.c in SQLite before
3.8.9 does not properly handle precision and width values
during floating-point conversions, which allows
context-dependent attackers to cause a denial of service
(integer overflow and stack-based buffer overflow) or
possibly have unspecified other impact via large integers
in a crafted printf function call in a SELECT statement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3414</cvename>
<cvename>CVE-2015-3415</cvename>
<cvename>CVE-2015-3416</cvename>
<url>https://www.sqlite.org/src/info/eddc05e7bb31fae7</url>
<url>https://www.sqlite.org/src/info/02e3c88fbf6abdcf</url>
<url>https://www.sqlite.org/src/info/c494171f77dc2e5e</url>
<mlist>http://seclists.org/fulldisclosure/2015/Apr/31</mlist>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-18</entry>
<modified>2015-05-08</modified>
</dates>
</vuln>
<vuln vid="c4571ca8-053d-44c9-ab3c-89b1372ad0a5">
<topic>chrony -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chrony</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrony News reports:</p>
<blockquote cite="http://chrony.tuxfamily.org/News.html">
<p>CVE-2015-1853: DoS attack on authenticated symmetric NTP
associations</p>
<p>CVE-2015-1821: Heap-based buffer overflow in access
configuration</p>
<p>CVE-2015-1822: Use of uninitialized pointer in command
processing</p>
</blockquote>
</body>
</description>
<references>
<url>http://chrony.tuxfamily.org/News.html</url>
<cvename>CVE-2015-1821</cvename>
<cvename>CVE-2015-1822</cvename>
<cvename>CVE-2015-1853</cvename>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-04-18</entry>
</dates>
</vuln>
<vuln vid="e426eda9-dae1-11e4-8107-94de806b0af9">
<topic>Dulwich -- Remote code execution</topic>
<affects>
<package>
<name>py27-dulwich</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838">
<p>Buffer overflow in the C implementation of the apply_delta
function in _pack.c in Dulwich before 0.9.9 allows remote
attackers to execute arbitrary code via a crafted pack file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0838</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="3364d497-e4e6-11e4-a265-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe is aware of a report that an exploit for
CVE-2015-3043 exists in the wild, and recommends users update their
product installations to the latest versions.
</p>
<ul>
<li>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
</li>
<li>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-0356).
</li>
<li>
These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2015-0348).
</li>
<li>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
CVE-2015-3039).
</li>
<li>
These updates resolve double-free vulnerabilities that could lead to
code execution (CVE-2015-0346, CVE-2015-0359).
</li>
<li>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
</li>
<li>
These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-3044).
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-06.html</url>
<cvename>CVE-2015-3038</cvename>
<cvename>CVE-2015-3039</cvename>
<cvename>CVE-2015-3040</cvename>
<cvename>CVE-2015-3041</cvename>
<cvename>CVE-2015-3042</cvename>
<cvename>CVE-2015-3043</cvename>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-0346</cvename>
<cvename>CVE-2015-0347</cvename>
<cvename>CVE-2015-0348</cvename>
<cvename>CVE-2015-0349</cvename>
<cvename>CVE-2015-0350</cvename>
<cvename>CVE-2015-0351</cvename>
<cvename>CVE-2015-0352</cvename>
<cvename>CVE-2015-0353</cvename>
<cvename>CVE-2015-0354</cvename>
<cvename>CVE-2015-0355</cvename>
<cvename>CVE-2015-0356</cvename>
<cvename>CVE-2015-0357</cvename>
<cvename>CVE-2015-0358</cvename>
<cvename>CVE-2015-0359</cvename>
<cvename>CVE-2015-0360</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="ba326a36-5f02-452d-a215-31e7b06d5edf">
<topic>Wesnoth -- Remote information disclosure</topic>
<affects>
<package>
<name>wesnoth</name>
<name>wesnoth-devel</name>
<range><ge>1.7.0</ge><lt>1.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0844">
<p>The WML/Lua API in Battle for Wesnoth 1.7.x through
1.11.x and 1.12.x before 1.12.2 allows remote attackers to
read arbitrary files via a crafted (1) campaign or (2) map
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0844</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="5713bfda-e27d-11e4-b2ce-5453ed2e2b49">
<topic>qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling</topic>
<affects>
<package>
<name>qt4-imageformats</name>
<range><lt>4.8.6_3</lt></range>
</package>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_5</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.4.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-April/000067.html">
<p>Due to two recent vulnerabilities identified in the built-in image
format handling code, it was decided that this area required further
testing to determine if further issues remained. Fuzzing using
afl-fuzz located a number of issues in the handling of BMP, ICO and
GIF files. The issues exposed included denial of service and buffer
overflows leading to heap corruption. It is possible the latter could
be used to perform remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-April/000067.html</mlist>
<cvename>CVE-2015-1858</cvename>
<cvename>CVE-2015-1859</cvename>
<cvename>CVE-2015-1860</cvename>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-04-14</entry>
</dates>
</vuln>
<vuln vid="d4379f59-3e9b-49eb-933b-61de4d0b0fdb">
<topic>Ruby -- OpenSSL Hostname Verification Vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby20</name>
<range><ge>2.0,1</ge><lt>2.0.0.645,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby21</name>
<range><ge>2.1,1</ge><lt>2.1.6,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby22</name>
<range><ge>2.2,1</ge><lt>2.2.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/">
<p>After reviewing RFC 6125 and RFC 5280, we found multiple violations
of matching hostnames and particularly wildcard certificates.</p>
<p>Ruby’s OpenSSL extension will now provide a string-based matching
algorithm which follows more strict behavior, as recommended by
these RFCs. In particular, matching of more than one wildcard per
subject/SAN is no-longer allowed. As well, comparison of these
values are now case-insensitive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/</url>
<cvename>CVE-2015-1855</cvename>
</references>
<dates>
<discovery>2015-04-13</discovery>
<entry>2015-04-14</entry>
<modified>2015-09-23</modified>
</dates>
</vuln>
<vuln vid="a5f160fa-deee-11e4-99f8-080027ef73ec">
<topic>mailman -- path traversal vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><lt>2.1.14.j7_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html">
<p>A path traversal vulnerability has been discovered and fixed. This
vulnerability is only exploitable by a local user on a Mailman
server where the suggested Exim transport, the Postfix
postfix_to_mailman.py transport or some other programmatic MTA
delivery not using aliases is employed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html</url>
<url>https://bugs.launchpad.net/mailman/+bug/1437145</url>
<cvename>CVE-2015-2775</cvename>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-04-09</entry>
<modified>2015-06-17</modified>
</dates>
</vuln>
<vuln vid="5fee3f02-de37-11e4-b7c3-001999f8d30b">
<topic>asterisk -- TLS Certificate Common name NULL byte exploit</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.17.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk registers to a SIP TLS device and and
verifies the server, Asterisk will accept signed certificates
that match a common name other than the one Asterisk is
expecting if the signed certificate has a common name
containing a null byte after the portion of the common
name that Asterisk expected. For example, if Asterisk is
trying to register to www.domain.com, Asterisk will accept
certificates of the form
www.domain.com\x00www.someotherdomain.com</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-003.html</url>
<cvename>CVE-2015-3008</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-04-08</entry>
</dates>
</vuln>
<vuln vid="ebd84c96-dd7e-11e4-854e-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p2</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://archive.ntp.org/ntp4/ChangeLog-stable">
<ul>
<li>[Sec 2779] ntpd accepts unauthenticated packets
with symmetric key crypto.</li>
<li>[Sec 2781] Authentication doesn't protect symmetric
associations against DoS attacks.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:07.ntp</freebsdsa>
<cvename>CVE-2015-1798</cvename>
<cvename>CVE-2015-1799</cvename>
<url>http://archive.ntp.org/ntp4/ChangeLog-stable</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-04-07</entry>
</dates>
</vuln>
<vuln vid="b8321d76-24e7-4b72-a01d-d12c4445d826">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-44 Certificate verification bypass through the
HTTP/2 Alt-Svc header</p>
<p>MFSA 2015-43 Loading privileged content through Reader
mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0798</cvename>
<cvename>CVE-2015-0799</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-43/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-44/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-04-03</discovery>
<entry>2015-04-04</entry>
</dates>
</vuln>
<vuln vid="2f75141c-da1d-11e4-8d32-5404a68ad561">
<topic>Several vulnerabilities in libav</topic>
<affects>
<package>
<name>libav</name>
<range><lt>11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libav project reports:</p>
<blockquote cite="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3">
<p>utvideodec: Handle slice_height being zero (CVE-2014-9604)</p>
<p>tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3</url>
<cvename>CVE-2014-8544</cvename>
<cvename>CVE-2014-9604</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-04-03</entry>
</dates>
</vuln>
<vuln vid="742563d4-d776-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php53</name>
<range><le>5.3.29_5</le></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.39</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.23</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-03-20-2">
<p>The PHP development team announces the immediate
availability of PHP 5.6.7. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.6 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.23. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.5 users are encouraged
to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.4.39. Six security-related
bugs were fixed in this release, including
CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331.
All PHP 5.4 users are encouraged to upgrade to
this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-03-20-2</url>
<cvename>CVE-2015-0231</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2311</cvename>
<freebsdpr>ports/198739</freebsdpr>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-04-01</entry>
</dates>
</vuln>
<vuln vid="8e887b71-d769-11e4-b1c2-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.5.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion HTTP servers with FSFS repositories are vulnerable to a remotely
triggerable excessive memory use with certain REPORT requests.</p>
<p>Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable
assertion DoS vulnerability for certain requests with dynamically evaluated
revision numbers.</p>
<p>Subversion HTTP servers allow spoofing svn:author property values for new
revisions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/</url>
<cvename>CVE-2015-0202</cvename>
<cvename>CVE-2015-0248</cvename>
<cvename>CVE-2015-0251</cvename>
<url>http://subversion.apache.org/security/CVE-2015-0202-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0248-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0251-advisory.txt</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0
/ rv:31.6)</p>
<p>MFSA-2015-31 Use-after-free when using the Fluendo MP3
GStreamer plugin</p>
<p>MFSA-2015-32 Add-on lightweight theme installation
approval bypassed through MITM attack</p>
<p>MFSA-2015-33 resource:// documents can load privileged
pages</p>
<p>MFSA-2015-34 Out of bounds read in QCMS library</p>
<p>MFSA-2015-35 Cursor clickjacking with flash and images</p>
<p>MFSA-2015-36 Incorrect memory management for simple-type
arrays in WebRTC</p>
<p>MFSA-2015-37 CORS requests should not follow 30x
redirections after preflight</p>
<p>MFSA-2015-38 Memory corruption crashes in Off Main Thread
Compositing</p>
<p>MFSA-2015-39 Use-after-free due to type confusion flaws</p>
<p>MFSA-2015-40 Same-origin bypass through anchor navigation</p>
<p>MFSA-2015-41 PRNG weakness allows for DNS poisoning on
Android</p>
<p>MFSA-2015-42 Windows can retain access to privileged
content on navigation to unprivileged pages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2808</cvename>
<cvename>CVE-2015-0800</cvename>
<cvename>CVE-2015-0801</cvename>
<cvename>CVE-2015-0802</cvename>
<cvename>CVE-2015-0803</cvename>
<cvename>CVE-2015-0804</cvename>
<cvename>CVE-2015-0805</cvename>
<cvename>CVE-2015-0806</cvename>
<cvename>CVE-2015-0807</cvename>
<cvename>CVE-2015-0808</cvename>
<cvename>CVE-2015-0810</cvename>
<cvename>CVE-2015-0811</cvename>
<cvename>CVE-2015-0812</cvename>
<cvename>CVE-2015-0813</cvename>
<cvename>CVE-2015-0814</cvename>
<cvename>CVE-2015-0815</cvename>
<cvename>CVE-2015-0816</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2">
<topic>osc -- shell command injection via crafted _service files</topic>
<affects>
<package>
<name>osc</name>
<range><lt>0.151.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUSE Security Update reports:</p>
<blockquote cite="https://www.suse.com/security/cve/CVE-2015-0778.html">
<p>osc before 0.151.0 allows remote attackers to execute
arbitrary commands via shell metacharacters in a _service
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0778</cvename>
<url>https://www.suse.com/security/cve/CVE-2015-0778.html</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=901643</url>
<url>http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html</url>
</references>
<dates>
<discovery>2015-03-16</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8">
<topic>cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gcpio</name>
<range><lt>2.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Debian Security Team:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2014-9112">
<p>Heap-based buffer overflow in the process_copy_in
function in GNU Cpio 2.11 allows remote attackers to cause
a denial of service via a large block value in a cpio
archive.</p>
</blockquote>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2015-1197">
<p>cpio 2.11, when using the --no-absolute-filenames
option, allows local users to write to arbitrary files
via a symlink attack on a file in an archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9112</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2014-9112</url>
<cvename>CVE-2015-1197</cvename>
<url>https://bugzilla.suse.com/show_bug.cgi?id=658010</url>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="264749ae-d565-11e4-b545-00269ee29e57">
<topic>libzip -- integer overflow</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>0.11.2_2</lt></range>
</package>
<package>
<name>ppsspp</name>
<range><lt>1.0.1_5</lt></range>
</package>
<package>
<name>ppsspp-devel</name>
<range><lt>1.0.1.2668_1</lt></range>
</package>
<package>
<name>radare2</name>
<range><lt>0.9.8_1</lt></range>
</package>
<package>
<name>openlierox</name>
<range><lt>0.58.r3_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="http://hg.nih.at/libzip/rev/9f11d54f692e">
<p>Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69253</url>
<url>https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5</url>
<url>http://hg.nih.at/libzip/rev/9f11d54f692e</url>
<cvename>CVE-2015-2331</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-28</entry>
<modified>2015-09-20</modified>
</dates>
</vuln>
<vuln vid="62287f51-d43d-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/mar/18/security-releases/">
<p>In accordance with our security release policy, the Django team
is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
1.8c1. These releases are now available on PyPI and our download
page. These releases address several security issues detailed
below. We encourage all users of Django to upgrade as soon as
possible. The Django master branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/mar/18/security-releases/</url>
<cvename>CVE-2015-2316</cvename>
<cvename>CVE-2015-2317</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-27</entry>
</dates>
</vuln>
<vuln vid="f6a014cd-d268-11e4-8339-001e679db764">
<topic>GNU binutils -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cross-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>x86_64-pc-mingw32-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>m6811-binutils</name>
<range><lt>2.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501">
<p>The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
binutils 2.24 and earlier allows remote attackers to cause a
denial of service (out-of-bounds write) and possibly have other
unspecified impact via a crafted NumberOfRvaAndSizes field in the
AOUT header in a PE executable.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502">
<p>Heap-based buffer overflow in the pe_print_edata function in
bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a truncated export table in a PE
file.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503">
<p>Stack-based buffer overflow in the ihex_scan function in
bfd/ihex.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a crafted ihex file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8501</cvename>
<cvename>CVE-2014-8502</cvename>
<cvename>CVE-2014-8503</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503</url>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2015-03-24</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="996bce94-d23d-11e4-9463-9cb654ea3e1c">
<topic>libuv -- incorrect revocation order while relinquishing privileges</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nodejs releases reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable">
<h5>CVE-2015-0278</h5>
<p>This may potentially allow an attacker to gain elevated privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable</url>
<freebsdpr>ports/198861</freebsdpr>
<cvename>CVE-2015-0278</cvename>
</references>
<dates>
<discovery>2015-03-14</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="22dc4a22-d1e5-11e4-879c-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.605</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.596.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23">
<h1>Description</h1>
<h5>SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)</h5>
<p>An attacker without any access to Jenkins can navigate the user
to a carefully crafted URL and have the user execute unintended
actions. This vulnerability can be used to attack Jenkins inside
firewalls from outside so long as the location of Jenkins is known
to the attacker.</p>
<h5>SECURITY-180 (forced API token change)</h5>
<p>The part of Jenkins that issues a new API token was not
adequately protected against anonymous attackers. This allows an
attacker to escalate privileges on Jenkins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23</url>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="76ff65f4-17ca-4d3f-864a-a3d6026194fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-28 Privilege escalation through SVG navigation</p>
<p>MFSA-2015-29 Code execution through incorrect JavaScript
bounds checking elimination</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0817</cvename>
<cvename>CVE-2015-0818</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-29/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-03-22</entry>
</dates>
</vuln>
<vuln vid="9d15355b-ce7c-11e4-9db0-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_19</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1m</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_4</lt></range>
</package>
<package>
<name>libressl</name>
<range><le>2.1.5_1</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_8</lt></range>
<range><ge>9.3</ge><lt>9.3_12</lt></range>
<range><ge>8.4</ge><lt>8.4_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150319.txt">
<ul>
<li>Reclassified: RSA silently downgrades to EXPORT_RSA
[Client] (CVE-2015-0204). OpenSSL only.</li>
<li>Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)</li>
<li>ASN.1 structure reuse memory corruption (CVE-2015-0287)</li>
<li>PKCS#7 NULL pointer dereferences (CVE-2015-0289)</li>
<li>Base64 decode (CVE-2015-0292). OpenSSL only.</li>
<li>DoS via reachable assert in SSLv2 servers
(CVE-2015-0293). OpenSSL only.</li>
<li>Use After Free following d2i_ECPrivatekey error
(CVE-2015-0209)</li>
<li>X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:06.openssl</freebsdsa>
<freebsdpr>ports/198681</freebsdpr>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0286</cvename>
<cvename>CVE-2015-0287</cvename>
<cvename>CVE-2015-0289</cvename>
<cvename>CVE-2015-0292</cvename>
<cvename>CVE-2015-0293</cvename>
<cvename>CVE-2015-0209</cvename>
<cvename>CVE-2015-0288</cvename>
<url>https://www.openssl.org/news/secadv_20150319.txt</url>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-03-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="f7d79fac-cd49-11e4-898f-bcaec565249c">
<topic>libXfont -- BDF parsing issues</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>linux-c6-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
<package>
<name>linux-f10-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2015-March/002550.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered an issue in the parsing of BDF font files by libXfont.
Additional testing by Alan Coopersmith and William Robinet with
the American Fuzzy Lop (afl) tool uncovered two more issues in
the parsing of BDF font files.</p>
<p>As libXfont is used by the X server to read font files, and an
unprivileged user with access to the X server can tell the X
server to read a given font file from a path of their choosing,
these vulnerabilities have the potential to allow unprivileged
users to run code with the privileges of the X server
(often root access).</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2015-March/002550.html</url>
<cvename>CVE-2015-1802</cvename>
<cvename>CVE-2015-1803</cvename>
<cvename>CVE-2015-1804</cvename>
</references>
<dates>
<discovery>2015-03-17</discovery>
<entry>2015-03-18</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="8b3ecff5-c9b2-11e4-b71f-00bd5af88c00">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,
CVE-2015-0339).
These updates resolve type confusion vulnerabilities that could lead
to code execution (CVE-2015-0334, CVE-2015-0336).
These updates resolve a vulnerability that could lead to a
cross-domain policy bypass (CVE-2015-0337).
These updates resolve a vulnerability that could lead to a file
upload restriction bypass (CVE-2015-0340).
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-0338).
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0341, CVE-2015-0342).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-05.html</url>
<cvename>CVE-2015-0332</cvename>
<cvename>CVE-2015-0333</cvename>
<cvename>CVE-2015-0334</cvename>
<cvename>CVE-2015-0335</cvename>
<cvename>CVE-2015-0336</cvename>
<cvename>CVE-2015-0337</cvename>
<cvename>CVE-2015-0338</cvename>
<cvename>CVE-2015-0339</cvename>
<cvename>CVE-2015-0340</cvename>
<cvename>CVE-2015-0341</cvename>
<cvename>CVE-2015-0342</cvename>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="451a6c79-c92b-11e4-a835-000c292ee6b8">
<topic>sympa -- Remote attackers can read arbitrary files</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sympa Project reports:</p>
<blockquote cite="https://www.sympa.org/security_advisories">
<p>The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sympa.org/security_advisories</url>
<cvename>CVE-2015-1306</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="d08f6002-c588-11e4-8495-6805ca0b3d42">
<topic>rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.10</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html">
<p>RT 3.0.0 and above, if running on Perl 5.14.0 or higher,
are vulnerable to a remote denial-of-service via the email
gateway; any installation which accepts mail from untrusted
sources is vulnerable, regardless of the permissions
configuration inside RT. This denial-of-service may
encompass both CPU and disk usage, depending on RT's logging
configuration. This vulnerability is assigned
CVE-2014-9472.</p>
<p>RT 3.8.8 and above are vulnerable to an information
disclosure attack which may reveal RSS feeds URLs, and thus
ticket data; this vulnerability is assigned
CVE-2015-1165. RSS feed URLs can also be leveraged to
perform session hijacking, allowing a user with the URL to
log in as the user that created the feed; this vulnerability
is assigned CVE-2015-1464.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html</url>
<cvename>CVE-2014-9472</cvename>
<cvename>CVE-2015-1165</cvename>
<cvename>CVE-2015-1464</cvename>
</references>
<dates>
<discovery>2015-02-26</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="81b4c118-c586-11e4-8495-6805ca0b3d42">
<topic>phpMyAdmin -- Risk of BREACH attack due to reflected parameter</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.3.0</ge><lt>4.3.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php">
<p>Risk of BREACH attack due to reflected parameter.</p>
<p>With a large number of crafted requests it was possible to infer
the CSRF token by a BREACH attack.</p>
<p>Mitigation factor: this vulnerability can only be exploited in
the presence of another vulnerability that allows the attacker to
inject JavaScript into victim's browser.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php</url>
<cvename>CVE-2015-2206</cvename>
</references>
<dates>
<discovery>2015-03-04</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="c0cae920-c4e9-11e4-898e-90e6ba741e35">
<topic>mono -- TLS bugs</topic>
<affects>
<package>
<name>mono</name>
<range><lt>3.10.1</lt></range>
<range><ge>3.12</ge><lt>3.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mono project reports:</p>
<blockquote cite="http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs">
<p>Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in <a href="https://www.smacktls.com/#skip">SKIP-TLS post</a>.</p>
<p>Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the <a href="https://www.smacktls.com/#freak">FREAK</a> attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs</url>
</references>
<dates>
<discovery>2015-03-06</discovery>
<entry>2015-03-07</entry>
</dates>
</vuln>
<vuln vid="92fc2e2b-c383-11e4-8ef7-080027ef73ec">
<topic>PuTTY -- fails to scrub private keys from memory after use</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html">
<p>When PuTTY has sensitive data in memory and has no further need for
it, it should wipe the data out of its memory, in case malware later
gains access to the PuTTY process or the memory is swapped out to
disk or written into a crash dump file. An obvious example of this
is the password typed during SSH login; other examples include
obsolete session keys, public-key passphrases, and the private
halves of public keys.</p>
<p>PuTTY 0.63 and earlier versions, after loading a private key
from a disk file, mistakenly leak a memory buffer containing a
copy of the private key, in the function ssh2_load_userkey. The
companion function ssh2_save_userkey (only called by PuTTYgen) can
also leak a copy, but only in the case where the file it tried to
save to could not be created.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html</url>
<cvename>CVE-2015-2157</cvename>
</references>
<dates>
<discovery>2015-02-28</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="8505e013-c2b3-11e4-875d-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-npapi</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>41.0.2272.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>51 security fixes in this release, including:</p>
<ul>
<li>[456516] High CVE-2015-1212: Out-of-bounds write in media.
Credit to anonymous.</li>
<li>[448423] High CVE-2015-1213: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445810] High CVE-2015-1214: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445809] High CVE-2015-1215: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[454954] High CVE-2015-1216: Use-after-free in v8 bindings.
Credit to anonymous.</li>
<li>[456192] High CVE-2015-1217: Type confusion in v8 bindings.
Credit to anonymous.</li>
<li>[456059] High CVE-2015-1218: Use-after-free in dom.
Credit to cloudfuzzer.</li>
<li>[446164] High CVE-2015-1219: Integer overflow in webgl.
Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.</li>
<li>[437651] High CVE-2015-1220: Use-after-free in gif decoder.
Credit to Aki Helin of OUSPG.</li>
<li>[455368] High CVE-2015-1221: Use-after-free in web databases.
Credit to Collin Payne.</li>
<li>[448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.</li>
<li>[454231] High CVE-2015-1223: Use-after-free in dom.
Credit to Maksymillian Motyl.</li>
<li>High CVE-2015-1230: Type confusion in v8.
Credit to Skylined working with HP's Zero Day Initiative.</li>
<li>[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.</li>
<li>[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium.
Credit to cloudfuzzer.</li>
<li>[456841] Medium CVE-2015-1226: Validation issue in debugger.
Credit to Rob Wu.</li>
<li>[450389] Medium CVE-2015-1227: Uninitialized value in blink.
Credit to Christoph Diehl.</li>
<li>[444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.</li>
<li>[431504] Medium CVE-2015-1229: Cookie injection via proxies.
Credit to iliwoy.</li>
<li>[463349] CVE-2015-1231: Various fixes from internal audits,
fuzzing, and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1212</cvename>
<cvename>CVE-2015-1213</cvename>
<cvename>CVE-2015-1214</cvename>
<cvename>CVE-2015-1215</cvename>
<cvename>CVE-2015-1216</cvename>
<cvename>CVE-2015-1217</cvename>
<cvename>CVE-2015-1218</cvename>
<cvename>CVE-2015-1219</cvename>
<cvename>CVE-2015-1220</cvename>
<cvename>CVE-2015-1221</cvename>
<cvename>CVE-2015-1222</cvename>
<cvename>CVE-2015-1223</cvename>
<cvename>CVE-2015-1224</cvename>
<cvename>CVE-2015-1225</cvename>
<cvename>CVE-2015-1226</cvename>
<cvename>CVE-2015-1227</cvename>
<cvename>CVE-2015-1228</cvename>
<cvename>CVE-2015-1229</cvename>
<cvename>CVE-2015-1230</cvename>
<cvename>CVE-2015-1231</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-03-03</discovery>
<entry>2015-03-04</entry>
</dates>
</vuln>
<vuln vid="c9c3374d-c2c1-11e4-b236-5453ed2e2b49">
<topic>qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler</topic>
<affects>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_4</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.3.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-February/000059.html">
<p>The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug
that would lead to a division by zero when loading certain corrupt
BMP files. This in turn would cause the application loading these
hand crafted BMPs to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0295</cvename>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-February/000059.html</mlist>
</references>
<dates>
<discovery>2015-02-22</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="7480b6ac-adf1-443e-a33c-3a3c0becba1e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.600</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.580.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">
<h1>Description</h1>
<h5>SECURITY-125 (Combination filter Groovy script unsecured)</h5>
<p>This vulnerability allows users with the job configuration
privilege to escalate his privileges, resulting in arbitrary code
execution to the master.</p>
<h5>SECURITY-162 (directory traversal from artifacts via symlink)</h5>
<p>This vulnerability allows users with the job configuration
privilege or users with commit access to the build script to
access arbitrary files/directories on the master, resulting in
the exposure of sensitive information, such as encryption keys.</p>
<h5>SECURITY-163 (update center metadata retrieval DoS attack)</h5>
<p>This vulnerability allows authenticated users to disrupt the
operation of Jenkins by feeding malicious update center data into
Jenkins, affecting plugin installation and tool installation.</p>
<h5>SECURITY-165 (external entity injection via XPath)</h5>
<p>This vulnerability allows users with the read access to Jenkins
to retrieve arbitrary XML document on the server, resulting in
the exposure of sensitive information inside/outside Jenkins.</p>
<h5>SECURITY-166 (HudsonPrivateSecurityRealm allows creation of
reserved names)</h5>
<p>For users using "Jenkins' own user database" setting, Jenkins
doesn't refuse reserved names, thus allowing privilege escalation.</p>
<h5>SECURITY-167 (External entity processing in XML can reveal
sensitive local files)</h5>
<p>This vulnerability allows attackers to create malicious XML
documents and feed that into Jenkins, which causes Jenkins to
retrieve arbitrary XML document on the server, resulting in the
exposure of sensitive information inside/outside Jenkins.</p>
<h1>Severity</h1>
<p>SECURITY-125 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in arbitrary
code execution on the master.</p>
<p>SECURITY-162 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in the
exposure of sensitive information.</p>
<p>SECURITY-163 is rated <strong>medium</strong>, as it results in the
loss of functionality.</p>
<p>SECURITY-165 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive
information.</p>
<p>SECURITY-166 is rated <strong>critical</strong>. For users who use
the affected feature, this attack results in arbitrary code
execution on the master.</p>
<p>SECURITY-167 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</url>
</references>
<dates>
<discovery>2015-03-01</discovery>
<entry>2015-03-01</entry>
</dates>
</vuln>
<vuln vid="99029172-8253-407d-9d8b-2cfeab9abf81">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0
/ rv:31.5)</p>
<p>MFSA-2015-12 Invoking Mozilla updater will load locally
stored DLL files</p>
<p>MFSA-2015-13 Appended period to hostnames can bypass HPKP
and HSTS protections</p>
<p>MFSA-2015-14 Malicious WebGL content crash when writing
strings</p>
<p>MFSA-2015-15 TLS TURN and STUN connections silently fail
to simple TCP connections</p>
<p>MFSA-2015-16 Use-after-free in IndexedDB</p>
<p>MFSA-2015-17 Buffer overflow in libstagefright during MP4
video playback</p>
<p>MFSA-2015-18 Double-free when using non-default memory
allocators with a zero-length XHR</p>
<p>MFSA-2015-19 Out-of-bounds read and write while rendering
SVG content</p>
<p>MFSA-2015-20 Buffer overflow during CSS restyling</p>
<p>MFSA-2015-21 Buffer underflow during MP3 playback</p>
<p>MFSA-2015-22 Crash using DrawTarget in Cairo graphics
library</p>
<p>MFSA-2015-23 Use-after-free in Developer Console date
with OpenType Sanitiser</p>
<p>MFSA-2015-24 Reading of local files through manipulation
of form autocomplete</p>
<p>MFSA-2015-25 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA-2015-26 UI Tour whitelisted sites in background tab
can spoof foreground tabs</p>
<p>MFSA-2015-27 Caja Compiler JavaScript sandbox bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0819</cvename>
<cvename>CVE-2015-0820</cvename>
<cvename>CVE-2015-0821</cvename>
<cvename>CVE-2015-0822</cvename>
<cvename>CVE-2015-0823</cvename>
<cvename>CVE-2015-0824</cvename>
<cvename>CVE-2015-0825</cvename>
<cvename>CVE-2015-0826</cvename>
<cvename>CVE-2015-0827</cvename>
<cvename>CVE-2015-0828</cvename>
<cvename>CVE-2015-0829</cvename>
<cvename>CVE-2015-0830</cvename>
<cvename>CVE-2015-0831</cvename>
<cvename>CVE-2015-0832</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-0834</cvename>
<cvename>CVE-2015-0835</cvename>
<cvename>CVE-2015-0836</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-12/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-13/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-14/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-15/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-27/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-02-24</discovery>
<entry>2015-02-27</entry>
</dates>
</vuln>
<vuln vid="f7a9e415-bdca-11e4-970c-000c292ee6b8">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.38</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.22</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>Use after free vulnerability in unserialize() with DateTimeZone.</p>
<p>Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<cvename>CVE-2015-0273</cvename>
<url>http://php.net/ChangeLog-5.php#5.4.38</url>
<url>http://php.net/ChangeLog-5.php#5.5.22</url>
<url>http://php.net/ChangeLog-5.php#5.6.6</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-26</entry>
</dates>
</vuln>
<vuln vid="dbf9e66c-bd50-11e4-a7ba-206a8a720317">
<topic>krb5 1.11 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-111</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt">
<p>Handle certain invalid RFC 1964 GSS tokens correctly to avoid
invalid memory reference vulnerabilities. [CVE-2014-4341</p>
<p>Fix memory management vulnerabilities in GSSAPI SPNEGO.
[CVE-2014-4343 CVE-2014-4344]</p>
<p>Fix buffer overflow vulnerability in LDAP KDB back end.
[CVE-2014-4345]</p>
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354 CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-9421
CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt</url>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2015-02-25</entry>
</dates>
</vuln>
<vuln vid="996c219c-bbb1-11e4-88ae-d050992ecde8">
<topic>samba -- Unexpected code execution in smbd</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.25</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
</package>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba development team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2015-0240">
<p>All versions of Samba from 3.5.0 to 4.2.0rc4 are
vulnerable to an unexpected code execution vulnerability
in the smbd file server daemon.</p>
<p>A malicious client could send packets that may set up the
stack in such a way that the freeing of memory in a
subsequent anonymous netlogon packet could allow execution
of arbitrary code. This code would execute with root
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0240</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-0240</url>
</references>
<dates>
<discovery>2015-02-23</discovery>
<entry>2015-02-23</entry>
</dates>
</vuln>
<vuln vid="0f488b7b-bbb9-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- buffer overflow if s_first_meta_bg too big</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4">
<p>If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.</p>
<p>The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4</url>
<url>http://www.ocert.org/advisories/ocert-2015-002.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1187032</url>
<cvename>CVE-2015-0247</cvename>
</references>
<dates>
<discovery>2014-08-09</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="2a4bcd7d-bbb8-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- potential buffer overflow in closefs()</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73">
<p>On a carefully crafted filesystem that gets modified through
tune2fs or debugfs, it is possible to trigger a buffer overrun when
the file system is closed via closefs().</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73</url>
<cvename>CVE-2015-1572</cvename>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="58033a95-bba8-11e4-88ae-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<name>bind910-base</name>
<range><lt>9.10.1P2</lt></range>
</package>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6P2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_10</lt></range>
<range><ge>8.4</ge><lt>8.4_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01235">
<p>When configured to perform DNSSEC validation, named can
crash when encountering a rare set of conditions in the
managed trust anchors.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:05.bind</freebsdsa>
<cvename>CVE-2015-1349</cvename>
<url>https://kb.isc.org/article/AA-01235</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-23</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="63527d0d-b9de-11e4-8a48-206a8a720317">
<topic>krb5 1.12 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-112</name>
<range><lt>1.12.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354] [CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-5352
CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt</url>
</references>
<dates>
<discovery>2015-02-20</discovery>
<entry>2015-02-21</entry>
</dates>
</vuln>
<vuln vid="3680b234-b6f0-11e4-b7cc-d050992ecde8">
<topic>unzip -- heap based buffer overflow in iconv patch</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2502-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2502-1/">
<p>unzip could be made to run programs if it opened a specially crafted file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1315</cvename>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1315</url>
<url>http://www.ubuntu.com/usn/usn-2502-1/</url>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-02-17</entry>
</dates>
</vuln>
<vuln vid="3a888a1e-b321-11e4-83b2-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_2</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn
function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP,
allows remote authenticated users to cause a denial of service
(daemon crash) via a successful LDAP query with no results, as
demonstrated by using an incorrect object type for a password
policy.</p>
<p>CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in
MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when
the KDC uses LDAP, allows remote authenticated users to cause a
denial of service (NULL pointer dereference and daemon crash) by
creating a database entry for a keyless principal, as
demonstrated by a kadmin "add_principal -nokey" or "purgekeys
-all" command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5353</cvename>
<cvename>CVE-2014-5354</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-02-12</entry>
<modified>2015-02-13</modified>
</dates>
</vuln>
<vuln vid="54a69cf7-b2ef-11e4-b1f1-bcaec565249c">
<topic>xorg-server -- Information leak in the XkbSetGeometry request of X servers.</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.14.7_2,1</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><ge>1.15.0,1</ge><lt>1.16.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Hutterer reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2015-February/057158.html">
<p>Olivier Fourdan from Red Hat has discovered a protocol handling
issue in the way the X server code base handles the XkbSetGeometry
request.</p>
<p>The issue stems from the server trusting the client to send valid
string lengths in the request data. A malicious client with string
lengths exceeding the request length can cause the server to copy
adjacent memory data into the XKB structs. This data is then
available to the client via the XkbGetGeometry request. The
data length is at least up to 64k, it is possible to obtain
more data by chaining strings, each string length is then
determined by whatever happens to be in that 16-bit region of
memory.</p>
<p>A similarly crafted request can likely cause the X server
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0255</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2015-February/057158.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2015-02-12</entry>
</dates>
</vuln>
<vuln vid="a0c45e53-ae51-11e4-8ac7-d050992ecde8">
<topic>openldap -- two remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.40_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ryan Tandy reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988">
<p>With the deref overlay enabled, ldapsearch with '-E deref=member:'
causes slapd to crash.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991">
<p>Bill MacAllister discovered that certain queries cause slapd
to crash while freeing operation controls. This is a 2.4.40 regression.
Earlier releases are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991</url>
</references>
<dates>
<discovery>2015-02-02</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="a6eb239f-adbe-11e4-9fce-080027593b9a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.111</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>11 security fixes in this release, including:</p>
<ul>
<li>[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to
Maksymillian.</li>
<li>[453979] High CVE-2015-1210: Cross-origin-bypass in V8
bindings. Credit to anonymous.</li>
<li>[453982] High CVE-2015-1211: Privilege escalation using service
workers. Credit to anonymous.</li>
<li>[455225] CVE-2015-1212: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1209</cvename>
<cvename>CVE-2015-1210</cvename>
<cvename>CVE-2015-1211</cvename>
<cvename>CVE-2015-1212</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="3b40bf2c-ad83-11e4-a2b2-0026551a22dc">
<topic>PostgreSQL -- multiple buffer overflows and memory issues</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.19</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.15</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.6</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1569/">
<p>This update fixes multiple security issues reported in PostgreSQL
over the past few months. All of these issues require prior
authentication, and some require additional conditions, and as such
are not considered generally urgent. However, users should examine
the list of security holes patched below in case they are particularly
vulnerable.</p>
<ol>
<li>CVE-2015-0241 Buffer overruns in "to_char" functions.</li>
<li>CVE-2015-0242 Buffer overrun in replacement printf family of
functions.</li>
<li>CVE-2015-0243 Memory errors in functions in the pgcrypto extension.</li>
<li>CVE-2015-0244 An error in extended protocol message reading.</li>
<li>CVE-2014-8161 Constraint violation errors can cause display of values in columns
which the user would not normally have rights to see.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0241</cvename>
<cvename>CVE-2015-0242</cvename>
<cvename>CVE-2015-0243</cvename>
<cvename>CVE-2015-0244</cvename>
<cvename>CVE-2014-8161</cvename>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-05</entry>
</dates>
</vuln>
<vuln vid="24ce5597-acab-11e4-a847-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13_1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_1</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
gss_process_context_token() is used to process a valid context
deletion token, the caller is left with a security context handle
containing a dangling pointer. Further uses of this handle will
result in use-after-free and double-free memory access violations.
libgssrpc server applications such as kadmind are vulnerable as
they can be instructed to call gss_process_context_token().</p>
<p>CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may perform use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results. Other libgssrpc server applications may
also be vulnerable if they contain insufficiently defensive XDR
functions.</p>
<p>CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.</p>
<p>CVE-2014-9423: libgssrpc applications including kadmind output
four or eight bytes of uninitialized memory to the network as
part of an unused "handle" field in replies to clients.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5352</cvename>
<cvename>CVE-2014-9421</cvename>
<cvename>CVE-2014-9422</cvename>
<cvename>CVE-2014-9423</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-03</discovery>
<entry>2015-02-04</entry>
</dates>
</vuln>
<vuln vid="e543c6f8-abf2-11e4-8ac7-d050992ecde8">
<topic>unzip -- out of boundary access issues in test_compr_eb</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2489-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2489-1/">
<p>Michal Zalewski discovered that unzip incorrectly handled
certain malformed zip archives. If a user or automated system
were tricked into processing a specially crafted zip archive,
an attacker could possibly execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9636</cvename>
<url>http://www.ubuntu.com/usn/usn-2489-1/</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html</url>
<url>http://seclists.org/oss-sec/2014/q4/489</url>
<url>http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450</url>
</references>
<dates>
<discovery>2014-11-02</discovery>
<entry>2015-02-03</entry>
</dates>
</vuln>
<vuln vid="1c7cfd05-aaee-11e4-83b4-14dae9d210b8">
<topic>Xymon -- buffer overrun</topic>
<affects>
<package>
<name>xymon-server</name>
<range><ge>4.3.4</ge><lt>4.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776007">
<p>web/acknowledge.c uses a string twice in a format string, but only
allocates memory for one copy.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/01/31/4</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1430</url>
<cvename>CVE-2015-1430</cvename>
</references>
<dates>
<discovery>2014-09-28</discovery>
<entry>2015-02-02</entry>
</dates>
</vuln>
<vuln vid="8469d41c-a960-11e4-b18e-bcaec55be5e5">
<topic>rabbitmq -- Security issues in management plugin</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RabbitMQ project reports:</p>
<blockquote cite="http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100">
<p>Some user-controllable content was not properly HTML-escaped
before being presented to a user in the management web UI:</p>
<ul>
<li>When a user unqueued a message from the management UI,
message details (header names, arguments, etc.) were displayed
unescaped. An attacker could publish a specially crafted
message to add content or execute arbitrary Javascript code on
behalf of a user, if this user unqueued the message from the
management UI.</li>
<li>When viewing policies, their name was displayed unescaped.
An attacker could create a policy with a specially crafted name
to add content or execute arbitrary Javascript code on behalf
of a user who is viewing policies.</li>
<li>When listing connected AMQP network clients, client details
such as its version were displayed unescaped. An attacker could
use a client with a specially crafted version field to add
content or execute arbitrary Javascript code on behalf of a
user who is viewing connected clients.</li>
</ul>
<p>In all cases, the attacker needs a valid user account on the
targeted RabbitMQ cluster.</p>
<p>Furthermore, some admin-controllable content was not properly
escaped:</p>
<ul>
<li>user names;</li>
<li>the cluster name.</li>
</ul>
<p>Likewise, an attacker could add content or execute arbitrary
Javascript code on behalf of a user using the management web UI.
However, the attacker must be an administrator on the RabbitMQ
cluster, thus a trusted user.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100</url>
<url>http://www.rabbitmq.com/release-notes/README-3.4.3.txt</url>
<cvename>CVE-2015-0862</cvename>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="5804b9d4-a959-11e4-9363-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
<p>mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
with response headers' size above 8K.</p>
<p>mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.</p>
<p>mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used
in multiple Require directives with different arguments. PR57204.</p>
<p>core: HTTP trailers could be used to replace HTTP headers late during
request processing, potentially undoing or otherwise confusing modules
that examined or modified request headers earlier. Adds "MergeTrailers"
directive to restore legacy behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3583</cvename>
<cvename>CVE-2014-3581</cvename>
<cvename>CVE-2014-8109</cvename>
<cvename>CVE-2013-5704</cvename>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="7656fc62-a7a7-11e4-96ba-001999f8d30b">
<topic>asterisk -- Mitigation for libcURL HTTP request injection vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.2</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.15.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>CVE-2014-8150 reported an HTTP request injection
vulnerability in libcURL. Asterisk uses libcURL in its
func_curl.so module (the CURL() dialplan function), as
well as its res_config_curl.so (cURL realtime backend)
modules.</p>
<p>Since Asterisk may be configured to allow for user-supplied
URLs to be passed to libcURL, it is possible that an
attacker could use Asterisk as an attack vector to inject
unauthorized HTTP requests if the version of libcURL
installed on the Asterisk server is affected by
CVE-2014-8150.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-002.html</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-01-29</entry>
</dates>
</vuln>
<vuln vid="2eeb6652-a7a6-11e4-96ba-001999f8d30b">
<topic>asterisk -- File descriptor leak when incompatible codecs are offered</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may be configured to only allow specific audio
or video codecs to be used when communicating with a
particular endpoint. When an endpoint sends an SDP offer
that only lists codecs not allowed by Asterisk, the offer
is rejected. However, in this case, RTP ports that are
allocated in the process are not reclaimed.</p>
<p>This issue only affects the PJSIP channel driver in
Asterisk. Users of the chan_sip channel driver are not
affected.</p>
<p>As the resources are allocated after authentication,
this issue only affects communications with authenticated
endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-001.html</url>
<cvename>CVE-2015-1558</cvename>
</references>
<dates>
<discovery>2015-01-06</discovery>
<entry>2015-01-29</entry>
<modified>2015-02-17</modified>
</dates>
</vuln>
<vuln vid="0765de84-a6c1-11e4-a0c1-c485083ca99c">
<topic>glibc -- gethostbyname buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<range><lt>6.6_2</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
<package>
<name>linux-c6-devtools</name>
<range><lt>6.6_3</lt></range>
</package>
<package>
<name>linux-f10-devtools</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Krátký reports:</p>
<blockquote cite="https://access.redhat.com/discussions/1332403">
<p>
GHOST is a 'buffer overflow' bug affecting the gethostbyname() and
gethostbyname2() function calls in the glibc library. This
vulnerability allows a remote attacker that is able to make an
application call to either of these functions to execute arbitrary
code with the permissions of the user running the application.
The gethostbyname() function calls are used for DNS resolving, which
is a very common event. To exploit this vulnerability, an attacker
must trigger a buffer overflow by supplying an invalid hostname
argument to an application that performs a DNS resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<url>https://access.redhat.com/articles/1332213</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/27/9</url>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2015-01-28</entry>
<modified>2015-02-02</modified>
</dates>
</vuln>
<vuln vid="37a87ade-a59f-11e4-958e-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerability</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsa15-01.html">
<p>Successful exploitation could cause a crash and potentially allow
an attacker to take control of the affected system. We are aware
of reports that this vulnerability is being actively exploited in
the wild via drive-by-download attacks against systems running
Internet Explorer and Firefox on Windows 8.1 and below.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0311</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa15-01.html</url>
</references>
<dates>
<discovery>2015-01-22</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d">
<topic>Bugzilla multiple security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.15/">
<h5>Command Injection</h5>
<p>Some code in Bugzilla does not properly utilize 3 arguments form
for open() and it is possible for an account with editcomponents
permissions to inject commands into product names and other
attributes.</p>
<h5>Information Leak</h5>
<p>Using the WebServices API, a user can possibly execute imported
functions from other non-WebService modules. A whitelist has now
been added that lists explicit methods that can be executed via the
API.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8630</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jan/13/security/">
<p>Today the Django team is issuing multiple releases --
Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our
security process. These releases are now available on PyPI and our
download page.</p>
<p>These releases address several security issues. We encourage all
users of Django to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jan/13/security/</url>
<cvename>CVE-2015-0219</cvename>
<cvename>CVE-2015-0220</cvename>
<cvename>CVE-2015-0221</cvename>
<cvename>CVE-2015-0222</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-23</entry>
<modified>2015-01-24</modified>
</dates>
</vuln>
<vuln vid="0523fb7e-8444-4e86-812d-8de05f6f0dce">
<topic>libutp -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>bittorrent-libutp</name>
<range><lt>0.20130514_1</lt></range>
</package>
<package>
<name>transmission-cli</name>
<name>transmission-deamon</name>
<name>transmission-gtk</name>
<name>transmission-qt4</name>
<range><lt>2.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6129">
<p>Stack-based buffer overflow in utp.cpp in libutp, as used
in Transmission before 2.74 and possibly other products,
allows remote attackers to cause a denial of service (crash)
and possibly execute arbitrary code via crafted "micro
transport protocol packets."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6129</cvename>
<url>https://github.com/bittorrent/libutp/issues/38</url>
<url>https://trac.transmissionbt.com/ticket/5002</url>
</references>
<dates>
<discovery>2012-08-01</discovery>
<entry>2014-12-29</entry>
</dates>
</vuln>
<vuln vid="f9c388c5-a256-11e4-992a-7b2a515a1247">
<topic>LibreSSL -- DTLS vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Security Advisory:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>
A memory leak can occur in the dtls1_buffer_record function under certain
conditions. In particular this could occur if an attacker sent repeated DTLS
records with the same sequence number but for the next epoch. The memory leak
could be exploited by an attacker in a Denial of Service attack through memory
exhaustion.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="cc294a2c-a232-11e4-8e9f-0011d823eebd">
<topic>Adobe Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb15-01.html">
<p>These updates address vulnerabilities that could potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0301</cvename>
<cvename>CVE-2015-0302</cvename>
<cvename>CVE-2015-0303</cvename>
<cvename>CVE-2015-0304</cvename>
<cvename>CVE-2015-0305</cvename>
<cvename>CVE-2015-0306</cvename>
<cvename>CVE-2015-0307</cvename>
<cvename>CVE-2015-0308</cvename>
<cvename>CVE-2015-0309</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb15-01.html</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="e30e0c99-a1b7-11e4-b85c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.91</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>62 security fixes in this release, including:</p>
<ul>
<li>[430353] High CVE-2014-7923: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[435880] High CVE-2014-7924: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit
to mark.buer.</li>
<li>[422824] High CVE-2014-7926: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[444695] High CVE-2014-7927: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[435073] High CVE-2014-7928: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[442710] High CVE-2014-7931: Memory corruption in V8. Credit to
cloudfuzzer.</li>
<li>[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to
Atte Kettunen of OUSPG.</li>
<li>[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit
to aohelin.</li>
<li>[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[402957] High CVE-2014-7935: Use-after-free in Speech. Credit
to Khalil Zhani.</li>
<li>[428561] High CVE-2014-7936: Use-after-free in Views. Credit
to Christoph Diehl.</li>
<li>[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit
to Atte Kettunen of OUSPG.</li>
<li>[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit
to Atte Kettunen of OUSPG.</li>
<li>[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit
to Takeshi Terada.</li>
<li>[433866] Medium CVE-2014-7940: Uninitialized-value in ICU.
Credit to miaubiz.</li>
<li>[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit
to Atte Kettunen of OUSPG and Christoph Diehl.</li>
<li>[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts.
Credit to miaubiz.</li>
<li>[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia.
Credit to Atte Kettunen of OUSPG.</li>
<li>[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts.
Credit to miaubiz.</li>
<li>[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium.
Credit to fuzztercluck.</li>
<li>[414026] Medium CVE-2014-7948: Caching error in AppCache.
Credit to jiayaoqijia.</li>
<li>[449894] CVE-2015-1205: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 3.30
branch (currently 3.30.33.15).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7923</cvename>
<cvename>CVE-2014-7924</cvename>
<cvename>CVE-2014-7925</cvename>
<cvename>CVE-2014-7926</cvename>
<cvename>CVE-2014-7927</cvename>
<cvename>CVE-2014-7928</cvename>
<cvename>CVE-2014-7929</cvename>
<cvename>CVE-2014-7930</cvename>
<cvename>CVE-2014-7931</cvename>
<cvename>CVE-2014-7932</cvename>
<cvename>CVE-2014-7933</cvename>
<cvename>CVE-2014-7934</cvename>
<cvename>CVE-2014-7935</cvename>
<cvename>CVE-2014-7936</cvename>
<cvename>CVE-2014-7937</cvename>
<cvename>CVE-2014-7938</cvename>
<cvename>CVE-2014-7939</cvename>
<cvename>CVE-2014-7940</cvename>
<cvename>CVE-2014-7941</cvename>
<cvename>CVE-2014-7942</cvename>
<cvename>CVE-2014-7943</cvename>
<cvename>CVE-2014-7944</cvename>
<cvename>CVE-2014-7945</cvename>
<cvename>CVE-2014-7946</cvename>
<cvename>CVE-2014-7947</cvename>
<cvename>CVE-2014-7948</cvename>
<cvename>CVE-2015-1205</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-21</entry>
</dates>
</vuln>
<vuln vid="a5856eba-a015-11e4-a680-1c6f65c3c4ff">
<topic>polarssl -- Remote attack using crafted certificates</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.12_1</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PolarSSL team reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04">
<p>During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not
initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a
situation is created where the uninitialized pointer is passed to polarssl_free().</p>
<p>This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this
means clients when receiving a certificate from the server or servers in case they are actively
asking for a client certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1182</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04</url>
<url>https://www.certifiedsecure.com/polarssl-advisory/</url>
</references>
<dates>
<discovery>2015-01-14</discovery>
<entry>2015-01-19</entry>
</dates>
</vuln>
<vuln vid="d9360908-9d52-11e4-87fd-10bf48e1088e">
<topic>unzip -- input sanitization errors</topic>
<affects>
<package>
<name>unzip</name>
<range><le>6.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-011.html">
<p>The UnZip tool is an open source extraction utility for archives
compressed in the zip format.</p>
<p>The unzip command line tool is affected by heap-based buffer
overflows within the CRC32 verification, the test_compr_eb() and
the getZip64Data() functions. The input errors may result in
arbitrary code execution.</p>
<p>A specially crafted zip file, passed to unzip -t, can be used to
trigger the vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8139</cvename>
<cvename>CVE-2014-8140</cvename>
<cvename>CVE-2014-8141</cvename>
<url>http://www.info-zip.org/UnZip.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174844</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174856</url>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="d4f45676-9d33-11e4-8275-000c292e4fd8">
<topic>samba -- Elevation of privilege to Active Directory Domain Controller</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2014-8143">
<p>In Samba's AD DC we neglected to ensure that
attempted modifications of the userAccountControl attribute
did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8143</cvename>
<url>https://www.samba.org/samba/security/CVE-2014-8143</url>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="7a8a74d1-9c34-11e4-a40b-5453ed2e2b49">
<topic>kde-runtime -- incorrect CBC encryption handling</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.12_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Valentin Rusu reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20150109-1.txt">
<p>Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC
encryption blocks when encrypting secrets in kwl files. The secrets
were still encrypted, but the result binary data corresponded to an
ECB encrypted block instead of CBC.</p>
<p>The ECB encryption algorithm, even if it'll scramble user data,
will produce same encrypted byte sequence for the same input text.
As a result, attackers may eventually find-out the encrypted
text.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7252</cvename>
<url>https://www.kde.org/info/security/advisory-20150109-1.txt</url>
</references>
<dates>
<discovery>2015-01-09</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="bd62c640-9bb9-11e4-a5ad-000c297fb80f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0
/ rv:31.4)</p>
<p>MFSA-2015-02 Uninitialized memory use during bitmap
rendering</p>
<p>MFSA-2015-03 sendBeacon requests lack an Origin header</p>
<p>MFSA-2015-04 Cookie injection through Proxy Authenticate
responses</p>
<p>MFSA-2015-05 Read of uninitialized memory in Web Audio</p>
<p>MFSA-2015-06 Read-after-free in WebRTC</p>
<p>MFSA-2015-07 Gecko Media Plugin sandbox escape</p>
<p>MFSA-2015-08 Delegated OCSP responder certificates failure
with id-pkix-ocsp-nocheck extension</p>
<p>MFSA-2015-09 XrayWrapper bypass through DOM objects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8634</cvename>
<cvename>CVE-2014-8635</cvename>
<cvename>CVE-2014-8637</cvename>
<cvename>CVE-2014-8638</cvename>
<cvename>CVE-2014-8639</cvename>
<cvename>CVE-2014-8640</cvename>
<cvename>CVE-2014-8641</cvename>
<cvename>CVE-2014-8642</cvename>
<cvename>CVE-2014-8643</cvename>
<cvename>CVE-2014-8636</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d">
<topic>libevent -- integer overflow in evbuffers</topic>
<affects>
<package>
<name>libevent</name>
<range><lt>1.4.15</lt></range>
<range><ge>2.0</ge><lt>2.0.22</lt></range>
</package>
<package>
<name>libevent2</name>
<range><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Team reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3119">
<p>Andrew Bartlett of Catalyst reported a defect affecting certain
applications using the Libevent evbuffer API. This defect leaves
applications which pass insanely large inputs to evbuffers open
to a possible heap overflow or infinite loop. In order to exploit
this flaw, an attacker needs to be able to find a way to provoke
the program into trying to make a buffer chunk larger than what
will fit into a single size_t or off_t.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6272</cvename>
<url>https://www.debian.org/security/2015/dsa-3119</url>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-01-11</entry>
<modified>2017-02-20</modified>
</dates>
</vuln>
<vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e">
<topic>cURL -- URL request injection vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.40.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150108B.html">
<p>When libcurl sends a request to a server via a HTTP proxy, it
copies the entire URL into the request and sends if off.
If the given URL contains line feeds and carriage returns those will
be sent along to the proxy too, which allows the program to for
example send a separate HTTP request injected embedded in the URL.
Many programs allow some kind of external sources to set the URL or
provide partial pieces for the URL to ask for, and if the URL as
received from the user is not stripped good enough this flaw allows
malicious users to do additional requests in a way that was not
intended, or just to insert request headers into the request that
the program didn't intend.
We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8150</cvename>
<url>http://curl.haxx.se/docs/adv_20150108B.html</url>
</references>
<dates>
<discovery>2014-12-25</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="e9ccdb28-9802-11e4-9d9c-bcaec565249c">
<topic>WebKit-gtk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.4.8</lt></range>
</package>
<package>
<name>webkit-gtk3</name>
<range><lt>1.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webkit release team reports:</p>
<blockquote cite="http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html">
<p>This release fixes the following security issues:
CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386,
CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.</p>
</blockquote>
</body>
</description>
<references>
<url>http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html</url>
<cvename>CVE-2014-1344</cvename>
<cvename>CVE-2014-1384</cvename>
<cvename>CVE-2014-1385</cvename>
<cvename>CVE-2014-1386</cvename>
<cvename>CVE-2014-1387</cvename>
<cvename>CVE-2014-1388</cvename>
<cvename>CVE-2014-1389</cvename>
<cvename>CVE-2014-1390</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="4e536c14-9791-11e4-977d-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_17</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1k</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_4</lt></range>
<range><ge>10.0</ge><lt>10.0_16</lt></range>
<range><ge>9.3</ge><lt>9.3_8</lt></range>
<range><ge>8.4</ge><lt>8.4_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)</p>
<p>DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)</p>
<p>no-ssl3 configuration sets method to NULL (CVE-2014-3569)</p>
<p>ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)</p>
<p>RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)</p>
<p>DH client certificates accepted without verification [Server] (CVE-2015-0205)</p>
<p>Certificate fingerprints can be modified (CVE-2014-8275)</p>
<p>Bignum squaring may produce incorrect results (CVE-2014-3570)</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:01.openssl</freebsdsa>
<cvename>CVE-2014-3569</cvename>
<cvename>CVE-2014-3570</cvename>
<cvename>CVE-2014-3571</cvename>
<cvename>CVE-2014-3572</cvename>
<cvename>CVE-2014-8275</cvename>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0205</cvename>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-08</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5e135178-8aeb-11e4-801f-0022156e8794">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.7.5,1</lt></range>
<range><ge>3.8,1</ge><lt>3.8.5,1</lt></range>
<range><ge>3.9,1</ge><lt>3.9.3,1</lt></range>
<range><ge>4.0,1</ge><lt>4.0.1,1</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9039">
<p>wp-login.php in WordPress before 3.7.5, 3.8.x before
3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow
remote attackers to reset passwords by leveraging access to
an e-mail account that received a password-reset message.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9038">
<p>wp-includes/http.php in WordPress before 3.7.5, 3.8.x
before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to conduct server-side request
forgery (SSRF) attacks by referring to a 127.0.0.0/8
resource.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9037">
<p>WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 might allow remote attackers to
obtain access to an account idle since 2008 by leveraging an
improper PHP dynamic type comparison for an MD5 hash.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9036">
<p>Cross-site scripting (XSS) vulnerability in WordPress
before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and
4.x before 4.0.1 allows remote attackers to inject arbitrary
web script or HTML via a crafted Cascading Style Sheets
(CSS) token sequence in a post.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9035">
<p>Cross-site scripting (XSS) vulnerability in Press This in
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 allows remote attackers to
inject arbitrary web script or HTML via unspecified
vectors</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9034">
<p>wp-includes/class-phpass.php in WordPress before 3.7.5,
3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to cause a denial of service (CPU
consumption) via a long password that is improperly handled
during hashing, a similar issue to CVE-2014-9016.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9033">
<p>Cross-site request forgery (CSRF) vulnerability in
wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0
allows remote attackers to hijack the authentication of
arbitrary users for requests that reset passwords.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9033</cvename>
<cvename>CVE-2014-9034</cvename>
<cvename>CVE-2014-9035</cvename>
<cvename>CVE-2014-9036</cvename>
<cvename>CVE-2014-9037</cvename>
<cvename>CVE-2014-9038</cvename>
<cvename>CVE-2014-9039</cvename>
</references>
<dates>
<discovery>2014-11-25</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="c564f9bd-8ba7-11e4-801f-0022156e8794">
<topic>png -- heap overflow for 32-bit builds</topic>
<affects>
<package>
<name>png</name>
<range><ge>1.2.6</ge><lt>1.5.21</lt></range>
<range><ge>1.6</ge><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>32-bit builds of PNG library are vulnerable to an unsigned
integer overflow that is triggered by a crafted wide
interlaced images.
Overflow results in a heap corruption that will crash the
application and may lead to the controlled overwrite of a
selected portions of process address space.</p>
</body>
</description>
<references>
<url>http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt</url>
<url>http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/</url>
</references>
<dates>
<discovery>2014-12-23</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="9575259a-92d5-11e4-bce6-d050992ecde8">
<topic>file -- multiple vulnerabilities</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.21</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.4</ge><lt>8.4_20</lt></range>
<range><ge>9.1</ge><lt>9.1_23</lt></range>
<range><ge>9.2</ge><lt>9.2_16</lt></range>
<range><ge>9.3</ge><lt>9.3_6</lt></range>
<range><ge>10.0</ge><lt>10.0_13</lt></range>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/1056">
<p>Thomas Jarosch of Intra2net AG reported a number of
denial of service issues (resource consumption) in
the ELF parser used by file(1). These issues were
fixed in the 5.21 release of file(1), but by mistake
are missing from the changelog.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3710</cvename>
<cvename>CVE-2014-8116</cvename>
<cvename>CVE-2014-8117</cvename>
<freebsdsa>SA-14:28.file</freebsdsa>
<url>http://seclists.org/oss-sec/2014/q4/1056</url>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2015-01-02</entry>
</dates>
</vuln>
<vuln vid="c3d43001-8064-11e4-801f-0022156e8794">
<topic>mutt -- denial of service via crafted mail message</topic>
<affects>
<package>
<name>mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>ja-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>zh-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116">
<p>The write_one_header function in mutt 1.5.23 does not
properly handle newline characters at the beginning of a
header, which allows remote attackers to cause a denial of
service (crash) via a header with an empty body, which
triggers a heap-based buffer overflow in the mutt_substrdup
function.</p>
</blockquote>
</body>
</description>
<references>
<bid>71334</bid>
<cvename>CVE-2014-9116</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125</url>
<url>http://dev.mutt.org/trac/ticket/3716</url>
</references>
<dates>
<discovery>2014-11-26</discovery>
<entry>2014-12-23</entry>
</dates>
</vuln>
<vuln vid="4033d826-87dd-11e4-9079-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<name>ntp-devel</name>
<range><lt>4.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/852879">
<p>The Network Time Protocol (NTP) provides networked
systems with a way to synchronize time for various
services and applications. ntpd version 4.2.7 and
previous versions allow attackers to overflow several
buffers in a way that may allow malicious code to
be executed. ntp-keygen prior to version 4.2.7p230
also uses a non-cryptographic random number generator
when generating symmetric keys.</p>
<p>The buffer overflow vulnerabilities in ntpd may
allow a remote unauthenticated attacker to execute
arbitrary malicious code with the privilege level
of the ntpd process. The weak default key and
non-cryptographic random number generator in
ntp-keygen may allow an attacker to gain
information regarding the integrity checking
and authentication encryption schemes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9293</cvename>
<cvename>CVE-2014-9294</cvename>
<cvename>CVE-2014-9295</cvename>
<cvename>CVE-2014-9296</cvename>
<url>http://www.kb.cert.org/vuls/id/852879</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-20</entry>
</dates>
</vuln>
<vuln vid="1d567278-87a5-11e4-879c-000c292ee6b8">
<topic>git -- Arbitrary command execution on case-insensitive filesystems</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git Project reports:</p>
<blockquote cite="http://article.gmane.org/gmane.linux.kernel/1853266">
<p>When using a case-insensitive filesystem an attacker can
craft a malicious Git tree that will cause Git to overwrite
its own .git/config file when cloning or checking out a
repository, leading to arbitrary command execution in the
client machine. If you are a hosting service whose users
may fetch from your service to Windows or Mac OS X machines,
you are strongly encouraged to update to protect such users
who use existing versions of Git.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9390</cvename>
<url>https://github.com/blog/1938-git-client-vulnerability-announced</url>
<url>http://article.gmane.org/gmane.linux.kernel/1853266</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-19</entry>
</dates>
</vuln>
<vuln vid="0c5cf7c4-856e-11e4-a089-60a44c524f57">
<topic>otrs -- Incomplete Access Control</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.17</lt></range>
<range><gt>3.3.*</gt><lt>3.3.11</lt></range>
<range><gt>4.0.*</gt><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/">
<p>An attacker with valid OTRS credentials could access and manipulate ticket data
of other users via the GenericInterface, if a ticket webservice is configured
and not additionally secured.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/</url>
<cvename>CVE-2014-9324</cvename>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2014-12-16</entry>
</dates>
</vuln>
<vuln vid="f5561ade-846c-11e4-b7a7-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a REPORT request for some invalid formatted special URIs.</p>
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a request for some invalid formatted special URIs.</p>
<p>We consider this to be a medium risk vulnerability. Repositories which
allow for anonymous reads will be vulnerable without authentication.
Unfortunately, no special configuration is required and all mod_dav_svn
servers are vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3580</cvename>
<cvename>CVE-2014-8108</cvename>
<url>http://subversion.apache.org/security/CVE-2014-3580-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2014-8108-advisory.txt</url>
</references>
<dates>
<discovery>2014-12-13</discovery>
<entry>2014-12-15</entry>
</dates>
</vuln>
<vuln vid="fdf72a0e-8371-11e4-bc20-001636d274f3">
<topic>NVIDIA UNIX driver -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>340.65</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.125</lt></range>
</package>
<package>
<name>nvidia-driver-173</name>
<range><le>173.14.35_3</le></range>
</package>
<package>
<name>nvidia-driver-96</name>
<range><le>96.43.23_2</le></range>
</package>
<package>
<name>nvidia-driver-71</name>
<range><le>71.86.15_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3610">
<p>The GLX indirect rendering support supplied on NVIDIA products
is subject to the recently disclosed X.Org vulnerabilities
(CVE-2014-8093, CVE-2014-8098) as well as internally identified
vulnerabilities (CVE-2014-8298).</p>
<p>Depending on how it is configured, the X server typically runs
with raised privileges, and listens for GLX indirect rendering
protocol requests from a local socket and potentially a TCP/IP
port. The vulnerabilities could be exploited in a way that
causes the X server to access uninitialized memory or overwrite
arbitrary memory in the X server process. This can cause a
denial of service (e.g., an X server segmentation fault), or
could be exploited to achieve arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8298</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8098</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-14</entry>
</dates>
</vuln>
<vuln vid="ab3e98d9-8175-11e4-907d-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6</lt></range>
</package>
<package>
<name>bind98</name>
<name>bind98-base</name>
<name>bind96</name>
<name>bind96-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_6</lt></range>
<range><ge>9.2</ge><lt>9.2_16</lt></range>
<range><ge>9.1</ge><lt>9.1_23</lt></range>
<range><ge>8.4</ge><lt>8.4_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/important-security-advisory-posted/">
<p>We have today posted updated versions of 9.9.6 and 9.10.1
to address a significant security vulnerability in DNS
resolution. The flaw was discovered by Florian Maury of
ANSSI, and applies to any recursive resolver that does not
support a limit on the number of recursions. [<a href="http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html">CERTFR-2014-AVI-512</a>],
[USCERT <a href="www.kb.cert.org/vuls/id/264212">VU#264212</a>]</p>
<p>A flaw in delegation handling could be exploited to put named
into an infinite loop, in which each lookup of a name server
triggered additional lookups of more name servers. This has
been addressed by placing limits on the number of levels of
recursion named will allow (default 7), and on the number of
queries that it will send before terminating a recursive query
(default 50). The recursion depth limit is configured via the
max-recursion-depth option, and the query limit via the
max-recursion-queries option. For more information, see the
security advisory at <a href="https://kb.isc.org/article/AA-01216/">https://kb.isc.org/article/AA-01216/</a>.
<a href="https://kb.isc.org/article/AA-01216/">[CVE-2014-8500]</a>
[RT #37580]</p>
<p>In addition, we have also corrected a potential security
vulnerability in the GeoIP feature in the 9.10.1 release only.
For more information on this issue, see the security advisory
at <a href="https://kb.isc.org/article/AA-01217">https://kb.isc.org/article/AA-01217</a>.
<a href="https://kb.isc.org/article/AA-01217">[CVE-2014-8680]</a></p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-14:29.bind</freebsdsa>
<cvename>CVE-2014-8500</cvename>
<cvename>CVE-2014-8680</cvename>
<url>https://www.isc.org/blogs/important-security-advisory-posted/</url>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="94268da0-8118-11e4-a180-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in WebSocket Server</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.14.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When handling a WebSocket frame the res_http_websocket
module dynamically changes the size of the memory used
to allow the provided payload to fit. If a payload length
of zero was received the code would incorrectly attempt
to resize to zero. This operation would succeed and end
up freeing the memory but be treated as a failure. When
the session was subsequently torn down this memory would
get freed yet again causing a crash.</p>
<p>Users of the WebSocket functionality also did not take
into account that provided text frames are not guaranteed
to be NULL terminated. This has been fixed in chan_sip
and chan_pjsip in the applicable versions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-019.html</url>
<cvename>CVE-2014-9374</cvename>
</references>
<dates>
<discovery>2014-10-30</discovery>
<entry>2014-12-11</entry>
<modified>2015-01-29</modified>
</dates>
</vuln>
<vuln vid="27b9b2f0-8081-11e4-b4ca-bcaec565249c">
<topic>xserver -- multiple issue with X client request handling</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.12.4_10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-December/002500.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way the X server
code base handles requests from X clients, and has worked
with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>The vulnerabilities could be exploited to cause the X server
to access uninitialized memory or overwrite arbitrary memory
in the X server process. This can cause a denial of service
(e.g., an X server segmentation fault), or could be exploited
to achieve arbitrary code execution.</p>
<p>The GLX extension to the X Window System allows an X client
to send X protocol to the X server, to request that the X
server perform OpenGL rendering on behalf of the X client.
This is known as "GLX indirect rendering", as opposed to
"GLX direct rendering" where the X client submits OpenGL
rendering commands directly to the GPU, bypassing the X
server and avoiding the X server code for GLX protocol
handling.</p>
<p>Most GLX indirect rendering implementations share some
common ancestry, dating back to "Sample Implementation"
code from Silicon Graphics, Inc (SGI), which SGI
originally commercially licensed to other Unix workstation
and graphics vendors, and later released as open source, so
those vulnerabilities may affect other licensees of SGI's
code base beyond those running code from the X.Org Foundation
or the XFree86 Project.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2014-December/002500.html</url>
<cvename>CVE-2014-8091</cvename>
<cvename>CVE-2014-8092</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8094</cvename>
<cvename>CVE-2014-8095</cvename>
<cvename>CVE-2014-8096</cvename>
<cvename>CVE-2014-8097</cvename>
<cvename>CVE-2014-8098</cvename>
<cvename>CVE-2014-8099</cvename>
<cvename>CVE-2014-8100</cvename>
<cvename>CVE-2014-8101</cvename>
<cvename>CVE-2014-8102</cvename>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2014-12-10</entry>
</dates>
</vuln>
<vuln vid="10d73529-7f4b-11e4-af66-00215af774f0">
<topic>unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_14</lt></range>
<range><ge>10.1</ge><lt>10.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://unbound.net/downloads/CVE-2014-8602.txt">
<p>The resolver can be tricked into following an endless series of
delegations, this consumes a lot of resources.</p>
</blockquote>
</body>
</description>
<references>
<url>http://unbound.net/downloads/CVE-2014-8602.txt</url>
<freebsdsa>SA-14:30.unbound</freebsdsa>
<cvename>CVE-2014-8602</cvename>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-09</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="567beb1e-7e0a-11e4-b9cc-bcaec565249c">
<topic>freetype -- Out of bounds stack-based read/write</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner LEMBERG reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html">
<p>The fix for CVE-2014-2240 was not 100% complete to fix the issue
from the CVE completly.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html</url>
<cvename>CVE-2014-2240</cvename>
</references>
<dates>
<discovery>2014-12-07</discovery>
<entry>2014-12-07</entry>
</dates>
</vuln>
<vuln vid="c9c46fbf-7b83-11e4-a96e-6805ca0b3d42">
<topic>phpMyAdmin -- XSS and DoS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php">
<p>DoS vulnerability with long passwords.</p>
<p>With very long passwords it was possible to initiate a
denial of service attack on phpMyAdmin.</p>
<p>We consider this vulnerability to be serious.</p>
<p>This vulnerability can be mitigated by configuring
throttling in the webserver.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php">
<p>XSS vulnerability in redirection mechanism.</p>
<p>With a crafted URL it was possible to trigger an XSS in
the redirection mechanism in phpMyAdmin.</p>
<p>We consider this vulnerability to be non critical.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php</url>
<cvename>CVE-2014-9218</cvename>
<cvename>CVE-2014-9219</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-04</entry>
</dates>
</vuln>
<vuln vid="7ae61870-9dd2-4884-a2f2-f19bb5784d09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>ASN.1 DER decoding of lengths is too permissive, allowing
undetected smuggling of arbitrary data</p>
<p>MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10
logging input data to /tmp directory</p>
<p>MFSA-2014-89 Bad casting from the BasicThebesLayer to
BasicContainerLayer</p>
<p>MFSA-2014-88 Buffer overflow while parsing media content</p>
<p>MFSA-2014-87 Use-after-free during HTML5 parsing</p>
<p>MFSA-2014-86 CSP leaks redirect data via violation reports</p>
<p>MFSA-2014-85 XMLHttpRequest crashes with some input streams</p>
<p>MFSA-2014-84 XBL bindings accessible via improper CSS
declarations</p>
<p>MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0
/ rv:31.3)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1587</cvename>
<cvename>CVE-2014-1588</cvename>
<cvename>CVE-2014-1589</cvename>
<cvename>CVE-2014-1590</cvename>
<cvename>CVE-2014-1591</cvename>
<cvename>CVE-2014-1592</cvename>
<cvename>CVE-2014-1593</cvename>
<cvename>CVE-2014-1594</cvename>
<cvename>CVE-2014-1595</cvename>
<cvename>CVE-2014-1569</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2014-83</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-84</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-85</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-86</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-87</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-88</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-89</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-90</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2014-12-01</discovery>
<entry>2014-12-02</entry>
</dates>
</vuln>
<vuln vid="23ab5c3e-79c3-11e4-8b1e-d050992ecde8">
<topic>OpenVPN -- denial of service security vulnerability</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.11</lt></range>
<range><ge>2.1.0</ge><lt>2.2.3</lt></range>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenVPN project reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b">
<p>In late November 2014 Dragana Damjanovic notified OpenVPN
developers of a critical denial of service security vulnerability
(CVE-2014-8104). The vulnerability allows an tls-authenticated
client to crash the server by sending a too-short control channel
packet to the server. In other words this vulnerability is denial
of service only.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8104</cvename>
<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b</url>
</references>
<dates>
<discovery>2014-12-01</discovery>
<entry>2014-12-02</entry>
</dates>
</vuln>
<vuln vid="a33addf6-74e6-11e4-a615-f8b156b6dcc8">
<topic>flac -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.3.0_3</lt></range>
</package>
<package>
<name>linux-c6-flac</name>
<range><lt>1.2.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik de Castro Lopo reports:</p>
<blockquote cite="http://lists.xiph.org/pipermail/flac-dev/2014-November/005226.html">
<p>Google Security Team member, Michele Spagnuolo, recently
found two potential problems in the FLAC code base. They are:</p>
<ul>
<li>CVE-2014-9028: Heap buffer write overflow.</li>
<li>CVE-2014-8962: Heap buffer read overflow.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e</url>
<cvename>CVE-2014-8962</cvename>
<url>https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85</url>
<cvename>CVE-2014-9028</cvename>
</references>
<dates>
<discovery>2014-11-25</discovery>
<entry>2014-11-25</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="7bfd797c-716d-11e4-b008-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2014-014 - High call load may result in hung
channels in ConfBridge.</p>
<p>AST-2014-017 - Permission escalation through ConfBridge
actions/dialplan functions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-014.html</url>
<cvename>CVE-2014-8414</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-017.html</url>
<cvename>CVE-2014-8417</cvename>
</references>
<dates>
<discovery>2014-11-21</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="a92ed304-716c-11e4-b008-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.1</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>AST-2014-012 - Mixed IP address families in access
control lists may permit unwanted traffic.</p>
<p>AST-2014-018 - AMI permission escalation through DB
dialplan function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-012.html</url>
<cvename>CVE-2014-8412</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-018.html</url>
<cvename>CVE-2014-8418</cvename>
</references>
<dates>
<discovery>2014-11-21</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="a5d4a82a-7153-11e4-88c7-6805ca0b3d42">
<topic>phpMyAdmin -- XSS and information disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php">
<ul>
<li>With a crafted database, table or column name it is
possible to trigger an XSS attack in the table browse
page.</li>
<li>With a crafted ENUM value it is possible to trigger
XSS attacks in the table print view and zoom search
pages.</li>
<li>With a crafted value for font size it is possible to
trigger an XSS attack in the home page.</li>
</ul>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages. Moreover, exploitation of the XSS
vulnerability related to the font size requires forgery of
the pma_fontsize cookie.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php">
<p> In the GIS editor feature, a parameter specifying the
geometry type was not correcly validated, opening the door
to a local file inclusion attack.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php">
<p>With a crafted file name it is possible to trigger an
XSS in the error reporting page.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php">
<p>In the error reporting feature, a parameter specifying
the file was not correctly validated, allowing the
attacker to derive the line count of an arbitrary file</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php</url>
<cvename>CVE-2014-8958</cvename>
<cvename>CVE-2014-8959</cvename>
<cvename>CVE-2014-8960</cvename>
<cvename>CVE-2014-8961</cvename>
</references>
<dates>
<discovery>2014-11-20</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="890b6b22-70fa-11e4-91ae-5453ed2e2b49">
<topic>kwebkitpart, kde-runtime -- insufficient input validation</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.14.2_2</lt></range>
</package>
<package>
<name>kwebkitpart</name>
<range><lt>1.3.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141113-1.txt">
<p>kwebkitpart and the bookmarks:// io slave were not sanitizing
input correctly allowing to some javascript being executed on the
context of the referenced hostname.</p>
<p>Whilst in most cases, the JavaScript will be executed in an
untrusted context, with the bookmarks IO slave, it will be executed
in the context of the referenced hostname. It should however be
noted that KDE mitigates this risk by attempting to ensure that
such URLs cannot be embedded directly into Internet hosted
content.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20141113-1.txt</url>
<cvename>CVE-2014-8600</cvename>
</references>
<dates>
<discovery>2014-11-13</discovery>
<entry>2014-11-20</entry>
</dates>
</vuln>
<vuln vid="5a35bc56-7027-11e4-a4a3-001999f8d30b">
<topic>yii -- Remote arbitrary PHP code execution</topic>
<affects>
<package>
<name>yii</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yii PHP Framework developers report:</p>
<blockquote cite="http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/">
<p>We are releasing Yii 1.1.15 to fix a security issue
found in 1.1.14. We urge all 1.1.14 users to upgrade their
Yii to this latest release. Note that the issue only
affects 1.1.14. All previous releases are not affected.
Upgrading to this release from 1.1.14 is very safe and
will not break your existing code.</p>
<p>The vulnerability is in the CDetailView widget. When
a Yii application uses this widget and configures the
"value" property of a CDetailView attribute using end
user inputs, it may allow attackers to potentially execute
arbitrary PHP scripts on the server. We are not showing
how to exploit it here to allow users to upgrade before
details about the exploit become publicly known. To our
knowledge the details of this issue are only known to
core team members.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4672</cvename>
<url>http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix</url>
</references>
<dates>
<discovery>2014-07-03</discovery>
<entry>2014-11-19</entry>
</dates>
</vuln>
<vuln vid="d395e44f-6f4f-11e4-a444-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>39.0.2171.65</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>39.0.2171.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html">
<p>42 security fixes in this release, including:</p>
<ul>
<li>[389734] High CVE-2014-7899: Address bar spoofing. Credit to
Eli Grey.</li>
<li>[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit
to Atte Kettunen from OUSPG.</li>
<li>[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit
to cloudfuzzer.</li>
<li>[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit
to cloudfuzzer.</li>
<li>[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit
to cloudfuzzer.</li>
<li>[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to
Atte Kettunen from OUSPG.</li>
<li>[421817] High CVE-2014-7905: Flaw allowing navigation to
intents that do not have the BROWSABLE category. Credit to
WangTao(neobyte) of Baidu X-Team.</li>
<li>[423030] High CVE-2014-7906: Use-after-free in pepper plugins.
Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
<li>[423703] High CVE-2014-0574: Double-free in Flash. Credit to
biloulehibou.</li>
<li>[424453] High CVE-2014-7907: Use-after-free in blink. Credit to
Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
<li>[425980] High CVE-2014-7908: Integer overflow in media. Credit
to Christoph Diehl.</li>
<li>[391001] Medium CVE-2014-7909: Uninitialized memory read in
Skia. Credit to miaubiz.</li>
<li>CVE-2014-7910: Various fixes from internal audits, fuzzing and
other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0574</cvename>
<cvename>CVE-2014-7899</cvename>
<cvename>CVE-2014-7900</cvename>
<cvename>CVE-2014-7901</cvename>
<cvename>CVE-2014-7902</cvename>
<cvename>CVE-2014-7903</cvename>
<cvename>CVE-2014-7904</cvename>
<cvename>CVE-2014-7905</cvename>
<cvename>CVE-2014-7906</cvename>
<cvename>CVE-2014-7907</cvename>
<cvename>CVE-2014-7908</cvename>
<cvename>CVE-2014-7909</cvename>
<cvename>CVE-2014-7910</cvename>
<url>http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2014-11-18</discovery>
<entry>2014-11-18</entry>
</dates>
</vuln>
<vuln vid="dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49">
<topic>kde-workspace -- privilege escalation</topic>
<affects>
<package>
<name>kde-workspace</name>
<range><lt>4.11.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Edmundson reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141106-1.txt">
<p>KDE workspace configuration module for setting the date and time
has a helper program which runs as root for performing actions.
This is secured with polkit.</p>
<p>This helper takes the name of the ntp utility to run as an
argument. This allows a hacker to run any arbitrary command as root
under the guise of updating the time.</p>
<p>An application can gain root priveledges from an admin user with
either misleading information or no interaction.</p>
<p>On some systems the user will be shown a prompt to change the
time. However, if the system has policykit-desktop-privileges
installed, the datetime helper will be invoked by an admin user
without any prompts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8651</cvename>
<mlist>http://seclists.org/oss-sec/2014/q4/520</mlist>
</references>
<dates>
<discovery>2014-11-06</discovery>
<entry>2014-11-17</entry>
</dates>
</vuln>
<vuln vid="c1930f45-6982-11e4-80e1-bcaec565249c">
<topic>dbus -- incomplete fix for CVE-2014-3636 part A</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-November/016395.html">
<p>The patch issued by the D-Bus maintainers for CVE-2014-3636
was based on incorrect reasoning, and does not fully prevent
the attack described as "CVE-2014-3636 part A", which is
repeated below. Preventing that attack requires raising the
system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher
value. CVE-2014-7824 has been allocated for this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7824</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-November/016395.html</url>
</references>
<dates>
<discovery>2014-11-10</discovery>
<entry>2014-11-11</entry>
</dates>
</vuln>
<vuln vid="ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e">
<topic>wget -- path traversal vulnerability in recursive FTP mode</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877">
<p>Absolute path traversal vulnerability in GNU Wget before
1.16, when recursion is enabled, allows remote FTP servers
to write to arbitrary files, and consequently execute
arbitrary code, via a LIST response that references the same
filename within two entries, one of which indicates that the
filename is for a symlink. </p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4877</cvename>
<certvu>685996</certvu>
</references>
<dates>
<discovery>2014-10-27</discovery>
<entry>2014-11-08</entry>
</dates>
</vuln>
<vuln vid="0167f5ad-64ea-11e4-98c1-00269ee29e57">
<topic>Konversation -- out-of-bounds read on a heap-allocated array</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Konversation developers report:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141104-1.txt">
<p>Konversation's Blowfish ECB encryption support assumes incoming blocks
to be the expected 12 bytes. The lack of a sanity-check for the actual
size can cause a denial of service and an information leak to the local
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8483</cvename>
<url>https://www.kde.org/info/security/advisory-20141104-1.txt</url>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2014-11-05</entry>
</dates>
</vuln>
<vuln vid="21ce1840-6107-11e4-9e84-0022156e8794">
<topic>twiki -- remote Perl code execution</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>5.1.4_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TWiki developers report:</p>
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236">
<p>The debugenableplugins request parameter allows arbitrary
Perl code execution.</p>
<p>Using an HTTP GET request towards a TWiki server,
add a specially crafted debugenableplugins request parameter
to TWiki's view script (typically port 80/TCP).
Prior authentication may or may not be necessary.</p>
<p>A remote attacker can execute arbitrary Perl code
to view and modify any file the webserver user has access to.</p>
<p>Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit</p>
<p>The TWiki site is vulnerable if you see a page with text
"Vulnerable!".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7236</cvename>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236</url>
</references>
<dates>
<discovery>2014-10-09</discovery>
<entry>2014-10-31</entry>
</dates>
</vuln>
<vuln vid="0dad9114-60cc-11e4-9e84-0022156e8794">
<topic>jenkins -- slave-originated arbitrary code execution on master servers</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.587</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.580.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30">
<p>Historically, Jenkins master and slaves behaved as if
they altogether form a single distributed process. This
means a slave can ask a master to do just about anything
within the confinement of the operating system, such as
accessing files on the master or trigger other jobs on
Jenkins.</p>
<p>This has increasingly become problematic, as larger
enterprise deployments have developed more sophisticated
trust separation model, where the administators of a master
might take slaves owned by other teams. In such an
environment, slaves are less trusted than the master.
Yet the "single distributed process" assumption was not
communicated well to the users, resulting in vulnerabilities
in some deployments.</p>
<p>SECURITY-144 (CVE-2014-3665) introduces a new subsystem
to address this problem. This feature is off by default for
compatibility reasons. See Wiki for more details, who should
turn this on, and implications.</p>
<p>CVE-2014-3566 is rated high. It only affects
installations that accept slaves from less trusted
computers, but this will allow an owner of of such slave to
mount a remote code execution attack on Jenkins.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3665</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30</url>
<url>https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control</url>
<url>http://www.cloudbees.com/jenkins-security-advisory-2014-10-30</url>
</references>
<dates>
<discovery>2014-10-30</discovery>
<entry>2014-10-31</entry>
</dates>
</vuln>
<vuln vid="f8c88d50-5fb3-11e4-81bd-5453ed2e2b49">
<topic>libssh -- PRNG state reuse on forking servers</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aris Adamantiadis reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/05/1">
<p>When accepting a new connection, the server forks and the
child process handles the request. The RAND_bytes() function
of openssl doesn't reset its state after the fork, but
simply adds the current process id (getpid) to the PRNG
state, which is not guaranteed to be unique.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0017</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2014/03/05/1</mlist>
<url>http://secunia.com/advisories/57407</url>
</references>
<dates>
<discovery>2014-03-05</discovery>
<entry>2014-10-29</entry>
</dates>
</vuln>
<vuln vid="d057c5e6-5b20-11e4-bebd-000c2980a9f3">
<topic>libpurple/pidgin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.10</lt></range>
</package>
<package>
<name>pidgin</name>
<range><lt>2.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pidgin development team reports:</p>
<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3694</cvename>
<cvename>CVE-2014-3697</cvename>
<cvename>CVE-2014-3696</cvename>
<cvename>CVE-2014-3695</cvename>
<cvename>CVE-2014-3698</cvename>
<url>https://developer.pidgin.im/wiki/ChangeLog</url>
</references>
<dates>
<discovery>2014-10-22</discovery>
<entry>2014-10-24</entry>
</dates>
</vuln>
<vuln vid="25b78f04-59c8-11e4-b711-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page.</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php">
<p>With a crafted database or table name it is possible to
trigger an XSS in SQL debug output when enabled and in
server monitor page when viewing and analysing executed
queries.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages. Moreover, debugging SQL is a developer option which
is disabled by default and expected to be disabled in
production environments.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php</url>
<cvename>CVE-2014-8326</cvename>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2014-10-22</entry>
</dates>
</vuln>
<vuln vid="76c7a0f5-5928-11e4-adc7-001999f8d30b">
<topic>asterisk -- Asterisk Susceptibility to POODLE Vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.31.1</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The POODLE vulnerability is described under CVE-2014-3566.
This advisory describes the Asterisk's project susceptibility
to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-011.html</url>
<cvename>CVE-2014-3566</cvename>
</references>
<dates>
<discovery>2014-10-20</discovery>
<entry>2014-10-21</entry>
</dates>
</vuln>
<vuln vid="0642b064-56c4-11e4-8b87-bcaec565249c">
<topic>libxml2 -- Denial of service</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.2</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2014-1655.html">
<p>A denial of service flaw was found in libxml2, a library
providing support to read, modify and write XML and HTML
files. A remote attacker could provide a specially crafted
XML file that, when processed by an application using
libxml2, would lead to excessive CPU consumption (denial of
service) based on excessive entity substitutions, even if
entity substitution was disabled, which is the parser default
behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3660</cvename>
<url>https://rhn.redhat.com/errata/RHSA-2014-1655.html</url>
</references>
<dates>
<discovery>2014-10-16</discovery>
<entry>2014-10-18</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="6f825fa4-5560-11e4-a4c3-00a0986f28c4">
<topic>drupal7 -- SQL injection</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-003">
<p>Drupal 7 includes a database abstraction API to ensure that
queries executed against the database are sanitized to prevent
SQL injection attacks.
A vulnerability in this API allows an attacker to send
specially crafted requests resulting in arbitrary SQL execution.
Depending on the content of the requests this can lead to
privilege escalation, arbitrary PHP execution, or other attacks.
This vulnerability can be exploited by anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3704</cvename>
<url>https://www.drupal.org/SA-CORE-2014-005</url>
<url>https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html</url>
</references>
<dates>
<discovery>2014-10-15</discovery>
<entry>2014-10-16</entry>
</dates>
</vuln>
<vuln vid="03175e62-5494-11e4-9cc1-bc5ff4fb5e7b">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_16</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1j</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.4</ge><lt>8.4_17</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20141015.txt">
<p>A flaw in the DTLS SRTP extension parsing code allows an
attacker, who sends a carefully crafted handshake message,
to cause OpenSSL to fail to free up to 64k of memory causing
a memory leak. This could be exploited in a Denial Of Service
attack. This issue affects OpenSSL 1.0.1 server implementations
for both SSL/TLS and DTLS regardless of whether SRTP is used
or configured. Implementations of OpenSSL that have been
compiled with OPENSSL_NO_SRTP defined are not affected.
[CVE-2014-3513].</p>
<p>When an OpenSSL SSL/TLS/DTLS server receives a session
ticket the integrity of that ticket is first verified.
In the event of a session ticket integrity check failing,
OpenSSL will fail to free memory causing a memory leak.
By sending a large number of invalid session tickets an
attacker could exploit this issue in a Denial Of Service
attack. [CVE-2014-3567].</p>
<p>OpenSSL has added support for TLS_FALLBACK_SCSV to allow
applications to block the ability for a MITM attacker to
force a protocol downgrade.</p>
<p>Some client applications (such as browsers) will reconnect
using a downgraded protocol to work around interoperability
bugs in older servers. This could be exploited by an active
man-in-the-middle to downgrade connections to SSL 3.0 even
if both sides of the connection support higher protocols.
SSL 3.0 contains a number of weaknesses including POODLE
[CVE-2014-3566].</p>
<p>When OpenSSL is configured with "no-ssl3" as a build option,
servers could accept and complete a SSL 3.0 handshake, and
clients could be configured to send them. [CVE-2014-3568].</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-14:23.openssl</freebsdsa>
<cvename>CVE-2014-3513</cvename>
<cvename>CVE-2014-3566</cvename>
<cvename>CVE-2014-3567</cvename>
<cvename>CVE-2014-3568</cvename>
<url>https://www.openssl.org/news/secadv_20141015.txt</url>
</references>
<dates>
<discovery>2014-10-15</discovery>
<entry>2014-10-15</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="9c1495ac-8d8c-4789-a0f3-8ca6b476619c">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.2.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.2.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-74 Miscellaneous memory safety hazards
(rv:33.0 / rv:31.2)</p>
<p>MFSA 2014-75 Buffer overflow during CSS manipulation</p>
<p>MFSA 2014-76 Web Audio memory corruption issues with
custom waveforms</p>
<p>MFSA 2014-78 Further uninitialized memory use during GIF</p>
<p>MFSA 2014-79 Use-after-free interacting with text
directionality</p>
<p>MFSA 2014-80 Key pinning bypasses</p>
<p>MFSA 2014-81 Inconsistent video sharing within iframe</p>
<p>MFSA 2014-82 Accessing cross-origin objects via the
Alarms API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1574</cvename>
<cvename>CVE-2014-1575</cvename>
<cvename>CVE-2014-1576</cvename>
<cvename>CVE-2014-1577</cvename>
<cvename>CVE-2014-1580</cvename>
<cvename>CVE-2014-1581</cvename>
<cvename>CVE-2014-1582</cvename>
<cvename>CVE-2014-1583</cvename>
<cvename>CVE-2014-1584</cvename>
<cvename>CVE-2014-1585</cvename>
<cvename>CVE-2014-1586</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-74.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-75.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-76.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-78.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-79.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-80.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-81.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-82.html</url>
<url>https://www.mozilla.org/security/announce/</url>
</references>
<dates>
<discovery>2014-10-14</discovery>
<entry>2014-10-14</entry>
<modified>2015-08-12</modified>
</dates>
</vuln>
<vuln vid="c30c3a2e-4fb1-11e4-b275-14dae9d210b8">
<topic>foreman-proxy SSL verification issue</topic>
<affects>
<package>
<name>foreman-proxy</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Foreman Security reports:</p>
<blockquote cite="http://projects.theforeman.org/issues/7822">
<p>The smart proxy when running in an SSL-secured mode permits incoming
API calls to any endpoint without requiring, or performing any
verification of an SSL client certificate. This permits any client
with access to the API to make requests and perform actions
permitting control of Puppet CA, DHCP, DNS etc.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3691</cvename>
<url>https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U</url>
</references>
<dates>
<discovery>2014-05-09</discovery>
<entry>2014-10-09</entry>
</dates>
</vuln>
<vuln vid="b6587341-4d88-11e4-aef9-20cf30e32f6d">
<topic>Bugzilla multiple security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.14/">
<h5>Unauthorized Account Creation</h5>
<p>An attacker creating a new Bugzilla account can override certain
parameters when finalizing the account creation that can lead to the
user being created with a different email address than originally
requested. The overridden login name could be automatically added
to groups based on the group's regular expression setting.</p>
<h5>Cross-Site Scripting</h5>
<p>During an audit of the Bugzilla code base, several places
were found where cross-site scripting exploits could occur which
could allow an attacker to access sensitive information.</p>
<h5>Information Leak</h5>
<p>If a new comment was marked private to the insider group, and a flag
was set in the same transaction, the comment would be visible to
flag recipients even if they were not in the insider group.</p>
<h5>Social Engineering</h5>
<p>Search results can be exported as a CSV file which can then be
imported into external spreadsheet programs. Specially formatted
field values can be interpreted as formulas which can be executed
and used to attack a user's computer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1572</cvename>
<cvename>CVE-2014-1573</cvename>
<cvename>CVE-2014-1571</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1074812</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1075578</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1064140</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1054702</url>
</references>
<dates>
<discovery>2014-10-06</discovery>
<entry>2014-10-06</entry>
</dates>
</vuln>
<vuln vid="81e2b308-4a6c-11e4-b711-6805ca0b3d42">
<topic>rt42 -- vulnerabilities related to shellshock</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html">
<p>RT 4.2.0 and above may be vulnerable to arbitrary
execution of code by way of CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 --
collectively known as "Shellshock." This vulnerability
requires a privileged user with access to an RT instance
running with SMIME integration enabled; it applies to both
mod_perl and fastcgi deployments. If you have already
taken upgrades to bash to resolve "Shellshock," you are
protected from this vulnerability in RT, and there is no
need to apply this patch. This vulnerability has been
assigned CVE-2014-7227.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html</url>
<cvename>CVE-2014-7227</cvename>
</references>
<dates>
<discovery>2014-10-02</discovery>
<entry>2014-10-02</entry>
</dates>
</vuln>
<vuln vid="549a2771-49cc-11e4-ae2c-c80aa9043978">
<topic>jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.583</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.565.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01</url>
<cvename>CVE-2014-3661</cvename>
<cvename>CVE-2014-3662</cvename>
<cvename>CVE-2014-3663</cvename>
<cvename>CVE-2014-3664</cvename>
<cvename>CVE-2014-3680</cvename>
<cvename>CVE-2014-3681</cvename>
<cvename>CVE-2014-3666</cvename>
<cvename>CVE-2014-3667</cvename>
<cvename>CVE-2013-2186</cvename>
<cvename>CVE-2014-1869</cvename>
<cvename>CVE-2014-3678</cvename>
<cvename>CVE-2014-3679</cvename>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="512d1301-49b9-11e4-ae2c-c80aa9043978">
<topic>bash -- remote code execution</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><lt>4.3.25_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Note that this is different than the public "Shellshock"
issue.</p>
<p>Specially crafted environment variables could lead to remote
arbitrary code execution. This was fixed in bash 4.3.27, however
the port was patched with a mitigation in 4.3.25_2.</p>
</body>
</description>
<references>
<url>http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html</url>
<cvename>CVE-2014-6277</cvename>
<cvename>CVE-2014-6278</cvename>
</references>
<dates>
<discovery>2014-09-27</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="3e8b7f8a-49b0-11e4-b711-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php">
<p>With a crafted ENUM value it is possible to trigger an
XSS in table search and table structure pages. This
vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php</url>
<cvename>CVE-2014-7217</cvename>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="4a4e9f88-491c-11e4-ae2c-c80aa9043978">
<topic>bash -- out-of-bounds memory access in parser</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><lt>4.3.27_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7186">
<p>It was discovered that the fixed-sized redir_stack could be forced
to overflow in the Bash parser, resulting in memory corruption, and
possibly leading to arbitrary code execution when evaluating
untrusted input that would not otherwise be run as code.</p>
</blockquote>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7187">
<p>An off-by-one error was discovered in the way Bash was handling
deeply nested flow control constructs. Depending on the layout of
the .bss segment, this could allow arbitrary execution of code that
would not otherwise be executed by Bash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/CVE-2014-7186</url>
<cvename>CVE-2014-7186</cvename>
<cvename>CVE-2014-7187</cvename>
</references>
<dates>
<discovery>2014-09-25</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="8e0e86ff-48b5-11e4-ab80-000c29f6ae42">
<topic>rsyslog -- remote syslog PRI vulnerability</topic>
<affects>
<package>
<name>rsyslog</name>
<range><lt>7.6.7</lt></range>
</package>
<package>
<name>rsyslog8</name>
<range><lt>8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The rsyslog project reports:</p>
<blockquote cite="http://www.rsyslog.com/remote-syslog-pri-vulnerability/">
<p>potential abort when a message with PRI > 191 was processed
if the "pri-text" property was used in active templates,
this could be abused to a remote denial of service from
permitted senders</p>
<p>The original fix for CVE-2014-3634 was not adequate.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.rsyslog.com/remote-syslog-pri-vulnerability/</url>
<cvename>CVE-2014-3634</cvename>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2014-09-30</entry>
<modified>2014-10-02</modified>
</dates>
</vuln>
<vuln vid="6c083cf8-4830-11e4-ae2c-c80aa9043978">
<topic>fish -- local privilege escalation and remote code execution</topic>
<affects>
<package>
<name>fish</name>
<range><ge>1.6.0</ge><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fish developer David Adam reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/09/28/8">
<p>This release fixes a number of local privilege escalation
vulnerability and one remote code execution vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/09/28/8</url>
<cvename>CVE-2014-2905</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1436</url>
<cvename>CVE-2014-2906</cvename>
<cvename>CVE-2014-3856</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1437</url>
<cvename>CVE-2014-2914</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1438</url>
<cvename>CVE-2014-3219</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1440</url>
</references>
<dates>
<discovery>2014-09-28</discovery>
<entry>2014-09-29</entry>
</dates>
</vuln>
<vuln vid="ca44b64c-4453-11e4-9ea1-c485083ca99c">
<topic>Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.400</lt></range>
</package>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.400</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-21.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0547</cvename>
<cvename>CVE-2014-0548</cvename>
<cvename>CVE-2014-0549</cvename>
<cvename>CVE-2014-0550</cvename>
<cvename>CVE-2014-0551</cvename>
<cvename>CVE-2014-0552</cvename>
<cvename>CVE-2014-0553</cvename>
<cvename>CVE-2014-0554</cvename>
<cvename>CVE-2014-0555</cvename>
<cvename>CVE-2014-0556</cvename>
<cvename>CVE-2014-0557</cvename>
<cvename>CVE-2014-0559</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb14-21.html</url>
</references>
<dates>
<discovery>2014-09-09</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="48108fb0-751c-4cbb-8f33-09239ead4b55">
<topic>NSS -- RSA Signature Forgery</topic>
<affects>
<package>
<name>linux-firefox</name>
<range><lt>32.0.3,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.29.1</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.17.1</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><lt>3.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/announce/2014/mfsa2014-73.html">
<p>Antoine Delignat-Lavaud discovered that NSS is vulnerable
to a variant of a signature forgery attack previously
published by Daniel Bleichenbacher. This is due to lenient
parsing of ASN.1 values involved in a signature and could
lead to the forging of RSA certificates.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1568</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-73.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="fb25333d-442f-11e4-98f3-5453ed2e2b49">
<topic>krfb -- Multiple security issues in bundled libvncserver</topic>
<affects>
<package>
<name>krfb</name>
<range><lt>4.12.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Sandsmark reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2">
<p>krfb 4.14 [and earlier] embeds libvncserver which has had
several security issues.</p>
<p>Several remotely exploitable security issues have been
uncovered in libvncserver, some of which might allow a
remote authenticated user code execution or application
crashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6055</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2</mlist>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="71ad81da-4414-11e4-a33e-3c970e169bc2">
<topic>bash -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><gt>3.0</gt><le>3.0.17</le></range>
<range><gt>3.1</gt><le>3.1.18</le></range>
<range><gt>3.2</gt><le>3.2.52</le></range>
<range><gt>4.0</gt><le>4.0.39</le></range>
<range><gt>4.1</gt><le>4.1.12</le></range>
<range><gt>4.2</gt><le>4.2.48</le></range>
<range><gt>4.3</gt><lt>4.3.25_1</lt></range>
</package>
<package>
<name>linux_base-c6</name>
<range><lt>6.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chet Ramey reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html">
<p>Under certain circumstances, bash will execute user code
while processing the environment for exported function
definitions.</p>
</blockquote>
<p>The original fix released for CVE-2014-6271 was not adequate. A
similar vulnerability was discovered and tagged as CVE-2014-7169.</p>
</body>
</description>
<references>
<cvename>CVE-2014-6271</cvename>
<cvename>CVE-2014-7169</cvename>
<url>https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/</url>
<url>https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html</url>
<url>http://seclists.org/oss-sec/2014/q3/690</url>
</references>
<dates>
<discovery>2014-09-24</discovery>
<entry>2014-09-24</entry>
<modified>2014-09-25</modified>
</dates>
</vuln>
<vuln vid="e60d9e65-3f6b-11e4-ad16-001999f8d30b">
<topic>asterisk -- Remotely triggered crash</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>When an out of call message - delivered by either the
SIP or PJSIP channel driver or the XMPP stack - is handled
in Asterisk, a crash can occur if the channel servicing
the message is sent into the ReceiveFax dialplan application
while using the res_fax_spandsp module.</p>
<p>Note that this crash does not occur when using the
res_fax_digium module. While this crash technically
occurs due to a configuration issue, as attempting to
receive a fax from a channel driver that only contains
textual information will never succeed, the likelihood
of having it occur is sufficiently high as to warrant
this advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-010.pdf</url>
<url>https://issues.asterisk.org/jira/browse/ASTERISK-24301</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-09-05</discovery>
<entry>2014-09-18</entry>
</dates>
</vuln>
<vuln vid="d3324c55-3f11-11e4-ad16-001999f8d30b">
<topic>squid -- Buffer overflow in SNMP processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.4.8</lt></range>
</package>
<package>
<name>squid32</name>
<range><gt>0</gt></range>
</package>
<package>
<name>squid33</name>
<range><lt>3.3.13_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid-cache project reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2014_3.txt">
<p>Due to incorrect buffer management Squid can be caused
by an attacker to write outside its allocated SNMP buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2014_3.txt</url>
<cvename>CVE-2014-6270</cvename>
</references>
<dates>
<discovery>2014-09-15</discovery>
<entry>2014-09-18</entry>
</dates>
</vuln>
<vuln vid="38242d51-3e58-11e4-ac2f-bcaec565249c">
<topic>dbus -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-September/016343.html">
<p>Do not accept an extra fd in the padding of a cmsg message,
which could lead to a 4-byte heap buffer overrun
(CVE-2014-3635).</p>
<p>Reduce default for maximum Unix file descriptors passed per
message from 1024 to 16, preventing a uid with the default
maximum number of connections from exhausting the system
bus' file descriptors under Linux's default rlimit
(CVE-2014-3636).</p>
<p>Disconnect connections that still have a fd pending
unmarshalling after a new configurable limit,
pending_fd_timeout (defaulting to 150 seconds), removing
the possibility of creating an abusive connection that
cannot be disconnected by setting up a circular reference
to a connection's file descriptor (CVE-2014-3637).</p>
<p>Reduce default for maximum pending replies per connection
from 8192 to 128, mitigating an algorithmic complexity
denial-of-service attack (CVE-2014-3638).</p>
<p>Reduce default for authentication timeout on the system
bus from 30 seconds to 5 seconds, avoiding denial of service
by using up all unauthenticated connection slots; and when
all unauthenticated connection slots are used up, make new
connection attempts block instead of disconnecting them
(CVE-2014-3639).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3635</cvename>
<cvename>CVE-2014-3636</cvename>
<cvename>CVE-2014-3637</cvename>
<cvename>CVE-2014-3638</cvename>
<cvename>CVE-2014-3639</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-September/016343.html</url>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2014-09-17</entry>
</dates>
</vuln>
<vuln vid="77b784bb-3dc6-11e4-b191-f0def16c5c1b">
<topic>nginx -- inject commands into SSL session vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.6.0</ge><lt>1.6.2,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.5.6</ge><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html">
<p>Security: it was possible to reuse SSL sessions in unrelated contexts
if a shared SSL session cache or the same TLS session ticket key was
used for multiple "server" blocks (CVE-2014-3616).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3616</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html</url>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2014-09-16</entry>
</dates>
</vuln>
<vuln vid="cc627e6c-3b89-11e4-b629-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php">
<p>XSRF/CSRF due to DOM based XSS in the micro history feature.</p>
<p>By deceiving a logged-in user to click on a crafted URL,
it is possible to perform remote code execution and in some
cases, create a root account due to a DOM based XSS
vulnerability in the micro history feature.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php</url>
<cvename>CVE-2014-6300</cvename>
</references>
<dates>
<discovery>2014-09-13</discovery>
<entry>2014-09-13</entry>
</dates>
</vuln>
<vuln vid="36858e78-3963-11e4-ad84-000c29f6ae42">
<topic>security/ossec-hids-* -- root escalation via temp files</topic>
<affects>
<package>
<name>ossec-hids-server</name>
<name>ossec-hids-client</name>
<name>ossec-hids-local</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSSEC reports:</p>
<blockquote cite="http://www.ossec.net/?p=1135">
<p>This correction will create the temp file for the hosts deny file
in /var/ossec and will use mktemp where available to create
NON-predictable temp file name. In cases where mktemp is not
available we have written a BAD version of mktemp, but should be a
little better then just process id.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5284</cvename>
<url>http://www.ossec.net/?p=1135</url>
</references>
<dates>
<discovery>2014-09-09</discovery>
<entry>2014-09-11</entry>
</dates>
</vuln>
<vuln vid="6318b303-3507-11e4-b76c-0011d823eebd">
<topic>trafficserver -- unspecified vulnerability</topic>
<affects>
<package>
<name>trafficserver</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bryan Call reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E">
<p>Below is our announcement for the security issue reported to us
from Yahoo! Japan. All versions of Apache Traffic Server are
vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1
immediately.</p>
<p>This fixes CVE-2014-3525 and limits access to how the health
checks are performed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3525</cvename>
<url>http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E</url>
</references>
<dates>
<discovery>2014-07-23</discovery>
<entry>2014-09-05</entry>
</dates>
</vuln>
<vuln vid="84203724-296b-11e4-bebd-000c2980a9f3">
<topic>file -- buffer overruns and missing buffer size tests</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Christos Zoulas reports:</p>
<blockquote cite="http://mx.gw.com/pipermail/file/2014/001553.html">
<p>A specially crafted file can cause a segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mx.gw.com/pipermail/file/2014/001553.html</url>
</references>
<dates>
<discovery>2014-06-09</discovery>
<entry>2014-08-21</entry>
</dates>
</vuln>
<vuln vid="3c5579f7-294a-11e4-99f6-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py27-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py27-django14</name>
<range><ge>1.4</ge><lt>1.4.14</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py32-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py33-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py34-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2014/aug/20/security/">
<p>These releases address an issue with reverse() generating external
URLs; a denial of service involving file uploads; a potential
session hijacking issue in the remote-user middleware; and a data
leak in the administrative interface. We encourage all users of
Django to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2014/aug/20/security/</url>
<cvename>CVE-2014-0480</cvename>
<cvename>CVE-2014-0481</cvename>
<cvename>CVE-2014-0482</cvename>
<cvename>CVE-2014-0483</cvename>
</references>
<dates>
<discovery>2014-08-20</discovery>
<entry>2014-08-21</entry>
</dates>
</vuln>
<vuln vid="d2a892b9-2605-11e4-9da0-00a0986f28c4">
<topic>PHP multiple vulnerabilities</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Team reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.3.29">
<p>insecure temporary file use in the configure script</p>
<p>unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
</p>
<p>Heap buffer over-read in DateInterval</p>
<p>fileinfo: cdf_read_short_sector insufficient boundary check</p>
<p>fileinfo: CDF infinite loop in nelements DoS</p>
<p>fileinfo: fileinfo: numerous file_printf calls resulting in
performance degradation)</p>
<p>Fix potential segfault in dns_check_record()</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6712</cvename>
<cvename>CVE-2014-0207</cvename>
<cvename>CVE-2014-0237</cvename>
<cvename>CVE-2014-0238</cvename>
<cvename>CVE-2014-3515</cvename>
<cvename>CVE-2014-3981</cvename>
<cvename>CVE-2014-4049</cvename>
<url>http://php.net/ChangeLog-5.php#5.3.29</url>
<url>https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html</url>
</references>
<dates>
<discovery>2014-08-14</discovery>
<entry>2014-08-18</entry>
</dates>
</vuln>
<vuln vid="fbb01289-2645-11e4-bc44-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php">
<p>Multiple XSS vulnerabilities in browse table, ENUM
editor, monitor, query charts and table relations pages.</p>
<p> With a crafted database, table or a primary/unique key
column name it is possible to trigger an XSS when dropping
a row from the table. With a crafted column name it is
possible to trigger an XSS in the ENUM editor dialog. With
a crafted variable name or a crafted value for unit field
it is possible to trigger a self-XSS when adding a new
chart in the monitor page. With a crafted value for x-axis
label it is possible to trigger a self-XSS in the query
chart page. With a crafted relation name it is possible to
trigger an XSS in table relations page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php">
<p>XSS in view operations page.</p>
<p>With a crafted view name it is possible to trigger an
XSS when dropping the view in view operation page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php</url>
<cvename>CVE-2014-5273</cvename>
<cvename>CVE-2014-5274</cvename>
</references>
<dates>
<discovery>2014-08-17</discovery>
<entry>2014-08-17</entry>
</dates>
</vuln>
<vuln vid="69048656-2187-11e4-802c-20cf30e32f6d">
<topic>serf -- SSL Certificate Null Byte Poisoning</topic>
<affects>
<package>
<name>serf</name>
<range><lt>1.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>serf Development list reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc">
<p>Serf provides APIs to retrieve information about a certificate. These
APIs return the information as NUL terminated strings (commonly called C
strings). X.509 uses counted length strings which may include a NUL byte.
This means that a library user will interpret any information as ending
upon seeing this NUL byte and will only see a partial value for that field.
</p>
<p>Attackers could exploit this vulnerability to create a certificate that a
client will accept for a different hostname than the full certificate is
actually for by embedding a NUL byte in the certificate.</p>
<p>This can lead to a man-in-the-middle attack. There are no known instances
of this problem being exploited in the wild and in practice it should be
difficult to actually exploit this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3504</cvename>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-11</entry>
</dates>
</vuln>
<vuln vid="83a418cc-2182-11e4-802c-20cf30e32f6d">
<topic>subversion -- several vulnerabilities</topic>
<affects>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
<range><ge>1.8.0</ge><lt>1.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2014-3522-advisory.txt">
<p>Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API
to handle matching wildcards in certificate Common Names and Subject
Alternate Names. However, apr_fnmatch is not designed for this purpose.
Instead it is designed to behave like common shell globbing. In particular
this means that '*' is not limited to a single label within a hostname
(i.e. it will match '.'). But even further apr_fnmatch supports '?' and
character classes (neither of which are part of the RFCs defining how
certificate validation works).</p>
<p>Subversion stores cached credentials by an MD5 hash based on the URL and
the authentication realm of the server the credentials are cached for.
MD5 has been shown to be subject to chosen plaintext hash collisions.
This means it may be possible to generate an authentication realm which
results in the same MD5 hash for a different URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3522</cvename>
<cvename>CVE-2014-3528</cvename>
<url>http://subversion.apache.org/security/CVE-2014-3522-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2014-3528-advisory.txt</url>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-11</entry>
</dates>
</vuln>
<vuln vid="ad747a01-1fee-11e4-8ff1-f0def16c5c1b">
<topic>nginx -- inject commands into SSL session vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.6.0,2</ge><lt>1.6.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.5.6</ge><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html">
<p>Security: pipelined commands were not discarded after STARTTLS
command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3556</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html</url>
</references>
<dates>
<discovery>2014-08-05</discovery>
<entry>2014-08-09</entry>
</dates>
</vuln>
<vuln vid="8aff07eb-1dbd-11e4-b6ba-3c970e169bc2">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_14</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1i</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.4</ge><lt>8.4_15</lt></range>
<range><ge>9.1</ge><lt>9.1_18</lt></range>
<range><ge>9.2</ge><lt>9.2_11</lt></range>
<range><ge>9.3</ge><lt>9.3_1</lt></range>
<range><ge>10.0</ge><lt>10.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20140806.txt">
<p>A flaw in OBJ_obj2txt may cause pretty printing functions
such as X509_name_oneline, X509_name_print_ex et al. to leak
some information from the stack. [CVE-2014-3508]</p>
<p>The issue affects OpenSSL clients and allows a malicious
server to crash the client with a null pointer dereference
(read) by specifying an SRP ciphersuite even though it was
not properly negotiated with the client. [CVE-2014-5139]</p>
<p>If a multithreaded client connects to a malicious server
using a resumed session and the server sends an ec point
format extension it could write up to 255 bytes to freed
memory. [CVE-2014-3509]</p>
<p>An attacker can force an error condition which causes
openssl to crash whilst processing DTLS packets due to
memory being freed twice. This can be exploited through
a Denial of Service attack. [CVE-2014-3505]</p>
<p>An attacker can force openssl to consume large amounts
of memory whilst processing DTLS handshake messages.
This can be exploited through a Denial of Service
attack. [CVE-2014-3506]</p>
<p>By sending carefully crafted DTLS packets an attacker
could cause openssl to leak memory. This can be exploited
through a Denial of Service attack. [CVE-2014-3507]</p>
<p>OpenSSL DTLS clients enabling anonymous (EC)DH
ciphersuites are subject to a denial of service attack.
A malicious server can crash the client with a null pointer
dereference (read) by specifying an anonymous (EC)DH
ciphersuite and sending carefully crafted handshake
messages. [CVE-2014-3510]</p>
<p>A flaw in the OpenSSL SSL/TLS server code causes the
server to negotiate TLS 1.0 instead of higher protocol
versions when the ClientHello message is badly
fragmented. This allows a man-in-the-middle attacker
to force a downgrade to TLS 1.0 even if both the server
and the client support a higher protocol version, by
modifying the client's TLS records. [CVE-2014-3511]</p>
<p>A malicious client or server can send invalid SRP
parameters and overrun an internal buffer. Only
applications which are explicitly set up for SRP
use are affected. [CVE-2014-3512]</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv_20140806.txt</url>
<freebsdsa>SA-14:18.openssl</freebsdsa>
<cvename>CVE-2014-3505</cvename>
<cvename>CVE-2014-3506</cvename>
<cvename>CVE-2014-3507</cvename>
<cvename>CVE-2014-3508</cvename>
<cvename>CVE-2014-3509</cvename>
<cvename>CVE-2014-3510</cvename>
<cvename>CVE-2014-3511</cvename>
<cvename>CVE-2014-3512</cvename>
<cvename>CVE-2014-5139</cvename>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-06</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="be5421ab-1b56-11e4-a767-5453ed2e2b49">
<topic>krfb -- Possible Denial of Service or code execution via integer overflow</topic>
<affects>
<package>
<name>krfb</name>
<range><lt>4.12.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2">
<p>krfb embeds libvncserver which embeds liblzo2, it contains various
flaws that result in integer overflow problems.</p>
<p>This potentially allows a malicious application to create a
possible denial of service or code execution. Due to the need to
exploit precise details of the target architecture and threading it
is unlikely that remote code execution can be achieved in
practice.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4607</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2</mlist>
</references>
<dates>
<discovery>2014-08-03</discovery>
<entry>2014-08-03</entry>
</dates>
</vuln>
<vuln vid="89ff45e3-1a57-11e4-bebd-000c2980a9f3">
<topic>samba -- remote code execution</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.21</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba developers report:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2014-3560">
<p>A malicious browser can send packets that may overwrite the heap of
the target nmbd NetBIOS name services daemon. It may be possible to
use this to generate a remote code execution vulnerability as the
superuser (root).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3560</cvename>
<url>http://www.samba.org/samba/security/CVE-2014-3560</url>
</references>
<dates>
<discovery>2014-07-31</discovery>
<entry>2014-08-02</entry>
</dates>
</vuln>
<vuln vid="90ca3ba5-19e6-11e4-8616-001b3856973b">
<topic>gpgme -- heap-based buffer overflow in gpgsm status handler</topic>
<affects>
<package>
<name>gpgme</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Trnka reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1113267">
<p>Gpgme contains a buffer overflow in the gpgsm status handler
that could possibly be exploited using a specially crafted certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3564</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1113267</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2014-08-02</entry>
</dates>
</vuln>
<vuln vid="2f90556f-18c6-11e4-9cc4-5453ed2e2b49">
<topic>kdelibs -- KAuth PID Reuse Flaw</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.12.5_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Sandsmark reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2">
<p>The KAuth framework uses polkit-1 API which tries to authenticate
using the requestors PID. This is prone to PID reuse race
conditions.</p>
<p>This potentially allows a malicious application to pose as another
for authentication purposes when executing privileged actions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5033</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2</mlist>
</references>
<dates>
<discovery>2014-07-30</discovery>
<entry>2014-07-31</entry>
</dates>
</vuln>
<vuln vid="31c09848-1829-11e4-bf04-60a44c524f57">
<topic>tor -- traffic confirmation attack</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.4.23</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.5.6.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html">
<p>Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a
circuit after an inbound RELAY_EARLY cell is received by a client,
which makes it easier for remote attackers to conduct
traffic-confirmation attacks by using the pattern of RELAY and
RELAY_EARLY cells as a means of communicating information about
hidden service names.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html</url>
<url>https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack</url>
<cvename>CVE-2014-5117</cvename>
</references>
<dates>
<discovery>2014-07-30</discovery>
<entry>2014-07-30</entry>
</dates>
</vuln>
<vuln vid="13419364-1685-11e4-bf04-60a44c524f57">
<topic>i2p -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>i2p</name>
<range><lt>0.9.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The i2p project reports:</p>
<blockquote cite="http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release">
<p>XSS and remote execution vulnerabilities reported by Exodus Intelligence.</p>
</blockquote>
<p>Exodus Intelligence reports:</p>
<blockquote cite="http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/">
<p>The vulnerability we have found is able to perform remote code
execution with a specially crafted payload. This payload can be
customized to unmask a user and show the public IP address in
which the user connected from within 'a couple of seconds.'</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/</url>
<url>http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release</url>
</references>
<dates>
<discovery>2014-07-24</discovery>
<entry>2014-07-28</entry>
</dates>
</vuln>
<vuln vid="9defb2d6-1404-11e4-8cae-20cf30e32f6d">
<topic>bugzilla -- Cross Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.13/">
<p>Adobe does not properly restrict the SWF file format,
which allows remote attackers to conduct cross-site
request forgery (CSRF) attacks against Bugzilla's JSONP
endpoint, possibly obtaining sensitive bug information,
via a crafted OBJECT element with SWF content satisfying
the character-set requirements of a callback API.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1546</cvename>
</references>
<dates>
<discovery>2014-07-24</discovery>
<entry>2014-07-25</entry>
</dates>
</vuln>
<vuln vid="f927e06c-1109-11e4-b090-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP SERVER PROJECT reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.29">
<p> mod_deflate: The DEFLATE input filter (inflates request bodies) now
limits the length and compression ratio of inflated request bodies to
avoid denial of service via highly compressed bodies. See directives
DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and
DeflateInflateRatioBurst.</p>
<p>mod_cgid: Fix a denial of service against CGI scripts that do not consume
stdin that could lead to lingering HTTPD child processes filling up the
scoreboard and eventually hanging the server. By default, the client I/O
timeout (Timeout directive) now applies to communication with scripts. The
CGIDScriptTimeout directive can be used to set a different timeout for
communication with scripts.</p>
<p>Fix a race condition in scoreboard handling, which could lead to a heap
buffer overflow.</p>
<p>core: HTTP trailers could be used to replace HTTP headers late during
request processing, potentially undoing or otherwise confusing modules
that examined or modified request headers earlier. Adds "MergeTrailers"
directive to restore legacy behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0118</cvename>
<cvename>CVE-2014-0231</cvename>
<cvename>CVE-2014-0226</cvename>
<cvename>CVE-2013-5704</cvename>
</references>
<dates>
<discovery>2014-07-19</discovery>
<entry>2014-07-24</entry>
<modified>2014-09-03</modified>
</dates>
</vuln>
<vuln vid="81fc1076-1286-11e4-bebd-000c2980a9f3">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.40</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.53</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomcat Security Team reports:</p>
<blockquote cite="https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.54">
<p>Tomcat does not properly restrict XSLT stylesheets, which allows
remote attackers to bypass security-manager restrictions and read
arbitrary files via a crafted web application that provides an XML
external entity declaration in conjunction with an entity
reference, related to an XML External Entity (XXE) issue.</p>
<p>An integer overflow, when operated behind a reverse proxy, allows
remote attackers to conduct HTTP request smuggling attacks via a
crafted Content-Length HTTP header.</p>
<p>An integer overflow in parseChunkHeader allows remote attackers
to cause a denial of service (resource consumption) via a malformed
chunk size in chunked transfer coding of a request during the
streaming of data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0096</cvename>
<cvename>CVE-2014-0099</cvename>
<cvename>CVE-2014-0075</cvename>
<url>https://tomcat.apache.org/security-6.html</url>
<url>https://tomcat.apache.org/security-7.html</url>
<url>https://tomcat.apache.org/security-8.html</url>
</references>
<dates>
<discovery>2014-05-23</discovery>
<entry>2014-07-23</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="978b0f76-122d-11e4-afe3-bc5ff4fb5e7b">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>31.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>31.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.7.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.7.0</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.16.1_2</lt></range>
<!-- CVE-2014-1544/Bug 963150 -->
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-66 IFRAME sandbox same-origin access through
redirect</p>
<p>MFSA 2014-65 Certificate parsing broken by non-standard
character encoding</p>
<p>MFSA 2014-64 Crash in Skia library when scaling high
quality images</p>
<p>MFSA 2014-63 Use-after-free while when manipulating
certificates in the trusted cache</p>
<p>MFSA 2014-62 Exploitable WebGL crash with Cesium
JavaScript library</p>
<p>MFSA 2014-61 Use-after-free with FireOnStateChange
event</p>
<p>MFSA 2014-60 Toolbar dialog customization event
spoofing</p>
<p>MFSA 2014-59 Use-after-free in DirectWrite font
handling</p>
<p>MFSA 2014-58 Use-after-free in Web Audio due to
incorrect control message ordering</p>
<p>MFSA 2014-57 Buffer overflow during Web Audio
buffering for playback</p>
<p>MFSA 2014-56 Miscellaneous memory safety hazards
(rv:31.0 / rv:24.7)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1544</cvename>
<cvename>CVE-2014-1547</cvename>
<cvename>CVE-2014-1548</cvename>
<cvename>CVE-2014-1549</cvename>
<cvename>CVE-2014-1550</cvename>
<cvename>CVE-2014-1551</cvename>
<cvename>CVE-2014-1552</cvename>
<cvename>CVE-2014-1555</cvename>
<cvename>CVE-2014-1556</cvename>
<cvename>CVE-2014-1557</cvename>
<cvename>CVE-2014-1558</cvename>
<cvename>CVE-2014-1559</cvename>
<cvename>CVE-2014-1560</cvename>
<cvename>CVE-2014-1561</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-56.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-57.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-58.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-59.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-60.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-61.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-62.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-63.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-64.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-65.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-66.html</url>
<url>https://www.mozilla.org/security/announce/</url>
</references>
<dates>
<discovery>2014-07-22</discovery>
<entry>2014-07-23</entry>
</dates>
</vuln>
<vuln vid="ecea9e92-0be5-4931-88da-8772d044972a">
<topic>mcollective -- cert valication issue</topic>
<affects>
<package>
<name>mcollective</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Melissa Stone reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4">
<p>The MCollective aes_security public key plugin does not correctly
validate certs against the CA. By exploiting this vulnerability
within a race/initialization window, an attacker with local access
could initiate an unauthorized MCollective client connection with a
server, and thus control the mcollective plugins running on that
server. This vulnerability requires a collective be configured to
use the aes_security plugin. Puppet Enterprise and open source
MCollective are not configured to use the plugin and are not
vulnerable by default.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3251</cvename>
<url>https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4</url>
</references>
<dates>
<discovery>2014-07-09</discovery>
<entry>2014-07-21</entry>
</dates>
</vuln>
<vuln vid="904d78b8-0f7e-11e4-8b71-5453ed2e2b49">
<topic>qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler</topic>
<affects>
<package>
<name>qt4-imageformats</name>
<range><lt>4.8.6_1</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.2.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2014-April/000045.html">
<p>The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug
that would lead to a null pointer dereference when loading certain
hand crafted corrupt GIF files. This in turn would cause the
application loading these hand crafted GIFs to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0190</cvename>
<bid>67087</bid>
<mlist>http://lists.qt-project.org/pipermail/announce/2014-April/000045.html</mlist>
</references>
<dates>
<discovery>2014-04-24</discovery>
<entry>2014-07-19</entry>
<modified>2014-07-21</modified>
</dates>
</vuln>
<vuln vid="4364e1f1-0f44-11e4-b090-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&pathrev=1610737">
<p>mod_proxy: Fix crash in Connection header handling which allowed a
denial of service attack against a reverse proxy with a threaded MPM.</p>
<p>Fix a race condition in scoreboard handling, which could lead to a
heap buffer overflow.</p>
<p>mod_deflate: The DEFLATE input filter (inflates request bodies) now
limits the length and compression ratio of inflated request bodies to avoid
denial of sevice via highly compressed bodies. See directives
DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
and DeflateInflateRatioBurst.</p>
<p>mod_cgid: Fix a denial of service against CGI scripts that do
not consume stdin that could lead to lingering HTTPD child processes
filling up the scoreboard and eventually hanging the server. By
default, the client I/O timeout (Timeout directive) now applies to
communication with scripts. The CGIDScriptTimeout directive can be
used to set a different timeout for communication with scripts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0117</cvename>
<cvename>CVE-2014-3523</cvename>
<cvename>CVE-2014-0226</cvename>
<cvename>CVE-2014-0118</cvename>
<cvename>CVE-2014-0231</cvename>
</references>
<dates>
<discovery>2014-07-15</discovery>
<entry>2014-07-19</entry>
</dates>
</vuln>
<vuln vid="3f09ca29-0e48-11e4-b17a-6805ca0b3d42">
<topic>phpMyAdmin -- multiple XSS vulnerabilities, missing validation</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php">
<p>Self-XSS due to unescaped HTML output in database
structure page.</p>
<p>With a crafted table comment, it is possible to trigger
an XSS in database structure page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php">
<p>Self-XSS due to unescaped HTML output in database
triggers page.</p>
<p>When navigating into the database triggers page, it is
possible to trigger an XSS with a crafted trigger
name.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php">
<p>Multiple XSS in AJAX confirmation messages.</p>
<p>With a crafted column name it is possible to trigger an
XSS when dropping the column in table structure page. With
a crafted table name it is possible to trigger an XSS when
dropping or truncating the table in table operations
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php">
<p>Access for an unprivileged user to MySQL user list.</p>
<p>An unpriviledged user could view the MySQL user list and
manipulate the tabs displayed in phpMyAdmin for them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4954</cvename>
<cvename>CVE-2014-4955</cvename>
<cvename>CVE-2014-4986</cvename>
<cvename>CVE-2014-4987</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php</url>
</references>
<dates>
<discovery>2014-07-18</discovery>
<entry>2014-07-18</entry>
<modified>2014-07-20</modified>
</dates>
</vuln>
<vuln vid="4a114331-0d24-11e4-8dd2-5453ed2e2b49">
<topic>kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw</topic>
<affects>
<package>
<name>kdelibs</name>
<range><ge>4.10.95</ge><lt>4.12.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20140618-1.txt">
<p>The POP3 kioslave used by KMail will accept invalid
certificates without presenting a dialog to the user due a
bug that leads to an inability to display the dialog
combined with an error in the way the result is checked.</p>
<p>This flaw allows an active attacker to perform MITM
attacks against the ioslave which could result in the leakage of
sensitive data such as the authentication details and the contents of
emails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3494</cvename>
<bid>68113</bid>
<mlist>http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2</mlist>
</references>
<dates>
<discovery>2014-06-17</discovery>
<entry>2014-07-16</entry>
</dates>
</vuln>
<vuln vid="ff98087f-0a8f-11e4-b00b-5453ed2e2b49">
<topic>postfixadmin -- SQL injection vulnerability</topic>
<affects>
<package>
<name>postfixadmin</name>
<range><lt>2.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/26/6">
<p>Postfixadmin has an SQL injection vulnerability. This
vulnerability is only exploitable by authenticated users able to
create new aliases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2655</cvename>
<bid>66455</bid>
<freebsdpr>ports/189248</freebsdpr>
<mlist>http://www.openwall.com/lists/oss-security/2014/03/26/6</mlist>
<url>https://www.debian.org/security/2014/dsa-2889</url>
</references>
<dates>
<discovery>2014-03-28</discovery>
<entry>2014-07-13</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="e6a7636a-02d0-11e4-88b6-080027671656">
<topic>dbus -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-July/016235.html">
<p>Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's
support for file descriptor passing. A malicious process could
force system services or user applications to be disconnected
from the D-Bus system bus by sending them a message containing
a file descriptor, then causing that file descriptor to exceed
the kernel's maximum recursion depth (itself introduced to fix
a DoS) before dbus-daemon forwards the message to the victim
process. Most services and applications exit when disconnected
from the system bus, leading to a denial of service.</p>
<p>Additionally, Alban discovered that bug fd.o#79694, a bug
previously reported by Alejandro Martínez Suárez which was n
believed to be security flaw, could be used for a similar denial
of service, by causing dbus-daemon to attempt to forward invalid
file descriptors to a victim process when file descriptors become
associated with the wrong message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3532</cvename>
<cvename>CVE-2014-3533</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-July/016235.html</url>
</references>
<dates>
<discovery>2014-07-02</discovery>
<entry>2014-07-03</entry>
</dates>
</vuln>
<vuln vid="17dfd984-feba-11e3-b938-5404a68ad561">
<topic>mencoder -- potential buffer overrun when processing malicious lzo compressed input</topic>
<affects>
<package>
<name>mencoder</name>
<range><lt>1.1.r20140418_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
<blockquote>
<p>avutil/lzo: Fix integer overflow</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
<cvename>CVE-2014-4610</cvename>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2014-06-28</entry>
</dates>
</vuln>
<vuln vid="9ab3a22c-feb8-11e3-b938-5404a68ad561">
<topic>mplayer -- potential buffer overrun when processing malicious lzo compressed input</topic>
<affects>
<package>
<name>mplayer</name>
<range><lt>1.1.r20140418_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
<blockquote>
<p>avutil/lzo: Fix integer overflow</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
<cvename>CVE-2014-4610</cvename>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2014-06-28</entry>
</dates>
</vuln>
<vuln vid="d1f5e12a-fd5a-11e3-a108-080027ef73ec">
<topic>LZO -- potential buffer overrun when processing malicious input data</topic>
<affects>
<package>
<name>lzo2</name>
<range><lt>2.07</lt></range>
</package>
<package>
<name>busybox</name>
<range><lt>1.22.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:</p>
<blockquote>
<p>Fixed a potential integer overflow condition in the "safe"
decompressor variants which could result in a possible buffer
overrun when processing maliciously crafted compressed input
data.</p>
<p>As this issue only affects 32-bit systems and also can only happen
if you use uncommonly huge buffer sizes where you have to decompress
more than 16 MiB (2^24 bytes) compressed bytes within a single
function call, the practical implications are limited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz</url>
<cvename>CVE-2014-4608</cvename>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2014-06-26</entry>
<modified>2015-01-06</modified>
</dates>
</vuln>
<vuln vid="1c840eb9-fb32-11e3-866e-b499baab0cbe">
<topic>gnupg -- possible DoS using garbled compressed data packets</topic>
<affects>
<package>
<name>gnupg1</name>
<range><lt>1.4.17</lt></range>
</package>
<package>
<name>gnupg</name>
<range><lt>2.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html">
<p>This release includes a *security fix* to stop
a possible DoS using garbled compressed data packets which can be used
to put gpg into an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html</url>
</references>
<dates>
<discovery>2014-06-23</discovery>
<entry>2014-06-23</entry>
</dates>
</vuln>
<vuln vid="6ad309d9-fb03-11e3-bebd-000c2980a9f3">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><lt>3.6.24</lt></range>
</package>
<package>
<name>samba4</name>
<range><lt>4.0.19</lt></range>
</package>
<package>
<name>samba41</name>
<range><lt>4.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/history/">
<p>A malformed packet can cause the nmbd server to loop the CPU and
prevent any further NetBIOS name service.</p>
<p>Valid unicode path names stored on disk can cause smbd to
crash if an authenticated client attempts to read them
using a non-unicode request.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0244</cvename>
<cvename>CVE-2014-3493</cvename>
<url>https://www.samba.org/samba/security/CVE-2014-0244</url>
<url>https://www.samba.org/samba/security/CVE-2014-3493</url>
</references>
<dates>
<discovery>2014-06-23</discovery>
<entry>2014-06-23</entry>
</dates>
</vuln>
<vuln vid="c4892644-f8c6-11e3-9f45-6805ca0b3d42">
<topic>phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.1.0</ge><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php">
<p>Self-XSS due to unescaped HTML output in recent/favorite
tables navigation.</p>
<p>When marking a crafted database or table name as
favorite or having it in recent tables, it is possible to
trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php">
<p>Self-XSS due to unescaped HTML output in navigation items
hiding feature.</p>
<p>When hiding or unhiding a crafted table name in the
navigation, it is possible to trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4348</cvename>
<cvename>CVE-2014-4349</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php</url>
</references>
<dates>
<discovery>2014-06-20</discovery>
<entry>2014-06-20</entry>
<modified>2014-06-24</modified>
</dates>
</vuln>
<vuln vid="0981958a-f733-11e3-8276-071f1604ef8a">
<topic>iodined -- authentication bypass</topic>
<affects>
<package>
<name>iodine</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Ekman of the iodine project reports:</p>
<blockquote cite="https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850">
<p>The client could bypass the password check by continuing after
getting error from the server and guessing the network parameters.
The server would still accept the rest of the setup and also network
traffic.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850</url>
</references>
<dates>
<discovery>2014-06-16</discovery>
<entry>2014-06-18</entry>
</dates>
</vuln>
<vuln vid="f109b02f-f5a4-11e3-82e9-00a098b18457">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.10.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.28.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Asterisk Manager User Unauthorized Shell Access. Manager users can
execute arbitrary shell commands with the MixMonitor manager action.
Asterisk does not require system class authorization for a manager
user to use the MixMonitor action, so any manager user who is
permitted to use manager commands can potentially execute shell
commands as the user executing the Asterisk process.</p>
<p>Exhaustion of Allowed Concurrent HTTP Connections. Establishing a
TCP or TLS connection to the configured HTTP or HTTPS port
respectively in http.conf and then not sending or completing a HTTP
request will tie up a HTTP session. By doing this repeatedly until the
maximum number of open HTTP sessions is reached, legitimate requests
are blocked.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4046</cvename>
<cvename>CVE-2014-4047</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-006.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-007.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-06-12</discovery>
<entry>2014-06-17</entry>
</dates>
</vuln>
<vuln vid="52bbc7e8-f13c-11e3-bc09-bcaec565249c">
<topic>dbus -- local DoS</topic>
<affects>
<package>
<name>dbus</name>
<range><ge>1.8.0</ge><lt>1.8.4</lt></range>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon MvVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-June/016220.html">
<p>Alban Crequy at Collabora Ltd. discovered and fixed a
denial-of-service flaw in dbus-daemon, part of the reference
implementation of D-Bus. Additionally, in highly unusual
environments the same flaw could lead to a side channel between
processes that should not be able to communicate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3477</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-June/016220.html</url>
</references>
<dates>
<discovery>2014-06-10</discovery>
<entry>2014-06-14</entry>
</dates>
</vuln>
<vuln vid="888a0262-f0d9-11e3-ba0c-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>30.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.6.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.26.1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>30.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.26.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.6.0</lt></range>
</package>
<package>
<name>nspr</name>
<range><lt>4.10.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-48 Miscellaneous memory safety hazards
(rv:30.0 / rv:24.6)</p>
<p>MFSA 2014-49 Use-after-free and out of bounds
issues found using Address Sanitizer</p>
<p>MFSA 2014-51 Use-after-free in Event Listener
Manager</p>
<p>MFSA 2014-52 Use-after-free with SMIL Animation
Controller</p>
<p>MFSA 2014-53 Buffer overflow in Web Audio Speex
resampler</p>
<p>MFSA 2014-54 Buffer overflow in Gamepad API</p>
<p>MFSA 2014-55 Out of bounds write in NSPR</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1533</cvename>
<cvename>CVE-2014-1534</cvename>
<cvename>CVE-2014-1536</cvename>
<cvename>CVE-2014-1537</cvename>
<cvename>CVE-2014-1540</cvename>
<cvename>CVE-2014-1541</cvename>
<cvename>CVE-2014-1542</cvename>
<cvename>CVE-2014-1543</cvename>
<cvename>CVE-2014-1545</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-48.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-49.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-51.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-52.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-53.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-54.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-55.html</url>
</references>
<dates>
<discovery>2014-06-10</discovery>
<entry>2014-06-10</entry>
</dates>
</vuln>
<vuln vid="5ac53801-ec2e-11e3-9cf3-3c970e169bc2">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_13</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1h</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.0</ge><lt>8.4_12</lt></range>
<range><ge>9.1</ge><lt>9.1_15</lt></range>
<range><ge>9.2</ge><lt>9.2_8</lt></range>
<range><ge>10.0</ge><lt>10.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20140605.txt">
<p>An attacker using a carefully crafted handshake can force
the use of weak keying material in OpenSSL SSL/TLS clients
and servers. This can be exploited by a Man-in-the-middle
(MITM) attack where the attacker can decrypt and modify
traffic from the attacked client and server. [CVE-2014-0224]</p>
<p>By sending an invalid DTLS handshake to an OpenSSL DTLS
client the code can be made to recurse eventually crashing
in a DoS attack. [CVE-2014-0221]</p>
<p>A buffer overrun attack can be triggered by sending invalid
DTLS fragments to an OpenSSL DTLS client or server. This is
potentially exploitable to run arbitrary code on a vulnerable
client or server. [CVE-2014-0195]</p>
<p>OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
subject to a denial of service attack. [CVE-2014-3470]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0195</cvename>
<cvename>CVE-2014-0221</cvename>
<cvename>CVE-2014-0224</cvename>
<cvename>CVE-2014-3470</cvename>
<freebsdsa>SA-14:14.openssl</freebsdsa>
<url>http://www.openssl.org/news/secadv_20140605.txt</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2014-06-05</entry>
</dates>
</vuln>
<vuln vid="9733c480-ebff-11e3-970b-206a8a720317">
<topic>gnutls -- client-side memory corruption</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.23_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
<p>This vulnerability affects the client side of the gnutls library.
A server that sends a specially crafted ServerHello could corrupt
the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
</references>
<dates>
<discovery>2014-05-14</discovery>
<entry>2014-06-04</entry>
</dates>
</vuln>
<vuln vid="027af74d-eb56-11e3-9032-000c2980a9f3">
<topic>gnutls -- client-side memory corruption</topic>
<affects>
<package>
<name>gnutls3</name>
<range><ge>3.1</ge><lt>3.1.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
<p>This vulnerability affects the client side of the gnutls library.
A server that sends a specially crafted ServerHello could corrupt
the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
</references>
<dates>
<discovery>2014-05-14</discovery>
<entry>2014-06-03</entry>
</dates>
</vuln>
<vuln vid="77e2e631-e742-11e3-9a25-5404a6a6412c">
<topic>mumble -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mumble</name>
<range><ge>1.2.0</ge><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mumble reports:</p>
<blockquote cite="http://blog.mumble.info/mumble-1-2-6/">
<p>SVG images with local file references could trigger client DoS</p>
<p>The Mumble client did not properly HTML-escape some external strings
before using them in a rich-text (HTML) context.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mumble.info/security/Mumble-SA-2014-005.txt</url>
<url>http://mumble.info/security/Mumble-SA-2014-006.txt</url>
</references>
<dates>
<discovery>2014-04-16</discovery>
<entry>2014-05-29</entry>
</dates>
</vuln>
<vuln vid="c2c8c84b-e734-11e3-9a25-5404a6a6412c">
<topic>mumble -- NULL pointer dereference and heap-based buffer overflow</topic>
<affects>
<package>
<name>mumble</name>
<range><ge>1.2.4</ge><le>1.2.4_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mumble reports:</p>
<blockquote cite="http://blog.mumble.info/mumble-1-2-5/">
<p>A malformed Opus voice packet sent to a Mumble client could trigger
a NULL pointer dereference or an out-of-bounds array access.</p>
<p>A malformed Opus voice packet sent to a Mumble client could trigger a
heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0044</cvename>
<cvename>CVE-2014-0045</cvename>
<url>http://mumble.info/security/Mumble-SA-2014-001.txt</url>
<url>http://mumble.info/security/Mumble-SA-2014-002.txt</url>
</references>
<dates>
<discovery>2014-01-25</discovery>
<entry>2014-05-29</entry>
</dates>
</vuln>
<vuln vid="f99a4686-e694-11e3-9032-000c2980a9f3">
<cancelled/>
</vuln>
<vuln vid="688e73a2-e514-11e3-a52a-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.359</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-14.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0510</cvename>
<cvename>CVE-2014-0516</cvename>
<cvename>CVE-2014-0517</cvename>
<cvename>CVE-2014-0518</cvename>
<cvename>CVE-2014-0519</cvename>
<cvename>CVE-2014-0520</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb14-14.html</url>
</references>
<dates>
<discovery>2014-03-13</discovery>
<entry>2014-05-26</entry>
</dates>
</vuln>
<vuln vid="02db20d7-e34a-11e3-bd92-bcaec565249c">
<topic>openjpeg -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openjpeg release notes report:</p>
<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS">
<p>That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1
release.</p>
</blockquote>
<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS">
<p>That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045,
CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887,
where fixed in the 1.5.2 release.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3358</cvename>
<cvename>CVE-2012-3535</cvename>
<cvename>CVE-2013-1447</cvename>
<cvename>CVE-2013-4289</cvename>
<cvename>CVE-2013-4290</cvename>
<cvename>CVE-2013-6045</cvename>
<cvename>CVE-2013-6052</cvename>
<cvename>CVE-2013-6053</cvename>
<cvename>CVE-2013-6054</cvename>
<cvename>CVE-2013-6887</cvename>
<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS</url>
<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS</url>
</references>
<dates>
<discovery>2012-05-13</discovery>
<entry>2014-05-24</entry>
</dates>
</vuln>
<vuln vid="b060ee50-daba-11e3-99f2-bcaec565249c">
<topic>libXfont -- X Font Service Protocol and Font metadata file handling issues</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.7_3</lt></range>
</package>
<package>
<name>linux-c6-xorg-libs</name>
<range><lt>7.4_2</lt></range>
</package>
<package>
<name>linux-f10-xorg-libs</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-May/002431.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered several issues in the way the libXfont library
handles the responses it receives from xfs servers, and has
worked with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>Most of these issues stem from libXfont trusting the font server
to send valid protocol data, and not verifying that the values
will not overflow or cause other damage. This code is commonly
called from the X server when an X Font Server is active in the
font path, so may be running in a setuid-root process depending
on the X server in use. Exploits of this path could be used by
a local, authenticated user to attempt to raise privileges; or
by a remote attacker who can control the font server to attempt
to execute code with the privileges of the X server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0209</cvename>
<cvename>CVE-2014-0210</cvename>
<cvename>CVE-2014-0211</cvename>
<url>http://lists.x.org/archives/xorg-announce/2014-May/002431.html</url>
</references>
<dates>
<discovery>2014-05-13</discovery>
<entry>2014-05-13</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="e7bb3885-da40-11e3-9ecb-2c4138874f7d">
<topic>libxml2 -- lack of end-of-document check DoS</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.1</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877">
<p>parser.c in libxml2 before 2.9.0, as used in Google
Chrome before 28.0.1500.71 and other products, allows remote
attackers to cause a denial of service (out-of-bounds read)
via a document that ends abruptly, related to the lack of
certain checks for the XML_PARSER_EOF state.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2877</cvename>
<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877</url>
</references>
<dates>
<discovery>2013-04-11</discovery>
<entry>2013-07-10</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="efdd0edc-da3d-11e3-9ecb-2c4138874f7d">
<topic>libxml2 -- entity substitution DoS</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.1</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/06/4">
<p>It was discovered that libxml2, a library providing
support to read, modify and write XML files, incorrectly
performs entity substitution in the doctype prolog, even if
the application using libxml2 disabled any entity
substitution. A remote attacker could provide a
specially-crafted XML file that, when processed, would lead
to the exhaustion of CPU and memory resources or file
descriptors.</p>
<p>This issue was discovered by Daniel Berrange of Red Hat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0191</cvename>
<url>http://www.openwall.com/lists/oss-security/2014/05/06/4</url>
<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2014-05-06</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="1959e847-d4f0-11e3-84b0-0018fe623f2b">
<topic>OpenSSL -- NULL pointer dereference / DoS</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_12</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenBSD and David Ramos reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/02/5">
<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache,
are prone to a race condition which may allow a remote attacker to
crash the current service.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/05/02/5</url>
<url>https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321</url>
<freebsdsa>SA-14:10.openssl</freebsdsa>
<cvename>CVE-2014-0198</cvename>
</references>
<dates>
<discovery>2014-05-02</discovery>
<entry>2014-05-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="89709e58-d497-11e3-a3d5-5453ed2e2b49">
<topic>qt4-xml -- XML Entity Expansion Denial of Service</topic>
<affects>
<package>
<name>qt4-xml</name>
<range><lt>4.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2013-December/000036.html">
<p>QXmlSimpleReader in Qt versions prior to 5.2 supports
expansion of internal entities in XML documents without
placing restrictions to ensure the document does not cause
excessive memory usage. If an application using this API
processes untrusted data then the application may use
unexpected amounts of memory if a malicious document is
processed.</p>
<p>It is possible to construct XML documents using internal
entities that consume large amounts of memory and other
resources to process, this is known as the 'Billion Laughs'
attack. Qt versions prior to 5.2 did not offer protection
against this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4549</cvename>
<url>http://lists.qt-project.org/pipermail/announce/2013-December/000036.html</url>
</references>
<dates>
<discovery>2013-12-05</discovery>
<entry>2014-05-05</entry>
</dates>
</vuln>
<vuln vid="6fb521b0-d388-11e3-a790-000c2980a9f3">
<topic>strongswan -- Remote Authentication Bypass</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan developers report:</p>
<blockquote cite="www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-2338).html">
<p>Remote attackers are able to bypass authentication by rekeying an
IKE_SA during (1) initiation or (2) re-authentication, which
triggers the IKE_SA state to be set to established.</p>
<p>Only installations that actively initiate or re-authenticate IKEv2
IKE_SAs are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2338</cvename>
<url>http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</url>
</references>
<dates>
<discovery>2014-03-12</discovery>
<entry>2014-05-04</entry>
</dates>
</vuln>
<vuln vid="670d732a-cdd4-11e3-aac2-0022fb6fcf92">
<topic>mohawk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mohawk</name>
<range><lt>2.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mohawk project reports:</p>
<blockquote cite="http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351">
<p>Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.</p>
</blockquote>
</body>
</description>
<references>
<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351</url>
<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e</url>
</references>
<dates>
<discovery>2014-04-10</discovery>
<entry>2014-04-30</entry>
</dates>
</vuln>
<vuln vid="985d4d6c-cfbd-11e3-a003-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>29.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>29.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.26</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.5.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-34 Miscellaneous memory safety hazards
(rv:29.0 / rv:24.5)</p>
<p>MFSA 2014-35 Privilege escalation through Mozilla Maintenance
Service Installer</p>
<p>MFSA 2014-36 Web Audio memory corruption issues</p>
<p>MFSA 2014-37 Out of bounds read while decoding JPG images</p>
<p>MFSA 2014-38 Buffer overflow when using non-XBL object as
XBL</p>
<p>MFSA 2014-39 Use-after-free in the Text Track Manager
for HTML video</p>
<p>MFSA 2014-41 Out-of-bounds write in Cairo</p>
<p>MFSA 2014-42 Privilege escalation through Web Notification
API</p>
<p>MFSA 2014-43 Cross-site scripting (XSS) using history
navigations</p>
<p>MFSA 2014-44 Use-after-free in imgLoader while resizing
images</p>
<p>MFSA 2014-45 Incorrect IDNA domain name matching for
wildcard certificates</p>
<p>MFSA 2014-46 Use-after-free in nsHostResolve</p>
<p>MFSA 2014-47 Debugger can bypass XrayWrappers
with JavaScript</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1492</cvename>
<cvename>CVE-2014-1518</cvename>
<cvename>CVE-2014-1519</cvename>
<cvename>CVE-2014-1520</cvename>
<cvename>CVE-2014-1522</cvename>
<cvename>CVE-2014-1523</cvename>
<cvename>CVE-2014-1524</cvename>
<cvename>CVE-2014-1525</cvename>
<cvename>CVE-2014-1526</cvename>
<cvename>CVE-2014-1527</cvename>
<cvename>CVE-2014-1528</cvename>
<cvename>CVE-2014-1529</cvename>
<cvename>CVE-2014-1530</cvename>
<cvename>CVE-2014-1531</cvename>
<cvename>CVE-2014-1532</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-34.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-35.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-36.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-37.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-38.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-39.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-41.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-42.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-43.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-44.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-45.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-46.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-47.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-04-29</discovery>
<entry>2014-04-29</entry>
</dates>
</vuln>
<vuln vid="59e72db2-cae6-11e3-8420-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py31-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py26-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py27-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py31-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py32-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py33-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py34-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py26-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py27-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py31-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py32-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py33-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py34-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20140423,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20140423,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2014/apr/21/security/">
<p>These releases address an unexpected code-execution issue, a
caching issue which can expose CSRF tokens and a MySQL typecasting
issue. While these issues present limited risk and may not affect
all Django users, we encourage all users to evaluate their own
risk and upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2014/apr/21/security/</url>
<cvename>CVE-2014-0472</cvename>
<cvename>CVE-2014-0473</cvename>
<cvename>CVE-2014-0474</cvename>
</references>
<dates>
<discovery>2014-04-21</discovery>
<entry>2014-04-23</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="0b8d7194-ca88-11e3-9d8d-c80aa9043978">
<topic>OpenSSL -- Remote Data Injection / DoS</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_11</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><le>1.0.1g</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are
prone to a race condition which may allow a remote attacker to
inject random data into other connections.</p>
</body>
</description>
<references>
<url>https://rt.openssl.org/Ticket/Display.html?id=2167</url>
<url>http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse</url>
<freebsdsa>SA-14:09.openssl</freebsdsa>
<cvename>CVE-2010-5298</cvename>
</references>
<dates>
<discovery>2010-02-09</discovery>
<entry>2014-04-23</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="608ed765-c700-11e3-848c-20cf30e32f6d">
<topic>bugzilla -- Cross-Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla40</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
<p>The login form had no CSRF protection, meaning that
an attacker could force the victim to log in using the
attacker's credentials. If the victim then reports a new
security sensitive bug, the attacker would get immediate
access to this bug.</p>
<p>
Due to changes involved in the Bugzilla API, this fix is
not backported to the 4.0 and 4.2 branches, meaning that
Bugzilla 4.0.12 and older, and 4.2.8 and older, will
remain vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1517</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=713926</url>
</references>
<dates>
<discovery>2014-04-17</discovery>
<entry>2014-04-18</entry>
<modified>2014-04-18</modified>
</dates>
</vuln>
<vuln vid="60bfa396-c702-11e3-848c-20cf30e32f6d">
<topic>bugzilla -- Social Engineering</topic>
<affects>
<package>
<name>bugzilla40</name>
<range><ge>2.0.0</ge><lt>4.0.12</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>4.1.1</ge><lt>4.2.8</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>4.4.0</ge><lt>4.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
<p>Dangerous control characters can be inserted into
Bugzilla, notably into bug comments. If the text, which
may look safe, is copied into a terminal such as xterm or
gnome-terminal, then unexpected commands could be executed
on the local machine.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=968576</url>
</references>
<dates>
<discovery>2014-04-17</discovery>
<entry>2014-04-18</entry>
<modified>2014-04-18</modified>
</dates>
</vuln>
<vuln vid="abad20bf-c1b4-11e3-a5ac-001b21614864">
<topic>OpenLDAP -- incorrect handling of NULL in certificate Common Name</topic>
<affects>
<package>
<name>openldap24-client</name>
<range><lt>2.4.18</lt></range>
</package>
<package>
<name>linux-f10-openldap</name>
<range><lt>2.4.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767">
<p>OpenLDAP does not properly handle a '\0' character in a domain name
in the subject's Common Name (CN) field of an X.509 certificate,
which allows man-in-the-middle attackers to spoof arbitrary SSL
servers via a crafted certificate issued by a legitimate
Certification Authority</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3767</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767</url>
</references>
<dates>
<discovery>2009-08-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="9aecb94c-c1ad-11e3-a5ac-001b21614864">
<topic>cURL -- inappropriate GSSAPI delegation</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.6</ge><le>7.21.6</le></range>
</package>
<package>
<name>linux-f10-curl</name>
<range><ge>7.10.6</ge><le>7.21.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20110623.html">
<p>When doing GSSAPI authentication, libcurl unconditionally performs
credential delegation. This hands the server a copy of the client's
security credentials, allowing the server to impersonate the client
to any other using the same GSSAPI mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2192</cvename>
<url>http://curl.haxx.se/docs/adv_20110623.html</url>
</references>
<dates>
<discovery>2011-06-23</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="77bb0541-c1aa-11e3-a5ac-001b21614864">
<topic>dbus-glib -- privledge escalation</topic>
<affects>
<package>
<name>dbus-glib</name>
<range><lt>0.100.1</lt></range>
</package>
<package>
<name>linux-f10-dbus-glib</name>
<range><lt>0.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="https://bugs.freedesktop.org/show_bug.cgi?id=60916">
<p>A privilege escalation flaw was found in the way dbus-glib, the
D-Bus add-on library to integrate the standard D-Bus library with
the GLib thread abstraction and main loop, performed filtering of
the message sender (message source subject), when the
NameOwnerChanged signal was received. A local attacker could use
this flaw to escalate their privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0292</cvename>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=60916</url>
</references>
<dates>
<discovery>2013-02-15</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="bf7912f5-c1a8-11e3-a5ac-001b21614864">
<topic>nas -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nas</name>
<range><lt>1.9.4</lt></range>
</package>
<package>
<name>linux-f10-nas-libs</name>
<range><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hamid Zamani reports:</p>
<blockquote cite="http://radscan.com/pipermail/nas/2013-August/001270.html">
<p>multiple security problems (buffer overflows, format string
vulnerabilities and missing input sanitising), which could lead to
the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4256</cvename>
<cvename>CVE-2013-4257</cvename>
<cvename>CVE-2013-4258</cvename>
<url>http://radscan.com/pipermail/nas/2013-August/001270.html</url>
</references>
<dates>
<discovery>2013-08-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="09f47c51-c1a6-11e3-a5ac-001b21614864">
<topic>libaudiofile -- heap-based overflow in Microsoft ADPCM compression module</topic>
<affects>
<package>
<name>libaudiofile</name>
<range><lt>0.2.7</lt></range>
</package>
<package>
<name>linux-f10-libaudiofile</name>
<range><lt>0.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205">
<p>Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile
0.2.6 allows context-dependent attackers to cause a denial of service
(application crash) or possibly execute arbitrary code via a crafted
WAV file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0159</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205</url>
</references>
<dates>
<discovery>2008-12-30</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="972837fc-c304-11e3-8758-00262d5ed8ee">
<topic>ChaSen -- buffer overflow</topic>
<affects>
<package>
<name>chasen-base</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>chasen</name>
<range><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JVN iPedia reports:</p>
<blockquote cite="http://jvn.jp/en/jp/JVN16901583/index.html">
<p>ChaSen provided by Nara Institute of Science and Technology is a
software for morphologically analyzing Japanese. ChaSen contains an
issue when reading in strings, which may lead to a buffer
overflow.</p>
<p>An arbitrary script may be executed by an attacker with access to
a system that is running a product listed in "Products
Affected."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4000</cvename>
<url>http://jvn.jp/en/jp/JVN16901583/index.html</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2014-04-13</entry>
</dates>
</vuln>
<vuln vid="7ccd4def-c1be-11e3-9d09-000c2980a9f3">
<topic>OpenSSL -- Local Information Disclosure</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_15</lt></range>
<range><ge>8.4</ge><lt>8.4_8</lt></range>
<range><ge>9.1</ge><lt>9.1_11</lt></range>
<range><ge>9.2</ge><lt>9.2_4</lt></range>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/vulnerabilities.html#2014-0076">
<p>A flaw in the implementation of Montgomery Ladder Approach would
create a side-channel that leaks sensitive timing information.</p>
<p>A local attacker might be able to snoop a signing process and
might recover the signing key from it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0076</cvename>
<freebsdsa>SA-14:06.openssl</freebsdsa>
<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
</references>
<dates>
<discovery>2014-04-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="c0c31b27-bff3-11e3-9d09-000c2980a9f3">
<topic>openafs -- Denial of Service</topic>
<affects>
<package>
<name>openafs</name>
<range><ge>1.4.8</ge><lt>1.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/security/OPENAFS-SA-2014-001.txt">
<p>An attacker with the ability to connect to an OpenAFS fileserver can
trigger a buffer overflow, crashing the server.</p>
<p>The buffer overflow can be triggered by sending an unauthenticated
request for file server statistical information.</p>
<p>Clients are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0159</cvename>
<url>http://openafs.org/security/OPENAFS-SA-2014-001.txt</url>
</references>
<dates>
<discovery>2014-04-09</discovery>
<entry>2014-04-09</entry>
</dates>
</vuln>
<vuln vid="5631ae98-be9e-11e3-b5e3-c80aa9043978">
<topic>OpenSSL -- Remote Information Disclosure</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20140407.txt">
<p>A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.</p>
<p>Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.</p>
</blockquote>
<blockquote cite="http://www.heartbleed.com">
<p>The bug allows anyone on the Internet to read the memory of the
systems protected by the vulnerable versions of the OpenSSL software.
This compromises the secret keys used to identify the service
providers and to encrypt the traffic, the names and passwords of the
users and the actual content. This allows attackers to eavesdrop
communications, steal data directly from the services and users and
to impersonate services and users.</p>
</blockquote>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:06.openssl.asc">
<p>The code used to handle the Heartbeat Extension does not do
sufficient boundary checks on record length, which allows reading
beyond the actual payload.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0160</cvename>
<freebsdsa>SA-14:06.openssl</freebsdsa>
<url>https://www.openssl.org/news/secadv_20140407.txt</url>
<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
<url>http://www.heartbleed.com</url>
</references>
<dates>
<discovery>2014-04-07</discovery>
<entry>2014-04-07</entry>
<modified>2014-04-11</modified>
</dates>
</vuln>
<vuln vid="ffa7c6e4-bb29-11e3-8136-60a44c524f57">
<topic>otrs -- Clickjacking issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.21</lt></range>
<range><gt>3.2.*</gt><lt>3.2.16</lt></range>
<range><gt>3.3.*</gt><lt>3.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/">
<p>An attacker could embed OTRS in a hidden iframe tag of another
page, tricking the user into clicking links in OTRS.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.w3.org/1999/xhtml</url>
<cvename>CVE-2014-2554</cvename>
</references>
<dates>
<discovery>2014-04-01</discovery>
<entry>2014-04-03</entry>
</dates>
</vuln>
<vuln vid="580cc46b-bb1e-11e3-b144-2c4138874f7d">
<topic>LibYAML input sanitization errors</topic>
<affects>
<package>
<name>libyaml</name>
<range><lt>0.1.6</lt></range>
</package>
<package>
<name>mingw32-libyaml</name>
<range><lt>0.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-003.html">
<p>The LibYAML project is an open source YAML 1.1 parser and
emitter written in C.</p>
<p>The library is affected by a heap-based buffer overflow
which can lead to arbitrary code execution. The
vulnerability is caused by lack of proper expansion for the
string passed to the yaml_parser_scan_uri_escapes()
function.</p>
<p>A specially crafted YAML file, with a long sequence of
percent-encoded characters in a URL, can be used to trigger
the overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2525</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525</url>
</references>
<dates>
<discovery>2014-03-11</discovery>
<entry>2014-03-26</entry>
</dates>
</vuln>
<vuln vid="4e95eb4e-b737-11e3-87cd-f0def10dca57">
<topic>Icinga -- buffer overflow in classic web interface</topic>
<affects>
<package>
<name>icinga</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Icinga Team reports:</p>
<blockquote cite="https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d">
<p>Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2386</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386</url>
</references>
<dates>
<discovery>2014-02-18</discovery>
<entry>2014-03-29</entry>
</dates>
</vuln>
<vuln vid="7e61a839-b714-11e3-8195-001966155bea">
<topic>file -- out-of-bounds access in search rules with offsets from input file</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Reffett reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270">
<p>softmagic.c in file ... and libmagic allows context-dependent
attackers to cause a denial of service (out-of-bounds memory access and
crash) via crafted offsets in the softmagic of a PE executable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2270</cvename>
<url>http://bugs.gw.com/view.php?id=31</url>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2014-03-29</entry>
</dates>
</vuln>
<vuln vid="9fa1a0ac-b2e0-11e3-bb07-6cf0490a8c18">
<topic>Joomla! -- Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>joomla2</name>
<range><ge>2.5.*</ge><le>2.5.18</le></range>
</package>
<package>
<name>joomla3</name>
<range><ge>3.0.*</ge><le>3.2.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/578-20140301-core-sql-injection.html">
<h2>[20140301] - Core - SQL Injection</h2>
<p>Inadequate escaping leads to SQL injection vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html">
<h2>[20140302] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_contact.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html">
<h2>[20140303] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html">
<h2>[20140304] - Core - Unauthorised Logins</h2>
<p>Inadequate checking allowed unauthorised logins via GMail authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/578-20140301-core-sql-injection.html</url>
<url>http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html</url>
<url>http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html</url>
<url>http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html</url>
</references>
<dates>
<discovery>2014-03-01</discovery>
<entry>2014-03-23</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="36f9ac43-b2ac-11e3-8752-080027ef73ec">
<topic>mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection</topic>
<affects>
<package>
<name>trojita</name>
<range><lt>0.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Kundrát reports:</p>
<blockquote cite="http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html">
<p>An SSL stripping vulnerability was discovered in Trojitá, a fast Qt
IMAP e-mail client. User's credentials are never leaked, but if a
user tries to send an e-mail, the automatic saving into the "sent"
or "draft" folders could happen over a plaintext connection even if
the user's preferences specify STARTTLS as a requirement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2567</cvename>
<url>http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html</url>
</references>
<dates>
<discovery>2014-03-20</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="da4b89ad-b28f-11e3-99ca-f0def16c5c1b">
<topic>nginx-devel -- SPDY heap buffer overflow</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><ge>1.3.15</ge><lt>1.5.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
<p>A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).</p>
<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.</p>
<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0133</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
</references>
<dates>
<discovery>2014-03-18</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="fc28df92-b233-11e3-99ca-f0def16c5c1b">
<topic>nginx -- SPDY heap buffer overflow</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
<p>A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).</p>
<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.</p>
<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0133</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
</references>
<dates>
<discovery>2014-03-18</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="91ecb546-b1e6-11e3-980f-20cf30e32f6d">
<topic>apache -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><gt>2.4.0</gt><lt>2.4.9</lt></range>
</package>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.27">
<p>Clean up cookie logging with fewer redundant string parsing passes.
Log only cookies with a value assignment. Prevents segfaults when
logging truncated cookies.</p>
<p>mod_dav: Keep track of length of cdata properly when removing leading
spaces. Eliminates a potential denial of service from specifically
crafted DAV WRITE requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0098</cvename>
<cvename>CVE-2013-6438</cvename>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-03-22</entry>
</dates>
</vuln>
<vuln vid="610de647-af8d-11e3-a25b-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>28.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>28.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.4.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-15 Miscellaneous memory safety hazards
(rv:28.0 / rv:24.4)</p>
<p>MFSA 2014-16 Files extracted during updates are not always
read only</p>
<p>MFSA 2014-17 Out of bounds read during WAV file decoding</p>
<p>MFSA 2014-18 crypto.generateCRMFRequest does not validate
type of key</p>
<p>MFSA 2014-19 Spoofing attack on WebRTC permission prompt</p>
<p>MFSA 2014-20 onbeforeunload and Javascript navigation DOS</p>
<p>MFSA 2014-21 Local file access via Open Link in new tab</p>
<p>MFSA 2014-22 WebGL content injection from one domain to
rendering in another</p>
<p>MFSA 2014-23 Content Security Policy for data: documents
not preserved by session restore</p>
<p>MFSA 2014-24 Android Crash Reporter open to manipulation</p>
<p>MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable
to relative path escape</p>
<p>MFSA 2014-26 Information disclosure through polygon
rendering in MathML</p>
<p>MFSA 2014-27 Memory corruption in Cairo during PDF font
rendering</p>
<p>MFSA 2014-28 SVG filters information disclosure through
feDisplacementMap</p>
<p>MFSA 2014-29 Privilege escalation using WebIDL-implemented
APIs</p>
<p>MFSA 2014-30 Use-after-free in TypeObject</p>
<p>MFSA 2014-31 Out-of-bounds read/write through neutering
ArrayBuffer objects</p>
<p>MFSA 2014-32 Out-of-bounds write through TypedArrayObject
after neutering</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1493</cvename>
<cvename>CVE-2014-1494</cvename>
<cvename>CVE-2014-1496</cvename>
<cvename>CVE-2014-1497</cvename>
<cvename>CVE-2014-1498</cvename>
<cvename>CVE-2014-1499</cvename>
<cvename>CVE-2014-1500</cvename>
<cvename>CVE-2014-1501</cvename>
<cvename>CVE-2014-1502</cvename>
<cvename>CVE-2014-1504</cvename>
<cvename>CVE-2014-1505</cvename>
<cvename>CVE-2014-1506</cvename>
<cvename>CVE-2014-1507</cvename>
<cvename>CVE-2014-1508</cvename>
<cvename>CVE-2014-1509</cvename>
<cvename>CVE-2014-1510</cvename>
<cvename>CVE-2014-1511</cvename>
<cvename>CVE-2014-1512</cvename>
<cvename>CVE-2014-1513</cvename>
<cvename>CVE-2014-1514</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-15.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-16.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-17.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-18.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-19.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-20.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-21.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-22.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-23.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-24.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-25.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-26.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-27.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-28.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-29.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-30.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-31.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-32.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-03-19</discovery>
<entry>2014-03-19</entry>
<modified>2014-03-20</modified>
</dates>
</vuln>
<vuln vid="eb426e82-ab68-11e3-9d09-000c2980a9f3">
<topic>mutt -- denial of service, potential remote code execution</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>1.5.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Beatrice Torracca and Evgeni Golov report:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/531431">
<p>A buffer overflow has been discovered that could result in
denial of service or potential execution of arbitrary code.</p>
<p>This condition can be triggered by malformed RFC2047 header
lines</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0467</cvename>
<url>http://packetstormsecurity.com/files/cve/CVE-2014-0467</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467</url>
</references>
<dates>
<discovery>2014-03-12</discovery>
<entry>2014-03-14</entry>
</dates>
</vuln>
<vuln vid="777d7b9e-ab02-11e3-841e-60a44c524f57">
<topic>wemux -- read-only can be bypassed</topic>
<affects>
<package>
<name>wemux</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JonApps reports:</p>
<blockquote cite="https://github.com/zolrath/wemux/issues/36">
<p>The read-only mode can be bypassed and any command sent to bash session</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zolrath/wemux/issues/36</url>
</references>
<dates>
<discovery>2013-12-24</discovery>
<entry>2014-03-13</entry>
</dates>
</vuln>
<vuln vid="03e48bf5-a96d-11e3-a556-3c970e169bc2">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.23</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.16</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4496">
<p>In Samba's SAMR server we neglect to ensure that attempted
password changes will update the bad password count, nor set
the lockout flags. This would allow a user unlimited attempts
against the password by simply calling ChangePasswordUser2
repeatedly.</p>
<p>This is available without any other authentication.</p>
</blockquote>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-6442">
<p>smbcacls can remove a file or directory ACL by mistake.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4496</cvename>
<cvename>CVE-2013-6442</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4496</url>
<url>http://www.samba.org/samba/security/CVE-2013-6442</url>
</references>
<dates>
<discovery>2014-03-11</discovery>
<entry>2014-03-11</entry>
</dates>
</vuln>
<vuln vid="03159886-a8a3-11e3-8f36-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.8.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP
request that is handled by Asterisk with a large number of Cookie
headers could overflow the stack. You could even exhaust memory if you
sent an unlimited number of headers in the request.</p>
<p>Denial of Service Through File Descriptor Exhaustion with chan_sip
Session-Timers. An attacker can use all available file descriptors
using SIP INVITE requests. Asterisk will respond with code 400, 420,
or 422 for INVITEs meeting this criteria.
Each INVITE meeting these conditions will leak a channel and several
file descriptors. The file descriptors cannot be released without
restarting Asterisk which may allow intrusion detection systems to be
bypassed by sending the requests slowly.</p>
<p>Remote Crash Vulnerability in PJSIP channel driver. A remotely
exploitable crash vulnerability exists in the PJSIP channel driver if
the "qualify_frequency" configuration option is enabled on an AOR and
the remote SIP server challenges for authentication of the resulting
OPTIONS request. The response handling code wrongly assumes that a
PJSIP endpoint will always be associated with an outgoing request which
is incorrect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2286</cvename>
<cvename>CVE-2014-2287</cvename>
<cvename>CVE-2014-2288</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-001.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-002.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-003.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-03-10</discovery>
<entry>2014-03-10</entry>
</dates>
</vuln>
<vuln vid="1a0de610-a761-11e3-95fe-bcaec565249c">
<topic>freetype2 -- Out of bounds read/write</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mateusz Jurczyk reports:</p>
<blockquote cite="http://savannah.nongnu.org/bugs/?41697">
<p>Out of bounds stack-based read/write in
cf2_hintmap_build.</p>
<p>This is a critical vulnerability in the CFF Rasterizer
code recently contributed by Adobe, leading to potential
arbitrary code execution in the context of the FreeType2
library client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://savannah.nongnu.org/bugs/?41697</url>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-03-09</entry>
</dates>
</vuln>
<vuln vid="20e23b65-a52e-11e3-ae3a-00224d7c32a2">
<topic>xmms -- Integer Overflow And Underflow Vulnerabilities</topic>
<affects>
<package>
<name>xmms</name>
<range><le>1.2.11_20</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2007-47/advisory/">
<p>Secunia Research has discovered two vulnerabilities in XMMS, which can
be exploited by malicious people to compromise a user's system.</p>
<p>1) An integer underflow error exists in the processing of skin bitmap
images. This can be exploited to cause a stack-based buffer overflow
via specially crafted skin images containing manipulated header
information.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
<p>2) An integer overflow error exists in the processing of skin bitmap
images. This can be exploited to cause memory corruption via specially
crafted skin images containing manipulated header information.</p>
<p>Successful exploitation may allow the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0653</cvename>
<cvename>CVE-2007-0654</cvename>
</references>
<dates>
<discovery>2007-02-06</discovery>
<entry>2014-03-06</entry>
</dates>
</vuln>
<vuln vid="89db3b31-a4c3-11e3-978f-f0def16c5c1b">
<topic>nginx -- SPDY memory corruption</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><eq>1.5.10</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html">
<p>A bug in the experimental SPDY implementation in nginx 1.5.10 was found,
which might allow an attacker to corrupt worker process memory by using
a specially crafted request, potentially resulting in arbitrary code
execution (CVE-2014-0088).</p>
<p>The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with
the ngx_http_spdy_module module (which is not compiled by default), if
the "spdy" option of the "listen" directive is used in a configuration
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0088</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html</url>
</references>
<dates>
<discovery>2014-03-04</discovery>
<entry>2014-03-06</entry>
</dates>
</vuln>
<vuln vid="f645aa90-a3e8-11e3-a422-3c970e169bc2">
<topic>gnutls -- multiple certificate verification issues</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.23_4</lt></range>
</package>
<package>
<name>linux-f10-gnutls</name>
<range><lt>2.12.23_4</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><lt>3.1.22</lt></range>
<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
</package>
<package>
<name>gnutls3</name>
<range><lt>3.1.22</lt></range>
<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-2">
<p>A vulnerability was discovered that affects the
certificate verification functions of all gnutls
versions. A specially crafted certificate could
bypass certificate validation checks. The
vulnerability was discovered during an audit of
GnuTLS for Red Hat.</p>
</blockquote>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-1">
<p>Suman Jana reported a vulnerability that affects
the certificate verification functions of
gnutls 2.11.5 and later versions. A version 1
intermediate certificate will be considered as
a CA certificate by default (something that
deviates from the documented behavior).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0092</cvename>
<cvename>CVE-2014-1959</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-1</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-2</url>
</references>
<dates>
<discovery>2014-03-03</discovery>
<entry>2014-03-04</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="815dbcf9-a2d6-11e3-8088-002590860428">
<topic>file -- denial of service</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Fine Free file project reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943">
<p>file before 5.17 allows context-dependent attackers to
cause a denial of service (infinite recursion, CPU consumption, and
crash) via a crafted indirect offset value in the magic of a file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1943</cvename>
<mlist>http://mx.gw.com/pipermail/file/2014/001327.html</mlist>
</references>
<dates>
<discovery>2014-02-16</discovery>
<entry>2014-03-03</entry>
</dates>
</vuln>
<vuln vid="8e5e6d42-a0fa-11e3-b09a-080027f2d077">
<topic>Python -- buffer overflow in socket.recvfrom_into()</topic>
<affects>
<package>
<name>python27</name>
<range><le>2.7.6_3</le></range>
</package>
<package>
<name>python31</name>
<range><le>3.1.5_10</le></range>
</package>
<package>
<name>python32</name>
<range><le>3.2.5_7</le></range>
</package>
<package>
<name>python33</name>
<range><le>3.3.3_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vincent Danen via Red Hat Issue Tracker reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1062370">
<p>A vulnerability was reported in Python's socket module, due to a
boundary error within the sock_recvfrom_into() function, which could be
exploited to cause a buffer overflow. This could be used to crash a
Python application that uses the socket.recvfrom_info() function or,
possibly, execute arbitrary code with the permissions of the user
running vulnerable Python code.</p>
<p>This vulnerable function, socket.recvfrom_into(), was introduced in
Python 2.5. Earlier versions are not affected by this flaw.</p>
</blockquote>
</body>
</description>
<references>
<bid>65379</bid>
<cvename>CVE-2014-1912</cvename>
<mlist>https://mail.python.org/pipermail/python-dev/2014-February/132758.html</mlist>
<url>http://bugs.python.org/issue20246</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1062370</url>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2014-03-01</entry>
</dates>
</vuln>
<vuln vid="1839f78c-9f2b-11e3-980f-20cf30e32f6d">
<topic>subversion -- mod_dav_svn vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
<range><ge>1.8.0</ge><lt>1.8.8</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives an OPTIONS request against the server root and Subversion is
configured to handle the server root and SVNListParentPath is on.
This can lead to a DoS. There are no known instances of this
problem being exploited in the wild, but the details of how to exploit
it have been disclosed on the Subversion development mailing list.</p>
</blockquote>
</body>
</description>
<references>
<url>CVE-2014-0032</url>
<url>https://subversion.apache.org/security/CVE-2014-0032-advisory.txt</url>
</references>
<dates>
<discovery>2014-01-10</discovery>
<entry>2014-02-26</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="70b72a52-9e54-11e3-babe-60a44c524f57">
<topic>otrs -- XSS Issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.20</lt></range>
<range><gt>3.2.*</gt><lt>3.2.15</lt></range>
<range><gt>3.3.*</gt><lt>3.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2014-03-xss-issue/">
<p>An attacker could send a specially prepared HTML email to OTRS. If
he can then trick an agent into following a special link to display this email,
JavaScript code would be executed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2014-03-xss-issue/</url>
<cvename>CVE-2014-1695</cvename>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-02-25</entry>
</dates>
</vuln>
<vuln vid="42d42090-9a4d-11e3-b029-08002798f6ff">
<topic>PostgreSQL -- multiple privilege issues</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>8.4.20</lt></range>
<range><ge>9.0.0</ge><lt>9.0.16</lt></range>
<range><ge>9.1.0</ge><lt>9.1.12</lt></range>
<range><ge>9.2.0</ge><lt>9.2.7</lt></range>
<range><ge>9.3.0</ge><lt>9.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1506/">
<p>This update fixes CVE-2014-0060, in which PostgreSQL did not
properly enforce the WITH ADMIN OPTION permission for ROLE management.
Before this fix, any member of a ROLE was able to grant others access
to the same ROLE regardless if the member was given the WITH ADMIN
OPTION permission. It also fixes multiple privilege escalation issues,
including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,
CVE-2014-0065, and CVE-2014-0066. More information on these issues can
be found on our security page and the security issue detail wiki page.
</p>
<p>
With this release, we are also alerting users to a known security hole
that allows other users on the same machine to gain access to an
operating system account while it is doing "make check":
CVE-2014-0067. "Make check" is normally part of building PostgreSQL
from source code. As it is not possible to fix this issue without
causing significant issues to our testing infrastructure, a patch will
be released separately and publicly. Until then, users are strongly
advised not to run "make check" on machines where untrusted users have
accounts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0060</cvename>
<cvename>CVE-2014-0061</cvename>
<cvename>CVE-2014-0062</cvename>
<cvename>CVE-2014-0063</cvename>
<cvename>CVE-2014-0064</cvename>
<cvename>CVE-2014-0065</cvename>
<cvename>CVE-2014-0066</cvename>
<cvename>CVE-2014-0067</cvename>
</references>
<dates>
<discovery>2014-02-20</discovery>
<entry>2014-02-20</entry>
</dates>
</vuln>
<vuln vid="0871d18b-9638-11e3-a371-6805ca0b3d42">
<topic>phpMyAdmin -- Self-XSS due to unescaped HTML output in import.</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.3.1</ge><lt>4.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php">
<p> When importing a file with crafted filename, it is
possible to trigger an XSS. We consider this vulnerability
to be non critical.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php</url>
<cvename>CVE-2014-1879</cvename>
</references>
<dates>
<discovery>2014-02-15</discovery>
<entry>2014-02-15</entry>
</dates>
</vuln>
<vuln vid="3e0507c6-9614-11e3-b3a5-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.551</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.532.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</url>
<cvename>CVE-2013-5573</cvename>
<cvename>CVE-2013-7285</cvename>
</references>
<dates>
<discovery>2014-02-14</discovery>
<entry>2014-02-15</entry>
</dates>
</vuln>
<vuln vid="90b27045-9530-11e3-9d09-000c2980a9f3">
<topic>lighttpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lighttpd security advisories report:</p>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt">
<p>It is possible to inadvertantly enable vulnerable ciphers when using
ssl.cipher-list.</p>
</blockquote>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt">
<p>In certain cases setuid() and similar can fail, potentially triggering
lighttpd to restart running as root.</p>
</blockquote>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt">
<p>If FAMMonitorDirectory fails, the memory intended to store the context is
released; some lines below the "version" compoment of that context is read.
Reading invalid data doesn't matter, but the memory access could trigger a
segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt</url>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt</url>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt</url>
<cvename>CVE-2013-4508</cvename>
<cvename>CVE-2013-4559</cvename>
<cvename>CVE-2013-4560</cvename>
</references>
<dates>
<discovery>2013-11-28</discovery>
<entry>2014-02-14</entry>
</dates>
</vuln>
<vuln vid="4dd575b8-8f82-11e3-bb11-0025905a4771">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2014-02-04.php">
<p> An arbitrary script may be executed on the user's Internet
Explorer when using an older version of the browser. If a user views
a malicious page while logged in, settings may be changed
unintentionally.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0813</cvename>
<cvename>CVE-2014-0814</cvename>
<url>http://www.phpmyfaq.de/advisory_2014-02-04.php</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-06</entry>
</dates>
</vuln>
<vuln vid="b7a7576d-8e0a-11e3-9976-9c4e36909cc0">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.336</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb14-04.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0497</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb14-04.html</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-04</entry>
<modified>2014-02-05</modified>
</dates>
</vuln>
<vuln vid="1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>25.0,1</gt><lt>27.0,1</lt></range>
<range><lt>24.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>27.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.24</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.3.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.24</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-01 Miscellaneous memory safety hazards
(rv:27.0 / rv:24.3)</p>
<p>MFSA 2014-02 Clone protected content with XBL scopes</p>
<p>MFSA 2014-03 UI selection timeout missing on download
prompts</p>
<p>MFSA 2014-04 Incorrect use of discarded images by
RasterImage</p>
<p>MFSA 2014-05 Information disclosure with *FromPoint on
iframes</p>
<p>MFSA 2014-06 Profile path leaks to Android system log</p>
<p>MFSA 2014-07 XSLT stylesheets treated as styles in Content
Security Policy</p>
<p>MFSA 2014-08 Use-after-free with imgRequestProxy and image
proccessing</p>
<p>MFSA 2014-09 Cross-origin information leak through web
workers</p>
<p>MFSA 2014-10 Firefox default start page UI content invokable
by script</p>
<p>MFSA 2014-11 Crash when using web workers with asm.js</p>
<p>MFSA 2014-12 NSS ticket handling issues</p>
<p>MFSA 2014-13 Inconsistent JavaScript handling of access to
Window objects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1477</cvename>
<cvename>CVE-2014-1478</cvename>
<cvename>CVE-2014-1479</cvename>
<cvename>CVE-2014-1480</cvename>
<cvename>CVE-2014-1481</cvename>
<cvename>CVE-2014-1482</cvename>
<cvename>CVE-2014-1483</cvename>
<cvename>CVE-2014-1484</cvename>
<cvename>CVE-2014-1485</cvename>
<cvename>CVE-2014-1486</cvename>
<cvename>CVE-2014-1487</cvename>
<cvename>CVE-2014-1488</cvename>
<cvename>CVE-2014-1489</cvename>
<cvename>CVE-2014-1490</cvename>
<cvename>CVE-2014-1491</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-01.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-02.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-03.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-04.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-05.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-06.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-07.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-08.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-09.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-10.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-11.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-12.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-04</entry>
</dates>
</vuln>
<vuln vid="111f1f84-1d14-4ff2-a9ea-cf07119c0d3b">
<topic>libyaml heap overflow resulting in possible code execution</topic>
<affects>
<package>
<name>libyaml</name>
<range><lt>0.1.4_3</lt></range>
</package>
<package>
<name>pkg</name>
<range><lt>1.2.6</lt></range>
</package>
<package>
<name>pkg-devel</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libyaml was prone to a heap overflow that could result in
arbitrary code execution. Pkg uses libyaml to parse
the package manifests in some cases. Pkg also used libyaml
to parse the remote repository until 1.2.</p>
<p>RedHat Product Security Team reports on libyaml:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1033990">
<p>A heap-based buffer overflow flaw was found in the way libyaml
parsed YAML tags. A remote attacker could provide a
specially-crafted YAML document that, when parsed by an application
using libyaml, would cause the application to crash or, potentially,
execute arbitrary code with the privileges of the user running the
application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6393</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1033990</url>
</references>
<dates>
<discovery>2013-11-24</discovery>
<entry>2014-02-01</entry>
<modified>2014-02-01</modified>
</dates>
</vuln>
<vuln vid="a4c9e12d-88b7-11e3-8ada-10bf48e1088e">
<topic>socat -- buffer overflow with data from command line</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer of the Red Hat Product Security Team reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt">
<p>Due to a missing check during assembly of the HTTP request line a long
target server name in the PROXY-CONNECT address can cause a stack buffer
overrun. Exploitation requires that the attacker is able to provide the
target server name to the PROXY-CONNECT address in the command line.
This can happen for example in scripts that receive data from untrusted
sources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0019</cvename>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt</url>
</references>
<dates>
<discovery>2014-01-24</discovery>
<entry>2014-01-29</entry>
</dates>
</vuln>
<vuln vid="c7b5d72b-886a-11e3-9533-60a44c524f57">
<topic>otrs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.19</lt></range>
<range><gt>3.2.*</gt><lt>3.2.14</lt></range>
<range><gt>3.3.*</gt><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/">
<p>SQL injection issue</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/">
<p>An attacker that managed to take over the session of a logged in customer
could create tickets and/or send follow-ups to existing tickets due to
missing challenge token checks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1471</cvename>
<url>https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/</url>
<url>https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/</url>
</references>
<dates>
<discovery>2014-01-28</discovery>
<entry>2014-01-28</entry>
<modified>2014-02-06</modified>
</dates>
</vuln>
<vuln vid="080c5370-886a-11e3-9533-60a44c524f57">
<cancelled superseded="c7b5d72b-886a-11e3-9533-60a44c524f57"/>
</vuln>
<vuln vid="d1dfc4c7-8791-11e3-a371-6805ca0b3d42">
<topic>rt42 -- denial-of-service attack via the email gateway</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2</ge><lt>4.2.1_3</lt></range>
<range><ge>4.2.2</ge><lt>4.2.2_2</lt></range>
</package>
<package>
<name>p5-Email-Address-List</name>
<range><lt>0.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RT development team reports:</p>
<blockquote cite="http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html">
<p>Versions of RT between 4.2.0 and 4.2.2 (inclusive) are
vulnerable to a denial-of-service attack via the email
gateway; any installation which accepts mail from untrusted
sources is vulnerable, regardless of the permissions
configuration inside RT. This vulnerability is assigned
CVE-2014-1474.</p>
<p>This vulnerability is caused by poor parsing performance
in the Email::Address::List module, which RT depends on. We
recommend that affected users upgrade their version of
Email::Address::List to v0.02 or above, which resolves the
issue. Due to a communications mishap, the release on CPAN
will temporarily appear as "unauthorized," and the
command-line cpan client will hence not install it. We
expect this to be resolved shortly; in the meantime, the
release is also available from our server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1474</cvename>
<url>http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html</url>
</references>
<dates>
<discovery>2014-01-27</discovery>
<entry>2014-01-27</entry>
</dates>
</vuln>
<vuln vid="efa663eb-8754-11e3-9a47-00163e1ed244">
<topic>strongswan -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan Project reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html">
<p>A DoS vulnerability triggered by crafted IKEv1 fragmentation
payloads was discovered in strongSwan's IKE daemon charon. All
versions since 5.0.2 are affected.</p>
</blockquote>
<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html">
<p>A DoS vulnerability and potential authorization bypass triggered
by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan.
All versions since 4.3.3 are affected.</p>
</blockquote>
<blockquote cite="http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html">
<p>A DoS vulnerability in strongSwan was discovered, which is
triggered by XAuth usernames and EAP identities in versions
5.0.3 and 5.0.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5018</cvename>
<cvename>CVE-2013-6075</cvename>
<cvename>CVE-2013-6076</cvename>
<url>http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html</url>
<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html</url>
<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html</url>
</references>
<dates>
<discovery>2013-11-01</discovery>
<entry>2014-01-27</entry>
</dates>
</vuln>
<vuln vid="d9dbe6e8-84da-11e3-98bd-080027f2d077">
<topic>varnish -- DoS vulnerability in Varnish HTTP cache</topic>
<affects>
<package>
<name>varnish</name>
<range><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html">
<p>If Varnish receives a certain illegal request, and the subroutine
'vcl_error{}' restarts the request, the varnishd worker process
will crash with an assert.
</p>
<p>The varnishd management process will restart the worker process, but
there will be a brief interruption of service and the cache will be
emptied, causing more traffic to go to the backend.
</p>
<p>We are releasing this advisory because restarting from vcl_error{} is
both fairly common and documented.</p>
<p>This is purely a denial of service vulnerability, there is no risk of
privilege escalation.</p>
<p>Workaround</p>
<p>Insert this at the top of your VCL file:</p>
<pre>
sub vcl_error {
if (obj.status == 400 || obj.status == 413) {
return(deliver);
}
}
Or add this test at the top of your existing vcl_error{}.
</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4484</cvename>
<mlist>https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html</mlist>
</references>
<dates>
<discovery>2013-10-30</discovery>
<entry>2014-01-25</entry>
</dates>
</vuln>
<vuln vid="c0ef849e-84ac-11e3-bec4-9c4e36909cc0">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.335</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0491</cvename>
<cvename>CVE-2014-0492</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</url>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2014-01-24</entry>
</dates>
</vuln>
<vuln vid="6d08fa63-83bf-11e3-bdba-080027ef73ec">
<topic>HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes</topic>
<affects>
<package>
<name>htmldoc</name>
<range><lt>1.8.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Sweet reports:</p>
<blockquote cite="http://www.msweet.org/projects.php?Z1">
<p>HTMLDOC 1.8.28 fixes some known security issues and
formatting bugs. Changes include:</p>
<ul>
<li>SECURITY: Fixed three buffer overflow issues when
reading AFM files and parsing page sizes.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.msweet.org/projects.php?Z1</url>
</references>
<dates>
<discovery>2014-01-06</discovery>
<entry>2014-01-22</entry>
<modified>2014-01-23</modified>
</dates>
</vuln>
<vuln vid="81f1fdc2-7ec7-11e3-a6c6-00163e1ed244">
<topic>virtualbox-ose -- local vulnerability</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>4.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html">
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox prior to
3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local
users to affect confidentiality, integrity, and availability
via unknown vectors related to Core.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5892</cvename>
<url>http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</url>
</references>
<dates>
<discovery>2014-01-15</discovery>
<entry>2014-01-16</entry>
</dates>
</vuln>
<vuln vid="3d95c9a7-7d5c-11e3-a8c1-206a8a720317">
<topic>ntpd DRDoS / Amplification Attack using ntpdc monlist command</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.7p26</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_14</lt></range>
<range><ge>8.4</ge><lt>8.4_7</lt></range>
<range><ge>9.1</ge><lt>9.1_10</lt></range>
<range><ge>9.2</ge><lt>9.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using">
<p>Unrestricted access to the monlist feature in
ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote
attackers to cause a denial of service (traffic
amplification) via forged (1) REQ_MON_GETLIST or (2)
REQ_MON_GETLIST_1 requests, as exploited in the wild in
December 2013</p>
<p>Use noquery to your default restrictions to block all
status queries.</p>
<p>Use disable monitor to disable the ``ntpdc -c monlist''
command while still allowing other status queries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5211</cvename>
<freebsdsa>SA-14:02.ntpd</freebsdsa>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using</url>
</references>
<dates>
<discovery>2014-01-01</discovery>
<entry>2014-01-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ba04a373-7d20-11e3-8992-00132034b086">
<topic>nagios -- denial of service vulnerability</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>3.5.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Stanley reports:</p>
<blockquote cite="http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/">
<p>Most CGIs previously incremented the input variable counter twice
when it encountered a long key value. This could cause the CGI to
read past the end of the list of CGI variables.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7108</cvename>
<cvename>CVE-2013-7205</cvename>
<url>http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1046113</url>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2014-01-14</entry>
</dates>
</vuln>
<vuln vid="cb252f01-7c43-11e3-b0a6-005056a37f68">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.4.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.4.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.6.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.6.2</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.2.ESV.R10.2</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><lt>9.6.3.2.ESV.R10.2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_3</lt></range>
<range><ge>9.1</ge><lt>9.1_10</lt></range>
<range><ge>8.4</ge><lt>8.4_7</lt></range>
<range><ge>8.3</ge><lt>8.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01078/74/">
<p>Because of a defect in handling queries for NSEC3-signed zones,
BIND can crash with an "INSIST" failure in name.c when processing
queries possessing certain properties. By exploiting this defect
an attacker deliberately constructing a query with the right
properties could achieve denial of service against an authoritative
nameserver serving NSEC3-signed zones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0591</cvename>
<freebsdsa>SA-14:04.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01078/74/</url>
</references>
<dates>
<discovery>2014-01-08</discovery>
<entry>2014-01-13</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="28c575fa-784e-11e3-8249-001cc0380077">
<topic>libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freedesktop.org reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-January/002389.html">
<p>A BDF font file containing a longer than expected string can cause
a buffer overflow on the stack. Testing in X servers built with
Stack Protector restulted in an immediate crash when reading a
user-proveded specially crafted font.</p>
<p>As libXfont is used to read user-specified font files in all X
servers distributed by X.Org, including the Xorg server which is
often run with root privileges or as setuid-root in order to access
hardware, this bug may lead to an unprivileged user acquiring root
privileges in some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6462</cvename>
<url>http://lists.x.org/archives/xorg-announce/2014-January/002389.html</url>
</references>
<dates>
<discovery>2013-12-24</discovery>
<entry>2014-01-08</entry>
</dates>
</vuln>
<vuln vid="5aaa257e-772d-11e3-a65a-3c970e169bc2">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL development team reports:</p>
<blockquote cite="http://www.openssl.org/news/openssl-1.0.1-notes.html">
<p>Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:</p>
<ul>
<li>Fix for TLS record tampering bug [CVE-2013-4353]</li>
<li>Fix for TLS version checking bug [CVE-2013-6449]</li>
<li>Fix for DTLS retransmission bug [CVE-2013-6450]</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-14:03.openssl</freebsdsa>
<cvename>CVE-2013-4353</cvename>
<cvename>CVE-2013-6449</cvename>
<cvename>CVE-2013-6450</cvename>
<url>http://www.openssl.org/news/openssl-1.0.1-notes.html</url>
</references>
<dates>
<discovery>2014-01-06</discovery>
<entry>2014-01-06</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="3e33a0bb-6b2f-11e3-b042-20cf30e32f6d">
<topic>OpenX -- SQL injection vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Revive reports:</p>
<blockquote cite="http://www.revive-adserver.com/security/revive-sa-2013-001/">
<p>An SQL-injection vulnerability was recently discovered and reported
to the Revive Adserver team by Florian Sander. The vulnerability is
known to be already exploited to gain unauthorised access to the
application using brute force mechanisms, however other kind of
attacks might be possible and/or already in use. The risk is rated
to be critical as the most common end goal of the attackers is to
spread malware to the visitors of all the websites and ad networks
that the ad server is being used on.</p>
<p>The vulnerability is also present and exploitable in OpenX Source
2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.revive-adserver.com/security/revive-sa-2013-001/</url>
<url>http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/</url>
<cvename>CVE-2013-7149</cvename>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2013-12-22</entry>
</dates>
</vuln>
<vuln vid="4e1f4abc-6837-11e3-9cda-3c970e169bc2">
<topic>cURL library -- cert name check ignore with GnuTLS</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.21.4</ge><lt>7.33.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20131217.html">
<p>libcurl is vulnerable to a case of missing out the checking
of the certificate CN or SAN name field when the digital
signature verification is turned off.</p>
<p>libcurl offers two separate and independent options for
verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER
and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to
verify the trust chain using a CA cert bundle, while the
second tells libcurl to make sure that the name fields in
the server certificate meets the criteria. Both options are
enabled by default.</p>
<p>This flaw had the effect that when an application disabled
CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the
CURLOPT_SSL_VERIFYHOST check. Applications can disable
CURLOPT_SSL_VERIFYPEER and still achieve security by doing
the check on its own using other means.</p>
<p>The curl command line tool is not affected by this problem
as it either enables both options or disables both at the
same time.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20131217.html</url>
<cvename>CVE-2013-6422</cvename>
</references>
<dates>
<discovery>2013-12-17</discovery>
<entry>2013-12-18</entry>
</dates>
</vuln>
<vuln vid="2e5715f8-67f7-11e3-9811-b499baab0cbe">
<topic>gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.16</lt></range>
</package>
<package>
<name>gnupg1</name>
<range><lt>1.4.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html">
<p>CVE-2013-4576 has been assigned to this security bug.</p>
<p>The paper describes two attacks. The first attack allows
to distinguish keys: An attacker is able to notice which key is
currently used for decryption. This is in general not a problem but
may be used to reveal the information that a message, encrypted to a
commonly not used key, has been received by the targeted machine. We
do not have a software solution to mitigate this attack.</p>
<p>The second attack is more serious. It is an adaptive
chosen ciphertext attack to reveal the private key. A possible
scenario is that the attacker places a sensor (for example a standard
smartphone) in the vicinity of the targeted machine. That machine is
assumed to do unattended RSA decryption of received mails, for example
by using a mail client which speeds up browsing by opportunistically
decrypting mails expected to be read soon. While listening to the
acoustic emanations of the targeted machine, the smartphone will send
new encrypted messages to that machine and re-construct the private
key bit by bit. A 4096 bit RSA key used on a laptop can be revealed
within an hour.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4576</cvename>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html</url>
</references>
<dates>
<discovery>2013-12-18</discovery>
<entry>2013-12-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="0c39bafc-6771-11e3-868f-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk10</name>
<range><lt>10.12.4</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.6.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.24.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>A 16 bit SMS message that contains an odd message length value will
cause the message decoding loop to run forever. The message buffer is
not on the stack but will be overflowed resulting in corrupted memory
and an immediate crash.</p>
<p>External control protocols, such as the Asterisk Manager Interface,
often have the ability to get and set channel variables; this allows
the execution of dialplan functions. Dialplan functions within
Asterisk are incredibly powerful, which is wonderful for building
applications using Asterisk. But during the read or write execution,
certain diaplan functions do much more. For example, reading the SHELL()
function can execute arbitrary commands on the system Asterisk is
running on. Writing to the FILE() function can change any file that
Asterisk has write access to. When these functions are executed from an
external protocol, that execution could result in a privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7100</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-006.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-007.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-12-16</discovery>
<entry>2013-12-17</entry>
</dates>
</vuln>
<vuln vid="3b86583a-66a7-11e3-868f-0025905a4771">
<topic>phpmyfaq -- arbitrary PHP code execution vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2013-11-26.php">
<p>Secunia noticed while analysing the advisory that authenticated
users with "Right to add attachments" are able to exploit an already
publicly known issue in the bundled Ajax File Manager of phpMyFAQ version
2.8.3, which leads to arbitrary PHP code execution for authenticated
users with the permission "Right to add attachments".</p>
</blockquote>
</body>
</description>
<references>
<url>http://en.securitylab.ru/lab/PT-2013-41</url>
<url>http://www.phpmyfaq.de/advisory_2013-11-26.php</url>
</references>
<dates>
<discovery>2013-11-26</discovery>
<entry>2013-12-16</entry>
<modified>2013-12-17</modified>
</dates>
</vuln>
<vuln vid="44d0f8dc-6607-11e3-bb11-0025900931f8">
<topic>zabbix -- shell command injection vulnerability</topic>
<affects>
<package>
<name>zabbix2-agent</name>
<range><lt>2.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Recurity Labs Team project reports:</p>
<blockquote cite="https://support.zabbix.com/browse/ZBX-7479">
<p>Zabbix agent is vulnerable to remote command execution
from the Zabbix server in some cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6824</cvename>
<url>https://support.zabbix.com/browse/ZBX-7479</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2013-12-16</entry>
</dates>
</vuln>
<vuln vid="47b4e713-6513-11e3-868f-0025905a4771">
<topic>PHP5 -- memory corruption in openssl_x509_parse()</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.4.0</ge><lt>5.4.23</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.28</lt></range>
</package>
<package>
<name>php55</name>
<range><ge>5.5.0</ge><lt>5.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html">
<p>The PHP function openssl_x509_parse() uses a helper function
called asn1_time_to_time_t() to convert timestamps from ASN1
string format into integer timestamp values. The parser within
this helper function is not binary safe and can therefore be
tricked to write up to five NUL bytes outside of an allocated
buffer.</p>
<p>This problem can be triggered by x509 certificates that contain
NUL bytes in their notBefore and notAfter timestamp fields and
leads to a memory corruption that might result in arbitrary
code execution.</p>
<p>Depending on how openssl_x509_parse() is used within a PHP
application the attack requires either a malicious cert signed
by a compromised/malicious CA or can be carried out with a
self-signed cert.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6420</cvename>
<url>https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html</url>
</references>
<dates>
<discovery>2013-12-13</discovery>
<entry>2013-12-14</entry>
</dates>
</vuln>
<vuln vid="dd116b19-64b3-11e3-868f-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>25.0,1</gt><lt>26.0,1</lt></range>
<range><lt>24.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>26.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.23</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.2.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.23</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-116 JPEG information leak</p>
<p>MFSA 2013-105 Application Installation doorhanger persists on
navigation</p>
<p>MFSA 2013-106 Character encoding cross-origin XSS attack</p>
<p>MFSA 2013-107 Sandbox restrictions not applied to nested object
elements</p>
<p>MFSA 2013-108 Use-after-free in event listeners</p>
<p>MFSA 2013-109 Use-after-free during Table Editing</p>
<p>MFSA 2013-110 Potential overflow in JavaScript binary search
algorithms</p>
<p>MFSA 2013-111 Segmentation violation when replacing ordered list
elements</p>
<p>MFSA 2013-112 Linux clipboard information disclosure though
selection paste</p>
<p>MFSA 2013-113 Trust settings for built-in roots ignored during EV
certificate validation</p>
<p>MFSA 2013-114 Use-after-free in synthetic mouse movement</p>
<p>MFSA 2013-115 GetElementIC typed array stubs can be generated
outside observed typesets</p>
<p>MFSA 2013-116 JPEG information leak</p>
<p>MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5609</cvename>
<cvename>CVE-2013-5610</cvename>
<cvename>CVE-2013-5611</cvename>
<cvename>CVE-2013-5612</cvename>
<cvename>CVE-2013-5613</cvename>
<cvename>CVE-2013-5614</cvename>
<cvename>CVE-2013-5615</cvename>
<cvename>CVE-2013-5616</cvename>
<cvename>CVE-2013-5618</cvename>
<cvename>CVE-2013-5619</cvename>
<cvename>CVE-2013-6629</cvename>
<cvename>CVE-2013-6630</cvename>
<cvename>CVE-2013-6671</cvename>
<cvename>CVE-2013-6672</cvename>
<cvename>CVE-2013-6673</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-104.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-105.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-106.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-107.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-108.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-109.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-110.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-111.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-112.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-113.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-114.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-115.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-116.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-117.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-12-09</discovery>
<entry>2013-12-14</entry>
</dates>
</vuln>
<vuln vid="613e45d1-6154-11e3-9b62-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.22</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/latest_news.html#4.1.3">
<p>These are security releases in order to address CVE-2013-4408
(DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150
(pam_winbind login without require_membership_of restrictions).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6150</cvename>
<cvename>CVE-2013-4408</cvename>
<url>http://www.samba.org/samba/security/CVE-2012-6150</url>
<url>http://www.samba.org/samba/security/CVE-2013-4408</url>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2013-12-11</entry>
</dates>
</vuln>
<vuln vid="6a806960-3016-44ed-8575-8614a7cb57c7">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionmailer</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activemodel</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activeresource</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-railties</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.0.2</lt></range>
</package>
<package>
<name>rubygem-activesupport4</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails weblog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/">
<p>Rails 3.2.16 and 4.0.2 have been released! These two
releases contain important security fixes, so please upgrade
as soon as possible! In order to make upgrading as smooth as
possible, we've only included commits directly related to
each security issue.</p>
<p>The security fixes in 3.2.16 are:</p>
<ul>
<li>CVE-2013-4491</li>
<li>CVE-2013-6414</li>
<li>CVE-2013-6415</li>
<li>CVE-2013-6417</li>
</ul>
<p>The security fixes in 4.0.2 are:</p>
<ul>
<li>CVE-2013-4491</li>
<li>CVE-2013-6414</li>
<li>CVE-2013-6415</li>
<li>CVE-2013-6416</li>
<li>CVE-2013-6417</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4491</cvename>
<cvename>CVE-2013-6414</cvename>
<cvename>CVE-2013-6415</cvename>
<cvename>CVE-2013-6416</cvename>
<cvename>CVE-2013-6417</cvename>
<url>http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2013-12-08</entry>
<modified>2014-04-23</modified>
</dates>
</vuln>
<vuln vid="d9649816-5e0d-11e3-8d23-3c970e169bc2">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.29</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-003">
<p>Multiple vulnerabilities were fixed in the supported Drupal
core versions 6 and 7.</p>
<ul>
<li>Multiple vulnerabilities due to optimistic cross-site
request forgery protection (Form API validation - Drupal 6
and 7)</li>
<li>Multiple vulnerabilities due to weakness in pseudorandom
number generation using mt_rand() (Form API, OpenID and
random password generation - Drupal 6 and 7)</li>
<li>Code execution prevention (Files directory .htaccess for
Apache - Drupal 6 and 7)</li>
<li>Access bypass (Security token validation - Drupal 6 and 7)</li>
<li>Cross-site scripting (Image module - Drupal 7)</li>
<li>Cross-site scripting (Color module - Drupal 7)</li>
<li>Open redirect (Overlay module - Drupal 7)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://drupal.org/SA-CORE-2013-003</url>
</references>
<dates>
<discovery>2013-11-20</discovery>
<entry>2013-12-06</entry>
</dates>
</vuln>
<vuln vid="4158c57e-5d39-11e3-bc1e-6cf0490a8c18">
<topic>Joomla! -- Core XSS Vulnerabilities</topic>
<affects>
<package>
<name>joomla2</name>
<range><ge>2.5.*</ge><le>2.5.14</le></range>
</package>
<package>
<name>joomla3</name>
<range><ge>3.0.*</ge><le>3.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/570-core-xss-20131101.html">
<h2>[20131101] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/571-core-xss-20131102.html">
<h2>[20131102] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/572-core-xss-20131103.html">
<h2>[20131103] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/570-core-xss-20131101.html</url>
<url>http://developer.joomla.org/security/571-core-xss-20131102.html</url>
<url>http://developer.joomla.org/security/572-core-xss-20131103.html</url>
</references>
<dates>
<discovery>2013-11-01</discovery>
<entry>2013-12-04</entry>
<modified>2014-04-23</modified>
</dates>
</vuln>
<vuln vid="d2073237-5b52-11e3-80f7-c86000cbc6ec">
<topic>OpenTTD -- Denial of service using forcefully crashed aircrafts</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.6</ge><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="https://security.openttd.org/en/CVE-2013-6411">
<p>The problem is caused by incorrectly handling the fact that
the aircraft circling the corner airport will be outside of the
bounds of the map. In the 'out of fuel' crash code the height
of the tile under the aircraft is determined. In this case
that means a tile outside of the allocated map array, which
could occasionally trigger invalid reads.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6411</cvename>
<url>https://security.openttd.org/en/CVE-2013-6411</url>
<url>http://bugs.openttd.org/task/5820</url>
<url>http://vcs.openttd.org/svn/changeset/26134</url>
</references>
<dates>
<discovery>2013-11-28</discovery>
<entry>2013-11-28</entry>
</dates>
</vuln>
<vuln vid="620cf713-5a99-11e3-878d-20cf30e32f6d">
<topic>monitorix -- serious bug in the built-in HTTP server</topic>
<affects>
<package>
<name>monitorix</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Monitorix Project reports:</p>
<blockquote cite="http://www.monitorix.org/news.html#N331">
<p>A serious bug in the built-in HTTP server. It was discovered that the
handle_request() routine did not properly perform input sanitization
which led into a number of security vulnerabilities. An unauthenticated,
remote attacker could exploit this flaw to execute arbitrary commands on
the remote host. All users still using older versions are advised to
upgrade to this version, which resolves this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.monitorix.org/news.html#N331</url>
<url>https://github.com/mikaku/Monitorix/issues/30</url>
</references>
<dates>
<discovery>2013-11-21</discovery>
<entry>2013-12-01</entry>
</dates>
</vuln>
<vuln vid="e3244a7b-5603-11e3-878d-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.4.0</ge><lt>1.7.14</lt></range>
<range><ge>1.8.0</ge><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>mod_dontdothat does not restrict requests from serf based clients</p>
<p>mod_dontdothat allows you to block update REPORT requests against certain
paths in the repository. It expects the paths in the REPORT request
to be absolute URLs. Serf based clients send relative URLs instead
of absolute URLs in many cases. As a result these clients are not blocked
as configured by mod_dontdothat.</p>
<p>mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits</p>
<p>When SVNAutoversioning is enabled via SVNAutoversioning on
commits can be made by single HTTP requests such as MKCOL and
PUT. If Subversion is built with assertions enabled any such
requests that have non-canonical URLs, such as URLs with a
trailing /, may trigger an assert. An assert will cause the
Apache process to abort.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4505</cvename>
<cvename>CVE-2013-4558</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4505-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2013-4558-advisory.txt</url>
</references>
<dates>
<discovery>2013-11-15</discovery>
<entry>2013-11-25</entry>
</dates>
</vuln>
<vuln vid="742eb9e4-e3cb-4f5a-b94e-0e9a39420600">
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
<affects>
<package>
<name>ruby19-gems</name>
<range><lt>1.8.27</lt></range>
</package>
<package>
<name>ruby20-gems</name>
<range><lt>1.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Gem developers report:</p>
<blockquote cite="http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html">
<p>The patch for CVE-2013-4363 was insufficiently verified so the
combined regular expression for verifying gem version remains
vulnerable following CVE-2013-4363.</p>
<p>RubyGems validates versions with a regular expression that is
vulnerable to denial of service due to backtracking. For specially
crafted RubyGems versions attackers can cause denial of service
through CPU consumption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4363</cvename>
</references>
<dates>
<discovery>2013-09-24</discovery>
<entry>2013-11-24</entry>
</dates>
</vuln>
<vuln vid="54237182-9635-4a8b-92d7-33bfaeed84cd">
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
<affects>
<package>
<name>ruby19-gems</name>
<range><lt>1.8.26</lt></range>
</package>
<package>
<name>ruby20-gems</name>
<range><lt>1.8.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Gem developers report:</p>
<blockquote cite="http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html">
<p>RubyGems validates versions with a regular expression that is
vulnerable to denial of service due to backtracking. For specially
crafted RubyGems versions attackers can cause denial of service
through CPU consumption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4287</cvename>
</references>
<dates>
<discovery>2013-09-09</discovery>
<entry>2013-11-24</entry>
</dates>
</vuln>
<vuln vid="cc9043cf-7f7a-426e-b2cc-8d1980618113">
<topic>ruby -- Heap Overflow in Floating Point Parsing</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.484,1</lt></range>
</package>
<package>
<name>ruby20</name>
<range><lt>2.0.0.353,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/">
<p>Any time a string is converted to a floating point value, a
specially crafted string can cause a heap overflow. This can lead
to a denial of service attack via segmentation faults and possibly
arbitrary code execution. Any program that converts input of
unknown origin to floating point values (especially common when
accepting JSON) are vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/</url>
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/</url>
<cvename>CVE-2013-4164</cvename>
</references>
<dates>
<discovery>2013-11-22</discovery>
<entry>2013-11-23</entry>
</dates>
</vuln>
<vuln vid="479efd57-516e-11e3-9b62-000c292e4fd8">
<topic>samba -- Private key in key.pem world readable</topic>
<affects>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4476">
<p>Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is
provided over SSL, uses world-readable permissions for a private key,
which allows local users to obtain sensitive information by reading the
key file, as demonstrated by access to the local filesystem on an AD
domain controller.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4476</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4476</url>
</references>
<dates>
<discovery>2013-06-12</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="a4f08579-516c-11e3-9b62-000c292e4fd8">
<topic>samba -- ACLs are not checked on opening an alternate data stream on a file or directory</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.20</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4475">
<p>Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
file or directory ACL when opening an alternate data stream.</p>
<p>According to the SMB1 and SMB2+ protocols the ACL on an underlying
file or directory should control what access is allowed to alternate
data streams that are associated with the file or directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4475</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4475</url>
</references>
<dates>
<discovery>2013-06-12</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="94b6264a-5140-11e3-8b22-f0def16c5c1b">
<topic>nginx -- Request line parsing vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.8.41</ge><lt>1.4.4,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.8.41</ge><lt>1.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html">
<p>Ivan Fratric of the Google Security Team discovered a bug in nginx, which might
allow an attacker to bypass security restrictions in certain configurations by
using a specially crafted request, or might have potential other impact
(CVE-2013-4547).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4547</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url>
</references>
<dates>
<discovery>2013-11-19</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="adcbdba2-4c27-11e3-9848-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.327</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-26.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5329</cvename>
<cvename>CVE-2013-5330</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-26.html</url>
</references>
<dates>
<discovery>2013-11-12</discovery>
<entry>2013-11-12</entry>
</dates>
</vuln>
<vuln vid="5709d244-4873-11e3-8a46-000d601460a4">
<topic>OpenSSH -- Memory corruption in sshd</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
</package>
<package>
<name>openssh-portable-base</name>
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH development team reports:</p>
<blockquote cite="http://www.openssh.com/txt/gcmrekey.adv">
<p>A memory corruption vulnerability exists in the post-
authentication sshd process when an AES-GCM cipher
(aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
selected during kex exchange.</p>
<p>If exploited, this vulnerability might permit code execution
with the privileges of the authenticated user and may
therefore allow bypassing restricted shell/command
configurations.</p>
<p>Either upgrade to 6.4 or disable AES-GCM in the server
configuration. The following sshd_config option will disable
AES-GCM while leaving other ciphers active:</p>
<p>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/gcmrekey.adv</url>
</references>
<dates>
<discovery>2013-11-07</discovery>
<entry>2013-11-08</entry>
<modified>2013-11-13</modified>
</dates>
</vuln>
<vuln vid="f969bad7-46fc-11e3-b6ee-00269ee29e57">
<topic>Quassel IRC -- SQL injection vulnerability</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quassel IRC developers report:</p>
<blockquote cite="http://www.quassel-irc.org/node/120">
<p>SQL injection vulnerability in Quassel IRC before 0.9.1,
when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used,
allows remote attackers to execute arbitrary SQL commands via
a \ (backslash) in a message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4422</cvename>
</references>
<dates>
<discovery>2013-10-07</discovery>
<entry>2013-11-06</entry>
</dates>
</vuln>
<vuln vid="81f866ad-41a4-11e3-a4af-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>24.1.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>25.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.22</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.1.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.22</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 /
rv:24.1 / rv:17.0.10)</p>
<p> MFSA 2013-94 Spoofing addressbar though SELECT element</p>
<p> MFSA 2013-95 Access violation with XSLT and uninitialized data</p>
<p> MFSA 2013-96 Improperly initialized memory and overflows in some
JavaScript functions</p>
<p> MFSA 2013-97 Writing to cycle collected object during image
decoding</p>
<p> MFSA 2013-98 Use-after-free when updating offline cache</p>
<p> MFSA 2013-99 Security bypass of PDF.js checks using iframes</p>
<p> MFSA 2013-100 Miscellaneous use-after-free issues found through
ASAN fuzzing</p>
<p> MFSA 2013-101 Memory corruption in workers</p>
<p> MFSA 2013-102 Use-after-free in HTML document templates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1739</cvename>
<cvename>CVE-2013-5590</cvename>
<cvename>CVE-2013-5591</cvename>
<cvename>CVE-2013-5592</cvename>
<cvename>CVE-2013-5593</cvename>
<cvename>CVE-2013-5595</cvename>
<cvename>CVE-2013-5596</cvename>
<cvename>CVE-2013-5597</cvename>
<cvename>CVE-2013-5598</cvename>
<cvename>CVE-2013-5599</cvename>
<cvename>CVE-2013-5600</cvename>
<cvename>CVE-2013-5601</cvename>
<cvename>CVE-2013-5602</cvename>
<cvename>CVE-2013-5603</cvename>
<cvename>CVE-2013-5604</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-93.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-94.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-95.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-96.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-97.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-98.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-99.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-100.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-101.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-102.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-10-29</discovery>
<entry>2013-10-30</entry>
<modified>2013-10-31</modified>
</dates>
</vuln>
<vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
<topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>mod_pagespeed</name>
<range><lt>1.2.24.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_pagespeed developers report:</p>
<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
<p>Various versions of mod_pagespeed are subject to critical
cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
permits a hostile third party to execute JavaScript in users'
browsers in context of the domain running mod_pagespeed, which
could permit theft of users' cookies or data on the site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6111</cvename>
</references>
<dates>
<discovery>2013-10-04</discovery>
<entry>2013-10-28</entry>
</dates>
</vuln>
<vuln vid="cd082cc6-1548-4b8d-a3aa-a007be611a29">
<cancelled/>
</vuln>
<vuln vid="9065b930-3d8b-11e3-bd1a-e840f2096bd0">
<topic>gnutls -- denial of service</topic>
<affects>
<package>
<name>gnutls3</name>
<range><lt>3.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2013-3">
<p>This vulnerability affects the DANE library of gnutls 3.1.x and
gnutls 3.2.x. A server that returns more 4 DANE entries could
corrupt the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2013-3</url>
</references>
<dates>
<discovery>2013-10-25</discovery>
<entry>2013-10-25</entry>
<modified>2013-11-01</modified>
</dates>
</vuln>
<vuln vid="9a57c607-3cab-11e3-b4d9-bcaec565249c">
<topic>xorg-server -- use-after-free</topic>
<affects>
<package>
<name>xorg-server</name>
<range><ge>1.7.0</ge><lt>1.7.7_11</lt></range>
<range><ge>1.12.0</ge><lt>1.12.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2013-October/002332.html">
<p>Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org
security team in which an authenticated X client can cause an X
server to use memory after it was freed, potentially leading to
crash and/or memory corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4396</cvename>
<url>http://lists.x.org/archives/xorg-announce/2013-October/002332.html</url>
</references>
<dates>
<discovery>2013-10-08</discovery>
<entry>2013-10-24</entry>
</dates>
</vuln>
<vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2">
<topic>pycrypto -- PRNG reseed race condition</topic>
<affects>
<package>
<name>py26-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py27-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py31-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py32-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py33-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dwayne Litzenberger reports:</p>
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">
<p>In PyCrypto before v2.6.1, the Crypto.Random pseudo-random
number generator (PRNG) exhibits a race condition that may cause
it to generate the same 'random' output in multiple processes that
are forked from each other. Depending on the application, this
could reveal sensitive information or cryptographic keys to remote
attackers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1445</cvename>
<url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>
</references>
<dates>
<discovery>2013-10-17</discovery>
<entry>2013-10-19</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The wordpress development team reports:</p>
<blockquote cite="http://wordpress.org/news/2013/09/wordpress-3-6-1/">
<ul>
<li>Block unsafe PHP unserialization that could occur in limited
situations and setups, which can lead to remote code
execution.</li>
<li>Prevent a user with an Author role, using a specially crafted
request, from being able to create a post "written by" another
user.</li>
<li>Fix insufficient input validation that could result in
redirecting or leading a user to another website.</li>
</ul>
<p>Additionally, we've adjusted security restrictions around file
uploads to mitigate the potential for cross-site scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4338</cvename>
<cvename>CVE-2013-4339</cvename>
<cvename>CVE-2013-4340</cvename>
<cvename>CVE-2013-5738</cvename>
<cvename>CVE-2013-5739</cvename>
<url>http://wordpress.org/news/2013/09/wordpress-3-6-1/</url>
</references>
<dates>
<discovery>2013-09-11</discovery>
<entry>2013-10-19</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="206f9826-a06d-4927-9a85-771c37010b32">
<topic>node.js -- DoS Vulnerability</topic>
<affects>
<package>
<name>node</name>
<range><lt>0.10.21</lt></range>
</package>
<package>
<name>node-devel</name>
<range><lt>0.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node.js developers report</p>
<blockquote cite="http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/">
<p>This release contains a security fix for the http server implementation, please upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url>
</references>
<dates>
<discovery>2013-10-19</discovery>
<entry>2013-10-19</entry>
</dates>
</vuln>
<vuln vid="e135f0c9-375f-11e3-80b7-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
</package>
<package>
<name>bugzilla40</name>
<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>4.4</ge><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.10/">
<h1>Cross-Site Request Forgery</h1>
<p>When a user submits changes to a bug right after another
user did, a midair collision page is displayed to inform
the user about changes recently made. This page contains
a token which can be used to validate the changes if the
user decides to submit his changes anyway. A regression
in Bugzilla 4.4 caused this token to be recreated if a
crafted URL was given, even when no midair collision page
was going to be displayed, allowing an attacker to bypass
the token check and abuse a user to commit changes on his
behalf.</p>
<h1>Cross-Site Request Forgery</h1>
<p>When an attachment is edited, a token is generated to
validate changes made by the user. Using a crafted URL,
an attacker could force the token to be recreated,
allowing him to bypass the token check and abuse a user
to commit changes on his behalf.</p>
<h1>Cross-Site Scripting</h1>
<p>Some parameters passed to editflagtypes.cgi were not
correctly filtered in the HTML page, which could lead
to XSS.</p>
<h1>Cross-Site Scripting</h1>
<p>Due to an incomplete fix for CVE-2012-4189, some
incorrectly filtered field values in tabular reports
could lead to XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1733</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=911593</url>
<cvename>CVE-2013-1734</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=913904</url>
<cvename>CVE-2013-1742</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924802</url>
<cvename>CVE-2013-1743</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924932</url>
</references>
<dates>
<discovery>2013-10-16</discovery>
<entry>2013-10-17</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="8c9b48d1-3715-11e3-a624-00262d8b701d">
<topic>dropbear -- exposure of sensitive information, DoS</topic>
<affects>
<package>
<name>dropbear</name>
<range><ge>2012.55</ge><lt>2013.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Dropbear project reports:</p>
<blockquote cite="http://secunia.com/advisories/55173/">
<p>A weakness and a vulnerability have been reported in Dropbear
SSH Server, which can be exploited by malicious people to disclose
certain sensitive information and cause a DoS.</p>
</blockquote>
</body>
</description>
<references>
<bid>62958</bid>
<bid>62993</bid>
<cvename>CVE-2013-4421</cvename>
<cvename>CVE-2013-4434</cvename>
<url>http://secunia.com/advisories/55173</url>
</references>
<dates>
<discovery>2013-05-08</discovery>
<!-- discovery>2013-10-03</discovery -->
<entry>2013-10-17</entry>
</dates>
</vuln>
<vuln vid="9003b500-31e3-11e3-b0d0-20cf30e32f6d">
<topic>mod_fcgid -- possible heap buffer overwrite</topic>
<affects>
<package>
<name>ap22-mod_fcgid</name>
<range><lt>2.3.9</lt></range>
</package>
<package>
<name>ap24-mod_fcgid</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Project reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/httpd-cvs/201309.mbox/%3C20130929174048.13B962388831@eris.apache.org%3E">
<p>Fix possible heap buffer overwrite.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4365</cvename>
</references>
<dates>
<discovery>2013-09-29</discovery>
<entry>2013-10-10</entry>
</dates>
</vuln>
<vuln vid="749b5587-2da1-11e3-b1a9-b499baab0cbe">
<topic>gnupg -- possible infinite recursion in the compressed packet parser</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.15</lt></range>
<range><ge>2.0.0</ge><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html">
<p>Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4402</cvename>
</references>
<dates>
<discovery>2013-10-05</discovery>
<entry>2013-10-05</entry>
</dates>
</vuln>
<vuln vid="5c34664f-2c2b-11e3-87c2-00215af774f0">
<topic>xinetd -- ignores user and group directives for TCPMUX services</topic>
<affects>
<package>
<name>xinetd</name>
<range><lt>2.3.15_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xinetd would execute configured TCPMUX services without dropping
privilege to match the service configuration allowing the service to
run with same privilege as the xinetd process (root).</p>
</body>
</description>
<references>
<cvename>CVE-2013-4342</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1006100</url>
</references>
<dates>
<discovery>2005-08-23</discovery>
<entry>2013-10-03</entry>
</dates>
</vuln>
<vuln vid="ccefac3e-2aed-11e3-af10-000c29789cb5">
<topic>polarssl -- Timing attack against protected RSA-CRT implementation</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PolarSSL Project reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05">
<p>The researchers Cyril Arnaud and Pierre-Alain Fouque
investigated the PolarSSL RSA implementation and discovered
a bias in the implementation of the Montgomery multiplication
that we used. For which they then show that it can be used to
mount an attack on the RSA key. Although their test attack is
done on a local system, there seems to be enough indication
that this can properly be performed from a remote system as
well.</p>
<p>All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected
if a third party can send arbitrary handshake messages to your
server.</p>
<p>If correctly executed, this attack reveals the entire private
RSA key after a large number of attack messages (> 600.000 on
a local machine) are sent to show the timing differences.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5915</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05</url>
<url>https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released</url>
</references>
<dates>
<discovery>2013-10-01</discovery>
<entry>2013-10-02</entry>
</dates>
</vuln>
<vuln vid="e1f99d59-81aa-4662-bf62-c1076f5016c8">
<topic>py-graphite-web -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py27-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py31-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py32-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py33-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Graphite developers report:</p>
<blockquote cite="http://graphite.readthedocs.org/en/0.9.11/releases/0_9_11.html">
<p>This release contains several security fixes for cross-site
scripting (XSS) as well as a fix for a remote-execution exploit in
graphite-web (CVE-2013-5903).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5093</cvename>
<url>https://github.com/rapid7/metasploit-framework/pull/2260</url>
</references>
<dates>
<discovery>2013-08-21</discovery>
<entry>2013-09-30</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="05dc6efa-2370-11e3-95b7-00e0814cab4e">
<topic>django -- denial-of-service via large passwords</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.5</ge><lt>1.5.4</lt></range>
<range><ge>1.4</ge><lt>1.4.8</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.5</ge><lt>1.5.4</lt></range>
<range><ge>1.4</ge><lt>1.4.8</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20130922,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20130922,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/15/security/">
<p>These releases address a denial-of-service attack against Django's
authentication framework. All users of Django are encouraged to
upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1443</cvename>
<url>https://www.djangoproject.com/weblog/2013/sep/15/security/</url>
</references>
<dates>
<discovery>2013-09-15</discovery>
<entry>2013-09-22</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="b72bad1c-20ed-11e3-be06-000c29ee3065">
<topic>FreeBSD -- Cross-mount links between nullfs(5) mounts</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.1</ge><lt>9.1_7</lt></range>
<range><ge>8.4</ge><lt>8.4_4</lt></range>
<range><ge>8.3</ge><lt>8.3_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The nullfs(5) implementation of the VOP_LINK(9) VFS
operation does not check whether the source and target of
the link are both in the same nullfs instance. It is
therefore possible to create a hardlink from a location in
one nullfs instance to a file in another, as long as the
underlying (source) filesystem is the same.</p>
<p>Impact:</p>
<p>If multiple nullfs views into the same filesystem are
mounted in different locations, a user with read access to
one of these views and write access to another will be able
to create a hard link from the latter to a file in the
former, even though they are, from the user's perspective,
different filesystems. The user may thereby gain write
access to files which are nominally on a read-only
filesystem.</p>
</body>
</description>
<references>
<cvename>CVE-2013-5710</cvename>
<freebsdsa>SA-13:13.nullfs</freebsdsa>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="4d87d357-202c-11e3-be06-000c29ee3065">
<topic>FreeBSD -- Insufficient credential checks in network ioctl(2)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.1</ge><lt>9.1_7</lt></range>
<range><ge>8.4</ge><lt>8.4_4</lt></range>
<range><ge>8.3</ge><lt>8.3_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>As is commonly the case, the IPv6 and ATM network layer
ioctl request handlers are written in such a way that an
unrecognized request is passed on unmodified to the link
layer, which will either handle it or return an error
code.</p>
<p>Network interface drivers, however, assume that the
SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and
SIOCSIFNETMASK requests have been handled at the network
layer, and therefore do not perform input validation or
verify the caller's credentials. Typical link-layer actions
for these requests may include marking the interface as "up"
and resetting the underlying hardware.</p>
<p>Impact:</p>
<p>An unprivileged user with the ability to run arbitrary code
can cause any network interface in the system to perform the
link layer actions associated with a SIOCSIFADDR,
SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl
request; or trigger a kernel panic by passing a specially
crafted address structure which causes a network interface
driver to dereference an invalid pointer.</p>
<p>Although this has not been confirmed, the possibility that
an attacker may be able to execute arbitrary code in kernel
context cannot be ruled out.</p>
</body>
</description>
<references>
<cvename>CVE-2013-5691</cvename>
<freebsdsa>SA-13:12.ifioctl</freebsdsa>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="7dfed67b-20aa-11e3-b8d8-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>24.0,1</lt></range>
<range><lt>17.0.9,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.9,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.21</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.21</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
rv:17.0.9)</p>
<p> MFSA 2013-77 Improper state in HTML5 Tree Builder with templates</p>
<p> MFSA 2013-78 Integer overflow in ANGLE library</p>
<p> MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
cloning</p>
<p> MFSA 2013-80 NativeKey continues handling key messages after
widget is destroyed</p>
<p> MFSA 2013-81 Use-after-free with select element</p>
<p> MFSA 2013-82 Calling scope for new Javascript objects can lead to
memory corruption</p>
<p> MFSA 2013-83 Mozilla Updater does not lock MAR file after
signature verification</p>
<p> MFSA 2013-84 Same-origin bypass through symbolic links</p>
<p> MFSA 2013-85 Uninitialized data in IonMonkey</p>
<p> MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA
graphic drivers</p>
<p> MFSA 2013-87 Shared object library loading from writable location</p>
<p> MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes</p>
<p> MFSA 2013-89 Buffer overflow with multi-column, lists, and floats</p>
<p> MFSA 2013-90 Memory corruption involving scrolling</p>
<p> MFSA 2013-91 User-defined properties on DOM proxies get the wrong
"this" object</p>
<p> MFSA 2013-92 GC hazard with default compartments and frame chain
restoration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1718</cvename>
<cvename>CVE-2013-1719</cvename>
<cvename>CVE-2013-1720</cvename>
<cvename>CVE-2013-1721</cvename>
<cvename>CVE-2013-1722</cvename>
<cvename>CVE-2013-1723</cvename>
<cvename>CVE-2013-1724</cvename>
<cvename>CVE-2013-1725</cvename>
<cvename>CVE-2013-1726</cvename>
<cvename>CVE-2013-1727</cvename>
<cvename>CVE-2013-1728</cvename>
<cvename>CVE-2013-1729</cvename>
<cvename>CVE-2013-1730</cvename>
<cvename>CVE-2013-1731</cvename>
<cvename>CVE-2013-1732</cvename>
<cvename>CVE-2013-1735</cvename>
<cvename>CVE-2013-1736</cvename>
<cvename>CVE-2013-1737</cvename>
<cvename>CVE-2013-1738</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-76.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-77.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-78.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-79.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-80.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-81.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-82.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-83.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-84.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-85.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-86.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-87.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-88.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-89.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-90.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-91.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-92.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-08-17</discovery>
<entry>2013-08-18</entry>
<modified>2013-09-19</modified>
</dates>
</vuln>
<vuln vid="5bd6811f-1c75-11e3-ba72-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.310</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-21.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3361</cvename>
<cvename>CVE-2013-3362</cvename>
<cvename>CVE-2013-3363</cvename>
<cvename>CVE-2013-5324</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-21.html</url>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-13</entry>
</dates>
</vuln>
<vuln vid="a851b305-1bc3-11e3-95b7-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.5</ge><lt>1.5.3</lt></range>
<range><ge>1.4</ge><lt>1.4.7</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.5</ge><lt>1.5.3</lt></range>
<range><ge>1.4</ge><lt>1.4.7</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20130912,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20130912,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/">
<p>These releases address a directory-traversal vulnerability in one
of Django's built-in template tags. While this issue requires some
fairly specific factors to be exploitable, we encourage all users
of Django to upgrade promptly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4315</cvename>
<url>https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/</url>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-12</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="f8a913cc-1322-11e3-8ffa-20cf30e32f6d">
<topic>svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.4.0</ge><lt>1.6.23_2</lt></range>
<range><ge>1.7.0</ge><lt>1.7.13</lt></range>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4277-advisory.txt">
<p>svnserve takes a --pid-file option which creates a file containing the
process id it is running as. It does not take steps to ensure that the file
it has been directed at is not a symlink. If the pid file is in a directory
writeable by unprivileged users, the destination could be replaced by a
symlink allowing for privilege escalation. svnserve does not create a pid
file by default.</p>
<p>All versions are only vulnerable when the --pid-file=ARG option is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4277</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4277-advisory.txt</url>
</references>
<dates>
<discovery>2013-08-30</discovery>
<entry>2013-09-02</entry>
</dates>
</vuln>
<vuln vid="b3b8d491-0fbb-11e3-8c50-1c6f65c11ee6">
<topic>cacti -- allow remote attackers to execute arbitrary SQL commands</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti release reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8b.php">
<p>Multiple security vulnerabilities have been fixed:</p>
<ul>
<li>SQL injection vulnerabilities</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1434</cvename>
<cvename>CVE-2013-1435</cvename>
<url>http://www.cacti.net/release_notes_0_8_8b.php</url>
</references>
<dates>
<discovery>2013-08-06</discovery>
<entry>2013-08-29</entry>
</dates>
</vuln>
<vuln vid="fd2bf3b5-1001-11e3-ba94-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.5.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.12.3</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.21.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote Crash From Late Arriving SIP ACK With SDP</p>
<p>Remote Crash when Invalid SDP is sent in SIP Request</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5641</cvename>
<cvename>CVE-2013-5642</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-004.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-005.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-08-27</discovery>
<entry>2013-08-28</entry>
<modified>2013-08-29</modified>
</dates>
</vuln>
<vuln vid="4d087b35-0990-11e3-a9f4-bcaec565249c">
<topic>gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav</topic>
<affects>
<package>
<name>gstreamer-ffmpeg</name>
<range><lt>0.10.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://libav.org/releases/libav-0.7.7.changelog">
<p>Bundled version of libav in gstreamer-ffmpeg contains a number of
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3892</cvename>
<cvename>CVE-2011-3893</cvename>
<cvename>CVE-2011-3895</cvename>
<cvename>CVE-2011-3929</cvename>
<cvename>CVE-2011-3936</cvename>
<cvename>CVE-2011-3937</cvename>
<cvename>CVE-2011-3940</cvename>
<cvename>CVE-2011-3945</cvename>
<cvename>CVE-2011-3947</cvename>
<cvename>CVE-2011-3951</cvename>
<cvename>CVE-2011-3952</cvename>
<cvename>CVE-2011-4031</cvename>
<cvename>CVE-2011-4351</cvename>
<cvename>CVE-2011-4352</cvename>
<cvename>CVE-2011-4353</cvename>
<cvename>CVE-2011-4364</cvename>
<cvename>CVE-2011-4579</cvename>
<cvename>CVE-2012-0848</cvename>
<cvename>CVE-2012-0850</cvename>
<cvename>CVE-2012-0851</cvename>
<cvename>CVE-2012-0852</cvename>
<cvename>CVE-2012-0853</cvename>
<cvename>CVE-2012-0858</cvename>
<cvename>CVE-2012-0947</cvename>
<cvename>CVE-2012-2772</cvename>
<cvename>CVE-2012-2775</cvename>
<cvename>CVE-2012-2777</cvename>
<cvename>CVE-2012-2779</cvename>
<cvename>CVE-2012-2783</cvename>
<cvename>CVE-2012-2784</cvename>
<cvename>CVE-2012-2786</cvename>
<cvename>CVE-2012-2787</cvename>
<cvename>CVE-2012-2788</cvename>
<cvename>CVE-2012-2790</cvename>
<cvename>CVE-2012-2791</cvename>
<cvename>CVE-2012-2793</cvename>
<cvename>CVE-2012-2794</cvename>
<cvename>CVE-2012-2798</cvename>
<cvename>CVE-2012-2800</cvename>
<cvename>CVE-2012-2801</cvename>
<cvename>CVE-2012-2803</cvename>
<cvename>CVE-2012-5144</cvename>
<url>http://libav.org/releases/libav-0.7.7.changelog</url>
</references>
<dates>
<discovery>2013-08-20</discovery>
<entry>2013-08-20</entry>
</dates>
</vuln>
<vuln vid="689c2bf7-0701-11e3-9a25-002590860428">
<topic>GnuPG and Libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.5.3</lt></range>
</package>
<package>
<name>linux-f10-libgcrypt</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch of the GNU project reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html">
<p>Noteworthy changes in version 1.5.3:</p>
<p>Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...</p>
<p>Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above
problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG
1.4.14.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4242</cvename>
<url>http://eprint.iacr.org/2013/448</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
</references>
<dates>
<discovery>2013-07-18</discovery>
<entry>2013-08-17</entry>
</dates>
</vuln>
<vuln vid="2b2f6092-0694-11e3-9e8e-000c29f6ae42">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>2.7</ge><lt>2.7.23</lt></range>
<range><ge>3.0</ge><lt>3.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet Labs reports:</p>
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-4761/">
<p>By using the `resource_type` service, an attacker could
cause puppet to load arbitrary Ruby files from the puppet
master node's file system. While this behavior is not
enabled by default, `auth.conf` settings could be modified
to allow it. The exploit requires local file system access
to the Puppet Master.</p>
<p>Puppet Module Tool (PMT) did not correctly control
permissions of modules it installed, instead transferring
permissions that existed when the module was built.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4761</cvename>
<cvename>CVE-2013-4956</cvename>
<url>http://puppetlabs.com/security/cve/cve-2013-4761/</url>
<url>http://puppetlabs.com/security/cve/cve-2013-4956/</url>
</references>
<dates>
<discovery>2013-07-05</discovery>
<entry>2013-08-16</entry>
</dates>
</vuln>
<vuln vid="9a0a892e-05d8-11e3-ba09-000c29784fd1">
<topic>lcms2 -- Null Pointer Dereference Denial of Service Vulnerability</topic>
<affects>
<package>
<name>lcms2</name>
<range><lt>2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mageia security team reports:</p>
<blockquote cite="http://advisories.mageia.org/MGASA-2013-0240.html">
<p>It was discovered that Little CMS did not properly verify certain
memory allocations. If a user or automated system using Little CMS
were tricked into opening a specially crafted file, an attacker
could cause Little CMS to crash (CVE-2013-4160).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4160</cvename>
<url>http://advisories.mageia.org/MGASA-2013-0240.html</url>
<url>https://bugs.mageia.org/show_bug.cgi?id=10816</url>
</references>
<dates>
<discovery>2013-07-22</discovery>
<entry>2013-08-15</entry>
<modified>2013-08-19</modified>
</dates>
</vuln>
<vuln vid="72bf9e21-03df-11e3-bd8d-080027ef73ec">
<topic>polarssl -- denial of service vulnerability</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Bakker reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03">
<p>A bug in the logic of the parsing of PEM encoded certificates in
x509parse_crt() can result in an infinite loop, thus hogging processing
power.</p>
<p>While parsing a Certificate message during the SSL/TLS handshake,
PolarSSL extracts the presented certificates and sends them on to
be parsed. As the RFC specifies that the certificates in the
Certificate message are always X.509 certificates in DER format,
bugs in the decoding of PEM certificates should normally not be
triggerable via the SSL/TLS handshake.</p>
<p>Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior
to 1.2.8 in the 1.2 branch call the generic x509parse_crt()
function for parsing during the handshake. x509parse_crt() is a
generic functions that wraps parsing of both PEM-encoded and
DER-formatted certificates. As a result it is possible to craft
a Certificate message that includes a PEM encoded certificate in
the Certificate message that triggers the infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4623</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03</url>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-08-13</entry>
<modified>2013-08-15</modified>
</dates>
</vuln>
<vuln vid="e21c7c7a-0116-11e3-9e83-3c970e169bc2">
<topic>samba -- denial of service vulnerability</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.17</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4124">
<p>All current released versions of Samba are vulnerable to
a denial of service on an authenticated or guest connection.
A malformed packet can cause the smbd server to loop the CPU
performing memory allocations and preventing any further service.</p>
<p>A connection to a file share, or a local account is needed
to exploit this problem, either authenticated or unauthenticated
if guest connections are allowed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4124</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4124</url>
</references>
<dates>
<discovery>2013-08-05</discovery>
<entry>2013-08-09</entry>
<modified>2013-08-09</modified>
</dates>
</vuln>
<vuln vid="0998e79d-0055-11e3-905b-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>23.0,1</lt></range>
<range><lt>17.0.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.8,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.20</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.20</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 /
rv:17.0.8)</p>
<p>MFSA 2013-64 Use after free mutating DOM during SetBody</p>
<p>MFSA 2013-65 Buffer underflow when generating CRMF requests</p>
<p>MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and
Mozilla Updater</p>
<p>MFSA 2013-67 Crash during WAV audio file decoding</p>
<p>MFSA 2013-68 Document URI misrepresentation and masquerading</p>
<p>MFSA 2013-69 CRMF requests allow for code execution and XSS
attacks</p>
<p>MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes</p>
<p>MFSA 2013-71 Further Privilege escalation through Mozilla Updater</p>
<p>MFSA 2013-72 Wrong principal used for validating URI for some
Javascript components</p>
<p>MFSA 2013-73 Same-origin bypass with web workers and
XMLHttpRequest</p>
<p>MFSA 2013-74 Firefox full and stub installer DLL hijacking</p>
<p>MFSA 2013-75 Local Java applets may read contents of local file
system</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1701</cvename>
<cvename>CVE-2013-1702</cvename>
<cvename>CVE-2013-1704</cvename>
<cvename>CVE-2013-1705</cvename>
<cvename>CVE-2013-1706</cvename>
<cvename>CVE-2013-1707</cvename>
<cvename>CVE-2013-1708</cvename>
<cvename>CVE-2013-1709</cvename>
<cvename>CVE-2013-1710</cvename>
<cvename>CVE-2013-1711</cvename>
<cvename>CVE-2013-1712</cvename>
<cvename>CVE-2013-1713</cvename>
<cvename>CVE-2013-1714</cvename>
<cvename>CVE-2013-1715</cvename>
<cvename>CVE-2013-1717</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-63.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-64.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-65.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-66.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-67.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-68.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-69.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-70.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-71.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-72.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-08-06</discovery>
<entry>2013-08-08</entry>
</dates>
</vuln>
<vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
<topic>PuTTY -- Four security holes in versions before 0.63</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
<p>This [0.63] release fixes multiple security holes in previous versions of
PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
underrun buffers and crash. [...]
</p><p>
These vulnerabilities can be triggered before host key verification,
which means that you are not even safe if you trust the server you
<em>think</em> you're connecting to, since it could be spoofed over the
network and the host key check would not detect this before the attack
could take place.
</p><p>
Additionally, when PuTTY authenticated with a user's private key, the
private key or information equivalent to it was accidentally kept in
PuTTY's memory for the rest of its run, where it could be retrieved by
other processes reading PuTTY's memory, or written out to swap files
or crash dumps. This release fixes that as well.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4206</cvename>
<cvename>CVE-2013-4207</cvename>
<cvename>CVE-2013-4208</cvename>
<cvename>CVE-2013-4852</cvename>
<mlist msgid="E1V6lUs-0007kP-40@atreus.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html</url>
</references>
<dates>
<discovery>2013-07-08</discovery>
<entry>2013-08-07</entry>
</dates>
</vuln>
<vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.29</lt></range>
<range><ge>4.7.0</ge><lt>4.7.14</lt></range>
<range><ge>6.1.0</ge><lt>6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002/">
<p>It has been discovered that TYPO3 Core is vulnerable to
Cross-Site Scripting and Remote Code Execution.</p>
<p>TYPO3 bundles flash files for video and audio playback. Old
versions of FlowPlayer and flashmedia are susceptible to
Cross-Site Scripting. No authentication is required to exploit
this vulnerability.</p>
<p>The file upload component and the File Abstraction Layer are
failing to check for denied file extensions, which allows
authenticated editors (even with limited permissions) to
upload php files with arbitrary code, which can then be
executed in web server's context.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3642</cvename>
<cvename>CVE-2013-1464</cvename>
</references>
<dates>
<discovery>2013-07-30</discovery>
<entry>2013-08-05</entry>
</dates>
</vuln>
<vuln vid="17326fd5-fcfb-11e2-9bb9-6805ca0b3d42">
<topic>phpMyAdmin -- clickJacking protection can be bypassed</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php">
<p> phpMyAdmin has a number of mechanisms to avoid a
clickjacking attack, however these mechanisms either work
only in modern browser versions, or can be bypassed.</p>
<p>"We have no solution for 3.5.x, due to the proposed
solution requiring JavaScript. We don't want to introduce a
dependency to JavaScript in the 3.5.x family."</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php</url>
</references>
<dates>
<discovery>2013-08-04</discovery>
<entry>2013-08-04</entry>
</dates>
</vuln>
<vuln vid="f4a0212f-f797-11e2-9bb9-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.4.2</lt></range>
</package>
<package>
<name>phpMyAdmin35</name>
<range><ge>3.5</ge><lt>3.5.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php">
<p>XSS due to unescaped HTML Output when executing a SQL query.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php">
<p>5 XSS vulnerabilities in setup, chart display, process
list, and logo link.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php">
<p>If a crafted version.json would be presented, an XSS
could be introduced.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php">
<p>Full path disclosure vulnerabilities.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php">
<p> XSS vulnerability when a text to link transformation is
used.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php">
<p>Self-XSS due to unescaped HTML output in schema
export.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php">
<p>SQL injection vulnerabilities, producing a privilege
escalation (control user).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php</url>
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view</url>
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view</url>
</references>
<dates>
<discovery>2013-07-28</discovery>
<entry>2013-07-28</entry>
<modified>2013-07-29</modified>
</dates>
</vuln>
<vuln vid="049332d2-f6e1-11e2-82f3-000c29ee3065">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.5.2,1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The wordpress development team reports:</p>
<blockquote cite="https://wordpress.org/news/2013/06/wordpress-3-5-2/">
<ul>
<li>Blocking server-side request forgery attacks, which could
potentially enable an attacker to gain access to a site</li>
<li>Disallow contributors from improperly publishing posts</li>
<li>An update to the SWFUpload external library to fix cross-site
scripting vulnerabilities</li>
<li>Prevention of a denial of service attack, affecting sites
using password-protected posts</li>
<li>An update to an external TinyMCE library to fix a cross-site
scripting vulnerability</li>
<li>Multiple fixes for cross-site scripting</li>
<li>Avoid disclosing a full file path when a upload fails</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2199</cvename>
<cvename>CVE-2013-2200</cvename>
<cvename>CVE-2013-2201</cvename>
<cvename>CVE-2013-2202</cvename>
<cvename>CVE-2013-2203</cvename>
<cvename>CVE-2013-2204</cvename>
<cvename>CVE-2013-2205</cvename>
<url>https://wordpress.org/news/2013/06/wordpress-3-5-2/</url>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-07-27</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="7943e521-f648-11e2-8607-3c970e169bc2">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.0</ge><lt>9.1_5</lt></range>
<range><ge>8.4</ge><lt>8.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01015/0">
<p>A specially crafted query that includes malformed
rdata can cause named to terminate with an assertion
failure while rejecting the malformed query.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4854</cvename>
<freebsdsa>SA-13:07.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01015/0</url>
</references>
<dates>
<discovery>2013-07-26</discovery>
<entry>2013-07-26</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="80771b89-f57b-11e2-bf21-b499baab0cbe">
<topic>gnupg -- side channel attack on RSA secret keys</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Yarom and Falkner paper reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html">
<p>Flush+Reload is a cache side-channel attack that monitors access to
data in shared pages. In this paper we demonstrate how to use the
attack to extract private encryption keys from GnuPG. The high
resolution and low noise of the Flush+Reload attack enables a spy
program to recover over 98% of the bits of the private key in a
single decryption or signing round. Unlike previous attacks, the
attack targets the last level L3 cache. Consequently, the spy
program and the victim do not need to share the execution core of
the CPU. The attack is not limited to a traditional OS and can be
used in a virtualised environment, where it can attack programs
executing in a different VM.</p>
</blockquote>
</body>
</description>
<references>
<url>http://eprint.iacr.org/2013/448</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
</references>
<dates>
<discovery>2013-07-18</discovery>
<entry>2013-07-25</entry>
<modified>2013-07-26</modified>
</dates>
</vuln>
<vuln vid="c4d412c8-f4d1-11e2-b86c-000c295229d5">
<topic>openafs -- single-DES cell-wide key brute force vulnerability</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenAFS Project reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt">
<p>The small size of the DES key space permits an attacker to brute
force a cell's service key and then forge traffic from any user
within the cell. The key space search can be performed in under 1
day at a cost of around $100 using publicly available services.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4134</cvename>
<url>http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt</url>
<url>http://openafs.org/pages/security/how-to-rekey.txt</url>
<url>http://openafs.org/pages/security/install-rxkad-k5-1.6.txt</url>
</references>
<dates>
<discovery>2013-07-24</discovery>
<entry>2013-07-25</entry>
</dates>
</vuln>
<vuln vid="2ae24334-f2e6-11e2-8346-001e8c75030d">
<topic>subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
<range><ge>1.7.0</ge><lt>1.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4131-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
on some requests made against a revision root. This can lead to a DoS.
If assertions are disabled it will trigger a read overflow which may cause a
SEGFAULT (or equivalent) or undefined behavior.</p>
<p>Commit access is required to exploit this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4131</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4131-advisory.txt</url>
</references>
<dates>
<discovery>2013-07-19</discovery>
<entry>2013-07-24</entry>
<modified>2013-07-25</modified>
</dates>
</vuln>
<vuln vid="2fbfd455-f2d0-11e2-8a46-000d601460a4">
<topic>suPHP -- Privilege escalation</topic>
<affects>
<package>
<name>suphp</name>
<range><lt>0.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>suPHP developer Sebastian Marsching reports:</p>
<blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html">
<p>When the suPHP_PHPPath was set, mod_suphp would use the specified PHP
executable to pretty-print PHP source files (MIME type
x-httpd-php-source or application/x-httpd-php-source).</p>
<p>However, it would not sanitize the environment. Thus a user that was
allowed to use the SetEnv directive in a .htaccess file (AllowOverride
FileInfo) could make PHP load a malicious configuration file (e.g.
loading malicious extensions).</p>
<p>As the PHP process for highlighting the source file was run with the
privileges of the user Apache HTTPd was running as, a local attacker
could probably execute arbitrary code with the privileges of this user.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.marsching.com/pipermail/suphp/2013-May/002552.html</url>
</references>
<dates>
<discovery>2013-05-20</discovery>
<entry>2013-07-22</entry>
</dates>
</vuln>
<vuln vid="ca4d63fb-f15c-11e2-b183-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP SERVER PROJECT reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
<p>mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn
with the source href (sent as part of the request body as XML) pointing
to a URI that is not configured for DAV will trigger a segfault.</p>
<p>mod_session_dbd: Make sure that dirty flag is respected when saving
sessions, and ensure the session ID is changed each time the session
changes. This changes the format of the updatesession SQL statement.
Existing configurations must be changed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1896</cvename>
<cvename>CVE-2013-2249</cvename>
<url>http://www.apache.org/dist/httpd/Announcement2.4.html</url>
</references>
<dates>
<discovery>2013-07-11</discovery>
<entry>2013-07-20</entry>
<modified>2013-07-21</modified>
</dates>
</vuln>
<vuln vid="9b037a0d-ef2c-11e2-b4a0-8c705af55518">
<topic>gallery -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery3</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat Security Response Team reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2013/07/04/7">
<p>Gallery upstream has released 3.0.9 version, correcting two
security flaws:</p>
<p>Issue #1 - Improper stripping of URL fragments in flowplayer
SWF file might lead to reply attacks (a different flaw than
CVE-2013-2138).</p>
<p>Issue #2 - gallery3: Multiple information exposure flaws in
data rest core module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2240</cvename>
<cvename>CVE-2013-2241</cvename>
<url>http://sourceforge.net/apps/trac/gallery/ticket/2073</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981197</url>
<url>http://sourceforge.net/apps/trac/gallery/ticket/2074</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981198</url>
<url>http://galleryproject.org/gallery_3_0_9</url>
</references>
<dates>
<discovery>2013-06-28</discovery>
<entry>2013-07-17</entry>
</dates>
</vuln>
<vuln vid="31b145f2-d9d3-49a9-8023-11cf742205dc">
<topic>PHP5 -- Heap corruption in XML parser</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113">
<p>ext/xml/xml.c in PHP before 5.3.27 does not properly
consider parsing depth, which allows remote attackers to
cause a denial of service (heap memory corruption) or
possibly have unspecified other impact via a crafted
document that is processed by the xml_parse_into_struct
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4113</cvename>
<url>https://bugs.php.net/bug.php?id=65236</url>
</references>
<dates>
<discovery>2013-07-10</discovery>
<entry>2013-07-16</entry>
</dates>
</vuln>
<vuln vid="5def3175-f3f9-4476-ba40-b46627cc638c">
<topic>PHP5 -- Integer overflow in Calendar module</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.4.0</ge><lt>5.4.16</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635">
<p>Integer overflow in the SdnToJewish function in jewish.c
in the Calendar component in PHP before 5.3.26 and 5.4.x
before 5.4.16 allows context-dependent attackers to cause a
denial of service (application hang) via a large argument to
the jdtojewish function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4635</cvename>
<url>https://bugs.php.net/bug.php?id=64895</url>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-07-16</entry>
</dates>
</vuln>
<vuln vid="df428c01-ed91-11e2-9466-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.297</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-17.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3344</cvename>
<cvename>CVE-2013-3345</cvename>
<cvename>CVE-2013-3347</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-17.html</url>
</references>
<dates>
<discovery>2013-07-09</discovery>
<entry>2013-07-15</entry>
<modified>2013-07-18</modified>
</dates>
</vuln>
<vuln vid="30a04ab4-ed7b-11e2-8643-8c705af55518">
<topic>squid -- denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.2</ge><lt>3.2.12</lt></range>
<range><ge>3.3</ge><lt>3.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid project reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2013_3.txt">
<p>Due to incorrect data validation Squid is vulnerable to a
denial of service attack when processing specially crafted
HTTP requests</p>
<p>This problem allows any client who can generate HTTP requests
to perform a denial of service attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4123</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2013_3.txt</url>
</references>
<dates>
<discovery>2013-07-13</discovery>
<entry>2013-07-15</entry>
</dates>
</vuln>
<vuln vid="04320e7d-ea66-11e2-a96e-60a44c524f57">
<topic>libzrtpcpp -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>libzrtpcpp</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Dowd reports:</p>
<blockquote cite="http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html">
<p>Vulnerability 1. Remote Heap Overflow: If an attacker sends a
packet larger than 1024 bytes that gets stored temporarily (which
occurs many times - such as when sending a ZRTP Hello packet), a
heap overflow will occur, leading to potential arbitrary code
execution on the vulnerable host.</p>
<p>Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains
multiple stack overflows that arise when preparing a response
to a client's ZRTP Hello packet.</p>
<p>Vulnerability 3. Information Leaking / Out of Bounds Reads:
The ZRTPCPP library performs very little validation regarding the
expected size of a packet versus the actual amount of data
received. This can lead to both information leaking and out
of bounds data reads (usually resulting in a crash).
Information leaking can be performed for example by sending
a malformed ZRTP Ping packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2221</cvename>
<cvename>CVE-2013-2222</cvename>
<cvename>CVE-2013-2223</cvename>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-07-11</entry>
</dates>
</vuln>
<vuln vid="ebd877b9-7ef4-4375-b1fd-c67780581898">
<topic>ruby -- Hostname check bypassing vulnerability in SSL client</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.448,1</lt></range>
</package>
<package>
<name>ruby18</name>
<range><lt>1.8.7.374,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/">
<p>Ruby's SSL client implements hostname identity check but it does
not properly handle hostnames in the certificate that contain null
bytes.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4073</cvename>
<url>http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/</url>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-07-11</entry>
<modified>2013-09-24</modified>
</dates>
</vuln>
<vuln vid="e3e788aa-e9fd-11e2-a96e-60a44c524f57">
<topic>otrs -- Sql Injection + Xss Issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/">
<p>An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4717</cvename>
<cvename>CVE-2013-4718</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/</url>
</references>
<dates>
<discovery>2013-07-09</discovery>
<entry>2013-07-11</entry>
</dates>
</vuln>
<vuln vid="f3d24aee-e5ad-11e2-b183-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.25">
<p>The mod_rewrite module in the Apache HTTP Server 2.2.x before
2.2.25 writes data to a log file without sanitizing
non-printable characters, which might allow remote attackers to
execute arbitrary commands via an HTTP request containing an
escape sequence for a terminal emulator.</p>
<p>mod_dav: Sending a MERGE request against a URI handled by
mod_dav_svn with the source href (sent as part of the request
body as XML) pointing to a URI that is not configured for DAV
will trigger a segfault.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1862</cvename>
<cvename>CVE-2013-1896</cvename>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-07-05</entry>
<modified>2013-07-10</modified>
</dates>
</vuln>
<vuln vid="1b93f6fe-e1c1-11e2-948d-6805ca0b3d42">
<topic>phpMyAdmin -- Global variable scope injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php">
<p>The import.php script was vulnerable to GLOBALS variable
injection. Therefore, an attacker could manipulate any
configuration parameter.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php</url>
<cvename>CVE-2013-4729</cvename>
</references>
<dates>
<discovery>2013-06-30</discovery>
<entry>2013-06-30</entry>
</dates>
</vuln>
<vuln vid="81da673e-dfe1-11e2-9389-08002798f6ff">
<topic>apache-xml-security-c -- heap overflow during XPointer evaluation</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2210.txt">
<p>The attempted fix to address CVE-2013-2154 introduced the
possibility of a heap overflow, possibly leading to arbitrary code
execution, in the processing of malformed XPointer expressions in the
XML Signature Reference processing code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2210</cvename>
<url>http://santuario.apache.org/secadv.data/CVE-2013-2210.txt</url>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-06-28</entry>
</dates>
</vuln>
<vuln vid="b3fcb387-de4b-11e2-b1c6-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>22.0,1</lt></range>
<range><lt>17.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.7,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.19</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.19</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)</p>
<p>Title: Memory corruption found using Address Sanitizer</p>
<p>Privileged content access and execution via XBL</p>
<p>Arbitrary code execution within Profiler</p>
<p>Execution of unmapped memory through onreadystatechange</p>
<p>Data in the body of XHR HEAD requests leads to CSRF attacks</p>
<p>SVG filters can lead to information disclosure</p>
<p>PreserveWrapper has inconsistent behavior</p>
<p>Sandbox restrictions not applied to nested frame elements</p>
<p>X-Frame-Options ignored when using server push with multi-part
responses</p>
<p>XrayWrappers can be bypassed to run user defined methods in a
privileged context</p>
<p>getUserMedia permission dialog incorrectly displays location</p>
<p>Homograph domain spoofing in .com, .net and .name</p>
<p>Inaccessible updater can lead to local privilege escalation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1682</cvename>
<cvename>CVE-2013-1683</cvename>
<cvename>CVE-2013-1684</cvename>
<cvename>CVE-2013-1685</cvename>
<cvename>CVE-2013-1686</cvename>
<cvename>CVE-2013-1687</cvename>
<cvename>CVE-2013-1688</cvename>
<cvename>CVE-2013-1690</cvename>
<cvename>CVE-2013-1692</cvename>
<cvename>CVE-2013-1693</cvename>
<cvename>CVE-2013-1694</cvename>
<cvename>CVE-2013-1695</cvename>
<cvename>CVE-2013-1696</cvename>
<cvename>CVE-2013-1697</cvename>
<cvename>CVE-2013-1698</cvename>
<cvename>CVE-2013-1699</cvename>
<cvename>CVE-2013-1700</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-49.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-50.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-51.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-52.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-53.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-54.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-55.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-56.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-57.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-58.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-59.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-60.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-61.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-62.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-06-25</discovery>
<entry>2013-06-26</entry>
</dates>
</vuln>
<vuln vid="01cf67b3-dc3b-11e2-a6cd-c48508086173">
<topic>cURL library -- heap corruption in curl_easy_unescape</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.7</ge><lt>7.24.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL developers report:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20130622.html">
<p>libcurl is vulnerable to a case of bad checking of the
input data which may lead to heap corruption.</p>
<p>The function curl_easy_unescape() decodes URL-encoded
strings to raw binary data. URL-encoded octets are
represented with %HH combinations where HH is a two-digit
hexadecimal number. The decoded string is written to an
allocated memory area that the function returns to the
caller.</p>
<p>The function takes a source string and a length
parameter, and if the length provided is 0 the function will
instead use strlen() to figure out how much data to
parse.</p>
<p>The "%HH" parser wrongly only considered the case where a
zero byte would terminate the input. If a length-limited
buffer was passed in which ended with a '%' character which
was followed by two hexadecimal digits outside of the buffer
libcurl was allowed to parse alas without a terminating
zero, libcurl would still parse that sequence as well. The
counter for remaining data to handle would then be decreased
too much and wrap to become a very large integer and the
copying would go on too long and the destination buffer that
is allocated on the heap would get overwritten.</p>
<p>We consider it unlikely that programs allow user-provided
strings unfiltered into this function. Also, only the not
zero-terminated input string use case is affected by this
flaw. Exploiting this flaw for gain is probably possible for
specific circumstances but we consider the general risk for
this to be low.</p>
<p>The curl command line tool is not affected by this
problem as it doesn't use this function.</p>
<p>There are no known exploits available at this time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2174</cvename>
<url>http://curl.haxx.se/docs/adv_20130622.html</url>
</references>
<dates>
<discovery>2013-06-22</discovery>
<entry>2013-06-23</entry>
<modified>2013-07-01</modified>
</dates>
</vuln>
<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
<topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>2.7</ge><lt>2.7.22</lt></range>
<range><ge>3.0</ge><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet Developers report:</p>
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
<p>When making REST api calls, the puppet master takes YAML from an
untrusted client, deserializes it, and then calls methods on the
resulting object. A YAML payload can be crafted to cause the
deserialization to construct an instance of any class available in
the ruby process, which allows an attacker to execute code
contained in the payload.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3567</cvename>
</references>
<dates>
<discovery>2013-06-13</discovery>
<entry>2013-06-22</entry>
<modified>2013-08-01</modified>
</dates>
</vuln>
<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
<topic>otrs -- information disclosure</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/">
<p>An attacker with a valid agent login could manipulate URLs in the ticket
watch mechanism to see contents of tickets they are not permitted to see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4088</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/</url>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-19</entry>
</dates>
</vuln>
<vuln vid="abef280d-d829-11e2-b71c-8c705af55518">
<topic>FreeBSD -- Privilege escalation via mmap</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.0</ge><lt>9.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a06.mmap.asc">
<p>Due to insufficient permission checks in the virtual memory
system, a tracing process (such as a debugger) may be able to
modify portions of the traced process's address space to which
the traced process itself does not have write access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2171</cvename>
<freebsdsa>SA-13:06.mmap</freebsdsa>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-18</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="279e5f4b-d823-11e2-928e-08002798f6ff">
<topic>apache-xml-security-c -- heap overflow</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2156.txt">
<p>A heap overflow exists in the processing of the PrefixList
attribute optionally used in conjunction with Exclusive
Canonicalization, potentially allowing arbitary code execution.
If verification of the signature occurs prior to actual evaluation of a
signing key, this could be exploited by an unauthenticated attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2156</cvename>
<url>http://santuario.apache.org/secadv.data/CVE-2013-2156.txt</url>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-18</entry>
</dates>
</vuln>
<vuln vid="80af2677-d6c0-11e2-8f5e-001966155bea">
<topic>tor -- guard discovery</topic>
<affects>
<package>
<name>tor-devel</name>
<range><lt>0.2.4.13.a_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://gitweb.torproject.org/tor.git/commit/2a95f3171681ee53c97ccba9d80f4454b462aaa7">
<p>Disable middle relay queue overfill detection code due to possible guard discovery attack</p>
</blockquote>
</body>
</description>
<references>
<url>https://trac.torproject.org/projects/tor/ticket/9072</url>
</references>
<dates>
<discovery>2013-06-15</discovery>
<entry>2013-06-16</entry>
</dates>
</vuln>
<vuln vid="4e9e410b-d462-11e2-8d57-080027019be0">
<topic>dbus -- local dos</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2013-June/015696.html">
<p>Alexandru Cornea discovered a vulnerability in libdbus caused
by an implementation bug in _dbus_printf_string_upper_bound().
This vulnerability can be exploited by a local user to crash
system services that use libdbus, causing denial of service.
It is platform-specific: x86-64 Linux is known to be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2168</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2013-June/015696.html</url>
</references>
<dates>
<discovery>2013-06-13</discovery>
<entry>2013-06-13</entry>
</dates>
</vuln>
<vuln vid="fce67546-d2e7-11e2-a9bf-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.291</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-16.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3343</cvename>
</references>
<dates>
<discovery>2013-06-11</discovery>
<entry>2013-06-14</entry>
<modified>2013-06-18</modified>
</dates>
</vuln>
<vuln vid="d7a43ee6-d2d5-11e2-9894-002590082ac6">
<topic>owncloud -- Multiple security vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>5.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ownCloud development team reports:</p>
<blockquote cite="http://owncloud.org/about/security/advisories/">
<p>oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities.
Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).</p>
<p>oC-SA-2013-022 / CVE-2013-2044: Open redirector.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.</p>
<p>oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.</p>
<p>oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.</p>
<p>oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.</p>
<p>oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-019/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-020/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-021/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-022/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-023/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-024/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-025/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-026/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-027/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-028/</url>
<cvename>CVE-2013-2039</cvename>
<cvename>CVE-2013-2040</cvename>
<cvename>CVE-2013-2041</cvename>
<cvename>CVE-2013-2042</cvename>
<cvename>CVE-2013-2043</cvename>
<cvename>CVE-2013-2044</cvename>
<cvename>CVE-2013-2045</cvename>
<cvename>CVE-2013-2047</cvename>
<cvename>CVE-2013-2048</cvename>
<cvename>CVE-2013-2085</cvename>
<cvename>CVE-2013-2086</cvename>
<cvename>CVE-2013-2089</cvename>
<cvename>CVE-2013-2149</cvename>
<cvename>CVE-2013-2150</cvename>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-06-11</entry>
</dates>
</vuln>
<vuln vid="59e7163c-cf84-11e2-907b-0025905a4770">
<topic>php5 -- Heap based buffer overflow in quoted_printable_encode</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.16</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>A Heap-based buffer overflow flaw was found in the php
quoted_printable_encode() function. A remote attacker could use
this flaw to cause php to crash or execute arbirary code with the
permission of the user running php</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2110</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=964969</url>
</references>
<dates>
<discovery>2013-06-06</discovery>
<entry>2013-06-07</entry>
</dates>
</vuln>
<vuln vid="72f35727-ce83-11e2-be04-005056a37f68">
<topic>dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone</topic>
<affects>
<package>
<name>bind99</name>
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
</package>
<package>
<name>bind96</name>
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00967">
<p>A bug has been discovered in the most recent releases of
BIND 9 which has the potential for deliberate exploitation
as a denial-of-service attack. By sending a recursive
resolver a query for a record in a specially malformed zone,
an attacker can cause BIND 9 to exit with a fatal
"RUNTIME_CHECK" error in resolver.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3919</cvename>
</references>
<dates>
<discovery>2013-06-04</discovery>
<entry>2013-06-06</entry>
<modified>2013-06-07</modified>
</dates>
</vuln>
<vuln vid="6b97436c-ce1e-11e2-9cb2-6805ca0b3d42">
<topic>phpMyAdmin -- XSS due to unescaped HTML output in Create View page</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php">
<p>When creating a view with a crafted name and an incorrect
CREATE statement, it is possible to trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php</url>
<cvename>CVE-2013-3742</cvename>
</references>
<dates>
<discovery>2013-06-05</discovery>
<entry>2013-06-05</entry>
</dates>
</vuln>
<vuln vid="a3c2dee5-cdb9-11e2-b9ce-080027019be0">
<topic>telepathy-gabble -- TLS verification bypass</topic>
<affects>
<package>
<name>telepathy-gabble</name>
<range><lt>0.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html">
<p>This release fixes a man-in-the-middle attack.</p>
<p>If you use an unencrypted connection to a "legacy Jabber"
(pre-XMPP) server, this version of Gabble will not connect
until you make one of these configuration changes:</p>
<p>. upgrade the server software to something that supports XMPP 1.0; or</p>
<p>. use an encrypted "old SSL" connection, typically on port 5223
(old-ssl); or</p>
<p>. turn off "Encryption required (TLS/SSL)" (require-encryption).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1431</cvename>
<url>http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-06-05</entry>
</dates>
</vuln>
<vuln vid="2eebebff-cd3b-11e2-8f09-001b38c3836c">
<topic>xorg -- protocol handling issues in X Window System client libraries</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.0</lt></range>
</package>
<package>
<name>libXext</name>
<range><lt>1.3.2</lt></range>
</package>
<package>
<name>libXfixes</name>
<range><lt>5.0.1</lt></range>
</package>
<package>
<name>libXi</name>
<range><lt>1.7_1</lt></range>
</package>
<package>
<name>libXinerama</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libXp</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>libXrandr</name>
<range><lt>1.4.1</lt></range>
</package>
<package>
<name>libXrender</name>
<range><lt>0.9.7_1</lt></range>
</package>
<package>
<name>libXres</name>
<range><lt>1.0.7</lt></range>
</package>
<package>
<name>libXtst</name>
<range><lt>1.2.2</lt></range>
</package>
<package>
<name>libXv</name>
<range><lt>1.0.8</lt></range>
</package>
<package>
<name>libXvMC</name>
<range><lt>1.0.7_1</lt></range>
</package>
<package>
<name>libXxf86dga</name>
<range><lt>1.1.4</lt></range>
</package>
<package>
<name>libdmx</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libxcb</name>
<range><lt>1.9.1</lt></range>
</package>
<package>
<name>libGL</name>
<range><lt>7.6.1_4</lt></range>
<range><gt>7.8.0</gt><lt>8.0.5_4</lt></range>
</package>
<package>
<name>xf86-video-openchrome</name>
<range><lt>0.3.3</lt></range>
</package>
<package>
<name>libFS</name>
<range><lt>1.0.5</lt></range>
</package>
<package>
<name>libXxf86vm</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libXt</name>
<range><lt>1.1.4</lt></range>
</package>
<package>
<name>libXcursor</name>
<range><lt>1.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freedesktop.org reports:</p>
<blockquote cite="http://www.x.org/wiki/Development/Security/Advisory-2013-05-23">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way various X client
libraries handle the responses they receive from servers, and has
worked with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>Most of these issues stem from the client libraries trusting the
server to send correct protocol data, and not verifying that the
values will not overflow or cause other damage. Most of the time X
clients & servers are run by the same user, with the server
more privileged from the clients, so this is not a problem, but
there are scenarios in which a privileged client can be connected
to an unprivileged server, for instance, connecting a setuid X
client (such as a screen lock program) to a virtual X server (such
as Xvfb or Xephyr) which the user has modified to return invalid
data, potentially allowing the user to escalate their privileges.</p>
<p>The vulnerabilities include:</p>
<p>Integer overflows calculating memory needs for replies.</p>
<p>Sign extension issues calculating memory needs for replies.</p>
<p>Buffer overflows due to not validating length or offset values in
replies.</p>
<p>Integer overflows parsing user-specified files.</p>
<p>Unbounded recursion parsing user-specified files.</p>
<p>Memory corruption due to unchecked return values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1981</cvename>
<cvename>CVE-2013-1982</cvename>
<cvename>CVE-2013-1983</cvename>
<cvename>CVE-2013-1984</cvename>
<cvename>CVE-2013-1985</cvename>
<cvename>CVE-2013-1986</cvename>
<cvename>CVE-2013-1987</cvename>
<cvename>CVE-2013-1988</cvename>
<cvename>CVE-2013-1989</cvename>
<cvename>CVE-2013-1990</cvename>
<cvename>CVE-2013-1991</cvename>
<cvename>CVE-2013-1992</cvename>
<cvename>CVE-2013-1993</cvename>
<cvename>CVE-2013-1994</cvename>
<cvename>CVE-2013-1995</cvename>
<cvename>CVE-2013-1996</cvename>
<cvename>CVE-2013-1997</cvename>
<cvename>CVE-2013-1998</cvename>
<cvename>CVE-2013-1999</cvename>
<cvename>CVE-2013-2000</cvename>
<cvename>CVE-2013-2001</cvename>
<cvename>CVE-2013-2002</cvename>
<cvename>CVE-2013-2003</cvename>
<cvename>CVE-2013-2004</cvename>
<cvename>CVE-2013-2005</cvename>
<cvename>CVE-2013-2062</cvename>
<cvename>CVE-2013-2063</cvename>
<cvename>CVE-2013-2064</cvename>
<cvename>CVE-2013-2066</cvename>
</references>
<dates>
<discovery>2013-05-23</discovery>
<entry>2013-06-04</entry>
</dates>
</vuln>
<vuln vid="e3f64457-cccd-11e2-af76-206a8a720317">
<topic>krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.11.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
<p>schpw.c in the kpasswd service in kadmind in MIT Kerberos 5
(aka krb5) before 1.11.3 does not properly validate UDP packets
before sending responses, which allows remote attackers to cause
a denial of service (CPU and bandwidth consumption) via a forged
packet that triggers a communication loop, as demonstrated by
krb_pingpong.nasl, a related issue to CVE-1999-0103.
[CVE-2002-2443].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2002-2443</cvename>
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
</references>
<dates>
<discovery>2013-05-10</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="0bf376b7-cc6b-11e2-a424-14dae938ec40">
<topic>net/openafs -- buffer overflow</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.2.*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nickolai Zeldovich reports:</p>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt">
<p>An attacker with the ability to manipulate AFS directory ACLs may
crash the fileserver hosting that volume.
In addition, once a corrupt ACL is placed on a fileserver, its
existence may crash client utilities manipulating ACLs
on that server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt</url>
<cvename>CVE-2013-1794</cvename>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="9dfb63b8-8f36-11e2-b34d-000c2957946c">
<topic>www/mod_security -- NULL pointer dereference DoS</topic>
<affects>
<package>
<name>mod_security</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/526746">
<p>When ModSecurity receives a request body with a size bigger than the
value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type"
that has no request body processor mapped to it, ModSecurity will
systematically crash on every call to "forceRequestBodyVariable".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2765</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="1225549f-ca91-11e2-b3b8-f0def16c5c1b">
<topic>passenger -- security vulnerability</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Phusion reports:</p>
<blockquote cite="http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/">
<p>A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2119</cvename>
<url>http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/</url>
</references>
<dates>
<discovery>2013-05-29</discovery>
<entry>2013-06-01</entry>
</dates>
</vuln>
<vuln vid="ce502902-ca39-11e2-9673-001e8c75030d">
<topic>devel/subversion -- svnserve remotely triggerable DoS</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.0.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2112-advisory.txt">
<p>Subversion's svnserve server process may exit when an incoming TCP connection
is closed early in the connection process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2112</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="6d0bf320-ca39-11e2-9673-001e8c75030d">
<topic>devel/subversion -- contrib hook-scripts can allow arbitrary code execution</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.2.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2088-advisory.txt">
<p>The script contrib/hook-scripts/check-mime-type.pl does not escape
argv arguments to 'svnlook' that start with a hyphen. This could be
used to cause 'svnlook', and hence check-mime-type.pl, to error out.</p>
<p>The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
from the output of 'svnlook changed' and passes them to a further
shell command (equivalent to the 'system()' call of the C standard
library) without escaping them. This could be used to run arbitrary
shell commands in the context of the user whom the pre-commit script
runs as (the user who owns the repository).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2088</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="787d21b9-ca38-11e2-9673-001e8c75030d">
<topic>devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.1.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1968-advisory.txt">
<p>If a filename which contains a newline character (ASCII 0x0a) is
committed to a repository using the FSFS format, the resulting
revision is corrupt.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1968</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="0a799a8e-c9d4-11e2-a424-14dae938ec40">
<topic>irc/bitchx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>BitchX</name>
<range><lt>1.2.*,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bannedit reports:</p>
<blockquote cite="http://www.cvedetails.com/cve/CVE-2007-4584/">
<p>Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC
servers to execute arbitrary code via a long string in a MODE
command, related to the p_mode variable.</p>
</blockquote>
<p>Nico Golde reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449149">
<p>There is a security issue in ircii-pana in bitchx' hostname
command. The e_hostname function (commands.c) uses tmpnam to
create a temporary file which is known to be insecure.</p>
</blockquote>
<p>Chris reports:</p>
<blockquote cite="http://secunia.com/advisories/27556">
<p>Chris has reported a vulnerability in the Cypress script for
BitchX, which can be exploited by malicious people to disclose
potentially sensitive information or to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to malicious code being present
in the modules/mdop.m file. This can be exploited to disclose the
content of various system files or to execute arbitrary shell
commands.</p>
<p>Successful exploitation allows execution of arbitrary code, but
requires the control of the "lsyn.webhop.net" domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4584</cvename>
<cvename>CVE-2007-5839</cvename>
<cvename>CVE-2007-5922</cvename>
</references>
<dates>
<discovery>2007-08-28</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="19751e06-c798-11e2-a373-000c29833058">
<topic>znc -- null pointer dereference in webadmin module</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28">
<p>Fix NULL pointer dereference in webadmin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-05-28</entry>
</dates>
</vuln>
<vuln vid="6d87c2e9-c64d-11e2-9c22-50465d9ff992">
<topic>socat -- FD leak</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gerhard Rieger reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q2/411">
<p>Under certain circumstances an FD leak occurs and can be misused for
denial of service attacks against socat running in server mode.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3571</cvename>
<url>http://seclists.org/oss-sec/2013/q2/411</url>
</references>
<dates>
<discovery>2013-05-26</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="79789daa-8af8-4e21-a47f-e8a645752bdb">
<topic>ruby -- Object taint bypassing in DL and Fiddle in Ruby</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.429,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/">
<p>There is a vulnerability in DL and Fiddle in Ruby where tainted
strings can be used by system calls regardless of the $SAFE level
set in Ruby.
</p>
<p>Native functions exposed to Ruby with DL or Fiddle do not check the
taint values set on the objects passed in. This can result in
tainted objects being accepted as input when a SecurityError
exception should be raised.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2065</cvename>
<url>http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/</url>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="4fb45a1c-c5d0-11e2-8400-001b216147b0">
<topic>couchdb -- DOM based Cross-Site Scripting via Futon UI</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>1.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lehnardt reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E">
<p>Query parameters passed into the browser-based test suite
are not sanitised, and can be used to load external resources.
An attacker may execute JavaScript code in the browser, using
the context of the remote user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5650</cvename>
<url>http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E</url>
</references>
<dates>
<discovery>2012-01-14</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="a5b24a6b-c37c-11e2-addb-60a44c524f57">
<topic>otrs -- information disclosure</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/">
<p>An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3551</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/</url>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="661bd031-c37d-11e2-addb-60a44c524f57">
<topic>otrs -- XSS vulnerability</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/">
<p>An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2637</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="3a429192-c36a-11e2-97a9-6805ca0b3d42">
<topic>RT -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rt38</name>
<range><ge>3.8</ge><lt>3.8.17</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Sibley reports:</p>
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html">
<p>We discovered a number of security vulnerabilities which
affect both RT 3.8.x and RT 4.0.x. We are releasing RT
versions 3.8.17 and 4.0.13 to resolve these vulnerabilities,
as well as patches which apply atop all released versions of
3.8 and 4.0.</p>
<p>The vulnerabilities addressed by 3.8.17, 4.0.13, and the
below patches include the following:</p>
<p>RT 4.0.0 and above are vulnerable to a limited privilege
escalation leading to unauthorized modification of ticket
data. The DeleteTicket right and any custom lifecycle
transition rights may be bypassed by any user with
ModifyTicket. This vulnerability is assigned
CVE-2012-4733.</p>
<p>RT 3.8.0 and above include a version of bin/rt that uses
semi-predictable names when creating tempfiles. This could
possibly be exploited by a malicious user to overwrite files
with permissions of the user running bin/rt. This
vulnerability is assigned CVE-2013-3368.</p>
<p>RT 3.8.0 and above allow calling of arbitrary Mason
components (without control of arguments) for users who can
see administration pages. This could be used by a malicious
user to run private components which may have negative
side-effects. This vulnerability is assigned
CVE-2013-3369.</p>
<p>RT 3.8.0 and above allow direct requests to private
callback components. Though no callback components ship
with RT, this could be used to exploit an extension or local
callback which uses the arguments passed to it insecurely.
This vulnerability is assigned CVE-2013-3370.</p>
<p>RT 3.8.3 and above are vulnerable to cross-site scripting
(XSS) via attachment filenames. The vector is difficult to
exploit due to parsing requirements. Additionally, RT 4.0.0
and above are vulnerable to XSS via maliciously-crafted
"URLs" in ticket content when RT's "MakeClicky" feature is
configured. Although not believed to be exploitable in the
stock configuration, a patch is also included for RTIR 2.6.x
to add bulletproofing. These vulnerabilities are assigned
CVE-2013-3371.</p>
<p>RT 3.8.0 and above are vulnerable to an HTTP header
injection limited to the value of the Content-Disposition
header. Injection of other arbitrary response headers is
not possible. Some (especially older) browsers may allow
multiple Content-Disposition values which could lead to XSS.
Newer browsers contain security measures to prevent this.
Thank you to Dominic Hargreaves for reporting this
vulnerability. This vulnerability is assigned
CVE-2013-3372.</p>
<p>RT 3.8.0 and above are vulnerable to a MIME header
injection in outgoing email generated by RT. The vectors
via RT's stock templates are resolved by this patchset, but
any custom email templates should be updated to ensure that
values interpolated into mail headers do not contain
newlines. This vulnerability is assigned CVE-2013-3373.</p>
<p>RT 3.8.0 and above are vulnerable to limited session
re-use when using the file-based session store,
Apache::Session::File. RT's default session configuration
only uses Apache::Session::File for Oracle. RT instances
using Oracle may be locally configured to use the
database-backed Apache::Session::Oracle, in which case
sessions are never re-used. The extent of session re-use is
limited to information leaks of certain user preferences and
caches, such as queue names available for ticket creation.
Thank you to Jenny Martin for reporting the problem that
lead to discovery of this vulnerability. This vulnerability
is assigned CVE-2013-3374.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html</url>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html</url>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html</url>
<cvename>CVE-2012-4733</cvename>
<cvename>CVE-2013-3368</cvename>
<cvename>CVE-2013-3369</cvename>
<cvename>CVE-2013-3370</cvename>
<cvename>CVE-2013-3371</cvename>
<cvename>CVE-2013-3372</cvename>
<cvename>CVE-2013-3373</cvename>
<cvename>CVE-2013-3374</cvename>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="c72a2494-c08b-11e2-bb21-083e8ed0f47b">
<topic>plib -- stack-based buffer overflow</topic>
<affects>
<package>
<name>plib</name>
<range><lt>1.8.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4552">
<p>Stack-based buffer overflow in the error function in
ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to
execute arbitrary code via a crafted 3d model file that
triggers a long error message, as demonstrated by a .ase
file.</p>
</blockquote>
</body>
</description>
<references>
<bid>55839</bid>
<cvename>CVE-2012-4552</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/29/8</mlist>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2013-05-19</entry>
</dates>
</vuln>
<vuln vid="13bf0602-c08a-11e2-bb21-083e8ed0f47b">
<topic>plib -- buffer overflow</topic>
<affects>
<package>
<name>plib</name>
<range><lt>1.8.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="https://secunia.com/advisories/47297">
<p>A vulnerability has been discovered in PLIB, which can be
exploited by malicious people to compromise an application
using the library. The vulnerability is caused due to a
boundary error within the "ulSetError()" function
(src/util/ulError.cxx) when creating the error message,
which can be exploited to overflow a static buffer.</p>
<p>Successful exploitation allows the execution of arbitrary
code but requires that the attacker can e.g. control the
content of an overly long error message passed to the
"ulSetError()" function.</p>
<p>The vulnerability is confirmed in version 1.8.5. Other
versions may also be affected.</p>
<p>Originally reported in TORCS by Andres Gomez.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4620</cvename>
<mlist>http://openwall.com/lists/oss-security/2011/12/21/2</mlist>
</references>
<dates>
<discovery>2011-12-21</discovery>
<entry>2013-05-19</entry>
</dates>
</vuln>
<vuln vid="a0c65049-bddd-11e2-a0f6-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.285</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-14.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2728</cvename>
<cvename>CVE-2013-3324</cvename>
<cvename>CVE-2013-3325</cvename>
<cvename>CVE-2013-3326</cvename>
<cvename>CVE-2013-3327</cvename>
<cvename>CVE-2013-3328</cvename>
<cvename>CVE-2013-3329</cvename>
<cvename>CVE-2013-3330</cvename>
<cvename>CVE-2013-3331</cvename>
<cvename>CVE-2013-3332</cvename>
<cvename>CVE-2013-3333</cvename>
<cvename>CVE-2013-3334</cvename>
<cvename>CVE-2013-3335</cvename>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-16</entry>
</dates>
</vuln>
<vuln vid="4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>21.0,1</lt></range>
<range><lt>17.0.6,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.6,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.17.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.17.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0
/ rv:17.0.6)</p>
<p>MFSA 2013-42 Privileged access for content level constructor</p>
<p>MFSA 2013-43 File input control has access to full path</p>
<p>MFSA 2013-44 Local privilege escalation through Mozilla
Maintenance Service</p>
<p>MFSA 2013-45 Mozilla Updater fails to update some Windows Registry
entries</p>
<p>MFSA 2013-46 Use-after-free with video and onresize event</p>
<p>MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent</p>
<p>MFSA 2013-48 Memory corruption found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1942</cvename>
<cvename>CVE-2013-0801</cvename>
<cvename>CVE-2013-1669</cvename>
<cvename>CVE-2013-1670</cvename>
<cvename>CVE-2013-1671</cvename>
<cvename>CVE-2013-1672</cvename>
<cvename>CVE-2013-1674</cvename>
<cvename>CVE-2013-1675</cvename>
<cvename>CVE-2013-1676</cvename>
<cvename>CVE-2013-1677</cvename>
<cvename>CVE-2013-1678</cvename>
<cvename>CVE-2013-1679</cvename>
<cvename>CVE-2013-1680</cvename>
<cvename>CVE-2013-1681</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-41.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-42.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-43.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-44.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-45.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-46.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-47.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-48.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-15</entry>
<modified>2013-05-21</modified>
</dates>
</vuln>
<vuln vid="efaa4071-b700-11e2-b1b9-f0def16c5c1b">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.2.0,1</ge><le>1.2.8,1</le></range>
<range><ge>1.3.0,1</ge><lt>1.4.1,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.1.4</ge><le>1.2.8</le></range>
<range><ge>1.3.0</ge><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>A stack-based buffer overflow might occur in a worker process
process while handling a specially crafted request, potentially
resulting in arbitrary code execution. [CVE-2013-2028]</p>
<p>A security problem related to CVE-2013-2028 was identified,
affecting some previous nginx versions if proxy_pass to
untrusted upstream HTTP servers is used.</p>
<p>The problem may lead to a denial of service or a disclosure of a
worker process memory on a specially crafted response from an
upstream proxied server. [CVE-2013-2070]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2028</cvename>
<cvename>CVE-2013-2070</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html</url>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html</url>
</references>
<dates>
<discovery>2013-05-07</discovery>
<entry>2013-05-07</entry>
<modified>2013-05-16</modified>
</dates>
</vuln>
<vuln vid="6ff570cb-b418-11e2-b279-20cf30e32f6d">
<topic>strongSwan -- ECDSA signature verification issue</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html">
<p>If the openssl plugin is used for ECDSA signature verification an empty,
zeroed or otherwise invalid signature is handled as a legitimate one.
Both IKEv1 and IKEv2 are affected.</p>
<p>Affected are only installations that have enabled and loaded the OpenSSL
crypto backend (--enable-openssl). Builds using the default crypto backends
are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2944</cvename>
</references>
<dates>
<discovery>2013-04-30</discovery>
<entry>2013-05-03</entry>
</dates>
</vuln>
<vuln vid="622e14b1-b40c-11e2-8441-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.514</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>
<p>SECURITY-63 / CVE-2013-2034</p>
<p>This creates a cross-site request forgery (CSRF) vulnerability
on Jenkins master, where an anonymous attacker can trick an
administrator to execute arbitrary code on Jenkins master by
having him open a specifically crafted attack URL.</p>
<p>There's also a related vulnerability where the permission
check on this ability is done imprecisely, which may affect
those who are running Jenkins instances with a custom
authorization strategy plugin.</p>
</li>
<li>
<p>SECURITY-67 / CVE-2013-2033</p>
<p>This creates a cross-site scripting (XSS) vulnerability, where
an attacker with a valid user account on Jenkins can execute
JavaScript in the browser of other users, if those users are
using certain browsers.</p>
</li>
<li>
<p>SECURITY-69 / CVE-2013-2034</p>
<p>This is another CSRF vulnerability that allows an attacker to
cause a deployment of binaries to Maven repositories. This
vulnerability has the same CVE ID as SEUCRITY-63.</p>
</li>
<li>
<p>SECURITY-71 / CVE-2013-1808</p>
<p>This creates a cross-site scripting (XSS) vulnerability.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02</url>
<cvename>CVE-2013-2034</cvename>
<cvename>CVE-2013-2033</cvename>
<cvename>CVE-2013-2034</cvename>
<cvename>CVE-2013-1808</cvename>
</references>
<dates>
<discovery>2013-05-02</discovery>
<entry>2013-05-03</entry>
</dates>
</vuln>
<vuln vid="e66a6e2f-b0d5-11e2-9164-0016e6dcb562">
<topic>FreeBSD -- NFS remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_8</lt></range>
<range><ge>9.1</ge><lt>9.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc">
<p>Insufficient input validation in the NFS server allows an
attacker to cause the underlying file system to treat a
regular file as a directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3266</cvename>
<freebsdsa>SA-13:05.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2013-04-21</discovery>
<entry>2013-04-29</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="57df803e-af34-11e2-8d62-6cf0490a8c18">
<topic>Joomla! -- XXS and DDoS vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><ge>2.0.*</ge><lt>2.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html">
<h2>[20130405] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in Voting plugin.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html">
<h2>[20130403] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering allows possibility of XSS exploit in some
circumstances.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/82-20130402-core-information-disclosure.html">
<h2>[20130402] - Core - Information Disclosure</h2>
<p>Inadequate permission checking allows unauthorised user to see
permission settings in some circumstances.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html">
<h2>[20130404] - Core - XSS Vulnerability</h2>
<p>Use of old version of Flash-based file uploader leads to XSS
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html">
<h2>[20130401] - Core - Privilege Escalation</h2>
<p>Inadequate permission checking allows unauthorised user to delete
private messages.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html">
<h2>[20130406] - Core - DOS Vulnerability</h2>
<p>Object unserialize method leads to possible denial of service
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html">
<h2>[20130407] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in highlighter
plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3059</cvename>
<cvename>CVE-2013-3058</cvename>
<cvename>CVE-2013-3057</cvename>
<url>http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html</url>
<cvename>CVE-2013-3056</cvename>
<cvename>CVE-2013-3242</cvename>
<cvename>CVE-2013-3267</cvename>
</references>
<dates>
<discovery>2013-04-24</discovery>
<entry>2013-04-27</entry>
</dates>
</vuln>
<vuln vid="8c8fa44d-ad15-11e2-8cea-6805ca0b3d42">
<topic>phpMyAdmin -- Multiple security vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php">
<p>In some PHP versions, the preg_replace() function can be
tricked into executing arbitrary PHP code on the
server. This is done by passing a crafted argument as the
regular expression, containing a null byte. phpMyAdmin does
not correctly sanitize an argument passed to preg_replace()
when using the "Replace table prefix" feature, opening the
way to this vulnerability..</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users to access the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php">
<p>phpMyAdmin can be configured to save an export file on
the web server, via its SaveDir directive. With this in
place, it's possible, either via a crafted filename template
or a crafted table name, to save a double extension file
like foobar.php.sql. In turn, an Apache webserver on which
there is no definition for the MIME type "sql" (the default)
will treat this saved file as a ".php" script, leading to
remote code execution.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users to access the required
form. Moreover, the SaveDir directive is empty by default,
so a default configuration is not vulnerable. The
$cfg['SaveDir'] directive must be configured, and the server
must be running Apache with mod_mime to be exploitable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3238</cvename>
<cvename>CVE-2013-3239</cvename>
</references>
<dates>
<discovery>2013-04-24</discovery>
<entry>2013-04-24</entry>
</dates>
</vuln>
<vuln vid="aeb962f6-ab8d-11e2-b3f5-003067c2616f">
<topic>tinc -- Buffer overflow</topic>
<affects>
<package>
<name>tinc</name>
<range><lt>1.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tinc-vpn.org reports:</p>
<blockquote cite="http://www.tinc-vpn.org/news/">
<p>Drop packets forwarded via TCP if they are too big.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1428</cvename>
</references>
<dates>
<discovery>2013-01-26</discovery>
<entry>2013-04-22</entry>
</dates>
</vuln>
<vuln vid="7280c3f6-a99a-11e2-8cef-6805ca0b3d42">
<topic>phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php">
<p> When modifying a URL parameter with a crafted value it
is possible to trigger an XSS.</p>
<p>These XSS can only be triggered when a valid database is
known and when a valid cookie token is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1937</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php</url>
</references>
<dates>
<discovery>2013-04-18</discovery>
<entry>2013-04-20</entry>
</dates>
</vuln>
<vuln vid="a592e991-a919-11e2-ade0-8c705af55518">
<topic>roundcube -- arbitrary file disclosure vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.8.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube development team reports:</p>
<blockquote cite="http://lists.roundcube.net/pipermail/dev/2013-March/022337.html">
<p>After getting reports about a possible vulnerability
of Roundcube which allows an attacker to modify its
users preferences in a way that he/she can then read
files from the server, we now published updated packages
as well as patches that fix this security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1904</cvename>
<url>https://secunia.com/advisories/52806/</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-04-19</entry>
</dates>
</vuln>
<vuln vid="8ff84335-a7da-11e2-b3f5-003067c2616f">
<topic>jasper -- buffer overflow</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fedora reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/887409">
<p>JasPer fails to properly decode marker segments and other
sections in malformed JPEG2000 files. Malformed inputs can
cause heap buffer overflows which in turn may result in
execution of attacker-controlled code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3520</cvename>
<cvename>CVE-2008-3522</cvename>
<cvename>CVE-2011-4516</cvename>
<cvename>CVE-2011-4517</cvename>
<url>http://www.kb.cert.org/vuls/id/887409</url>
</references>
<dates>
<discovery>2011-12-09</discovery>
<entry>2013-04-18</entry>
</dates>
</vuln>
<vuln vid="2070c79a-8e1e-11e2-b34d-000c2957946c">
<topic>ModSecurity -- XML External Entity Processing Vulnerability</topic>
<affects>
<package>
<name>mod_security</name>
<range><gt>2.*</gt><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Positive Technologies has reported a vulnerability in ModSecurity,
which can be exploited by malicious people to disclose potentially
sensitive information or cause a DoS (Denial Of Serice).</p>
<p>The vulnerability is caused due to an error when parsing external
XML entities and can be exploited to e.g. disclose local files or
cause excessive memory and CPU consumption.</p>
<blockquote cite="https://secunia.com/advisories/52847/">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1915</cvename>
<url>https://secunia.com/advisories/52847/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915</url>
<url>https://bugs.gentoo.org/show_bug.cgi?id=464188</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-16</entry>
</dates>
</vuln>
<vuln vid="a2ff483f-a5c6-11e2-9601-000d601460a4">
<topic>sieve-connect -- TLS hostname verification was not occurring</topic>
<affects>
<package>
<name>sieve-connect</name>
<range><lt>0.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sieve-connect developer Phil Pennock reports:</p>
<blockquote cite="http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html">
<p>sieve-connect was not actually verifying TLS certificate identities
matched the expected hostname.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html</url>
</references>
<dates>
<discovery>2013-04-14</discovery>
<entry>2013-04-15</entry>
</dates>
</vuln>
<vuln vid="15236023-a21b-11e2-a460-208984377b34">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.280</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-12.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1383</cvename>
<cvename>CVE-2013-1384</cvename>
<cvename>CVE-2013-1385</cvename>
<cvename>CVE-2013-1386</cvename>
</references>
<dates>
<discovery>2013-04-09</discovery>
<entry>2013-04-10</entry>
</dates>
</vuln>
<vuln vid="db0c4b00-a24c-11e2-9601-000d601460a4">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/">
<p>Rails versions 3.2.13 has been released. This release
contains important security fixes. It is recommended
users upgrade as soon as possible.</p>
<p>Four vulnerabilities have been discovered and fixed:</p>
<ol>
<li>(CVE-2013-1854) Symbol DoS vulnerability in Active Record</li>
<li>(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack</li>
<li>(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users</li>
<li>(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1854</cvename>
<cvename>CVE-2013-1856</cvename>
<cvename>CVE-2013-1856</cvename>
<cvename>CVE-2013-1857</cvename>
<url>http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/</url>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI</url>
</references>
<dates>
<discovery>2013-03-18</discovery>
<entry>2013-04-10</entry>
</dates>
</vuln>
<vuln vid="1431f2d6-a06e-11e2-b9e0-001636d274f3">
<topic>NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><ge>310.14</ge><lt>310.44</lt></range>
<range><ge>195.22</ge><lt>304.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3290">
<p>When the NVIDIA driver for the X Window System is operated in
"NoScanout" mode, and an X client installs an ARGB cursor that
is larger than the expected size (64x64 or 256x256, depending on
the driver version), the driver will overflow a buffer. This
can cause a denial of service (e.g., an X server segmentation
fault), or could be exploited to achieve arbitrary code
execution. Because the X server runs as setuid root in many
configurations, an attacker could potentially use this
vulnerability in those configurations to gain root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0131</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/3290</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-04-08</entry>
</dates>
</vuln>
<vuln vid="cebed39d-9e6f-11e2-b3f5-003067c2616f">
<topic>opera -- moderately severe issue</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
<p>Fixed a moderately severe issue, as reported by Attila Suszte.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/docs/changelogs/unified/1215/</url>
<url>http://www.opera.com/support/kb/view/1046/</url>
<url>http://www.opera.com/support/kb/view/1047/</url>
</references>
<dates>
<discovery>2013-04-04</discovery>
<entry>2014-04-30</entry>
</dates>
</vuln>
<vuln vid="b6beb137-9dc0-11e2-882f-20cf30e32f6d">
<topic>Subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
<range><ge>1.0.0</ge><lt>1.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1845-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will use excessive
amounts of memory when a large number of properties are set or deleted
on a node.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1846-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when
a LOCK request is made against activity URLs.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1847-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash in some
circumstances when a LOCK request is made against a non-existent URL.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1849-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
PROPFIND request is made against activity URLs.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1884-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
log REPORT request receives a limit that is out of the allowed range.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1845</cvename>
<cvename>CVE-2013-1846</cvename>
<cvename>CVE-2013-1847</cvename>
<cvename>CVE-2013-1849</cvename>
<cvename>CVE-2013-1884</cvename>
</references>
<dates>
<discovery>2013-04-05</discovery>
<entry>2013-04-05</entry>
</dates>
</vuln>
<vuln vid="eae8e3cf-9dfe-11e2-ac7f-001fd056c417">
<topic>otrs -- Information disclosure and Data manipulation</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/">
<p>An attacker with a valid agent login could manipulate URLs in the
object linking mechanism to see titles of tickets and other objects
that are not obliged to be seen. Furthermore, links to objects without
permission can be placed and removed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2625</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-05</entry>
</dates>
</vuln>
<vuln vid="3f332f16-9b6b-11e2-8fe9-08002798f6ff">
<topic>PostgreSQL -- anonymous remote access data corruption vulnerability</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><ge>8.3.0</ge><lt>8.3.21_1</lt></range>
<range><ge>8.4.0</ge><lt>8.4.17</lt></range>
<range><ge>9.0.0</ge><lt>9.0.13</lt></range>
<range><ge>9.1.0</ge><lt>9.1.9</lt></range>
<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1456/">
<p>
The PostgreSQL Global Development Group has released a security
update to all current versions of the PostgreSQL database system,
including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
fixes a high-exposure security vulnerability in versions 9.0 and
later. All users of the affected versions are strongly urged to apply
the update *immediately*.
</p>
<p>
A major security issue (for versions 9.x only) fixed in this release,
[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
makes it possible for a connection request containing a database name
that begins with "-" to be crafted that can damage or destroy files
within a server's data directory. Anyone with access to the port the
PostgreSQL server listens on can initiate this request. This issue was
discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
Software Center.
</p>
<p>
Two lesser security fixes are also included in this release:
[CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
wherein random numbers generated by contrib/pgcrypto functions may be
easy for another database user to guess (all versions), and
[CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
which mistakenly allows an unprivileged user to run commands that
could interfere with in-progress backups (for versions 9.x only).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1899</cvename>
<cvename>CVE-2013-1900</cvename>
<cvename>CVE-2013-1901</cvename>
</references>
<dates>
<discovery>2013-04-04</discovery>
<entry>2013-04-04</entry>
</dates>
</vuln>
<vuln vid="94976433-9c74-11e2-a9fc-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>20.0,1</lt></range>
<range><lt>17.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.5,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.17</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.17</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 /
rv:17.0.5)</p>
<p>MFSA 2013-31 Out-of-bounds write in Cairo library</p>
<p>MFSA 2013-32 Privilege escalation through Mozilla Maintenance
Service</p>
<p>MFSA 2013-33 World read and write access to app_tmp directory on
Android</p>
<p>MFSA 2013-34 Privilege escalation through Mozilla Updater</p>
<p>MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux</p>
<p>MFSA 2013-36 Bypass of SOW protections allows cloning of protected
nodes</p>
<p>MFSA 2013-37 Bypass of tab-modal dialog origin disclosure</p>
<p>MFSA 2013-38 Cross-site scripting (XSS) using timed history
navigations</p>
<p>MFSA 2013-39 Memory corruption while rendering grayscale PNG
images</p>
<p>MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0788</cvename>
<cvename>CVE-2013-0789</cvename>
<cvename>CVE-2013-0790</cvename>
<cvename>CVE-2013-0791</cvename>
<cvename>CVE-2013-0792</cvename>
<cvename>CVE-2013-0793</cvename>
<cvename>CVE-2013-0794</cvename>
<cvename>CVE-2013-0795</cvename>
<cvename>CVE-2013-0796</cvename>
<cvename>CVE-2013-0797</cvename>
<cvename>CVE-2013-0798</cvename>
<cvename>CVE-2013-0799</cvename>
<cvename>CVE-2013-0800</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-30.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-31.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-32.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-33.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-34.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-35.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-36.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-37.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-38.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-39.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-03</entry>
<modified>2013-04-08</modified>
</dates>
</vuln>
<vuln vid="13031d98-9bd1-11e2-a7be-8c705af55518">
<topic>FreeBSD -- BIND remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.0</ge><lt>9.0_7</lt></range>
<range><ge>9.1</ge><lt>9.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc">
<p>A flaw in a library used by BIND allows an
attacker to deliberately cause excessive memory
consumption by the named(8) process. This
affects both recursive and authoritative
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2266</cvename>
<freebsdsa>SA-13:04.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-00871</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="69bfc852-9bd0-11e2-a7be-8c705af55518">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_7</lt></range>
<range><ge>9.0</ge><lt>9.0_7</lt></range>
<range><ge>9.1</ge><lt>9.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc">
<p>A flaw in the OpenSSL handling of OCSP response
verification could be exploited to cause a denial of
service attack.</p>
<p>OpenSSL has a weakness in the handling of CBC
ciphersuites in SSL, TLS and DTLS. The weakness could reveal
plaintext in a timing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0166</cvename>
<cvename>CVE-2013-0169</cvename>
<freebsdsa>SA-13:03.openssl</freebsdsa>
<url>http://www.openssl.org/news/secadv_20130205.txt</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="92f30415-9935-11e2-ad4c-080027ef73ec">
<topic>OpenVPN -- potential side-channel/timing attack when comparing HMACs</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.9_4</lt></range>
<range><ge>2.1.0</ge><lt>2.2.2_2</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenVPN project reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc">
<p>OpenVPN 2.3.0 and earlier running in UDP mode are subject
to chosen ciphertext injection due to a non-constant-time
HMAC comparison function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc</url>
<cvename>CVE-2013-2061</cvename>
<url>http://www.openwall.com/lists/oss-security/2013/05/06/6</url>
<url>https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee</url>
</references>
<dates>
<discovery>2013-03-19</discovery>
<entry>2013-03-31</entry>
<modified>2013-06-01</modified>
</dates>
</vuln>
<vuln vid="843a4641-9816-11e2-9c51-080027019be0">
<topic>libxml2 -- cpu consumption Dos</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Seifried reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
<p>libxml2 is affected by the expansion of internal entities
(which can be used to consume resources) and external entities
(which can cause a denial of service against other services,
be used to port scan, etc.)..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0338</cvename>
<cvename>CVE-2013-0339</cvename>
<url>http://seclists.org/oss-sec/2013/q1/391</url>
<url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
<url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-03-29</entry>
</dates>
</vuln>
<vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.2.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.12.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.20.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Buffer Overflow Exploit Through SIP SDP Header</p>
<p>Username disclosure in SIP channel driver</p>
<p>Denial of Service in HTTP server</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2685</cvename>
<cvename>CVE-2013-2686</cvename>
<cvename>CVE-2013-2264</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-001.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-003.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-03-29</entry>
</dates>
</vuln>
<vuln vid="7a282e49-95b6-11e2-8433-0800273fe665">
<topic>dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.2.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.2.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.4.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00871">
<p>A critical defect in BIND 9 allows an attacker to cause
excessive memory consumption in named or other programs
linked to libdns.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2266</cvename>
</references>
<dates>
<discovery>2013-03-11</discovery>
<entry>2013-03-27</entry>
</dates>
</vuln>
<vuln vid="6adca5e9-95d2-11e2-8549-68b599b52a02">
<topic>firebird -- Remote Stack Buffer Overflow</topic>
<affects>
<package>
<name>firebird25-server</name>
<range><ge>2.5.0</ge><le>2.5.2</le></range>
</package>
<package>
<name>firebird21-server</name>
<range><ge>2.1.0</ge><le>2.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firebird Project reports:</p>
<blockquote cite="http://tracker.firebirdsql.org/browse/CORE-4058">
<p>The FirebirdSQL server is vulnerable to a stack buffer overflow
that can be triggered when an unauthenticated user sends a
specially crafted packet. The result can lead to remote code
execution as the user which runs the FirebirdSQL server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2492</cvename>
<url>https://gist.github.com/zeroSteiner/85daef257831d904479c</url>
</references>
<dates>
<discovery>2013-01-31</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="a8818f7f-9182-11e2-9bdf-d48564727302">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><ge>0.7</ge><lt>0.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="https://secunia.com/advisories/50654">
<p>A vulnerability has been reported in OptiPNG, which can be
exploited by malicious people to potentially compromise a user's
system.</p>
<p>The vulnerability is caused due to a use-after-free error related
to the palette reduction functionality. No further information is
currently available.</p>
<p>Success exploitation may allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4432</cvename>
<url>https://secunia.com/advisories/50654</url>
</references>
<dates>
<discovery>2012-09-16</discovery>
<entry>2013-03-21</entry>
</dates>
</vuln>
<vuln vid="1d23109a-9005-11e2-9602-d43d7e0c7c02">
<topic>php5 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.13</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>PHP does not validate the relationship between the soap.wsdl_cache_dir
directive and the open_basedir directive, which allows remote attackers to
bypass intended access restrictions by triggering the creation of cached
SOAP WSDL files in an arbitrary directory.</p>
<p>The SOAP parser in PHP allows remote attackers to read arbitrary files
via a SOAP WSDL file containing an XML external entity declaration in
conjunction with an entity reference, related to an XML External Entity
(XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1635</cvename>
<cvename>CVE-2013-1643</cvename>
</references>
<dates>
<discovery>2013-03-04</discovery>
<entry>2013-03-18</entry>
</dates>
</vuln>
<vuln vid="edd201a5-8fc3-11e2-b131-000c299b62e1">
<topic>piwigo -- CSRF/Path Traversal</topic>
<affects>
<package>
<name>piwigo</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>High-Tech Bridge Security Research Lab reports:</p>
<blockquote cite="http://piwigo.org/releases/2.4.7">
<p>The CSRF vulnerability exists due to insufficient verification of the
HTTP request origin in "/admin.php" script. A remote attacker can trick
a logged-in administrator to visit a specially crafted webpage and
create arbitrary PHP file on the remote server.</p>
<p>The path traversal vulnerability exists due to insufficient filtration
of user-supplied input in "dl" HTTP GET parameter passed to
"/install.php" script. The script is present on the system after
installation by default, and can be accessed by attacker without any
restrictions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1468</cvename>
<cvename>CVE-2013-1469</cvename>
<url>http://piwigo.org/bugs/view.php?id=0002843</url>
<url>http://piwigo.org/bugs/view.php?id=0002844</url>
<url>http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt</url>
</references>
<dates>
<discovery>2013-02-06</discovery>
<entry>2013-03-18</entry>
</dates>
</vuln>
<vuln vid="d881d254-70c6-11e2-862d-080027a5ec9a">
<topic>libexif -- multiple remote vulnerabilities</topic>
<affects>
<package>
<name>libexif</name>
<range><lt>0.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libexif project security advisory:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29534027">
<p>A number of remotely exploitable issues were discovered in libexif
and exif, with effects ranging from information leakage to potential
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2812</cvename>
<cvename>CVE-2012-2813</cvename>
<cvename>CVE-2012-2814</cvename>
<cvename>CVE-2012-2836</cvename>
<cvename>CVE-2012-2837</cvename>
<cvename>CVE-2012-2840</cvename>
<cvename>CVE-2012-2841</cvename>
<cvename>CVE-2012-2845</cvename>
<bid>54437</bid>
</references>
<dates>
<discovery>2012-07-12</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="5ff40cb4-8b92-11e2-bdb6-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.275</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-09.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0646</cvename>
<cvename>CVE-2013-0650</cvename>
<cvename>CVE-2013-1371</cvename>
<cvename>CVE-2013-1375</cvename>
</references>
<dates>
<discovery>2013-03-12</discovery>
<entry>2013-03-12</entry>
</dates>
</vuln>
<vuln vid="cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c">
<topic>puppet27 and puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>3.0</ge><lt>3.1.1</lt></range>
</package>
<package>
<name>puppet27</name>
<range><ge>2.7</ge><lt>2.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moses Mendoza reports:</p>
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
<p>A vulnerability found in Puppet could allow an authenticated client
to cause the master to execute arbitrary code while responding to a
catalog request. Specifically, in order to exploit the
vulnerability, the puppet master must be made to invoke the
'template' or 'inline_template' functions during catalog compilation.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent
could retrieve catalogs from the master that it is not authorized
to access or it could poison the puppet master's caches for any
puppet-generated data that supports caching such as catalogs,
nodes, facts, and resources. The extent and severity of this
vulnerability varies depending on the specific configuration of the
master: for example, whether it is using storeconfigs or not, which
version, whether it has access to the cache or not, etc.
</p>
<p>A vulnerability has been found in Puppet which could allow
authenticated clients to execute arbitrary code on agents that have
been configured to accept kick connections. This vulnerability is
not present in the default configuration of puppet agents, but if
they have been configured to listen for incoming connections
('listen=true'), and the agent's auth.conf has been configured to
allow access to the `run` REST endpoint, then a client could
construct an HTTP request which could execute arbitrary code. The
severity of this issue is exacerbated by the fact that puppet
agents typically run as root.
</p>
<p>A vulnerability has been found in Puppet that could allow a client
negotiating a connection to a master to downgrade the master's
SSL protocol to SSLv2. This protocol has been found to contain
design weaknesses. This issue only affects systems running older
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
SSLv2.
</p>
<p>A vulnerability found in Puppet could allow unauthenticated clients
to send requests to the puppet master which would cause it to load
code unsafely. While there are no reported exploits, this
vulnerability could cause issues like those described in Rails
CVE-2013-0156. This vulnerability only affects puppet masters
running Ruby 1.9.3 and higher.
</p>
<p>This vulnerability affects puppet masters 0.25.0 and above. By
default, auth.conf allows any authenticated node to submit a report
for any other node. This can cause issues with compliance. The
defaults in auth.conf have been changed.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1640</cvename>
<cvename>CVE-2013-1652</cvename>
<cvename>CVE-2013-1653</cvename>
<cvename>CVE-2013-1654</cvename>
<cvename>CVE-2013-1655</cvename>
<cvename>CVE-2013-2275</cvename>
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1653/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1655/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw</url>
</references>
<dates>
<discovery>2013-03-13</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="04042f95-14b8-4382-a8b9-b30e365776cf">
<topic>puppet26 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet26</name>
<range><ge>2.6</ge><lt>2.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moses Mendoza reports:</p>
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
<p>A vulnerability found in Puppet could allow an authenticated client
to cause the master to execute arbitrary code while responding to a
catalog request. Specifically, in order to exploit the
vulnerability, the puppet master must be made to invoke the
'template' or 'inline_template' functions during catalog compilation.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent
could retrieve catalogs from the master that it is not authorized
to access or it could poison the puppet master's caches for any
puppet-generated data that supports caching such as catalogs,
nodes, facts, and resources. The extent and severity of this
vulnerability varies depending on the specific configuration of the
master: for example, whether it is using storeconfigs or not, which
version, whether it has access to the cache or not, etc.
</p>
<p>A vulnerability has been found in Puppet that could allow a client
negotiating a connection to a master to downgrade the master's
SSL protocol to SSLv2. This protocol has been found to contain
design weaknesses. This issue only affects systems running older
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
SSLv2.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to execute arbitrary code on a puppet master that is running in the
default configuration, or an agent with `puppet kick` enabled.
Specifically, a properly authenticated and connected puppet agent
could be made to construct an HTTP PUT request for an authorized
report that actually causes the execution of arbitrary code on the
master.
</p>
<p>This vulnerability affects puppet masters 0.25.0 and above. By
default, auth.conf allows any authenticated node to submit a report
for any other node. This can cause issues with compliance. The
defaults in auth.conf have been changed.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1640</cvename>
<cvename>CVE-2013-1652</cvename>
<cvename>CVE-2013-1654</cvename>
<cvename>CVE-2013-2274</cvename>
<cvename>CVE-2013-2275</cvename>
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2274/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
</references>
<dates>
<discovery>2013-03-13</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="68c1f75b-8824-11e2-9996-c48508086173">
<topic>perl -- denial of service via algorithmic complexity attack on hashing routines</topic>
<affects>
<package>
<name>perl</name>
<name>perl-threaded</name>
<range><lt>5.12.4_5</lt></range>
<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Perl developers report:</p>
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html">
<p>In order to prevent an algorithmic complexity attack
against its hashing mechanism, perl will sometimes
recalculate keys and redistribute the contents of a hash.
This mechanism has made perl robust against attacks that
have been demonstrated against other systems.</p>
<p>Research by Yves Orton has recently uncovered a flaw in
the rehashing code which can result in pathological
behavior. This flaw could be exploited to carry out a
denial of service attack against code that uses arbitrary
user input as hash keys.</p>
<p>Because using user-provided strings as hash keys is a
very common operation, we urge users of perl to update their
perl executable as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1667</cvename>
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html</url>
</references>
<dates>
<discovery>2013-03-04</discovery>
<entry>2013-03-10</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="549787c1-8916-11e2-8549-68b599b52a02">
<topic>libpurple -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pidgin reports:</p>
<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
<p>libpurple</p>
<p>Fix a crash when receiving UPnP responses with abnormally long values.</p>
<p>MXit</p>
<p>Fix two bugs where a remote MXit user could possibly specify a local file
path to be written to.</p>
<p>Fix a bug where the MXit server or a man-in-the-middle could potentially
send specially crafted data that could overflow a buffer and lead to a crash
or remote code execution.</p>
<p>Sametime</p>
<p>Fix a crash in Sametime when a malicious server sends us an abnormally long
user ID.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0274</cvename>
<cvename>CVE-2013-0271</cvename>
<cvename>CVE-2013-0272</cvename>
<cvename>CVE-2013-0273</cvename>
<url>https://developer.pidgin.im/wiki/ChangeLog</url>
</references>
<dates>
<discovery>2013-02-13</discovery>
<entry>2013-03-10</entry>
<modified>2013-03-16</modified>
</dates>
</vuln>
<vuln vid="630c8c08-880f-11e2-807f-d43d7e0c7c02">
<topic>mozilla -- use-after-free in HTML Editor</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>19.0.2,1</lt></range>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.16.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.16.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.4</lt></range>
<range><lt>10.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-29 Use-after-free in HTML Editor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0787</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-29.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2013-03-08</entry>
</dates>
</vuln>
<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
<p>Extbase Framework - Failing to sanitize user input, the Extbase
database abstraction layer is susceptible to SQL Injection. TYPO3
sites which have no Extbase extensions installed are not affected.
Extbase extensions are affected if they use the Query Object Model
and relation values are user generated input. Credits go to Helmut
Hummel and Markus Opahle who discovered and reported the issue.</p>
<p>Access tracking mechanism - Failing to validate user provided
input, the access tracking mechanism allows redirects to arbitrary
URLs. To fix this vulnerability, we had to break existing
behaviour of TYPO3 sites that use the access tracking mechanism
(jumpurl feature) to transform links to external sites. The link
generation has been changed to include a hash that is checked
before redirecting to an external URL. This means that old links
that have been distributed (e.g. by a newsletter) will not work
any more.</p>
</blockquote>
</body>
</description>
<references>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
</references>
<dates>
<discovery>2013-03-06</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="c97219b6-843d-11e2-b131-000c299b62e1">
<topic>stunnel -- Remote Code Execution</topic>
<affects>
<package>
<name>stunnel</name>
<range><ge>4.21</ge><lt>4.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Trojnara reports:</p>
<blockquote cite="https://www.stunnel.org/CVE-2013-1762.html">
<p>64-bit versions of stunnel with the following conditions:
* NTLM authentication enabled
* CONNECT protocol negotiation enabled
* Configured in SSL client mode
* An attacker that can either control the proxy server specified in
the "connect" option or execute MITM attacks on the TCP session
between stunnel and the proxy</p>
<p>Can be exploited for remote code execution. The code is executed
within the configured chroot directory, with privileges of the
configured user and group.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1762</cvename>
<url>https://www.stunnel.org/CVE-2013-1762.html</url>
</references>
<dates>
<discovery>2013-03-03</discovery>
<entry>2013-03-03</entry>
</dates>
</vuln>
<vuln vid="9c88d8a8-8372-11e2-a010-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<h1>low: XSS due to unescaped hostnames CVE-2012-3499</h1>
<p>Various XSS flaws due to unescaped hostnames and URIs HTML output in
mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.</p>
<h1>moderate: XSS in mod_proxy_balancer CVE-2012-4558</h1>
<p>A XSS flaw affected the mod_proxy_balancer manager interface.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3499</cvename>
<cvename>CVE-2012-4558</cvename>
</references>
<dates>
<discovery>2012-10-07</discovery>
<entry>2013-03-02</entry>
</dates>
</vuln>
<vuln vid="764344fb-8214-11e2-9273-902b343deec9">
<topic>sudo -- Authentication bypass when clock is reset</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.6.p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/epoch_ticket.html">
<p>The flaw may allow someone with physical access to a machine that
is not password-protected to run sudo commands without knowing the
logged in user's password. On systems where sudo is the principal
way of running commands as root, such as on Ubuntu and Mac OS X,
there is a greater chance that the logged in user has run sudo
before and thus that an attack would succeed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1775</cvename>
<url>http://www.sudo.ws/sudo/alerts/epoch_ticket.html</url>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-03-01</entry>
</dates>
</vuln>
<vuln vid="82cfd919-8213-11e2-9273-902b343deec9">
<topic>sudo -- Potential bypass of tty_tickets constraints</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.6.p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/tty_tickets.html">
<p>A (potentially malicious) program run by a user with sudo access
may be able to bypass the "tty_ticket" constraints. In order for
this to succeed there must exist on the machine a terminal device
that the user has previously authenticated themselves on via sudo
within the last time stamp timeout (5 minutes by default).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1776</cvename>
<url>http://www.sudo.ws/sudo/alerts/tty_tickets.html</url>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-03-01</entry>
</dates>
</vuln>
<vuln vid="aa7764af-0b5e-4ddc-bc65-38ad697a484f">
<topic>rubygem-dragonfly -- arbitrary code execution</topic>
<affects>
<package>
<name>rubygem18-dragonfly</name>
<name>rubygem19-dragonfly</name>
<name>rubygem20-dragonfly</name>
<range><lt>0.9.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Evans reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo">
<p>Unfortnately there is a security vulnerability in Dragonfly when
used with Rails which would potentially allow an attacker to run
arbitrary code on a host machine using carefully crafted
requests.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1756</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-28</entry>
</dates>
</vuln>
<vuln vid="dbdac023-80e1-11e2-9a29-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.273</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-08.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0504</cvename>
<cvename>CVE-2013-0643</cvename>
<cvename>CVE-2013-0648</cvename>
</references>
<dates>
<discovery>2013-02-26</discovery>
<entry>2013-02-27</entry>
</dates>
</vuln>
<vuln vid="84065569-7fb4-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your browser while displaying the
email. In this case this is achieved by using javascript source
attributes with whitespaces.</p>
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to
and including 3.1.10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4751</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03</url>
</references>
<dates>
<discovery>2012-10-16</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="d60199df-7fb3-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your browser while displaying the
email in Firefox and Opera. In this case this is achieved with an
invalid HTML structure with nested tags.</p>
<p>Affected by this
vulnerability are all releases of OTRS 2.4.x up to and including
2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including
3.1.9 in combination with Firefox and Opera.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4600</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="b50cbbc0-7fb2-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. Due to the XSS vulnerability in Internet Explorer an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your Internet Explorer while
displaying the email.</p>
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to
and including 3.1.8 in combination with Internet Explorer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2582</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01</url>
</references>
<dates>
<discovery>2012-08-22</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="844cf3f5-9259-4b3e-ac9e-13ca17333ed7">
<topic>ruby -- DoS vulnerability in REXML</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.392,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">
<p>Unrestricted entity expansion can lead to a DoS vulnerability in
REXML. (The CVE identifier will be assigned later.) We strongly
recommend to upgrade ruby.
</p>
<p>When reading text nodes from an XML document, the REXML parser can
be coerced in to allocating extremely large string objects which
can consume all of the memory on a machine, causing a denial of
service.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</url>
</references>
<dates>
<discovery>2013-02-22</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="e1aa3bdd-839a-4a77-8617-cca439a8f9fc">
<topic>rubygem-ruby_parser -- insecure tmp file usage</topic>
<affects>
<package>
<name>rubygem18-ruby_parser</name>
<name>rubygem19-ruby_parser</name>
<name>rubygem20-ruby_parser</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Scherer reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q1/393">
<p>This is a relatively minor tmp file usage issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0162</cvename>
</references>
<dates>
<discovery>2013-02-24</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="21c59f5e-7cc5-11e2-9c11-080027a5ec9a">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<name>py27-django</name>
<range><ge>1.3</ge><lt>1.3.6</lt></range>
<range><ge>1.4</ge><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/feb/19/security/">
<p>These security releases fix four issues: one potential phishing
vector, one denial-of-service vector, an information leakage issue,
and a range of XML vulnerabilities.</p>
<ol>
<li>
<p>Host header poisoning</p>
<p>an attacker could cause Django to generate and display URLs that
link to arbitrary domains. This could be used as part of a phishing
attack. These releases fix this problem by introducing a new
setting, ALLOWED_HOSTS, which specifies a whitelist of domains your
site is known to respond to.</p>
<p>Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
allow all hosts. This means that to actually fix the security
vulnerability you should define this setting yourself immediately
after upgrading.</p>
</li>
<li>
<p>Formset denial-of-service</p>
<p>an attacker can abuse Django's tracking of the number of forms in
a formset to cause a denial-of-service attack. This has been fixed
by adding a default maximum number of forms of 1,000. You can still
manually specify a bigger max_num, if you wish, but 1,000 should be
enough for anyone.</p>
</li>
<li>
<p>XML attacks</p>
<p>Django's serialization framework was vulnerable to attacks via XML
entity expansion and external references; this is now fixed.
However, if you're parsing arbitrary XML in other parts of your
application, we recommend you look into the defusedxml Python
packages which remedy this anywhere you parse XML, not just via
Django's serialization framework.</p>
</li>
<li>
<p>Data leakage via admin history log</p>
<p>Django's admin interface could expose supposedly-hidden
information via its history log. This has been fixed.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1664</cvename>
<cvename>CVE-2013-1665</cvename>
<cvename>CVE-2013-0305</cvename>
<cvename>CVE-2013-0306</cvename>
<bid>58022</bid>
<bid>58061</bid>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="f54584bc-7d2b-11e2-9bd1-206a8a720317">
<topic>krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.11</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
<p>Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1415</cvename>
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-02-22</entry>
</dates>
</vuln>
<vuln vid="3c90e093-7c6e-11e2-809b-6c626d99876c">
<topic>FreeBSD -- glob(3) related resource exhaustion</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_12</lt></range>
<range><ge>8.3</ge><lt>8.3_6</lt></range>
<range><ge>9.0</ge><lt>9.0_6</lt></range>
<range><ge>9.1</ge><lt>9.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc">
<p>GLOB_LIMIT is supposed to limit the number of paths to prevent against
memory or CPU attacks. The implementation however is insufficient.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-13:02.libc</freebsdsa>
<cvename>CVE-2010-2632</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="4671cdc9-7c6d-11e2-809b-6c626d99876c">
<topic>FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.0</ge><lt>9.0_6</lt></range>
<range><ge>9.1</ge><lt>9.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:01.bind.asc">
<p>Due to a software defect a crafted query can cause named(8) to crash
with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-13:01.bind</freebsdsa>
<cvename>CVE-2012-5688</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-21</entry>
</dates>
</vuln>
<vuln vid="a4d71e4c-7bf4-11e2-84cd-d43d7e0c7c02">
<topic>drupal7 -- Denial of service</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-002">
<p>Drupal core's Image module allows for the on-demand generation
of image derivatives. This capability can be abused by requesting
a large number of new derivatives which can fill up the server disk
space, and which can cause a very high CPU load. Either of these
effects may lead to the site becoming unavailable or unresponsive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0316</cvename>
<url>https://drupal.org/SA-CORE-2013-002</url>
</references>
<dates>
<discovery>2013-02-20</discovery>
<entry>2013-02-21</entry>
</dates>
</vuln>
<vuln vid="58c15292-7b61-11e2-95da-001e8c1a8a0e">
<topic>nss-pam-ldapd -- file descriptor buffer overflow</topic>
<affects>
<package>
<name>nss-pam-ldapd</name>
<range><lt>0.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Garth Mollett reports:</p>
<blockquote cite="http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288">
<p>A file descriptor overflow issue in the use of FD_SET()
in nss-pam-ldapd can lead to a stack-based buffer overflow.
An attacker could, under some circumstances, use this flaw
to cause a process that has the NSS or PAM module loaded to
crash or potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0288</cvename>
</references>
<dates>
<discovery>2013-02-18</discovery>
<entry>2013-02-20</entry>
</dates>
</vuln>
<vuln vid="1c8a039b-7b23-11e2-b17b-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>de-bugzilla</name>
<name>ru-bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.13</lt></range>
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.12/">
<h1>Cross-Site Scripting</h1>
<p>When viewing a single bug report, which is the default,
the bug ID is validated and rejected if it is invalid.
But when viewing several bug reports at once, which is
specified by the format=multiple parameter, invalid bug
IDs can go through and are sanitized in the HTML page
itself. But when an invalid page format is passed to the
CGI script, the wrong HTML page is called and data are not
correctly sanitized, which can lead to XSS.</p>
<h1>Information Leak</h1>
<p>When running a query in debug mode, the generated SQL
query used to collect the data is displayed. The way this
SQL query is built permits the user to determine if some
confidential field value (such as a product name) exists.
This problem only affects Bugzilla 4.0.9 and older. Newer
releases are not affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0785</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=842038</url>
<cvename>CVE-2013-0786</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=824399</url>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-20</entry>
<modified>2013-03-31</modified>
</dates>
</vuln>
<vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>19.0,1</lt></range>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.16</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.16</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.3</lt></range>
<range><lt>10.0.12</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
rv:17.0.3)</p>
<p>MFSA 2013-22 Out-of-bounds read in image rendering</p>
<p>MFSA 2013-23 Wrapped WebIDL objects can be wrapped again</p>
<p>MFSA 2013-24 Web content bypass of COW and SOW security wrappers</p>
<p>MFSA 2013-25 Privacy leak in JavaScript Workers</p>
<p>MFSA 2013-26 Use-after-free in nsImageLoadingContent</p>
<p>MFSA 2013-27 Phishing on HTTPS connection through malicious proxy</p>
<p>MFSA 2013-28 Use-after-free, out of bounds read, and buffer
overflow issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0765</cvename>
<cvename>CVE-2013-0772</cvename>
<cvename>CVE-2013-0773</cvename>
<cvename>CVE-2013-0774</cvename>
<cvename>CVE-2013-0775</cvename>
<cvename>CVE-2013-0776</cvename>
<cvename>CVE-2013-0783</cvename>
<cvename>CVE-2013-0784</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-19</entry>
<modified>2013-02-20</modified>
</dates>
</vuln>
<vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
<topic>Ruby Rack Gem -- Multiple Issues</topic>
<affects>
<package>
<name>rubygem18-rack</name>
<range><lt>1.4.5</lt></range>
</package>
<package>
<name>rubygem19-rack</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rack developers report:</p>
<blockquote cite="http://www.ruby-forum.com/topic/4410659">
<p>Today we are proud to announce the release of Rack 1.4.5.</p>
<p>Fix CVE-2013-0263, timing attack against Rack::Session::Cookie</p>
<p>Fix CVE-2013-0262, symlink path traversal in Rack::File</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0262</cvename>
<cvename>CVE-2013-0263</cvename>
</references>
<dates>
<discovery>2013-02-08</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="beab40bf-c1ca-4d2b-ad46-2f14bac8a968">
<topic>Ruby Activemodel Gem -- Circumvention of attr_protected</topic>
<affects>
<package>
<name>rubygem18-activemodel</name>
<range><lt>3.2.12</lt></range>
</package>
<package>
<name>rubygem19-activemodel</name>
<range><lt>3.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8">
<p>The attr_protected method allows developers to specify a blacklist
of model attributes which users should not be allowed to assign to.
By using a specially crafted request, attackers could circumvent
this protection and alter values that were meant to be protected.</p>
<p>All users running an affected release should either upgrade or use
one of the work arounds immediately. Users should also consider
switching from attr_protected to the whitelist method
attr_accessible which is not vulnerable to this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0276</cvename>
</references>
<dates>
<discovery>2013-02-11</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.501</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>One of the vulnerabilities allows cross-site request
forgery (CSRF) attacks on Jenkins master, which causes an user
to make unwanted actions on Jenkins. Another vulnerability
enables cross-site scripting (XSS) attacks, which has the similar
consequence. Another vulnerability allowed an attacker to bypass
the CSRF protection mechanism in place, thereby mounting more CSRF
attackes. These attacks allow an attacker without direct access to
Jenkins to mount an attack.</li>
<li>In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.</li>
<li>And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
</references>
<dates>
<discovery>2013-02-16</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
<topic>poweradmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>poweradmin</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple cross-site scripting (XSS) vulnerabilities</p>
<blockquote cite="https://www.poweradmin.org/trac/ticket/468">
<p>Multiple scripts are vulnerable to XSS attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>55619</bid>
<url>http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html</url>
</references>
<dates>
<discovery>2012-01-12</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="c79eb109-a754-45d7-b552-a42099eb2265">
<topic>Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
</package>
<package>
<name>rubygem18-json</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem19-json</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem18-json_pure</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem19-json_pure</name>
<range><lt>1.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58">
<p>When parsing certain JSON documents, the JSON gem can be coerced in
to creating Ruby symbols in a target system. Since Ruby symbols
are not garbage collected, this can result in a denial of service
attack.</p>
<p>The same technique can be used to create objects in a target system
that act like internal objects. These "act alike" objects can be
used to bypass certain security mechanisms and can be used as a
spring board for SQL injection attacks in Ruby on Rails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0269</cvename>
</references>
<dates>
<discovery>2013-02-11</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="d3e96508-056b-4259-88ad-50dc8d1978a6">
<topic>Ruby -- XSS exploit of RDoc documentation generated by rdoc</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
</package>
<package>
<name>rubygem18-rdoc</name>
<range><lt>3.12.1</lt></range>
</package>
<package>
<name>rubygem19-rdoc</name>
<range><lt>3.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/">
<p>RDoc documentation generated by rdoc bundled with ruby are
vulnerable to an XSS exploit. All ruby users are recommended to
update ruby to newer version which includes security-fixed RDoc. If
you are publishing RDoc documentation generated by rdoc, you are
recommended to apply a patch for the documentaion or re-generate it
with security-fixed RDoc.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0256</cvename>
</references>
<dates>
<discovery>2013-02-06</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="414e6a41-7204-11e2-8599-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.262</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-04.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0633</cvename>
<cvename>CVE-2013-0634</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb13-04.html</url>
</references>
<dates>
<discovery>2013-02-07</discovery>
<entry>2013-02-08</entry>
</dates>
</vuln>
<vuln vid="00b0d8cd-7097-11e2-98d9-003067c2616f">
<topic>OpenSSL -- TLS 1.1, 1.2 denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20130205.txt">
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
and TLS 1.2 on AES-NI supporting platforms can be exploited in a
DoS attack.</p>
<p>A flaw in the OpenSSL handling of OCSP response verification can
be exploited in a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2686</cvename>
<cvename>CVE-2013-0166</cvename>
<cvename>CVE-2013-0169</cvename>
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
</references>
<dates>
<discovery>2013-02-05</discovery>
<entry>2013-02-06</entry>
</dates>
</vuln>
<vuln vid="8c773d7f-6cbb-11e2-b242-c8600054b392">
<topic>mysql/mariadb/percona server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.67</lt></range>
<range><ge>5.5</ge><lt>5.5.29</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><ge>5.3</ge><lt>5.3.12</lt></range>
<range><ge>5.5</ge><lt>5.5.29</lt></range>
</package>
<package>
<name>percona-server</name>
<range><ge>5.5</ge><lt>5.5.29.29.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ORACLE reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html">
<p>Multiple SQL injection vulnerabilities in the replication code</p>
<p>Stack-based buffer overflow</p>
<p>Heap-based buffer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4414</cvename>
<cvename>CVE-2012-5611</cvename>
<cvename>CVE-2012-5612</cvename>
<cvename>CVE-2012-5615</cvename>
<cvename>CVE-2012-5627</cvename>
<url>https://mariadb.atlassian.net/browse/MDEV-4029</url>
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
<url>http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/</url>
</references>
<dates>
<discovery>2012-12-01</discovery>
<entry>2013-02-01</entry>
</dates>
</vuln>
<vuln vid="ea0f45e2-6c4b-11e2-98d9-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<name>linux-opera-devel</name>
<range><lt>12.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
<p>Particular DOM event manipulations can cause Opera to crash. In
some cases, this crash might occur in a way that allows execution
of arbitrary code. To inject code, additional techniques would
have to be employed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1042/</url>
<url>http://www.opera.com/support/kb/view/1043/</url>
</references>
<dates>
<discovery>2013-01-30</discovery>
<entry>2013-02-01</entry>
</dates>
</vuln>
<vuln vid="2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84">
<topic>upnp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Project changelog reports:</p>
<blockquote cite="http://pupnp.sourceforge.net/ChangeLog">
<p>This patch addresses three possible buffer overflows in
function unique_service_name().The three issues have the
folowing CVE numbers:</p>
<ul>
<li>CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf</li>
<li>CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN</li>
<li>CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN</li>
</ul>
<p>Notice that the following issues have already been dealt by
previous work:</p>
<ul>
<li>CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN</li>
<li>CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType</li>
<li>CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN</li>
<li>CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType</li>
<li>CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5958</cvename>
<cvename>CVE-2012-5959</cvename>
<cvename>CVE-2012-5960</cvename>
<cvename>CVE-2012-5961</cvename>
<cvename>CVE-2012-5962</cvename>
<cvename>CVE-2012-5963</cvename>
<cvename>CVE-2012-5964</cvename>
<cvename>CVE-2012-5965</cvename>
</references>
<dates>
<discovery>2012-11-21</discovery>
<entry>2013-01-30</entry>
</dates>
</vuln>
<vuln vid="559e00b7-6a4d-11e2-b6b0-10bf48230856">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.5.1,1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="http://wordpress.org/news/2013/01/wordpress-3-5-1/">
<p>WordPress 3.5.1 also addresses the following security issues:</p>
<ul>
<li>A server-side request forgery vulnerability and remote port
scanning using pingbacks. This vulnerability, which could
potentially be used to expose information and compromise a
site, affects all previous WordPress versions. This was fixed
by the WordPress security team. We'd like to thank security
researchers <a href="http://codeseekah.com/">Gennady
Kovshenin</a> and <a href="http://www.ethicalhack3r.co.uk/">Ryan
Dewhurst</a> for reviewing our work.</li>
<li>Two instances of cross-site scripting via shortcodes and post
content. These issues were discovered by Jon Cave of the WordPress
security team.</li>
<li>A cross-site scripting vulnerability in the external library
Plupload. Thanks to the Moxiecode team for working with us on
this, and for releasing Plupload 1.5.5 to address this issue.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0235</cvename>
<cvename>CVE-2013-0236</cvename>
<cvename>CVE-2013-0237</cvename>
</references>
<dates>
<discovery>2013-01-24</discovery>
<entry>2013-01-29</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="3886cafe-668c-11e2-94b8-1c4bd681f0cf">
<topic>django-cms -- XSS Vulnerability</topic>
<affects>
<package>
<name>py-django-cms</name>
<range><lt>2.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cross-site scripting (XSS) vulnerability</p>
<blockquote cite="https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/">
<p>Jonas Obrist reports: The security issue allows users with limited
admin access to elevate their privileges through XSS injection
using the page_attribute template tag. Only users with admin access
and the permission to edit at least one django CMS page object
could exploit this vulnerability. Websites that do not use the
page_attribute template tag are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2013-01-25</entry>
</dates>
</vuln>
<vuln vid="1827f213-633e-11e2-8d93-c8600054b392">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.28</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-001">
<p>Cross-site scripting (Various core and contributed modules)</p>
<p>Access bypass (Book module printer friendly version)</p>
<p>Access bypass (Image module)</p>
</blockquote>
</body>
</description>
<references>
<url>https://drupal.org/SA-CORE-2013-001</url>
</references>
<dates>
<discovery>2013-01-16</discovery>
<entry>2013-01-20</entry>
</dates>
</vuln>
<vuln vid="1b9b199f-5efd-11e2-a1ee-c48508086173">
<topic>ettercap -- buffer overflow in target list parsing</topic>
<affects>
<package>
<name>ettercap</name>
<range><lt>0.7.4.1</lt></range>
<range><ge>0.7.5</ge><lt>0.7.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Host target list parsing routine in ettercap
0.7.4-series prior to 0.7.4.1 and 0.7.5-series
is prone to the stack-based buffer overflow that
may lead to the code execution with the privileges
of the ettercap process.</p>
<p>In order to trigger this vulnerability, user or service
that use ettercap should be tricked to pass the crafted list
of targets via the "-j" option.</p>
</body>
</description>
<references>
<cvename>CVE-2013-0722</cvename>
<url>http://www.exploit-db.com/exploits/23945/</url>
<url>https://secunia.com/advisories/51731/</url>
</references>
<dates>
<discovery>2013-01-07</discovery>
<entry>2013-01-16</entry>
</dates>
</vuln>
<vuln vid="d5e0317e-5e45-11e2-a113-c48508086173">
<topic>java 7.x -- security manager bypass</topic>
<affects>
<package>
<name>openjdk7</name>
<range><gt>0</gt></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>7.0</ge><lt>7.11</lt></range>
</package>
<package>
<name>linux-sun-jre</name>
<range><ge>7.0</ge><lt>7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/625617">
<p>Java 7 Update 10 and earlier versions of Java 7 contain a
vulnerability that can allow a remote, unauthenticated
attacker to execute arbitrary code on a vulnerable
system.</p>
<p>The Java JRE plug-in provides its own Security Manager.
Typically, a web applet runs with a security manager
provided by the browser or Java Web Start plugin. Oracle's
document states, "If there is a security manager already
installed, this method first calls the security manager's
checkPermission method with a
RuntimePermission("setSecurityManager") permission to ensure
it's safe to replace the existing security manager. This may
result in throwing a SecurityException".</p>
<p>By leveraging the vulnerability in the Java Management
Extensions (JMX) MBean components, unprivileged Java code
can access restricted classes. By using that vulnerability
in conjunction with a second vulnerability involving the
Reflection API and the invokeWithArguments method of the
MethodHandle class, an untrusted Java applet can escalate
its privileges by calling the the setSecurityManager()
function to allow full privileges, without requiring code
signing. Oracle Java 7 update 10 and earlier Java 7 versions
are affected. The invokeWithArguments method was introduced
with Java 7, so therefore Java 6 is not affected.</p>
<p>This vulnerability is being attacked in the wild, and is
reported to be incorporated into exploit kits. Exploit code
for this vulnerability is also publicly available.</p>
</blockquote>
<p>Esteban Guillardoy from Immunity Inc. additionally clarifies
on the recursive reflection exploitation technique:</p>
<blockquote cite="https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf">
<p>The real issue is in the native
sun.reflect.Reflection.getCallerClass method.</p>
<p>We can see the following information in the Reflection
source code:</p>
<p>Returns the class of the method realFramesToSkip frames
up the stack (zero-based), ignoring frames associated with
java.lang.reflect.Method.invoke() and its
implementation.</p>
<p>So what is happening here is that they forgot to skip the
frames related to the new Reflection API and only the old
reflection API is taken into account.</p>
</blockquote>
<p>This exploit does not only affect Java applets, but every
piece of software that relies on the Java Security Manager for
sandboxing executable code is affected: malicious code can
totally disable Security Manager.</p>
<p>For users who are running native Web browsers with enabled
Java plugin, the workaround is to remove the java/icedtea-web
port and restart all browser instances.</p>
<p>For users who are running Linux Web browser flavors, the
workaround is either to disable the Java plugin in browser
or to upgrade linux-sun-* packages to the non-vulnerable
version.</p>
<p>It is not recommended to run untrusted applets using
appletviewer, since this may lead to the execution of the
malicious code on vulnerable versions on JDK/JRE.</p>
</body>
</description>
<references>
<cvename>CVE-2013-0433</cvename>
<certvu>625617</certvu>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html</url>
<url>https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf</url>
</references>
<dates>
<discovery>2013-01-10</discovery>
<entry>2013-01-14</entry>
</dates>
</vuln>
<vuln vid="97c22a94-5b8b-11e2-b131-000c299b62e1">
<topic>nagios -- buffer overflow in history.cgi</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>3.4.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>full disclosure reports:</p>
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">
<p>history.cgi is vulnerable to a buffer overflow due to the use of
sprintf with user supplied data that has not been restricted in size.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6096</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</url>
<url>http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547</url>
</references>
<dates>
<discovery>2012-12-21</discovery>
<entry>2013-01-10</entry>
</dates>
</vuln>
<vuln vid="a4ed6632-5aa9-11e2-8fcb-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>17.0.2,1</lt></range>
<range><lt>10.0.12,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.2,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.15</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.15</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.2</lt></range>
<range><lt>10.0.12</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
</package>
<package>
<name>ca_root_nss</name>
<range><lt>3.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/
rv:10.0.12 / rv:17.0.2)</p>
<p>MFSA 2013-02 Use-after-free and buffer overflow issues found using
Address Sanitizer</p>
<p>MFSA 2013-03 Buffer Overflow in Canvas</p>
<p>MFSA 2013-04 URL spoofing in addressbar during page loads</p>
<p>MFSA 2013-05 Use-after-free when displaying table with many
columns and column groups</p>
<p>MFSA 2013-06 Touch events are shared across iframes</p>
<p>MFSA 2013-07 Crash due to handling of SSL on threads</p>
<p>MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during
garbage collection</p>
<p>MFSA 2013-09 Compartment mismatch with quickstubs returned values</p>
<p>MFSA 2013-10 Event manipulation in plugin handler to bypass
same-origin policy</p>
<p>MFSA 2013-11 Address space layout leaked in XBL objects</p>
<p>MFSA 2013-12 Buffer overflow in Javascript string concatenation</p>
<p>MFSA 2013-13 Memory corruption in XBL with XML bindings containing
SVG</p>
<p>MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing
prototype</p>
<p>MFSA 2013-15 Privilege escalation through plugin objects</p>
<p>MFSA 2013-16 Use-after-free in serializeToStream</p>
<p>MFSA 2013-17 Use-after-free in ListenerManager</p>
<p>MFSA 2013-18 Use-after-free in Vibrate</p>
<p>MFSA 2013-19 Use-after-free in Javascript Proxy objects</p>
<p>MFSA 2013-20 Mis-issued TURKTRUST certificates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5829</cvename>
<cvename>CVE-2013-0743</cvename>
<cvename>CVE-2013-0744</cvename>
<cvename>CVE-2013-0745</cvename>
<cvename>CVE-2013-0746</cvename>
<cvename>CVE-2013-0747</cvename>
<cvename>CVE-2013-0748</cvename>
<cvename>CVE-2013-0749</cvename>
<cvename>CVE-2013-0750</cvename>
<cvename>CVE-2013-0751</cvename>
<cvename>CVE-2013-0752</cvename>
<cvename>CVE-2013-0753</cvename>
<cvename>CVE-2013-0754</cvename>
<cvename>CVE-2013-0755</cvename>
<cvename>CVE-2013-0756</cvename>
<cvename>CVE-2013-0757</cvename>
<cvename>CVE-2013-0758</cvename>
<cvename>CVE-2013-0759</cvename>
<cvename>CVE-2013-0760</cvename>
<cvename>CVE-2013-0761</cvename>
<cvename>CVE-2013-0762</cvename>
<cvename>CVE-2013-0763</cvename>
<cvename>CVE-2013-0764</cvename>
<cvename>CVE-2013-0766</cvename>
<cvename>CVE-2013-0767</cvename>
<cvename>CVE-2013-0768</cvename>
<cvename>CVE-2013-0769</cvename>
<cvename>CVE-2013-0770</cvename>
<cvename>CVE-2013-0771</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-01.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-02.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-03.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-04.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-05.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-06.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-07.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-08.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-09.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-10.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-11.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-12.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-13.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-14.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-15.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-16.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-17.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-18.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-19.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-01-08</discovery>
<entry>2013-01-09</entry>
</dates>
</vuln>
<vuln vid="ca5d3272-59e3-11e2-853b-00262d5ed8ee">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/">
<p>Two high-risk vulnerabilities have been discovered:</p>
<p>(CVE-2013-0155) There is a vulnerability when Active Record is
used in conjunction with JSON parameter parsing.</p>
<p>Due to the way Active Record interprets parameters in combination
with the way that JSON parameters are parsed, it is possible for an
attacker to issue unexpected database queries with "IS NULL" or
empty "WHERE" clauses. This issue does not let an attacker insert
arbitrary values into an SQL query, however they can cause the
query to check for NULL or eliminate a WHERE clause when most users
would not expect it.</p>
<p>(CVE-2013-0156) There are multiple weaknesses in the parameter
parsing code for Ruby on Rails which allows attackers to bypass
authentication systems, inject arbitrary SQL, inject and execute
arbitrary code, or perform a DoS attack on a Rails application.</p>
<p>The parameter parsing code of Ruby on Rails allows applications to
automatically cast values from strings to certain data types.
Unfortunately the type casting code supported certain conversions
which were not suitable for performing on user-provided data
including creating Symbols and parsing YAML. These unsuitable
conversions can be used by an attacker to compromise a Rails
application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0155</cvename>
<cvename>CVE-2013-0156</cvename>
<url>http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ</url>
</references>
<dates>
<discovery>2013-01-08</discovery>
<entry>2013-01-08</entry>
</dates>
</vuln>
<vuln vid="b4051b52-58fa-11e2-853b-00262d5ed8ee">
<topic>rubygem-rails -- SQL injection vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM">
<p>There is a SQL injection vulnerability in Active Record in ALL
versions. Due to the way dynamic finders in Active Record extract
options from method parameters, a method parameter can mistakenly
be used as a scope. Carefully crafted requests can use the scope
to inject arbitrary SQL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5664</cvename>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM</url>
</references>
<dates>
<discovery>2013-01-02</discovery>
<entry>2013-01-07</entry>
</dates>
</vuln>
<vuln vid="3a65d33b-5950-11e2-b66b-00e0814cab4e">
<topic>jenkins -- HTTP access to the server to retrieve the master cryptographic key</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.498</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">
<p>This advisory announces a security vulnerability that was found
in Jenkins core.</p>
<p>An attacker can then use this master cryptographic key to mount
remote code execution attack against the Jenkins master, or
impersonate arbitrary users in making REST API calls.</p>
<p>There are several factors that mitigate some of these problems
that may apply to specific installations.</p>
<ul>
<li>The particular attack vector is only applicable on Jenkins
instances that have slaves attached to them, and allow
anonymous read access.</li>
<li>Jenkins allows users to re-generate the API tokens. Those
re-generated API tokens cannot be impersonated by the
attacker.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</url>
</references>
<dates>
<discovery>2013-01-04</discovery>
<entry>2013-01-08</entry>
</dates>
</vuln>
<vuln vid="1b769b72-582b-11e2-b66b-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>django</name>
<range><lt>1.4.3</lt></range>
</package>
<package>
<name>django13</name>
<range><lt>1.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/dec/10/security/">
<ol>
<li>
<p>Host header poisoning</p>
<p>Several earlier Django security releases focused on the issue of
poisoning the HTTP Host header, causing Django to generate URLs
pointing to arbitrary, potentially-malicious domains.</p>
<p>In response to further input received and reports of continuing
issues following the previous release, we're taking additional
steps to tighten Host header validation. Rather than attempt to
accommodate all features HTTP supports here, Django's Host header
validation attempts to support a smaller, but far more common, subset:</p>
<ul>
<li>Hostnames must consist of characters [A-Za-z0-9] plus hyphen
('-') or dot ('.').</li>
<li>IP addresses -- both IPv4 and IPv6 -- are permitted.</li>
<li>Port, if specified, is numeric.</li>
</ul>
<p>Any deviation from this will now be rejected, raising the exception
django.core.exceptions.SuspiciousOperation.</p>
</li>
<li>
<p>Redirect poisoning</p>
<p>Also following up on a previous issue: in July of this year, we made
changes to Django's HTTP redirect classes, performing additional
validation of the scheme of the URL to redirect to (since, both
within Django's own supplied applications and many third-party
applications, accepting a user-supplied redirect target is a common
pattern).</p>
<p>Since then, two independent audits of the code turned up further
potential problems. So, similar to the Host-header issue, we are
taking steps to provide tighter validation in response to reported
problems (primarily with third-party applications, but to a certain
extent also within Django itself). This comes in two parts:</p>
<ol>
<li>A new utility function, django.utils.http.is_safe_url, is
added; this function takes a URL and a hostname, and checks
that the URL is either relative, or if absolute matches the
supplied hostname. This function is intended for use whenever
user-supplied redirect targets are accepted, to ensure that
such redirects cannot lead to arbitrary third-party sites.</li>
<li>All of Django's own built-in views -- primarily in the
authentication system -- which allow user-supplied redirect
targets now use is_safe_url to validate the supplied URL.</li>
</ol>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2012/dec/10/security/</url>
</references>
<dates>
<discovery>2012-12-10</discovery>
<entry>2013-01-06</entry>
</dates>
</vuln>
<vuln vid="1ae613c3-5728-11e2-9483-14dae938ec40">
<topic>freetype -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeType Project reports:</p>
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view">
<p>Some vulnerabilities in the BDF implementation have been fixed.
Users of this font format should upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view</url>
</references>
<dates>
<discovery>2012-12-20</discovery>
<entry>2013-01-05</entry>
</dates>
</vuln>
<vuln vid="a264b1b0-5726-11e2-9483-14dae938ec40">
<topic>moinmoin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin developers report the following vulnerabilities
as fixed in version 1.9.6:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES">
<ul>
<li>remote code execution vulnerability in
twikidraw/anywikidraw action,</li>
<li>path traversal vulnerability in AttachFile action,</li>
<li>XSS issue, escape page name in rss link.</li>
</ul>
</blockquote>
<p>CVE entries at MITRE furher clarify:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6081">
<p>Multiple unrestricted file upload vulnerabilities in the
(1) twikidraw (action/twikidraw.py) and (2) anywikidraw
(action/anywikidraw.py) actions in MoinMoin before 1.9.6
allow remote authenticated users with write permissions to
execute arbitrary code by uploading a file with an
executable extension, then accessing it via a direct request
to the file in an unspecified directory, as exploited in the
wild in July 2012.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6080">
<p>Directory traversal vulnerability in the
_do_attachment_move function in the AttachFile action
(action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5
allows remote attackers to overwrite arbitrary files via a
.. (dot dot) in a file name.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6082">
<p>Cross-site scripting (XSS) vulnerability in the rsslink
function in theme/__init__.py in MoinMoin 1.9.5 allows
remote attackers to inject arbitrary web script or HTML
via the page name in a rss link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6081</cvename>
<cvename>CVE-2012-6080</cvename>
<cvename>CVE-2012-6082</cvename>
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES</url>
<url>http://www.debian.org/security/2012/dsa-2593</url>
</references>
<dates>
<discovery>2012-12-29</discovery>
<entry>2013-01-05</entry>
<modified>2013-01-06</modified>
</dates>
</vuln>
<vuln vid="f7c87a8a-55d5-11e2-a255-c8600054b392">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.1.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.11.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Crashes due to large stack allocations when using TCP</p>
<p>Denial of Service Through Exploitation of Device State Caching</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5976</cvename>
<cvename>CVE-2012-5977</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-014.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-015.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-01-02</discovery>
<entry>2013-01-03</entry>
</dates>
</vuln>
<vuln vid="4108cc57-54d7-11e2-9483-14dae938ec40">
<topic>ircd-ratbox and charybdis -- remote DoS vulnerability</topic>
<affects>
<package>
<name>ircd-ratbox</name>
<range><gt>2.*</gt><lt>3.0.8</lt></range>
</package>
<package>
<name>charybdis</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>atheme.org reports:</p>
<blockquote cite="http://www.ratbox.org/ASA-2012-12-31.txt">
<p>All versions of Charybdis are vulnerable to a remotely-triggered
crash bug caused by code originating from ircd-ratbox 2.0.
(Incidentally, this means all versions since ircd-ratbox 2.0 are
also vulnerable.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ratbox.org/ASA-2012-12-31.txt</url>
</references>
<dates>
<discovery>2012-12-31</discovery>
<entry>2013-01-02</entry>
</dates>
</vuln>
<vuln vid="101f0aae-52d1-11e2-87fe-f4ce46b9ace8">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.6.*</gt><lt>2.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>puppet -- multiple vulnerabilities</p>
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17">
<p>Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.</p>
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.</p>
<p>Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3864</cvename>
<cvename>CVE-2012-3865</cvename>
<cvename>CVE-2012-3867</cvename>
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
</references>
<dates>
<discovery>2012-07-10</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="13320091-52a6-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-03/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email. In this case this is
achieved by using javascript source attributes with whitespaces.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4751</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/</url>
<url>http://www.kb.cert.org/vuls/id/603276</url>
</references>
<dates>
<discovery>2012-10-16</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="95a69d1a-52a5-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability in Firefox and Opera</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email in Firefox and Opera.
In this case this is achieved with an invalid HTML structure with nested tags.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4600</cvename>
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="49a6026a-52a3-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability in Internet Explorer</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. Due to the XSS vulnerability in Internet Explorer an attacker could send
a specially prepared HTML email to OTRS which would cause JavaScript code to be
executed in your Internet Explorer while displaying the email.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2582</cvename>
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/</url>
</references>
<dates>
<discovery>2012-08-22</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="c37de843-488e-11e2-a5c9-0019996bc1f7">
<topic>squid -- denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.7.9_4</lt></range>
<range><ge>3.1</ge><lt>3.1.23</lt></range>
<range><ge>3.2</ge><lt>3.2.6</lt></range>
<range><ge>3.3</ge><lt>3.3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid developers report:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">
<p>Due to missing input validation Squid cachemgr.cgi tool
is vulnerable to a denial of service attack when processing
specially crafted requests.</p>
<p>This problem allows any client able to reach the
cachemgr.cgi to perform a denial of service attack on the
service host.</p>
<p>The nature of the attack may cause secondary effects
through resource consumption on the host server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5643</cvename>
<cvename>CVE-2013-0189</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</url>
</references>
<dates>
<discovery>2012-12-17</discovery>
<entry>2012-12-28</entry>
<modified>2013-05-02</modified>
</dates>
</vuln>
<vuln vid="85f33a8d-492f-11e2-aa75-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1038/">
<p>When loading GIF images into memory, Opera should allocate the
correct amount of memory to store that image. Specially crafted
image files can cause Opera to allocate the wrong amount of memory.
Subsequent data may then overwrite unrelated memory with
attacker-controlled data. This can lead to a crash, which may also
execute that data as code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1038/</url>
<url>http://www.opera.com/support/kb/view/1039/</url>
</references>
<dates>
<discovery>2012-12-18</discovery>
<entry>2012-12-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="1657a3e6-4585-11e2-a396-10bf48230856">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.258</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-27.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5676</cvename>
<cvename>CVE-2012-5677</cvename>
<cvename>CVE-2012-5678</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-27.html</url>
</references>
<dates>
<discovery>2012-12-11</discovery>
<entry>2012-12-14</entry>
</dates>
</vuln>
<vuln vid="953911fe-51ef-11e2-8e34-0022156e8794">
<topic>tomcat -- bypass of CSRF prevention filter</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.31</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>The CSRF prevention filter could be bypassed if a request was made to a
protected resource without a session identifier present in the request.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4431</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="134acaa2-51ef-11e2-8e34-0022156e8794">
<topic>tomcat -- denial of service</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.27</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>When using the NIO connector with sendfile and HTTPS enabled, if a
client breaks the connection while reading the response an infinite loop
is entered leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4534</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="f599dfc4-3ec2-11e2-8ae1-001a8056d0b5">
<topic>tomcat -- bypass of security constraints</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.29</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>When using FORM authentication it was possible to bypass the security
constraint checks in the FORM authenticator by appending
"/j_security_check" to the end of the URL if some other component
(such as the Single-Sign-On valve) had called request.setUserPrincipal()
before the call to FormAuthenticator#authenticate().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3546</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="2892a8e2-3d68-11e2-8e01-0800273fe665">
<topic>dns/bind9* -- servers using DNS64 can be crashed by a crafted query</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.2.1</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.2.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.4.1</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00828">
<p>BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
vulnerable to a software defect that allows a crafted query to
crash the server with a REQUIRE assertion failure. Remote
exploitation of this defect can be achieved without extensive
effort, resulting in a denial-of-service (DoS) vector against
affected servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5688</cvename>
</references>
<dates>
<discovery>2012-11-27</discovery>
<entry>2012-12-04</entry>
</dates>
</vuln>
<vuln vid="f524d8e0-3d83-11e2-807a-080027ef73ec">
<topic>bogofilter -- heap corruption by invalid base64 input</topic>
<affects>
<package> <name>bogofilter</name> <range><lt>1.2.3</lt></range> </package>
<package> <name>bogofilter-sqlite</name> <range><lt>1.2.3</lt></range> </package>
<package> <name>bogofilter-tc</name> <range><lt>1.2.3</lt></range> </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Relson reports:</p>
<blockquote cite="https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/NEWS">
<p>Fix a heap corruption in base64 decoder on invalid input.
Analysis and patch by Julius Plenz, [FU Berlin, Germany].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5468</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-12-03</entry>
</dates>
</vuln>
<vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d">
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
<affects>
<package>
<name>yahoo-ui</name>
<range><le>2.8.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The YUI team reports:</p>
<blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/">
<h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1>
<p>A XSS vulnerability has been discovered in some YUI 2 .swf files
from versions 2.4.0 through 2.9.0. This defect allows JavaScript
injection exploits to be created against domains that host affected
YUI .swf files.</p>
<p>If your site loads YUI 2 from a CDN (yui.yahooapis.com,
ajax.googleapis.com, etc.) and not from your own domain, you
are not affected. YUI 3 is not affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5881</cvename>
<cvename>CVE-2012-5882</cvename>
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
</references>
<dates>
<discovery>2012-10-30</discovery>
<entry>2012-11-27</entry>
<modified>2012-11-29</modified>
</dates>
</vuln>
<vuln vid="5536c8e4-36b3-11e2-a633-902b343deec9">
<topic>FreeBSD -- Linux compatibility layer input validation error</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_11</lt></range>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:08.linux.asc">
<p>A programming error in the handling of some Linux system calls
may result in memory locations being accessed without proper
validation.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:08.linux</freebsdsa>
<cvename>CVE-2012-4576</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="f115f693-36b2-11e2-a633-902b343deec9">
<topic>FreeBSD -- Insufficient message length validation for EAP-TLS messages</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc">
<p>The internal authentication server of hostapd does not
sufficiently validate the message length field of EAP-TLS
messages.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:07.hostapd</freebsdsa>
<cvename>CVE-2012-4445</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="4b79538b-a450-11e2-9898-001060e06fd4">
<topic>FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_11</lt></range>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:06.bind.asc">
<p>The BIND daemon would crash when a query is made on a resource
record with RDATA that exceeds 65535 bytes.</p>
<p>The BIND daemon would lock up when a query is made on specific
combinations of RDATA.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:06.bind</freebsdsa>
<cvename>CVE-2012-4244</cvename>
<cvename>CVE-2012-5166</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="0925716f-34e2-11e2-aa75-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1036/">
<p>When requesting pages using HTTP, Opera temporarily stores the
response in a buffer. In some cases, Opera may incorrectly allocate
too little space for a buffer, and may then store too much of the
response in that buffer. This causes a buffer overflow, which in
turn can lead to a memory corruption and crash. It is possible to
use this crash to execute the overflowing data as code, which may
be controlled by an attacking site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1036/</url>
</references>
<dates>
<discovery>2012-11-19</discovery>
<entry>2012-11-22</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="1cd3ca42-33e6-11e2-a255-5404a67eef98">
<topic>lighttpd -- remote DoS in header parsing</topic>
<affects>
<package>
<name>lighttpd</name>
<range><gt>1.4.30</gt><lt>1.4.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd security advisory reports:</p>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt">
<p>Certain Connection header values will trigger an endless loop, for example:
"Connection: TE,,Keep-Alive"</p>
<p>On receiving such value, lighttpd will enter an endless loop,
detecting an empty token but not incrementing the current string
position, and keep reading the ',' again and again.</p>
<p>This bug was introduced in 1.4.31, when we fixed an "invalid read"
bug (it would try to read the byte before the string if it started
with ',', although the value wasn't actually used).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5533</cvename>
</references>
<dates>
<discovery>2012-11-17</discovery>
<entry>2012-11-21</entry>
</dates>
</vuln>
<vuln vid="d23119df-335d-11e2-b64c-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>17.0,1</lt></range>
<range><lt>10.0.11,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.11,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.14</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.11</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.14</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0</lt></range>
<range><lt>10.0.11</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/
rv:10.0.11)</p>
<p>MFSA 2012-92 Buffer overflow while rendering GIF images</p>
<p>MFSA 2012-93 evalInSanbox location context incorrectly applied</p>
<p>MFSA 2012-94 Crash when combining SVG text on path with CSS</p>
<p>MFSA 2012-95 Javascript: URLs run in privileged context on New Tab
page</p>
<p>MFSA 2012-96 Memory corruption in str_unescape</p>
<p>MFSA 2012-97 XMLHttpRequest inherits incorrect principal within
sandbox</p>
<p>MFSA 2012-98 Firefox installer DLL hijacking</p>
<p>MFSA 2012-99 XrayWrappers exposes chrome-only properties when not
in chrome compartment</p>
<p>MFSA 2012-100 Improper security filtering for cross-origin
wrappers</p>
<p>MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset</p>
<p>MFSA 2012-102 Script entered into Developer Toolbar runs with
chrome privileges</p>
<p>MFSA 2012-103 Frames can shadow top.location</p>
<p>MFSA 2012-104 CSS and HTML injection through Style Inspector</p>
<p>MFSA 2012-105 Use-after-free and buffer overflow issues found</p>
<p>MFSA 2012-106 Use-after-free, buffer overflow, and memory
corruption issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4201</cvename>
<cvename>CVE-2012-4202</cvename>
<cvename>CVE-2012-4203</cvename>
<cvename>CVE-2012-4204</cvename>
<cvename>CVE-2012-4205</cvename>
<cvename>CVE-2012-4206</cvename>
<cvename>CVE-2012-4207</cvename>
<cvename>CVE-2012-4208</cvename>
<cvename>CVE-2012-4209</cvename>
<cvename>CVE-2012-4210</cvename>
<cvename>CVE-2012-4212</cvename>
<cvename>CVE-2012-4213</cvename>
<cvename>CVE-2012-4214</cvename>
<cvename>CVE-2012-4215</cvename>
<cvename>CVE-2012-4216</cvename>
<cvename>CVE-2012-4217</cvename>
<cvename>CVE-2012-4218</cvename>
<cvename>CVE-2012-5829</cvename>
<cvename>CVE-2012-5830</cvename>
<cvename>CVE-2012-5833</cvename>
<cvename>CVE-2012-5835</cvename>
<cvename>CVE-2012-5836</cvename>
<cvename>CVE-2012-5837</cvename>
<cvename>CVE-2012-5838</cvename>
<cvename>CVE-2012-5839</cvename>
<cvename>CVE-2012-5840</cvename>
<cvename>CVE-2012-5841</cvename>
<cvename>CVE-2012-5842</cvename>
<cvename>CVE-2012-5843</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-91.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-92.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-93.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-94.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-95.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-96.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-97.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-98.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-99.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-100.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-101.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-102.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-103.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-104.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-105.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-106.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2012-11-20</discovery>
<entry>2012-11-20</entry>
</dates>
</vuln>
<vuln vid="81826d12-317a-11e2-9186-406186f3d89d">
<topic>weechat -- Arbitrary shell command execution via scripts</topic>
<affects>
<package>
<name>weechat</name>
<range><ge>0.3.0</ge><lt>0.3.9.2</lt></range>
</package>
<package>
<name>weechat-devel</name>
<range><lt>20121118</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Helleu reports:</p>
<blockquote cite="http://weechat.org/security/">
<p>Untrusted command for function hook_process could lead to
execution of commands, because of shell expansions.</p>
<p>Workaround with a non-patched version: remove/unload all scripts
calling function hook_process (for maximum safety).</p>
</blockquote>
</body>
</description>
<references>
<url>http://weechat.org/security/</url>
<url>https://savannah.nongnu.org/bugs/?37764</url>
</references>
<dates>
<discovery>2012-11-15</discovery>
<entry>2012-11-18</entry>
<modified>2012-11-18</modified>
</dates>
</vuln>
<vuln vid="2b841f88-2e8d-11e2-ad21-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.12</lt></range>
<range><ge>4.0.0</ge><lt>4.0.9</lt></range>
<range><ge>4.2.0</ge><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.11/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Information Leak</h1>
<p>If the visibility of a custom field is controlled by a product
or a component of a product you cannot see, their names are
disclosed in the JavaScript code generated for this custom field
despite they should remain confidential.</p>
<p>Calling the User.get method with a 'groups' argument leaks the
existence of the groups depending on whether an error is thrown
or not. This method now also throws an error if the user calling
this method does not belong to these groups (independently of
whether the groups exist or not).</p>
<p>Trying to mark an attachment in a bug you cannot see as obsolete
discloses its description in the error message. The description
of the attachment is now removed from the error message.</p>
<h1>Cross-Site Scripting</h1>
<p>Due to incorrectly filtered field values in tabular reports,
it is possible to inject code leading to XSS.</p>
<p>A vulnerability in swfstore.swf from YUI2 allows JavaScript
injection exploits to be created against domains that host this
affected YUI .swf file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4199</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=731178</url>
<cvename>CVE-2012-4198</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=781850</url>
<cvename>CVE-2012-4197</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url>
<cvename>CVE-2012-4189</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url>
<cvename>CVE-2012-5881</cvename>
<cvename>CVE-2012-5882</cvename>
<cvename>CVE-2012-5883</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url>
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
</references>
<dates>
<discovery>2012-11-13</discovery>
<entry>2012-11-14</entry>
<modified>2012-11-27</modified>
</dates>
</vuln>
<vuln vid="79818ef9-2d10-11e2-9160-00262d5ed8ee">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.21</lt></range>
<range><ge>4.6.0</ge><lt>4.6.14</lt></range>
<range><ge>4.7.0</ge><lt>4.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/">
<p>TYPO3 Backend History Module - Due to missing encoding of user
input, the history module is susceptible to SQL Injection and
Cross-Site Scripting. A valid backend login is required to exploit
this vulnerability. Credits go to Thomas Worm who discovered and
reported the issue.</p>
<p>TYPO3 Backend API - Failing to properly HTML-encode user input the
tree render API (TCA-Tree) is susceptible to Cross-Site Scripting.
TYPO3 Versions below 6.0 does not make us of this API, thus is not
exploitable, if no third party extension is installed which uses
this API. A valid backend login is required to exploit this
vulnerability. Credits go to Richard Brain who discovered and
reported the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/</url>
</references>
<dates>
<discovery>2012-11-08</discovery>
<entry>2012-11-12</entry>
</dates>
</vuln>
<vuln vid="a537b449-2b19-11e2-b339-90e6ba652cce">
<topic>DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust</topic>
<affects>
<package>
<name>opendkim</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/268267">
<p>DomainKeys Identified Mail (DKIM) Verifiers may
inappropriately convey message trust when messages are
signed using test or small bit signing keys.</p>
</blockquote>
</body>
</description>
<references>
<certvu>268267</certvu>
</references>
<dates>
<discovery>2012-10-24</discovery>
<entry>2012-11-12</entry>
</dates>
</vuln>
<vuln vid="e02c572f-2af0-11e2-bb44-003067b2972c">
<topic>weechat -- Crash or freeze when decoding IRC colors in strings</topic>
<affects>
<package>
<name>weechat</name>
<range><ge>0.3.6</ge><lt>0.3.9.1</lt></range>
</package>
<package>
<name>weechat-devel</name>
<range><ge>20110614</ge><lt>20121110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Helleu reports:</p>
<blockquote cite="https://savannah.nongnu.org/bugs/?37704">
<p>A buffer overflow is causing a crash or freeze of WeeChat when
decoding IRC colors in strings.</p>
<p>Workaround for a non-patched version:
/set irc.network.colors_receive off</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5854</cvename>
<freebsdpr>ports/173513</freebsdpr>
<url>http://weechat.org/security/</url>
<url>https://savannah.nongnu.org/bugs/?37704</url>
</references>
<dates>
<discovery>2012-11-09</discovery>
<entry>2012-11-10</entry>
<modified>2012-11-13</modified>
</dates>
</vuln>
<vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
<topic>ruby -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9</ge><lt>1.9.3.327</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
<p>Carefully crafted sequence of strings can cause a denial of service
attack on the service that parses the sequence to create a Hash
object by using the strings as keys. For instance, this
vulnerability affects web application that parses the JSON data
sent from untrusted entity.</p>
<p>This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
1.9 versions were using modified MurmurHash function but it's
reported that there is a way to create sequence of strings that
collide their hash values each other. This fix changes the Hash
function of String object from the MurmurHash to SipHash 2-4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5371</cvename>
<url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
</references>
<dates>
<discovery>2012-11-10</discovery>
<entry>2012-11-10</entry>
</dates>
</vuln>
<vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
<topic>tomcat -- authentication weaknesses</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.36</lt></range>
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
<range><gt>7.0.0</gt><lt>7.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security.html">
<p>Three weaknesses in Tomcat's implementation of DIGEST
authentication were identified and resolved:</p>
<ul>
<li> Tomcat tracked client rather than server nonces and nonce count.</li>
<li> When a session ID was present, authentication was bypassed.</li>
<li> The user name and password were not checked before when indicating
that a nonce was stale.</li>
</ul>
<p>These issues reduced the security of DIGEST authentication making
replay attacks possible in some circumstances.</p>
<p>The first issue was identified by Tilmann Kuhn. The second and third
issues were identified by the Tomcat security team during the code
review resulting from the first issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3439</cvename>
<url>http://tomcat.apache.org/security.html</url>
<url>http://tomcat.apache.org/security-5.html</url>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-11-05</discovery>
<entry>2012-11-08</entry>
<modified>2012-11-09</modified>
</dates>
</vuln>
<vuln vid="4ca26574-2a2c-11e2-99c7-00a0d181e71d">
<topic>tomcat -- Denial of Service</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
<range><gt>7.0.0</gt><lt>7.0.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security.html">
<p>The checks that limited the permitted size of request headers were
implemented too late in the request parsing process for the HTTP NIO
connector. This enabled a malicious user to trigger an
OutOfMemoryError by sending a single request with very large
headers. This issue was identified by Josh Spiewak.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2733</cvename>
<url>http://tomcat.apache.org/security.html</url>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-11-05</discovery>
<entry>2012-11-08</entry>
<modified>2012-11-09</modified>
</dates>
</vuln>
<vuln vid="4b8b748e-2a24-11e2-bb44-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.243</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5274</cvename>
<cvename>CVE-2012-5275</cvename>
<cvename>CVE-2012-5276</cvename>
<cvename>CVE-2012-5277</cvename>
<cvename>CVE-2012-5278</cvename>
<cvename>CVE-2012-5279</cvename>
<cvename>CVE-2012-5280</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-24.html</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="38daea4f-2851-11e2-9483-14dae938ec40">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1030/">
<p>CORS (Cross-Origin Resource Sharing) allows web pages to retrieve
the contents of pages from other sites, with their permission,
as they would appear for the current user.
When requests are made in this way, the browser should only allow
the page content to be retrieved if the target site sends the
correct headers that give permission for their contents to be
used in this way. Specially crafted requests may trick Opera
into thinking that the target site has given permission when it
had not done so. This can result in the contents of any target page
being revealed to untrusted sites, including any
sensitive information or session IDs contained within the
source of those pages.</p>
</blockquote>
<p>Also reported are vulnerabilities involving SVG graphics and XSS.</p>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1030/</url>
<url>http://www.opera.com/support/kb/view/1031/</url>
<url>http://www.opera.com/support/kb/view/1033/</url>
</references>
<dates>
<discovery>2012-11-06</discovery>
<entry>2012-11-06</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="36533a59-2770-11e2-bb44-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.238</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5248</cvename>
<cvename>CVE-2012-5249</cvename>
<cvename>CVE-2012-5250</cvename>
<cvename>CVE-2012-5251</cvename>
<cvename>CVE-2012-5252</cvename>
<cvename>CVE-2012-5253</cvename>
<cvename>CVE-2012-5254</cvename>
<cvename>CVE-2012-5255</cvename>
<cvename>CVE-2012-5256</cvename>
<cvename>CVE-2012-5257</cvename>
<cvename>CVE-2012-5258</cvename>
<cvename>CVE-2012-5259</cvename>
<cvename>CVE-2012-5260</cvename>
<cvename>CVE-2012-5261</cvename>
<cvename>CVE-2012-5262</cvename>
<cvename>CVE-2012-5263</cvename>
<cvename>CVE-2012-5264</cvename>
<cvename>CVE-2012-5265</cvename>
<cvename>CVE-2012-5266</cvename>
<cvename>CVE-2012-5267</cvename>
<cvename>CVE-2012-5269</cvename>
<cvename>CVE-2012-5270</cvename>
<cvename>CVE-2012-5271</cvename>
<cvename>CVE-2012-5272</cvename>
<cvename>CVE-2012-5285</cvename>
<cvename>CVE-2012-5286</cvename>
<cvename>CVE-2012-5287</cvename>
<cvename>CVE-2012-5673</cvename>
<cvename>CVE-2012-2034</cvename>
<cvename>CVE-2012-2035</cvename>
<cvename>CVE-2012-2036</cvename>
<cvename>CVE-2012-2037</cvename>
<cvename>CVE-2012-2038</cvename>
<cvename>CVE-2012-2039</cvename>
<cvename>CVE-2012-2040</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-22.html</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="65539c54-2517-11e2-b9d6-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<h1>low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687</h1>
<p>Possible XSS for sites which use mod_negotiation and
allow untrusted uploads to locations which have MultiViews enabled.</p>
<h1>low: insecure LD_LIBRARY_PATH handling CVE-2012-0883</h1>
<p>This issue was already fixed in port version 2.2.22_5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2687</cvename>
<cvename>CVE-2012-0833</cvename><!-- already fixed in r301849 -->
</references>
<dates>
<discovery>2012-09-13</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="ec89dc70-2515-11e2-8eda-000a5e1e33c6">
<topic>webmin -- potential XSS attack via real name field</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.600_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The webmin updates site reports</p>
<blockquote cite="http://www.webmin.com/updates.html">
<p>Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack
via real name field; Solution: New module.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.webmin.com/updates.html</url>
</references>
<dates>
<discovery>2012-11-02</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="3decc87d-2498-11e2-b0c7-000d601460a4">
<topic>ruby -- Unintentional file creation caused by inserting an illegal NUL character</topic>
<affects>
<package>
<name>ruby</name>
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/">
<p>A vulnerability was found that file creation routines can create
unintended files by strategically inserting NUL(s) in file paths.
This vulnerability has been reported as CVE-2012-4522.</p>
<p>Ruby can handle arbitrary binary patterns as Strings, including
NUL chars. On the other hand OSes and other libraries tend not.
They usually treat a NUL as an End of String mark. So to interface
them with Ruby, NUL chars should properly be avoided.</p>
<p>However methods like IO#open did not check the filename passed to
them, and just passed those strings to lower layer routines. This
led to create unintentional files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4522</cvename>
<url>http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/</url>
<url>https://access.redhat.com/security/cve/CVE-2012-4522/</url>
</references>
<dates>
<discovery>2012-10-12</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="2a093853-2495-11e2-b0c7-000d601460a4">
<topic>ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s</topic>
<affects>
<package>
<name>ruby</name>
<range><gt>1.8.7,1</gt><lt>1.8.7.371,1</lt></range>
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/">
<p>Vulnerabilities found for Exception#to_s, NameError#to_s, and
name_err_mesg_to_s() which is Ruby interpreter-internal API. A
malicious user code can bypass $SAFE check by utilizing one of
those security holes.</p>
<p>Ruby's $SAFE mechanism enables untrusted user codes to run in
$SAFE >= 4 mode. This is a kind of sandboxing so some operations
are restricted in that mode to protect other data outside the
sandbox.</p>
<p>The problem found was around this mechanism. Exception#to_s,
NameError#to_s, and name_err_mesg_to_s() interpreter-internal API
was not correctly handling the $SAFE bits so a String object which
is not tainted can destructively be marked as tainted using them.
By using this an untrusted code in a sandbox can modify a
formerly-untainted string destructively.</p>
<p>Ruby 1.8 once had a similar security issue. It fixed
Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue
survived previous security fix</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4464</cvename>
<cvename>CVE-2012-4466</cvename>
<url>http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/</url>
<url>https://access.redhat.com/security/cve/CVE-2012-4464/</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="4b738d54-2427-11e2-9817-c8600054b392">
<topic>RT -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.8</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical report:</p>
<blockquote cite="http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html">
<p>All versions of RT are vulnerable to an email header injection
attack. Users with ModifySelf or AdminUser can cause RT to add
arbitrary headers or content to outgoing mail. Depending on the
scrips that are configured, this may be be leveraged for information
leakage or phishing.</p>
<p>RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability
due to lack of proper rights checking, allowing any privileged user
to create Articles in any class.</p>
<p>All versions of RT with cross-site-request forgery (CSRF)
protection (RT 3.8.12 and above, RT 4.0.6 and above, and any
instances running the security patches released 2012-05-22) contain
a vulnerability which incorrectly allows though CSRF requests which
toggle ticket bookmarks.</p>
<p>All versions of RT are vulnerable to a confused deputy attack on
the user. While not strictly a CSRF attack, users who are not logged
in who are tricked into following a malicious link may, after
supplying their credentials, be subject to an attack which leverages
their credentials to modify arbitrary state. While users who were
logged in would have observed the CSRF protection page, users who
were not logged in receive no such warning due to the intervening
login process. RT has been extended to notify users of pending
actions during the login process.</p>
<p>RT 3.8.0 and above are susceptible to a number of vulnerabilities
concerning improper signing or encryption of messages using GnuPG;
if GnuPG is not enabled, none of the following affect you.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4730</cvename>
<cvename>CVE-2012-4731</cvename>
<cvename>CVE-2012-4732</cvename>
<cvename>CVE-2012-4734</cvename>
<cvename>CVE-2012-4735</cvename>
<cvename>CVE-2012-4884</cvename>
<url>http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2012-10-26</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5">
<topic>drupal7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="http://drupal.org/node/1815912">
<ol>
<li>
<p>Arbitrary PHP code execution</p>
<p>A bug in the installer code was identified that allows an attacker
to re-install Drupal using an external database server under certain
transient conditions. This could allow the attacker to execute
arbitrary PHP code on the original server.</p>
</li>
<li>
<p>Information disclosure - OpenID module</p>
<p>For sites using the core OpenID module, an information disclosure
vulnerability was identified that allows an attacker to read files
on the local filesystem by attempting to log in to the site using a
malicious OpenID server.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/1815912</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-31</entry>
</dates>
</vuln>
<vuln vid="6b3b1b97-207c-11e2-a03f-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>16.0.2,1</lt></range>
<range><lt>10.0.10,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.10,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.13.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.13.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>16.0.2</lt></range>
<range><lt>10.0.10</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-90 Fixes for Location object issues</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4194</cvename>
<cvename>CVE-2012-4195</cvename>
<cvename>CVE-2012-4196</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
</references>
<dates>
<discovery>2012-10-26</discovery>
<entry>2012-10-27</entry>
</dates>
</vuln>
<vuln vid="b0f3ab1f-1f3b-11e2-8fe9-0022156e8794">
<topic>Exim -- remote code execution</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.70</ge><lt>4.80.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>This vulnerability affects Exim instances built with DKIM
enabled (this is the default for FreeBSD Exim port) and running
verification of DKIM signatures on the incoming mail
messages.</p>
<p>Phil Penncock reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html">
<p>This is a SECURITY release, addressing a CRITICAL remote
code execution flaw in versions of Exim between 4.70 and
4.80 inclusive, when built with DKIM support (the default).</p>
<p>This security vulnerability can be exploited by anyone
who can send email from a domain for which they control the
DNS.</p>
<p>You are not vulnerable if you built Exim with DISABLE_DKIM
or if you put this at the start of an ACL plumbed into
acl_smtp_connect or acl_smtp_rcpt:</p>
<pre>warn control = dkim_disable_verify</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5671</cvename>
<url>https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html</url>
</references>
<dates>
<discovery>2012-10-25</discovery>
<entry>2012-10-26</entry>
</dates>
</vuln>
<vuln vid="5f326d75-1db9-11e2-bc8f-d0df9acfd7e5">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>django</name>
<range><lt>1.4.2</lt></range>
</package>
<package>
<name>django13</name>
<range><lt>1.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/oct/17/security/">
<ol>
<li>
<p>Host header poisoning</p>
<p>Some parts of Django -- independent of end-user-written applications
-- make use of full URLs, including domain name, which are generated
from the HTTP Host header. Some attacks against this are beyond Django's
ability to control, and require the web server to be properly configured;
Django's documentation has for some time contained notes advising users
on such configuration.</p>
<p>Django's own built-in parsing of the Host header is, however, still
vulnerable, as was reported to us recently. The Host header parsing
in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host()
-- was incorrectly handling username/password information in the header.
Thus, for example, the following Host header would be accepted by Django when
running on "validsite.com":</p>
<p>Host: validsite.com:random@evilsite.com</p>
<p>Using this, an attacker can cause parts of Django -- particularly the
password-reset mechanism -- to generate and display arbitrary URLs to users.</p>
<p>To remedy this, the parsing in HttpRequest.get_host() is being modified; Host
headers which contain potentially dangerous content (such as username/password
pairs) now raise the exception django.core.exceptions.SuspiciousOperation.</p>
</li>
<li>
<p>Documentation of HttpOnly cookie option</p>
<p>As of Django 1.4, session cookies are always sent with the HttpOnly flag, which
provides some additional protection from cross-site scripting attacks by denying
client-side scripts access to the session cookie.</p>
<p>Though not directly a security issue in Django, it has been reported that the
Django 1.4 documentation incorrectly described this change, by claiming that this
was now the default for all cookies set by the HttpResponse.set_cookie() method.</p>
<p>The Django documentation has been updated to reflect that this only applies to the
session cookie. Users of Django are encouraged to review their use of set_cookie()
to ensure that the HttpOnly flag is being set or unset appropriately.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4520</cvename>
<url>https://www.djangoproject.com/weblog/2012/oct/17/security/</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-24</entry>
</dates>
</vuln>
<vuln vid="a7706414-1be7-11e2-9aad-902b343deec9">
<topic>Wireshark -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>wireshark-lite</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>tshark</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>tshark-lite</name>
<range><le>1.8.2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html">
<p>The HSRP dissector could go into an infinite loop.</p>
<p>The PPP dissector could abort.</p>
<p>Martin Wilck discovered an infinite loop in the DRDA
dissector.</p>
<p>Laurent Butti discovered a buffer overflow in the LDP
dissector.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5237</cvename>
<cvename>CVE-2012-5238</cvename>
<cvename>CVE-2012-5239</cvename>
<cvename>CVE-2012-5240</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-26.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-27.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-28.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-29.html</url>
<url>http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html</url>
</references>
<dates>
<discovery>2012-10-02</discovery>
<entry>2012-10-22</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="57652765-18aa-11e2-8382-00a0d181e71d">
<topic>xlockmore -- local exploit</topic>
<affects>
<package>
<name>xlockmore</name>
<range><lt>5.40_1</lt></range>
</package>
<package>
<name>ja-xlockmore</name>
<range><lt>5.40_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ignatios Souvatzis of NetBSD reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/10/17/10">
<p>Due to an error in the dclock screensaver in xlockmore, users who
explicitly use this screensaver or a random mix of screensavers using
something like "xlockmore -mode random" may have their screen unlocked
unexpectedly at a random time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4524</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/17/10</mlist>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-17</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="e11955ca-187c-11e2-be36-00215af774f0">
<topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic>
<affects>
<package>
<name>xinetd</name>
<range><lt>2.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Swan reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940">
<p>xinetd allows for services to be configured with the TCPMUX
or TCPMUXPLUS service types, which makes those services
available on port 1, as per RFC 1078 [1], if the tcpmux-server
service is enabled. When the tcpmux-server service is enabled,
xinetd would expose _all_ enabled services via the tcpmux port,
instead of just the configured service(s). This could allow
a remote attacker to bypass firewall restrictions and access
services via the tcpmux port.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0862</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url>
</references>
<dates>
<discovery>2012-02-15</discovery>
<entry>2012-10-17</entry>
</dates>
</vuln>
<vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32">
<topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.11.13</lt></range>
</package>
<package>
<name>magento</name>
<range><lt>1.7.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2012-01">
<p>The XmlRpc package of Zend Framework is vulnerable to XML
eXternal Entity Injection attacks (both server and client).
The SimpleXMLElement class (SimpleXML PHP extension) is used
in an insecure way to parse XML data. External entities can be
specified by adding a specific DOCTYPE element to XML-RPC
requests. By exploiting this vulnerability an application may be
coerced to open arbitrary files and/or TCP connections.</p>
<p>Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and
Zend_XmlRpc components are vulnerable to XML Entity Expansion
(XEE) vectors, leading to Denial of Service vectors. XEE attacks
occur when the XML DOCTYPE declaration includes XML entity
definitions that contain either recursive or circular references;
this leads to CPU and memory consumption, making Denial of
Service exploits trivial to implement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3363</cvename>
<url>https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt</url>
<url>http://framework.zend.com/security/advisory/ZF2012-01</url>
<url>http://framework.zend.com/security/advisory/ZF2012-02</url>
<url>http://www.openwall.com/lists/oss-security/2012/06/26/2</url>
<url>https://secunia.com/advisories/49665/</url>
<url>http://www.magentocommerce.com/download/release_notes</url>
</references>
<dates>
<discovery>2012-06-26</discovery>
<entry>2012-10-16</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="f94befcd-1289-11e2-a25e-525400272390">
<topic>gitolite -- path traversal vulnerability</topic>
<affects>
<package>
<name>gitolite</name>
<range><ge>3.01</ge><le>3.04</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sitaram Chamarty reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion">
<p>I'm sorry to say there is a potential path traversal vulnerability in
v3. Thanks to Stephane Chazelas for finding it and alerting me.</p>
<p>Can it affect you? This can only affect you if you are using wild
card repos, *and* at least one of your patterns allows the string
"../" to match multiple times.</p>
<p>How badly can it affect you? A malicious user who *also* has the
ability to create arbitrary files in, say, /tmp (e.g., he has his own
userid on the same box), can compromise the entire "git" user.
Otherwise the worst he can do is create arbitrary repos in /tmp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4506</cvename>
<mlist msgid="CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com">https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion</mlist>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2012-10-15</entry>
</dates>
</vuln>
<vuln vid="ef417da3-1640-11e2-999b-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php">
<p>When creating/modifying a trigger, event or procedure
with a crafted name, it is possible to trigger an XSS.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php">
<p>To display information about the current phpMyAdmin
version on the main page, a piece of JavaScript is fetched
from the phpmyadmin.net website in non-SSL mode. A
man-in-the-middle could modify this script on the wire to
cause mischief.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5339</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php</url>
<cvename>CVE-2012-5368</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-10-14</entry>
</dates>
</vuln>
<vuln vid="6e5a9afd-12d3-11e2-b47d-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>16.0.1,1</lt></range>
<range><lt>10.0.9,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.9,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.13.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.13.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>16.0.1</lt></range>
<range><lt>10.0.9</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/
rv:10.0.8)</p>
<p>MFSA 2012-75 select element persistance allows for attacks</p>
<p>MFSA 2012-76 Continued access to initial origin after setting
document.domain</p>
<p>MFSA 2012-77 Some DOMWindowUtils methods bypass security checks</p>
<p>MFSA 2012-78 Reader Mode pages have chrome privileges</p>
<p>MFSA 2012-79 DOS and crash with full screen and history navigation</p>
<p>MFSA 2012-80 Crash with invalid cast when using instanceof
operator</p>
<p>MFSA 2012-81 GetProperty function can bypass security checks</p>
<p>MFSA 2012-82 top object and location property accessible by
plugins</p>
<p>MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces
to privileged functions or properties</p>
<p>MFSA 2012-84 Spoofing and script injection through location.hash</p>
<p>MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds
read issues found using Address Sanitizer</p>
<p>MFSA 2012-86 Heap memory corruption issues found using Address
Sanitizer</p>
<p>MFSA 2012-87 Use-after-free in the IME State Manager</p>
<p>MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)</p>
<p>MFSA 2012-89 defaultValue security checks not applied</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3982</cvename>
<cvename>CVE-2012-3983</cvename>
<cvename>CVE-2012-3984</cvename>
<cvename>CVE-2012-3985</cvename>
<cvename>CVE-2012-3986</cvename>
<cvename>CVE-2012-3987</cvename>
<cvename>CVE-2012-3988</cvename>
<cvename>CVE-2012-3989</cvename>
<cvename>CVE-2012-3990</cvename>
<cvename>CVE-2012-3991</cvename>
<cvename>CVE-2012-3992</cvename>
<cvename>CVE-2012-3993</cvename>
<cvename>CVE-2012-3994</cvename>
<cvename>CVE-2012-3995</cvename>
<cvename>CVE-2012-4179</cvename>
<cvename>CVE-2012-4180</cvename>
<cvename>CVE-2012-4181</cvename>
<cvename>CVE-2012-4182</cvename>
<cvename>CVE-2012-4183</cvename>
<cvename>CVE-2012-4184</cvename>
<cvename>CVE-2012-4186</cvename>
<cvename>CVE-2012-4187</cvename>
<cvename>CVE-2012-4188</cvename>
<cvename>CVE-2012-4190</cvename>
<cvename>CVE-2012-4191</cvename>
<cvename>CVE-2012-4192</cvename>
<cvename>CVE-2012-4193</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-74.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-75.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-76.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-77.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-78.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-79.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-80.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-81.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-82.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-83.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-84.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-85.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-86.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-87.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-88.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-89.html</url>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2012-10-10</entry>
<modified>2012-10-11</modified>
</dates>
</vuln>
<vuln vid="57a700f9-12c0-11e2-9f86-001d923933b6">
<topic>dns/bind9* -- crash on deliberately constructed combination of records</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.4</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.1.4</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.4</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.3.4</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.4</lt></range>
</package>
<package>
<name>bind97-base</name>
<range><lt>9.7.6.4</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00801/">
<p>A deliberately constructed combination of records could cause named
to hang while populating the additional section of a response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5166</cvename>
</references>
<dates>
<discovery>2012-09-26</discovery>
<entry>2012-10-10</entry>
</dates>
</vuln>
<vuln vid="dee44ba9-08ab-11e2-a044-d0df9acfd7e5">
<topic>OpenX -- SQL injection vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/50598/">
<p>A vulnerability has been discovered in OpenX, which can be
exploited by malicious people to conduct SQL injection
attacks.</p>
<p>Input passed via the "xajaxargs" parameter to
www/admin/updates-history.php (when "xajax" is set to
"expandOSURow") is not properly sanitised in e.g. the
"queryAuditBackupTablesByUpgradeId()" function
(lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.</p>
<p>The vulnerability is confirmed in version 2.8.9. Prior versions
may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/50598/</url>
</references>
<dates>
<discovery>2012-09-14</discovery>
<entry>2012-09-27</entry>
</dates>
</vuln>
<vuln vid="73efb1b7-07ec-11e2-a391-000c29033c32">
<topic>eperl -- Remote code execution</topic>
<affects>
<package>
<name>eperl</name>
<range><le>2.2.14_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Madison reports:</p>
<blockquote cite="http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml">
<p>ePerl is a multipurpose Perl filter and interpreter program
for Unix systems. The ePerl preprocessor contains an input
validation error. The preprocessor allows foreign data to be
"safely" included using the 'sinclude' directive.</p>
<p>The problem occurs when a file referenced by a 'sinclude'
directive contains a 'include' directive; the contents of
the file referred to by the second directive will be loaded
and executed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2001-0733</cvename>
<url>http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml</url>
<bid>2912</bid>
<url>http://xforce.iss.net/xforce/xfdb/6743</url>
<url>http://osvdb.org/show/osvdb/1880</url>
</references>
<dates>
<discovery>2001-06-21</discovery>
<entry>2012-09-26</entry>
</dates>
</vuln>
<vuln vid="98690c45-0361-11e2-a391-000c29033c32">
<topic>ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file</topic>
<affects>
<package>
<name>ImageMagick</name>
<range><le>6.7.8.6</le></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><le>6.7.8.6</le></range>
</package>
<package>
<name>GraphicsMagick</name>
<range><ge>1.3.0</ge><le>1.3.16</le></range>
</package>
<package>
<name>GraphicsMagick-nox11</name>
<range><ge>1.3.0</ge><le>1.3.16</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Seifried reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=844105">
<p>There is an issue in ImageMagick that is also present in
GraphicsMagick. CVE-2011-3026 deals with libpng memory
allocation, and limitations have been added so that a bad PNG
can't cause the system to allocate a lot of memory and a
denial of service. However on further investigation of
ImageMagick, Tom Lane found that PNG malloc function
(Magick_png_malloc) in turn calls AcquireMagickMemory with an
improper size argument.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3438</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=844105</url>
<bid>54716</bid>
<url>http://secunia.com/advisories/50090</url>
<url>http://xforce.iss.net/xforce/xfdb/77259</url>
<url>http://osvdb.org/show/osvdb/84323</url>
</references>
<dates>
<discovery>2012-07-28</discovery>
<entry>2012-09-20</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="ec255bd8-02c6-11e2-92d1-000d601460a4">
<topic>php5-sqlite -- open_basedir bypass</topic>
<affects>
<package>
<name>php5-sqlite</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.15</lt></range>
</package>
<package>
<name>php52-sqlite</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53-sqlite</name>
<range><lt>5.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365">
<p>The SQLite functionality in PHP before 5.3.15 allows remote
attackers to bypass the open_basedir protection mechanism via
unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3365</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365</url>
</references>
<dates>
<discovery>2012-06-14</discovery>
<entry>2012-09-19</entry>
</dates>
</vuln>
<vuln vid="9b2a5e88-02b8-11e2-92d1-000d601460a4">
<topic>php5 -- Denial of Service in php_date_parse_tzfile()</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.9</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789">
<p>Memory leak in the timezone functionality in PHP before 5.3.9
allows remote attackers to cause a denial of service (memory
consumption) by triggering many strtotime function calls, which are
not properly handled by the php_date_parse_tzfile cache.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0789</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789</url>
<url>https://bugs.php.net/bug.php?id=53502</url>
</references>
<dates>
<discovery>2010-12-08</discovery>
<entry>2012-09-19</entry>
</dates>
</vuln>
<vuln vid="53a0ddef-0208-11e2-8afa-0024e830109b">
<topic>dns/bind9* -- Several vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.3</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.3</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.3</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00788">
<p>Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.</p>
<p>Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.</p>
<p>ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.</p>
<p>A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.</p>
</blockquote>
</body>
</description>
<references>
<url/>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-18</entry>
</dates>
</vuln>
<vuln vid="d846af5b-00f4-11e2-b6d0-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.482</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17">
<p>This advisory announces security vulnerabilities that were found
in Jenkins core and several plugins.</p>
<ol>
<li>The first vulnerability in Jenkins core allows unprivileged
users to insert data into Jenkins master, which can lead to
remote code execution. For this vulnerability to be exploited,
the attacker must have an HTTP access to a Jenkins master, and
he must have a read access to Jenkins.</li>
<li>The second vulnerability in Jenkins core is a cross-site
scripting vulnerability. This allows an attacker to craft an URL
that points to Jenkins, and if a legitimate user clicks this link,
and the attacker will be able to hijack the user session.</li>
<li>The third vulnerability is a cross-site scripting vulnerability
in the Violations plugin</li>
<li>The fourth vulnerability is a cross-site scripting vulnerability
in The Continuous Integration Game plugin</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17</url>
</references>
<dates>
<discovery>2012-09-17</discovery>
<entry>2012-09-17</entry>
</dates>
</vuln>
<vuln vid="62f36dfd-ff56-11e1-8821-001b2134ef46">
<topic>vlc -- arbitrary code execution in Real RTSP and MMS support</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.0.1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1201.html">
<p>If successful, a malicious third party could crash the VLC
media player process. Arbitrary code execution could be possible
on some systems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1201.html</url>
<url>http://www.videolan.org/security/sa1202.html</url>
<cvename>CVE-2012-1775</cvename>
<cvename>CVE-2012-1776</cvename>
</references>
<dates>
<discovery>2012-03-12</discovery>
<entry>2012-09-15</entry>
</dates>
</vuln>
<vuln vid="143f6932-fedb-11e1-ad4a-003067b2972c">
<topic>bacula -- Console ACL Bypass</topic>
<affects>
<package>
<name>bacula</name>
<range><lt>5.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://secunia.com/advisories/50535/">
<p>A security issue has been reported in Bacula, which can be
exploited by malicious users to bypass certain security
restrictions.</p>
<p>The security issue is caused due to an error within the implementation
of console ACLs, which can be exploited to gain access to certain
restricted functionality and e.g. dump resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4430</cvename>
<url>http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905</url>
<url>https://secunia.com/advisories/50535/</url>
<url>http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view</url>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-15</entry>
</dates>
</vuln>
<vuln vid="178ba4ea-fd40-11e1-b2ae-001fd0af1a4c">
<topic>mod_pagespeed -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mod_pagespeed</name>
<range><lt>0.10.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Reports:</p>
<blockquote cite="https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6">
<p>mod_pagespeed 0.10.22.6 is a security update that fixes two
critical issues that affect earlier versions:</p>
<ul>
<li>CVE-2012-4001, a problem with validation of own host name.</li>
<li>CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.</li>
</ul>
<p>The effect of the first problem is that it is possible to confuse
mod_pagespeed about its own host name, and to trick it into
fetching resources from other machines. This could be an issue if
the HTTP server has access to machines that are not otherwise
publicly visible.</p>
<p>The second problem would permit a hostile third party to execute
JavaScript in users' browsers in context of the domain running
mod_pagespeed, which could permit interception of users' cookies or
data on the site.</p>
<p>Because of the severity of the two problems, users are strongly
encouraged to update immediately.</p>
<p>Behavior Changes in the Update:</p>
<p>As part of the fix to the first issue, mod_pagespeed will not fetch
resources from machines other than localhost if they are not
explicitly mentioned in the configuration. This means that if you
need resources on the server's domain to be handled by some other
system, you'll need to explicitly use ModPagespeedMapOriginDomain
or ModPagespeedDomain to authorize that.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4001</cvename>
<cvename>CVE-2012-4360</cvename>
<url>https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6</url>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-12</entry>
</dates>
</vuln>
<vuln vid="3bbbe3aa-fbeb-11e1-8bd8-0022156e8794">
<topic>freeradius -- arbitrary code execution for TLS-based authentication</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>2.1.10</ge><lt>2.1.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freeRADIUS security team reports:</p>
<blockquote cite="http://freeradius.org/security.html">
<p>Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.</p>
<p>The issue was found by Timo Warns, and communicated to
security@freeradius.org. A sample exploit for the issue was
included in the notification.</p>
<p>The vulnerability was created in commit a368a6f4f4aaf on
August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11,
and 2.1.12. Also anyone running the git "master" branch
after August 18, 2010 is vulnerable.</p>
<p>All sites using TLS-based EAP methods and the above
versions are vulnerable. The only configuration change which
can avoid the issue is to disable EAP-TLS, EAP-TTLS, and
PEAP.</p>
<p>An external attacker can use this vulnerability to
over-write the stack frame of the RADIUS server, and cause
it to crash. In addition, more sophisticated attacks may
gain additional privileges on the system running the RADIUS
server.</p>
<p>This attack does not require local network access to the
RADIUS server. It can be done by an attacker through a WiFi
Access Point, so long as the Access Point is configured to
use 802.1X authentication with the RADIUS server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3547</cvename>
<url>http://freeradius.org/security.html</url>
<url>http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt</url>
</references>
<dates>
<discovery>2012-09-10</discovery>
<entry>2012-09-11</entry>
<modified>2012-09-11</modified>
</dates>
</vuln>
<vuln vid="c1e5f35e-f93d-11e1-b07f-00235a5f2c9a">
<topic>emacs -- remote code execution vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<range><gt>24.*</gt><lt>24.2</lt></range>
<range><gt>23.*</gt><le>23.4_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chong Yidong reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/08/13/1">
<p>Paul Ling has found a security flaw in the file-local
variables code in GNU Emacs.</p>
<p>When the Emacs user option `enable-local-variables' is
set to `:safe' (the default value is t), Emacs should
automatically refuse to evaluate `eval' forms in file-local
variable sections. Due to the bug, Emacs instead
automatically evaluates such `eval' forms. Thus, if the user
changes the value of `enable-local-variables' to `:safe',
visiting a malicious file can cause automatic execution of
arbitrary Emacs Lisp code with the permissions of the
user.</p>
<p>The bug is present in Emacs 23.2, 23.3, 23.4, and
24.1.</p>
</blockquote>
</body>
</description>
<references>
<bid>54969</bid>
<cvename>CVE-2012-3479</cvename>
<url>https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html</url>
<url>http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155</url>
</references>
<dates>
<discovery>2012-08-13</discovery>
<entry>2012-09-08</entry>
<modified>2013-05-13</modified>
</dates>
</vuln>
<vuln vid="30149157-f926-11e1-95cd-001fd0af1a4c">
<topic>wordpress -- multiple unspecified privilege escalation bugs</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="http://wordpress.org/news/2012/09/wordpress-3-4-2/">
<p>Version 3.4.2 also fixes a few security issues and contains some
security hardening. The vulnerabilities included potential
privilege escalation and a bug that affects multisite installs with
untrusted users. These issues were discovered and fixed by the
WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<url>http://wordpress.org/news/2012/09/wordpress-3-4-2/</url>
</references>
<dates>
<discovery>2012-09-06</discovery>
<entry>2012-09-07</entry>
</dates>
</vuln>
<vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794">
<topic>moinmoin -- cross-site scripting via RST parser</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">
<p>Cross-site scripting (XSS) vulnerability in the
reStructuredText (rst) parser in parser/text_rst.py in
MoinMoin before 1.9.4, when docutils is installed or when
"format rst" is set, allows remote attackers to inject
arbitrary web script or HTML via a javascript: URL in the
refuri attribute.</p>
</blockquote>
</body>
</description>
<references>
<bid>46476</bid>
<cvename>CVE-2011-1058</cvename>
<url>http://moinmo.in/SecurityFixes</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2012-09-05</entry>
</dates>
</vuln>
<vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794">
<topic>moinmoin -- wrong processing of group membership</topic>
<affects>
<package>
<name>moinmoin</name>
<range><ge>1.9</ge><lt>1.9.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin developers report:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16">
<p>If you have group NAMES containing "All" or "Known" or
"Trusted", they behaved wrong until now (they erroneously
included All/Known/Trusted users even if you did not list
them as members), but will start working correctly with this
changeset.</p>
<p>E.g. AllFriendsGroup:</p>
<ul>
<li>JoeDoe</li>
</ul>
<p>AllFriendsGroup will now (correctly) include only JoeDoe.
It (erroneously) contained all users (including JoeDoe)
before.</p>
<p>E.g. MyTrustedFriendsGroup:</p>
<ul>
<li>JoeDoe</li>
</ul>
<p>MyTrustedFriendsGroup will now (correctly) include only
JoeDoe. It (erroneously) contained all trusted users and
JoeDoe before.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4404</cvename>
<url>http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16</url>
</references>
<dates>
<discovery>2012-09-03</discovery>
<entry>2012-09-05</entry>
<modified>2012-09-11</modified>
</dates>
</vuln>
<vuln vid="918f38cd-f71e-11e1-8bd8-0022156e8794">
<topic>php5 -- header splitting attack via carriage-return character</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.11</lt></range>
<range><ge>5.4</ge><lt>5.4.1</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rui Hirokawa reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=60227">
<p>As of PHP 5.1.2, header() can no longer be used to send
multiple response headers in a single call to prevent the
HTTP Response Splitting Attack. header() only checks the
linefeed (LF, 0x0A) as line-end marker, it doesn't check the
carriage-return (CR, 0x0D).</p>
<p>However, some browsers including Google Chrome, IE also
recognize CR as the line-end.</p>
<p>The current specification of header() still has the
vulnerability against the HTTP header splitting attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1398</cvename>
<url>https://bugs.php.net/bug.php?id=60227</url>
</references>
<dates>
<discovery>2011-11-06</discovery>
<entry>2012-09-05</entry>
<modified>2012-09-19</modified>
</dates>
</vuln>
<vuln vid="b50913ce-f4a7-11e1-b135-003067b2972c">
<topic>bitcoin -- denial of service</topic>
<affects>
<package>
<name>bitcoin</name>
<range><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://bitcointalk.org/?topic=88734">
<p>A unspecified denial-of-service attack that could cause the
bitcoin process to become unresponsive was found.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3789</cvename>
<url>https://bitcointalk.org/?topic=88734</url>
</references>
<dates>
<discovery>2012-07-20</discovery>
<entry>2012-09-02</entry>
</dates>
</vuln>
<vuln vid="6ad18fe5-f469-11e1-920d-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.11</lt></range>
<range><ge>4.0.0</ge><lt>4.0.8</lt></range>
<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.10/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>LDAP Injection</h1>
<p>When the user logs in using LDAP, the username is not
escaped when building the uid=$username filter which is
used to query the LDAP directory. This could potentially
lead to LDAP injection.</p>
<h1>Directory Browsing</h1>
<p>Extensions are not protected against directory browsing
and users can access the source code of the templates
which may contain sensitive data.
Directory browsing is blocked in Bugzilla 4.3.3 only,
because it requires a configuration change in the Apache
httpd.conf file to allow local .htaccess files to use
Options -Indexes. To not break existing installations,
this fix has not been backported to stable branches.
The access to templates is blocked for all supported
branches except the old 3.6 branch, because this branch
doesn't have .htaccess in the bzr repository and cannot
be fixed easily for existing installations without
potentially conflicting with custom changes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3981</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785470</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785522</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785511</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="342176a8-f464-11e1-8bd8-0022156e8794">
<topic>GNU gatekeeper -- denial of service</topic>
<affects>
<package>
<name>gatekeeper</name>
<range><lt>3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Willamowius reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534">
<p>GNU Gatekeeper before 3.1 does not limit the number
of connections to the status port, which allows remote
attackers to cause a denial of service (connection and
thread consumption) via a large number of connections.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3534</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534</url>
<url>http://www.openwall.com/lists/oss-security/2012/08/25/4</url>
<url>http://www.gnugk.org/gnugk-3.1.html</url>
</references>
<dates>
<discovery>2012-08-15</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="7c0fecd6-f42f-11e1-b17b-000c2977ec30">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><ge>1.19</ge><lt>1.19.2</lt></range>
<range><ge>1.18</ge><lt>1.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html">
<p>(Bug 39700) Wikipedia administrator Writ Keeper discovered
a stored XSS (HTML injection) vulnerability. This was
possible due to the handling of link text on File: links for
nonexistent files. MediaWiki 1.16 and later is affected.</p>
<p>(Bug 39180) User Fomafix reported several DOM-based XSS
vulnerabilities, made possible by a combination of loose
filtering of the uselang parameter, and JavaScript gadgets
on various language Wikipedias.</p>
<p>(Bug 39180) During internal review, it was discovered that
CSRF tokens, available via the api, were not protected with
X-Frame-Options headers. This could lead to a CSRF vulnerability
if the API response is embedded in an external website using
using an iframe.</p>
<p>(Bug 39824) During internal review, it was discovered extensions
were not always allowed to prevent the account creation action.
This allowed users blocked by the GlobalBlocking extension to
create accounts.</p>
<p>(Bug 39184) During internal review, it was discovered that
password data was always saved to the local MediaWiki database
even if authentication was handled by an extension, such as LDAP.
This could allow a compromised MediaWiki installation to leak
information about user's LDAP passwords. Additionally, in situations
when an authentication plugin returned false in its strict
function, this would allow old passwords to be used for accounts
that did not exist in the external system, indefinitely.</p>
<p>(Bug 39823) During internal review, it was discovered that metadata
about blocks, hidden by a user with suppression rights, was visible
to administrators.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39700</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=37587</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39180</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39824</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39184</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39823</url>
<cvename>CVE-2012-4377</cvename>
<cvename>CVE-2012-4378</cvename>
<cvename>CVE-2012-4379</cvename>
<cvename>CVE-2012-4380</cvename>
<cvename>CVE-2012-4381</cvename>
<cvename>CVE-2012-4382</cvename>
</references>
<dates>
<discovery>2012-08-27</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="5415f1b3-f33d-11e1-8bd8-0022156e8794">
<topic>wireshark -- denial of service in DRDA dissector</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=849926">
<p>A denial of service flaw was found in the way Distributed
Relational Database Architecture (DRDA) dissector of
Wireshark, a network traffic analyzer, performed processing
of certain DRDA packet capture files. A remote attacker
could create a specially-crafted capture file that, when
opened could lead to wireshark executable to consume
excessive amount of CPU time and hang with an infinite
loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3548</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=849926</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-08-31</entry>
<modified>2012-09-05</modified>
</dates>
</vuln>
<vuln vid="4c53f007-f2ed-11e1-a215-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><gt>10.*</gt><lt>10.7.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Asterisk Manager User Unauthorized Shell Access</p>
<p>ACL rules ignored when placing outbound calls by certain IAX2
users</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2186</cvename>
<cvename>CVE-2012-4737</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-012.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-013.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="2b8cad90-f289-11e1-a215-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>15.0,1</lt></range>
<range><lt>10.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.7,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>15.0</lt></range>
<range><lt>10.0.7</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/
rv:10.0.7)</p>
<p>MFSA 2012-58 Use-after-free issues found using Address
Sanitizer</p>
<p>MFSA 2012-59 Location object can be shadowed using
Object.defineProperty</p>
<p>MFSA 2012-60 Escalation of privilege through about:newtab</p>
<p>MFSA 2012-61 Memory corruption with bitmap format images with
negative height</p>
<p>MFSA 2012-62 WebGL use-after-free and memory corruption</p>
<p>MFSA 2012-63 SVG buffer overflow and use-after-free issues</p>
<p>MFSA 2012-64 Graphite 2 memory corruption</p>
<p>MFSA 2012-65 Out-of-bounds read in format-number in XSLT</p>
<p>MFSA 2012-66 HTTPMonitor extension allows for remote debugging
without explicit activation</p>
<p>MFSA 2012-67 Installer will launch incorrect executable following
new installation</p>
<p>MFSA 2012-68 DOMParser loads linked resources in extensions when
parsing text/html</p>
<p>MFSA 2012-69 Incorrect site SSL certificate data display</p>
<p>MFSA 2012-70 Location object security checks bypassed by chrome
code</p>
<p>MFSA 2012-71 Insecure use of __android_log_print</p>
<p>MFSA 2012-72 Web console eval capable of executing
chrome-privileged code</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1956</cvename>
<cvename>CVE-2012-1970</cvename>
<cvename>CVE-2012-1971</cvename>
<cvename>CVE-2012-1972</cvename>
<cvename>CVE-2012-1973</cvename>
<cvename>CVE-2012-1974</cvename>
<cvename>CVE-2012-1975</cvename>
<cvename>CVE-2012-1976</cvename>
<cvename>CVE-2012-3956</cvename>
<cvename>CVE-2012-3957</cvename>
<cvename>CVE-2012-3958</cvename>
<cvename>CVE-2012-3959</cvename>
<cvename>CVE-2012-3960</cvename>
<cvename>CVE-2012-3961</cvename>
<cvename>CVE-2012-3962</cvename>
<cvename>CVE-2012-3963</cvename>
<cvename>CVE-2012-3964</cvename>
<cvename>CVE-2012-3965</cvename>
<cvename>CVE-2012-3966</cvename>
<cvename>CVE-2012-3967</cvename>
<cvename>CVE-2012-3968</cvename>
<cvename>CVE-2012-3969</cvename>
<cvename>CVE-2012-3970</cvename>
<cvename>CVE-2012-3971</cvename>
<cvename>CVE-2012-3972</cvename>
<cvename>CVE-2012-3973</cvename>
<cvename>CVE-2012-3974</cvename>
<cvename>CVE-2012-3975</cvename>
<cvename>CVE-2012-3976</cvename>
<cvename>CVE-2012-3978</cvename>
<cvename>CVE-2012-3979</cvename>
<cvename>CVE-2012-3980</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-57.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-58.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-59.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-60.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-61.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-62.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-63.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-64.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-65.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-66.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-67.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-68.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-69.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-70.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-71.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-72.html</url>
</references>
<dates>
<discovery>2012-08-28</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="6dd5e45c-f084-11e1-8d0f-406186f3d89d">
<topic>coppermine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.5.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Coppermine Team reports:</p>
<blockquote cite="http://forum.coppermine-gallery.net/index.php/topic,74682.0.html">
<p>The release covers several path disclosure vulnerabilities. If
unpatched, it's possible to generate an error that will reveal the
full path of the script. A remote user can determine the full path
to the web root directory and other potentially sensitive
information. Furthermore, the release covers a recently discovered
XSS vulnerability that allows (if unpatched) a malevolent visitor to
include own script routines under certain conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1613</cvename>
<cvename>CVE-2012-1614</cvename>
<mlist>http://seclists.org/oss-sec/2012/q2/11</mlist>
<url>http://forum.coppermine-gallery.net/index.php/topic,74682.0.html</url>
</references>
<dates>
<discovery>2012-03-29</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="16846d1e-f1de-11e1-8bd8-0022156e8794">
<topic>Java 1.7 -- security manager bypass</topic>
<affects>
<package>
<name>openjdk</name>
<range><ge>7.0</ge><lt>7.6.24_1</lt></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>7.0</ge><lt>7.7</lt></range>
</package>
<package>
<name>linux-sun-jre</name>
<range><ge>7.0</ge><lt>7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/636312">
<p>Oracle Java Runtime Environment (JRE) 1.7 contains a
vulnerability that may allow an applet to call
setSecurityManager in a way that allows setting of arbitrary
permissions.</p>
<p>By leveraging the public, privileged getField() function,
an untrusted Java applet can escalate its privileges by
calling the setSecurityManager() function to allow full
privileges, without requiring code signing.</p>
<p>This vulnerability is being actively exploited in the
wild, and exploit code is publicly available.</p>
</blockquote>
<p>This exploit does not only affect Java applets, but every
piece of software that relies on the Java Security Manager for
sandboxing executable code is affected: malicious code can
totally disable Security Manager.</p>
</body>
</description>
<references>
<cvename>CVE-2012-4681</cvename>
<certvu>636312</certvu>
<url>http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html</url>
<url>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html</url>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html</url>
</references>
<dates>
<discovery>2012-08-27</discovery>
<entry>2012-08-30</entry>
<modified>2012-08-31</modified>
</dates>
</vuln>
<vuln vid="18ce9a90-f269-11e1-be53-080027ef73ec">
<topic>fetchmail -- chosen plaintext attack against SSL CBC initialization vectors</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.9</ge><lt>6.3.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-01.txt">
<p>Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL)
which contains a switch to disable a countermeasure against certain
attacks against block ciphers that permit guessing the
initialization vectors, providing that an attacker can make the
application (fetchmail) encrypt some data for him -- which is not
easily the case.</p>
<p>Stream ciphers (such as RC4) are unaffected.</p>
<p>Credits to Apple Product Security for reporting this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3389</cvename>
</references>
<dates>
<discovery>2012-01-19</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="c906e0a4-efa6-11e1-8fbf-001b77d09812">
<topic>roundcube -- cross-site scripting in HTML email messages</topic>
<affects>
<package>
<name>roundcube</name>
<range><ge>0.8.0,1</ge><lt>0.8.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube branch 0.8.x prior to the version 0.8.1 is prone
to the cross-scripting attack (XSS) originating from incoming
HTML e-mails: due to the lack of proper sanitization
of JavaScript code inside the "href" attribute, sender
could launch XSS attack when recipient opens the message
in RoundCube interface.</p>
</body>
</description>
<references>
<cvename>CVE-2012-3508</cvename>
<url>http://trac.roundcube.net/wiki/Changelog</url>
<url>http://trac.roundcube.net/ticket/1488613</url>
</references>
<dates>
<discovery>2012-08-14</discovery>
<entry>2012-08-27</entry>
</dates>
</vuln>
<vuln vid="aa4d3d73-ef17-11e1-b593-00269ef07d24">
<topic>Calligra, KOffice -- input validation failure</topic>
<affects>
<package>
<name>koffice</name>
<range><le>1.6.3_18,2</le></range>
</package>
<package>
<name>koffice-kde4</name>
<range><le>2.3.3_7</le></range>
</package>
<package>
<name>calligra</name>
<range><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20120810-1.txt">
<p>A flaw has been found which can allow malicious code to take
advantage of an input validation failure in the Microsoft import
filter in Calligra and KOffice. Exploitation can allow the attacker
to gain control of the running process and execute code on its
behalf.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3455</cvename>
<cvename>CVE-2012-3456</cvename>
<url>http://www.kde.org/info/security/advisory-20120810-1.txt</url>
<url>http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf</url>
</references>
<dates>
<discovery>2012-08-10</discovery>
<entry>2012-08-26</entry>
</dates>
</vuln>
<vuln vid="ce680f0a-eea6-11e1-8bd8-0022156e8794">
<topic>squidclamav -- cross-site scripting in default virus warning pages</topic>
<affects>
<package>
<name>squidclamav</name>
<range><lt>5.8</lt></range>
<range><ge>6.0</ge><lt>6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquidClamav developers report:</p>
<blockquote cite="http://squidclamav.darold.net/news.html">
<p>This release fix several security issues by escaping CGI
parameters.</p>
</blockquote>
<p>Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not
properly sanitizing input variables, so they could be used to
inject arbitrary strings to the generated page, leading
to the cross-site scripting attacks.</p>
</body>
</description>
<references>
<cvename>CVE-2012-4667</cvename>
<url>http://squidclamav.darold.net/news.html</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-25</entry>
</dates>
</vuln>
<vuln vid="8defa0f9-ee8a-11e1-8bd8-0022156e8794">
<topic>squidclamav -- Denial of Service</topic>
<affects>
<package>
<name>squidclamav</name>
<range><lt>5.7_1</lt></range>
<range><ge>6.0</ge><lt>6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquidClamav developers report:</p>
<blockquote cite="http://squidclamav.darold.net/news.html">
<p>Add a workaround for a squidGuard bug that unescape
the URL and send it back unescaped. This result in garbage
staying into pipe of the system command call and could crash
squidclamav on next read or return false information.
This is specially true with URL containing the %0D or %0A
character.</p>
</blockquote>
<p>This vulnerability can be triggered only in configurations
where external chained URL checker is configured via
"squidguard" directive.</p>
</body>
</description>
<references>
<cvename>CVE-2012-3501</cvename>
<url>http://squidclamav.darold.net/news.html</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-25</entry>
<modified>2012-09-04</modified>
</dates>
</vuln>
<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
<topic>inn -- plaintext command injection into encrypted channel</topic>
<affects>
<package>
<name>inn</name>
<range><lt>2.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>INN developers report:</p>
<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
<p>Fixed a possible plaintext command injection during the
negotiation of a TLS layer. The vulnerability detailed
in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
commands. nnrpd now resets its read buffer upon
a successful negotiation of a TLS layer. It prevents
malicious commands, sent unencrypted, from being executed
in the new encrypted state of the session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3523</cvename>
<cvename>CVE-2011-0411</cvename>
<url>https://www.isc.org/software/inn/2.5.3article</url>
</references>
<dates>
<discovery>2012-08-14</discovery>
<entry>2012-08-25</entry>
</dates>
</vuln>
<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
<topic>jabberd -- domain spoofing in server dialback protocol</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.2.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>XMPP Standards Foundation reports:</p>
<blockquote cite="http://xmpp.org/resources/security-notices/server-dialback/">
<p>Some implementations of the XMPP Server Dialback protocol
(RFC 3920/XEP-0220) have not been checking dialback
responses to ensure that validated results are correlated
with requests.</p>
<p>An attacking server could spoof one or more domains in
communicating with a vulnerable server implementation,
thereby avoiding the protections built into the Server
Dialback protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3525</cvename>
<url>http://xmpp.org/resources/security-notices/server-dialback/</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-08-23</entry>
</dates>
</vuln>
<vuln vid="a4598875-ec91-11e1-8bd8-0022156e8794">
<topic>rssh -- configuration restrictions bypass</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Martin (rssh maintainer) reports:</p>
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
<p>John Barber reported a problem where, if the system
administrator misconfigures rssh by providing too few access
bits in the configuration file, the user will be given
default permissions (scp) to the entire system, potentially
circumventing any configured chroot. Fixing this required a
behavior change: in the past, using rssh without a config
file would give all users default access to use scp on an
unchrooted system. In order to correct the reported bug,
this feature has been eliminated, and you must now have a
valid configuration file. If no config file exists, all
users will be locked out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
</references>
<dates>
<discovery>2010-08-01</discovery>
<entry>2012-08-22</entry>
</dates>
</vuln>
<vuln vid="65b25acc-e63b-11e1-b81c-001b77d09812">
<topic>rssh -- arbitrary command execution</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Martin (rssh maintainer) reports:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29235647">
<p>Henrik Erkkonen has discovered that, through clever
manipulation of environment variables on the ssh command
line, it is possible to circumvent rssh. As far as I can
tell, there is no way to effect a root compromise, except of
course if the root account is the one you're attempting to
protect with rssh...</p>
</blockquote>
</body>
</description>
<references>
<bid>53430</bid>
<cvename>CVE-2012-3478</cvename>
<url>http://sourceforge.net/mailarchive/message.php?msg_id=29235647</url>
</references>
<dates>
<discovery>2012-05-08</discovery>
<entry>2012-08-22</entry>
</dates>
</vuln>
<vuln vid="c651c898-e90d-11e1-b230-0024e830109b">
<topic>libotr -- buffer overflows</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTR developers report:</p>
<blockquote cite="http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html">
<p>The otrl_base64_otr_decode() function and similar functions within OTR
suffer from buffer overflows in the case of malformed input;
specifically if a message of the format of "?OTR:===." is received
then a zero-byte allocation is performed without a similar correlation
between the subsequent base64 decoding write, as such it becomes
possible to write between zero and three bytes incorrectly to the
heap, albeit only with a value of '='.</p>
<p>Because this code path is highly utilized, specifically in the
reception of instant messages over pidgin or similar, this
vulnerability is considered severe even though in many platforms and
circumstances the bug would yield an unexploitable state and result
simply in denial of service.</p>
<p>The developers of OTR promptly fixed the errors and users of OTR are
advised to upgrade the software at the next release cycle.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3461</cvename>
<url>http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html</url>
</references>
<dates>
<discovery>2012-07-27</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="0f62be39-e8e0-11e1-bea0-002354ed89bc">
<topic>OpenTTD -- Denial of Service</topic>
<affects>
<package>
<name>openttd</name>
<range><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2012-3436">
<p>Denial of service (server) using ships on half tiles and
landscaping.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3436</cvename>
<url>http://security.openttd.org/en/CVE-2012-3436</url>
</references>
<dates>
<discovery>2012-07-25</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="4cdfe875-e8d6-11e1-bea0-002354ed89bc">
<topic>Wireshark -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>tshark</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.html">
<p>It may be possible to make Wireshark crash by injecting a
malformed packet onto the wire or by convincing someone to read a
malformed packet trace file.</p>
<p>It may be possible to make Wireshark consume excessive CPU
resources by injecting a malformed packet onto the wire or by
convincing someone to read a malformed packet trace file.</p>
<p>The PPP dissector could crash.</p>
<p>The NFS dissector could use excessive amounts of CPU.</p>
<p>The DCP ETSI dissector could trigger a zero division.</p>
<p>The MongoDB dissector could go into a large loop.</p>
<p>The XTP dissector could go into an infinite loop.</p>
<p>The ERF dissector could overflow a buffer.</p>
<p>The AFP dissector could go into a large loop.</p>
<p>The RTPS2 dissector could overflow a buffer.</p>
<p>The GSM RLC MAC dissector could overflow a buffer.</p>
<p>The CIP dissector could exhaust system memory.</p>
<p>The STUN dissector could crash.</p>
<p>The EtherCAT Mailbox dissector could abort.</p>
<p>The CTDB dissector could go into a large loop.</p>
<p>The pcap-ng file parser could trigger a zero division.</p>
<p>The Ixia IxVeriWave file parser could overflow a buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4048</cvename>
<cvename>CVE-2012-4049</cvename>
<cvename>CVE-2012-4285</cvename>
<cvename>CVE-2012-4286</cvename>
<cvename>CVE-2012-4287</cvename>
<cvename>CVE-2012-4288</cvename>
<cvename>CVE-2012-4289</cvename>
<cvename>CVE-2012-4290</cvename>
<cvename>CVE-2012-4291</cvename>
<cvename>CVE-2012-4292</cvename>
<cvename>CVE-2012-4293</cvename>
<cvename>CVE-2012-4294</cvename>
<cvename>CVE-2012-4295</cvename>
<cvename>CVE-2012-4296</cvename>
<cvename>CVE-2012-4297</cvename>
<cvename>CVE-2012-4298</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-11.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-12.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-13.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-14.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-15.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-16.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-17.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-18.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-19.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-20.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-21.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-22.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-23.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-24.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-25.html</url>
</references>
<dates>
<discovery>2012-07-22</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="07234e78-e899-11e1-b38d-0023ae8e59f0">
<topic>databases/postgresql*-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><gt>8.3.*</gt><lt>8.3.20</lt></range>
<range><gt>8.4.*</gt><lt>8.4.13</lt></range>
<range><gt>9.0.*</gt><lt>9.0.9</lt></range>
<range><gt>9.1.*</gt><lt>9.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1407/">
<p>The PostgreSQL Global Development Group today released
security updates for all active branches of the PostgreSQL
database system, including versions 9.1.5, 9.0.9, 8.4.13 and
8.3.20. This update patches security holes associated with
libxml2 and libxslt, similar to those affecting other open
source projects. All users are urged to update their
installations at the first available opportunity</p>
<p>Users who are relying on the built-in XML functionality to
validate external DTDs will need to implement a workaround, as
this security patch disables that functionality. Users who are
using xslt_process() to fetch documents or stylesheets from
external URLs will no longer be able to do so. The PostgreSQL
project regrets the need to disable both of these features in
order to maintain our security standards. These security issues
with XML are substantially similar to issues patched recently
by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5
(CVE-2012-0057) projects.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3488</cvename>
<cvename>CVE-2012-3489</cvename>
<url>http://www.postgresql.org/about/news/1407/</url>
</references>
<dates>
<discovery>2012-08-17</discovery>
<entry>2012-08-17</entry>
</dates>
</vuln>
<vuln vid="db1d3340-e83b-11e1-999b-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.5.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php">
<p>Using a crafted table name, it was possible to produce a
XSS : 1) On the Database Structure page, creating a new
table with a crafted name 2) On the Database Structure page,
using the Empty and Drop links of the crafted table name 3)
On the Table Operations page of a crafted table, using the
'Empty the table (TRUNCATE)' and 'Delete the table (DROP)'
links 4) On the Triggers page of a database containing
tables with a crafted name, when opening the 'Add Trigger'
popup 5) When creating a trigger for a table with a crafted
name, with an invalid definition. Having crafted data in a
database table, it was possible to produce a XSS : 6) When
visualizing GIS data, having a crafted label name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4345</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php</url>
</references>
<dates>
<discovery>2012-08-12</discovery>
<entry>2012-08-17</entry>
</dates>
</vuln>
<vuln vid="48bcb4b2-e708-11e1-a59d-000d601460a4">
<topic>typo3 -- Multiple vulernabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.19</lt></range>
<range><ge>4.6.0</ge><lt>4.6.12</lt></range>
<range><ge>4.7.0</ge><lt>4.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/">
<p>It has been discovered that TYPO3 Core is vulnerable to Cross-Site
Scripting, Information Disclosure, Insecure Unserialize leading to
Arbitrary Code Execution.</p>
<p>TYPO3 Backend Help System - Due to a missing signature (HMAC) for a
parameter in the view_help.php file, an attacker could unserialize
arbitrary objects within TYPO3. We are aware of a working exploit,
which can lead to arbitrary code execution. A valid backend user
login or multiple successful cross site request forgery attacks are
required to exploit this vulnerability.</p>
<p>TYPO3 Backend - Failing to properly HTML-encode user input in
several places, the TYPO3 backend is susceptible to Cross-Site
Scripting. A valid backend user is required to exploit these
vulnerabilities.</p>
<p>TYPO3 Backend - Accessing the configuration module discloses the
Encryption Key. A valid backend user with access to the
configuration module is required to exploit this vulnerability.</p>
<p>TYPO3 HTML Sanitizing API - By not removing several HTML5
JavaScript events, the API method t3lib_div::RemoveXSS() fails to
filter specially crafted HTML injections, thus is susceptible to
Cross-Site Scripting. Failing to properly encode for JavaScript the
API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site
Scripting.</p>
<p>TYPO3 Install Tool - Failing to properly sanitize user input, the
Install Tool is susceptible to Cross-Site Scripting.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/</url>
</references>
<dates>
<discovery>2012-08-15</discovery>
<entry>2012-08-15</entry>
</dates>
</vuln>
<vuln vid="83f9e943-e664-11e1-a66d-080027ef73ec">
<topic>fetchmail -- two vulnerabilities in NTLM authentication</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>5.0.8</ge><lt>6.3.21_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-02.txt">
<p>With NTLM support enabled, fetchmail might mistake a server-side
error message during NTLM protocol exchange for protocol data,
leading to a SIGSEGV.</p>
<p>Also, with a carefully crafted NTLM challenge, a malicious server
might cause fetchmail to read from a bad memory location, betraying
confidential data. It is deemed hard, although not impossible, to
steal other accounts' data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3482</cvename>
</references>
<dates>
<discovery>2012-08-12</discovery>
<entry>2012-08-14</entry>
<modified>2012-08-27</modified>
</dates>
</vuln>
<vuln vid="55b498e2-e56c-11e1-bbd5-001c25e46b1d">
<topic>Several vulnerabilities found in IcedTea-Web</topic>
<affects>
<package>
<name>icedtea-web</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The IcedTea project team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=840592">
<p>CVE-2012-3422: Use of uninitialized instance pointers</p>
<p>An uninitialized pointer use flaw was found in IcedTea-Web web
browser plugin. A malicious web page could use this flaw make
IcedTea-Web browser plugin pass invalid pointer to a web browser.
Depending on the browser used, it may cause the browser to crash
or possibly execute arbitrary code.</p>
<p>The get_cookie_info() and get_proxy_info() call
getFirstInTableInstance() with the instance_to_id_map hash as
a parameter. If instance_to_id_map is empty (which can happen
when plugin was recently removed), getFirstInTableInstance()
returns an uninitialized pointer.</p>
</blockquote>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=841345">
<p>CVE-2012-3423: Incorrect handling of non 0-terminated strings</p>
<p>It was discovered that the IcedTea-Web web browser plugin
incorrectly assumed that all strings provided by browser are NUL
terminated, which is not guaranteed by the NPAPI (Netscape Plugin
Application Programming Interface). When used in a browser that
does not NUL terminate NPVariant NPStrings, this could lead to
buffer over-read or over-write, resulting in possible information
leak, crash, or code execution.</p>
<p>Mozilla browsers currently NUL terminate strings, however recent
Chrome versions are known not to provide NUL terminated data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3422</cvename>
<cvename>CVE-2012-3423</cvename>
<mlist>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html</mlist>
</references>
<dates>
<discovery>2012-07-31</discovery>
<entry>2012-08-13</entry>
</dates>
</vuln>
<vuln vid="a14dee30-e3d7-11e1-a084-50e5492bd3dc">
<topic>libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname</topic>
<affects>
<package>
<name>py-libcloud</name>
<range><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libcloud development team reports:</p>
<blockquote cite="http://libcloud.apache.org/security.html">
<p>When establishing a secure (SSL / TLS) connection to a target server an invalid regular
expression has been used for performing the hostname verification. Subset instead of the
full target server hostname has been marked an an acceptable match for the given hostname.
For example, certificate with a hostname field of "aexample.com" was considered a valid
certificate for domain "example.com".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3446</cvename>
<url>http://seclists.org/fulldisclosure/2012/Aug/55</url>
</references>
<dates>
<discovery>2012-08-01</discovery>
<entry>2012-08-11</entry>
</dates>
</vuln>
<vuln vid="aca0d7e0-e38a-11e1-999b-e0cb4e266481">
<topic>phpMyAdmin -- Path disclosure due to missing library</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php">
<p>The show_config_errors.php script does not include a
library, so an error message shows the full path of this
file, leading to possible further attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4219</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php</url>
</references>
<dates>
<discovery>2012-08-03</discovery>
<entry>2012-08-11</entry>
</dates>
</vuln>
<vuln vid="31db9a18-e289-11e1-a57d-080027a27dbf">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/">
<p>This version contains three important security fixes, please upgrade immediately.</p>
<p>One of security fixes impacts all users and is related to HTML escaping code. The
other two fixes impacts people using select_tag's prompt option and strip_tags
helper from ActionPack.</p>
<p>CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.</p>
<p>CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.</p>
<p>CVE-2012-3465 XSS Vulnerability in strip_tags.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3463</cvename>
<cvename>CVE-2012-3464</cvename>
<cvename>CVE-2012-3465</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J</url>
<url>http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/</url>
</references>
<dates>
<discovery>2012-08-08</discovery>
<entry>2012-08-10</entry>
</dates>
</vuln>
<vuln vid="8675efd5-e22c-11e1-a808-002354ed89bc">
<topic>sudosh -- buffer overflow</topic>
<affects>
<package>
<name>sudosh2</name>
<range><le>1.0.2</le></range>
</package>
<package>
<name>sudosh3</name>
<range><le>3.2.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISS reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/55903">
<p>sudosh2 and sudosh3 are vulnerable to a stack-based buffer
overflow, caused by improper bounds checking by the replay()
function. By persuading a victim to replay a specially-crafted
recorded sudo session, a local attacker could overflow a buffer
and execute arbitrary code on the system with elevated privileges
or cause the application to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/xfdb/55903</url>
<url>http://secunia.com/advisories/38349</url>
<url>http://secunia.com/advisories/38292</url>
</references>
<dates>
<discovery>2010-01-17</discovery>
<entry>2012-08-09</entry>
</dates>
</vuln>
<vuln vid="0f020b7b-e033-11e1-90a2-000c299b62e1">
<topic>FreeBSD -- named(8) DNSSEC validation Denial of Service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_10</lt></range>
<range><ge>8.1</ge><lt>8.1_13</lt></range>
<range><ge>8.2</ge><lt>8.2_10</lt></range>
<range><ge>8.3</ge><lt>8.3_4</lt></range>
<range><ge>9.0</ge><lt>9.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc">
<p>BIND 9 stores a cache of query names that are known to be failing
due to misconfigured name servers or a broken chain of trust.
Under high query loads, when DNSSEC validation is active, it is
possible for a condition to arise in which data from this cache of
failing queries could be used before it was fully initialized,
triggering an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:05.bind</freebsdsa>
<cvename>CVE-2012-3817</cvename>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-07</entry>
</dates>
</vuln>
<vuln vid="36235c38-e0a8-11e1-9f4d-002354ed89bc">
<topic>automake -- Insecure 'distcheck' recipe granted world-writable distdir</topic>
<affects>
<package>
<name>automake</name>
<range><ge>1.5.0</ge><lt>1.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html">
<p>The recipe of the 'distcheck' target granted temporary
world-write permissions on the extracted distdir. This introduced
a locally exploitable race condition for those who run "make
distcheck" with a non-restrictive umask (e.g., 022) in a directory
that was accessible by others. A successful exploit would result
in arbitrary code execution with the privileges of the user
running "make distcheck".</p>
<p>It is important to stress that this vulnerability impacts not only
the Automake package itself, but all packages with
Automake-generated makefiles. For an effective fix it is necessary
to regenerate the Makefile.in files with a fixed Automake
version.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3386</cvename>
<url>https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html</url>
</references>
<dates>
<discovery>2012-07-09</discovery>
<entry>2012-08-06</entry>
<modified>2012-08-25</modified>
</dates>
</vuln>
<vuln vid="dbf338d0-dce5-11e1-b655-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>14.0.1,1</lt></range>
<range><lt>10.0.6,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.6,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>14.0</lt></range>
<range><lt>10.0.6</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/
rv:10.0.6)</p>
<p>MFSA 2012-43 Incorrect URL displayed in addressbar through drag and
drop</p>
<p>MFSA 2012-44 Gecko memory corruption</p>
<p>MFSA 2012-45 Spoofing issue with location</p>
<p>MFSA 2012-46 XSS through data: URLs</p>
<p>MFSA 2012-47 Improper filtering of javascript in HTML feed-view</p>
<p>MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden</p>
<p>MFSA 2012-49 Same-compartment Security Wrappers can be bypassed</p>
<p>MFSA 2012-50 Out of bounds read in QCMS</p>
<p>MFSA 2012-51 X-Frame-Options header ignored when duplicated</p>
<p>MFSA 2012-52 JSDependentString::undepend string conversion results
in memory corruption</p>
<p>MFSA 2012-53 Content Security Policy 1.0 implementation errors
cause data leakage</p>
<p>MFSA 2012-54 Clickjacking of certificate warning page</p>
<p>MFSA 2012-55 feed: URLs with an innerURI inherit security context
of page</p>
<p>MFSA 2012-56 Code execution through javascript: URLs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1949</cvename>
<cvename>CVE-2012-1950</cvename>
<cvename>CVE-2012-1951</cvename>
<cvename>CVE-2012-1952</cvename>
<cvename>CVE-2012-1953</cvename>
<cvename>CVE-2012-1954</cvename>
<cvename>CVE-2012-1955</cvename>
<cvename>CVE-2012-1957</cvename>
<cvename>CVE-2012-1958</cvename>
<cvename>CVE-2012-1959</cvename>
<cvename>CVE-2012-1960</cvename>
<cvename>CVE-2012-1961</cvename>
<cvename>CVE-2012-1962</cvename>
<cvename>CVE-2012-1963</cvename>
<cvename>CVE-2012-1964</cvename>
<cvename>CVE-2012-1965</cvename>
<cvename>CVE-2012-1966</cvename>
<cvename>CVE-2012-1967</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-42.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-43.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-44.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-45.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-46.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-47.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-48.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-49.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-50.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-51.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-52.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-53.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-54.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-55.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-56.html</url>
</references>
<dates>
<discovery>2012-07-17</discovery>
<entry>2012-08-02</entry>
</dates>
</vuln>
<vuln vid="de2bc01f-dc44-11e1-9f4d-002354ed89bc">
<topic>Apache -- Insecure LD_LIBRARY_PATH handling</topic>
<affects>
<package>
<name>apache</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-event</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-itk</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-peruser</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-worker</name>
<range><le>2.2.22_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>Insecure handling of LD_LIBRARY_PATH was found that could lead to
the current working directory to be searched for DSOs. This could
allow a local user to execute code as root if an administrator runs
apachectl from an untrusted directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0883</cvename>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4.2</url>
</references>
<dates>
<discovery>2012-03-02</discovery>
<entry>2012-08-01</entry>
</dates>
</vuln>
<vuln vid="f01292a0-db3c-11e1-a84b-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.4</ge><lt>1.4.1</lt></range>
<range><ge>1.3</ge><lt>1.3.2</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.1</lt></range>
<range><ge>1.3</ge><lt>1.3.2</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20120731,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20120731,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/">
<p>Today the Django team is issuing multiple releases --
Django 1.3.2 and Django 1.4.1 -- to remedy security issues
reported to us:</p>
<ul>
<li>Cross-site scripting in authentication views</li>
<li>Denial-of-service in image validation</li>
<li>Denial-of-service via get_image_dimensions()</li>
</ul>
<p>All users are encouraged to upgrade Django immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3442</cvename>
<cvename>CVE-2012-3443</cvename>
<cvename>CVE-2012-3444</cvename>
<url>https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/</url>
</references>
<dates>
<discovery>2012-07-30</discovery>
<entry>2012-07-31</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
<range><ge>4.0.0</ge><lt>4.0.7</lt></range>
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.9/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Information Leak</h1>
<p>Versions: 4.1.1 to 4.2.1, 4.3.1</p>
<p>In HTML bugmails, all bug IDs and attachment IDs are
linkified, and hovering these links displays a tooltip
with the bug summary or the attachment description if
the user is allowed to see the bug or attachment.
But when validating user permissions when generating the
email, the permissions of the user who edited the bug were
taken into account instead of the permissions of the
addressee. This means that confidential information could
be disclosed to the addressee if the other user has more
privileges than the addressee.
Plain text bugmails are not affected as bug and attachment
IDs are not linkified.</p>
<h1>Information Leak</h1>
<p>Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to
4.2.1, 4.3.1</p>
<p>The description of a private attachment could be visible
to a user who hasn't permissions to access this attachment
if the attachment ID is mentioned in a public comment in
a bug that the user can see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1968</cvename>
<cvename>CVE-2012-1969</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>
</references>
<dates>
<discovery>2012-07-26</discovery>
<entry>2012-07-27</entry>
</dates>
</vuln>
<vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1">
<topic>nsd -- Denial of Service</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>3.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tom Hendrikx reports:</p>
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt">
<p>It is possible to crash (SIGSEGV) a NSD child server process by
sending it a DNS packet from any host on the internet and the per
zone stats build option is enabled. A crashed child process will
automatically be restarted by the parent process, but an attacker
may keep the NSD server occupied restarting child processes by
sending it a stream of such packets effectively preventing the
NSD server to serve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2979</cvename>
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt</url>
</references>
<dates>
<discovery>2012-07-27</discovery>
<entry>2012-07-27</entry>
</dates>
</vuln>
<vuln vid="ae2fa87c-4bca-4138-8be1-67ce2a19b3a8">
<topic>rubygem-actionpack -- Denial of Service</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM">
<p>There is a DoS vulnerability in Action Pack digest authentication
handling in authenticate_or_request_with_http_digest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3424</cvename>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM</url>
</references>
<dates>
<discovery>2012-07-26</discovery>
<entry>2012-07-26</entry>
</dates>
</vuln>
<vuln vid="cdc4ff0e-d736-11e1-8221-e0cb4e266481">
<topic>p5-RT-Authen-ExternalAuth -- privilege escalation</topic>
<affects>
<package>
<name>p5-RT-Authen-ExternalAuth</name>
<range><lt>0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RT development team reports:</p>
<blockquote cite="http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html">
<p>RT::Authen::ExternalAuth 0.10 and below (for all versions
of RT) are vulnerable to an escalation of privilege attack
where the URL of a RSS feed of the user can be used to
acquire a fully logged-in session as that user.
CVE-2012-2770 has been assigned to this vulnerability.</p>
<p>Users of RT 3.8.2 and above should upgrade to
RT::Authen::ExternalAuth 0.11, which resolves this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html</url>
<cvename>CVE-2012-2770</cvename>
</references>
<dates>
<discovery>2012-07-25</discovery>
<entry>2012-07-26</entry>
</dates>
</vuln>
<vuln vid="c7fa3618-d5ff-11e1-90a2-000c299b62e1">
<topic>isc-dhcp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_5,2</lt></range>
</package>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/announcement/bind-and-dhcp-security-updates-released">
<p>An unexpected client identifier parameter can cause the ISC DHCP
daemon to segmentation fault when running in DHCPv6 mode,
resulting in a denial of service to further client requests. In
order to exploit this condition, an attacker must be able to send
requests to the DHCP server.</p>
<p>An error in the handling of malformed client identifiers can cause
a DHCP server running affected versions (see "Impact") to enter a
state where further client requests are not processed and the
server process loops endlessly, consuming all available CPU
cycles.
Under normal circumstances this condition should not be
triggered, but a non-conforming or malicious client could
deliberately trigger it in a vulnerable server. In order to
exploit this condition an attacker must be able to send requests
to the DHCP server.</p>
<p>Two memory leaks have been found and fixed in ISC DHCP. Both are
reproducible when running in DHCPv6 mode (with the -6 command-line
argument.) The first leak is confirmed to only affect servers
operating in DHCPv6 mode, but based on initial code analysis the
second may theoretically affect DHCPv4 servers (though this has
not been demonstrated.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3570</cvename>
<cvename>CVE-2012-3571</cvename>
<cvename>CVE-2012-3954</cvename>
<url>https://kb.isc.org/article/AA-00714</url>
<url>https://kb.isc.org/article/AA-00712</url>
<url>https://kb.isc.org/article/AA-00737</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-07-25</entry>
</dates>
</vuln>
<vuln vid="0bc67930-d5c3-11e1-bef6-0024e81297ae">
<topic>dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.2</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.2</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00729">
<p>High numbers of queries with DNSSEC validation enabled can
cause an assertion failure in named, caused by using a 'bad cache'
data structure before it has been initialized.</p>
<p>BIND 9 stores a cache of query names that are known to be failing due
to misconfigured name servers or a broken chain of trust. Under high query
loads when DNSSEC validation is active, it is possible for a condition
to arise in which data from this cache of failing queries could be used
before it was fully initialized, triggering an assertion failure.</p>
<p>This bug cannot be encountered unless your server is doing DNSSEC
validation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3817</cvename>
<url>https://kb.isc.org/article/AA-00729</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-07-24</entry>
</dates>
</vuln>
<vuln vid="748aa89f-d529-11e1-82ab-001fd0af1a4c">
<topic>rubygem-activerecord -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activemodel</name>
<range><lt>3.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rubygem-activerecord -- multiple vulernabilities</p>
<blockquote>
<p>Due to the way Active Record interprets parameters in
combination with the way that Rack parses query parameters, it
is possible for an attacker to issue unexpected database
queries with "IS NULL" where clauses. This issue does *not*
let an attacker insert arbitrary values into an SQL query,
however they can cause the query to check for NULL where most
users wouldn't expect it.</p>
<p>Due to the way Active Record handles nested query parameters,
an attacker can use a specially crafted request to inject some
forms of SQL into your application's SQL queries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2660</cvename>
<cvename>CVE-2012-2661</cvename>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k</url>
</references>
<dates>
<discovery>2012-05-31</discovery>
<entry>2012-07-23</entry>
<modified>2012-07-23</modified>
</dates>
</vuln>
<vuln vid="bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89">
<topic>php -- potential overflow in _php_stream_scandir</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.5</lt></range>
<range><ge>5.3</ge><lt>5.3.15</lt></range>
<range><ge>5.2</ge><lt>5.2.17_10</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.15</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Development Team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-07-19-1">
<p>The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in
_php_stream_scandir</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2688</cvename>
<url>http://www.php.net/archive/2012.php#id2012-07-19-1</url>
</references>
<dates>
<discovery>2012-07-19</discovery>
<entry>2012-07-23</entry>
<modified>2013-01-15</modified>
</dates>
</vuln>
<vuln vid="ce82bfeb-d276-11e1-92c6-14dae938ec40">
<topic>dns/nsd -- DoS vulnerability from non-standard DNS packet</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>3.2.11_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marek Vavrusa and Lubos Slovak report:</p>
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt">
<p>It is possible to crash (SIGSEGV) a NSD child server process
by sending it a non-standard DNS packet from any host on the
internet. A crashed child process will automatically be restarted
by the parent process, but an attacker may keep the NSD server
occupied restarting child processes by sending it a stream of
such packets effectively preventing the NSD server to serve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2978</cvename>
<freebsdpr>ports/170024</freebsdpr>
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt</url>
</references>
<dates>
<discovery>2012-07-19</discovery>
<entry>2012-07-20</entry>
<modified>2012-07-21</modified>
</dates>
</vuln>
<vuln vid="a460035e-d111-11e1-aff7-001fd056c417">
<topic>libjpeg-turbo -- heap-based buffer overflow</topic>
<affects>
<package>
<name>libjpeg-turbo</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt">
<p>The Changelog for version 1.2.1 says: Fixed a regression caused by
1.2.0[6] in which decompressing corrupt JPEG images (specifically,
images in which the component count was erroneously set to a large
value) would cause libjpeg-turbo to segfault.</p>
</blockquote>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=826849">
<p>A Heap-based buffer overflow was found in the way libjpeg-turbo
decompressed certain corrupt JPEG images in which the component count
was erroneously set to a large value. An attacker could create a
specially-crafted JPEG image that, when opened, could cause an
application using libpng to crash or, possibly, execute arbitrary code
with the privileges of the user running the application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2806</cvename>
<url>http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=826849</url>
</references>
<dates>
<discovery>2012-05-31</discovery>
<entry>2012-07-18</entry>
<modified>2012-07-19</modified>
</dates>
</vuln>
<vuln vid="2fe4b57f-d110-11e1-ac76-10bf48230856">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20120125_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://secunia.com/advisories/49196/">
<p>Secunia Research has discovered a vulnerability in DokuWiki, which can
be exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call"
is set to "medialist" and "do" is set to "media") is not properly
sanitised within the "tpl_mediaFileList()" function in inc/template.php
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/49196/</url>
<cvename>CVE-2012-0283</cvename>
</references>
<dates>
<discovery>2012-07-13</discovery>
<entry>2012-07-18</entry>
</dates>
</vuln>
<vuln vid="3a6960ef-c8a8-11e1-9924-001fd0af1a4c">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.7.*</gt><lt>2.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>puppet -- multiple vulnerabilities</p>
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18">
<p>Arbitrary file read on the puppet master from authenticated
clients (high). It is possible to construct an HTTP get request
from an authenticated client with a valid certificate that will
return the contents of an arbitrary file on the Puppet master
that the master has read-access to.</p>
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated
clients (high). Given a Puppet master with the "Delete"
directive allowed in auth.conf for an authenticated host, an
attacker on that host can send a specially crafted Delete
request that can cause an arbitrary file deletion on the Puppet
master, potentially causing a denial of service attack. Note
that this vulnerability does *not* exist in Puppet as
configured by default.</p>
<p>The last_run_report.yaml is world readable (medium). The most
recent Puppet run report is stored on the Puppet master with
world-readable permissions. The report file contains the
context diffs of any changes to configuration on an agent,
which may contain sensitive information that an attacker can
then access. The last run report is overwritten with every
Puppet run.</p>
<p>Arbitrary file read on the Puppet master by an agent (medium).
This vulnerability is dependent upon vulnerability
"last_run_report.yml is world readable" above. By creating a
hard link of a Puppet-managed file to an arbitrary file that
the Puppet master can read, an attacker forces the contents to
be written to the puppet run summary. The context diff is
stored in last_run_report.yaml, which can then be accessed by
the attacker.</p>
<p>Insufficient input validation for agent hostnames (low). An
attacker could trick the administrator into signing an
attacker's certificate rather than the intended one by
constructing specially crafted certificate requests containing
specific ANSI control sequences. It is possible to use the
sequences to rewrite the order of text displayed to an
administrator such that display of an invalid certificate and
valid certificate are transposed. If the administrator signs
the attacker's certificate, the attacker can then
man-in-the-middle the agent.</p>
<p>Agents with certnames of IP addresses can be impersonated
(low). If an authenticated host with a certname of an IP
address changes IP addresses, and a second host assumes the
first host's former IP address, the second host will be treated
by the puppet master as the first one, giving the second host
access to the first host's catalog. Note: This will not be
fixed in Puppet versions prior to the forthcoming 3.x. Instead,
with this announcement IP-based authentication in Puppet < 3.x
is deprecated.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3864</cvename>
<cvename>CVE-2012-3865</cvename>
<cvename>CVE-2012-3866</cvename>
<cvename>CVE-2012-3867</cvename>
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3866/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
</references>
<dates>
<discovery>2012-07-05</discovery>
<entry>2012-07-10</entry>
</dates>
</vuln>
<vuln vid="4c1ac2dd-c788-11e1-be25-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><gt>10.*</gt><lt>10.5.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Possible resource leak on uncompleted re-invite transactions.</p>
<p>Remote crash vulnerability in voice mail application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3812</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-010.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-011.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-07-05</discovery>
<entry>2012-07-06</entry>
<modified>2012-08-30</modified>
</dates>
</vuln>
<vuln vid="c28ee9cd-916e-4dcf-8ed3-e97e5846db6c">
<topic>typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5</ge><lt>4.5.17</lt></range>
<range><ge>4.6</ge><lt>4.6.10</lt></range>
<range><ge>4.7</ge><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 Security Report (TYPO3-CORE-SA-2012-003):</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/">
<p>TYPO3 bundles and uses an external JavaScript and Flash Upload Library
called swfupload. TYPO3 can be configured to use this Flash uploader.
Input passed via the "movieName" parameter to swfupload.swf is not
properly sanitised before being used in a call to
"ExternalInterface.call()". This can be exploited to execute arbitrary
script code in a user's browser session in context of an affected site.
The existance of the swfupload library is sufficient to be vulnerable
to the reported problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/49780/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/</url>
</references>
<dates>
<discovery>2012-07-04</discovery>
<entry>2012-07-06</entry>
</dates>
</vuln>
<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
<topic>phpList -- SQL injection and XSS vulnerability</topic>
<affects>
<package>
<name>phplist</name>
<range><le>2.10.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zero Science Lab reports:</p>
<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
<p>Input passed via the parameter 'sortby' is not properly
sanitised before being returned to the user or used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
where the attacker can execute arbitrary HTML and script code in
a user's browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2740</cvename>
<cvename>CVE-2012-2741</cvename>
<bid>52657</bid>
<url>https://www.phplist.com/?lid=567</url>
<url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
</references>
<dates>
<discovery>2012-03-21</discovery>
<entry>2012-07-02</entry>
</dates>
</vuln>
<vuln vid="aed44c4e-c067-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Privilege escalation when returning from kernel</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_9</lt></range>
<range><ge>8.1</ge><lt>8.1_12</lt></range>
<range><ge>8.2</ge><lt>8.2_9</lt></range>
<range><ge>8.3</ge><lt>8.3_3</lt></range>
<range><ge>9.0</ge><lt>9.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc">
<p>FreeBSD/amd64 runs on CPUs from different vendors. Due to varying
behaviour of CPUs in 64 bit mode a sanity check of the kernel may be
insufficient when returning from a system call.</p>
<p>Successful exploitation of the problem can lead to local kernel privilege
escalation, kernel data corruption and/or crash.
To exploit this vulnerability, an attacker must be able to run code with user
privileges on the target system.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:04.sysret</freebsdsa>
<cvename>CVE-2012-0217</cvename>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="fc5231b6-c066-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_9</lt></range>
<range><ge>8.1</ge><lt>8.1_11</lt></range>
<range><ge>8.2</ge><lt>8.2_9</lt></range>
<range><ge>8.3</ge><lt>8.3_3</lt></range>
<range><ge>9.0</ge><lt>9.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:03.bind.asc">
<p>The named(8) server does not properly handle DNS resource records where
the RDATA field is zero length, which may cause various issues for the
servers handling them.</p>
<p>Resolving servers may crash or disclose some portion of memory to the
client. Authoritative servers may crash on restart after transferring a
zone containing records with zero-length RDATA fields. These would
result in a denial of service, or leak of sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:03.bind</freebsdsa>
<cvename>CVE-2012-1667</cvename>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="185ff22e-c066-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Incorrect crypt() hashing</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_8</lt></range>
<range><ge>8.1</ge><lt>8.1_10</lt></range>
<range><ge>8.2</ge><lt>8.2_8</lt></range>
<range><ge>8.3</ge><lt>8.3_2</lt></range>
<range><ge>9.0</ge><lt>9.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc">
<p>There is a programming error in the DES implementation used in crypt()
when handling input which contains characters that cannot be represented
with 7-bit ASCII.</p>
<p>When the input contains characters with only the most significant bit set
(0x80), that character and all characters after it will be ignored.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:02.crypt</freebsdsa>
<cvename>CVE-2012-2143</cvename>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="2ae114de-c064-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_8</lt></range>
<range><ge>8.1</ge><lt>8.1_10</lt></range>
<range><ge>8.2</ge><lt>8.2_8</lt></range>
<range><ge>8.3</ge><lt>8.3_2</lt></range>
<range><ge>9.0</ge><lt>9.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:01.openssl.asc">
<p>OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0
records when operating as a client or a server that accept SSL 3.0
handshakes. As a result, in each record, up to 15 bytes of uninitialized
memory may be sent, encrypted, to the SSL peer. This could include
sensitive contents of previously freed memory. [CVE-2011-4576]</p>
<p>OpenSSL support for handshake restarts for server gated cryptography (SGC)
can be used in a denial-of-service attack. [CVE-2011-4619]</p>
<p>If an application uses OpenSSL's certificate policy checking when
verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
flag, a policy check failure can lead to a double-free. [CVE-2011-4109]</p>
<p>A weakness in the OpenSSL PKCS #7 code can be exploited using
Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
million message attack (MMA). [CVE-2012-0884]</p>
<p>The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp
functions, in OpenSSL contains multiple integer errors that can cause
memory corruption when parsing encoded ASN.1 data. This error can occur
on systems that parse untrusted ASN.1 data, such as X.509 certificates
or RSA public keys. [CVE-2012-2110]</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:01.openssl</freebsdsa>
<cvename>CVE-2011-4576</cvename>
<cvename>CVE-2011-4619</cvename>
<cvename>CVE-2011-4109</cvename>
<cvename>CVE-2012-0884</cvename>
<cvename>CVE-2012-2110</cvename>
</references>
<dates>
<discovery>2012-05-03</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="f45c0049-be72-11e1-a284-0023ae8e59f0">
<topic>pycrypto -- vulnerable ElGamal key generation</topic>
<affects>
<package>
<name>py-pycrypto</name>
<range><ge>2.5</ge><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dwayne C. Litzenberger of PyCrypto reports:</p>
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html">
<p>In the ElGamal schemes (for both encryption and signatures), g is
supposed to be the generator of the entire Z^*_p group. However, in
PyCrypto 2.5 and earlier, g is more simply the generator of a random
sub-group of Z^*_p.</p>
<p>The result is that the signature space (when the key is used for
signing) or the public key space (when the key is used for encryption)
may be greatly reduced from its expected size of log(p) bits, possibly
down to 1 bit (the worst case if the order of g is 2).</p>
<p>While it has not been confirmed, it has also been suggested that an
attacker might be able to use this fact to determine the private key.</p>
<p>Anyone using ElGamal keys should generate new keys as soon as
practical.</p>
<p>Any additional information about this bug will be tracked at
https://bugs.launchpad.net/pycrypto/+bug/985164</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2417</cvename>
<url>http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html</url>
<url>https://bugs.launchpad.net/pycrypto/+bug/985164</url>
</references>
<dates>
<discovery>2012-05-24</discovery>
<entry>2012-06-24</entry>
</dates>
</vuln>
<vuln vid="f46c4c6a-ba25-11e1-806a-001143cd36d8">
<topic>joomla -- Privilege Escalation</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! reported a Core Privilege Escalation::</p>
<blockquote cite="http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html">
<p>Inadequate checking leads to possible user privilege escalation..</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html</url>
</references>
<dates>
<discovery>2012-04-29</discovery>
<entry>2012-06-19</entry>
</dates>
</vuln>
<vuln vid="eb12ebee-b7af-11e1-b5e0-000c299b62e1">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.97.5</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20120612</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Advisories report:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419">
<p>The TAR parser allows remote attackers to bypass malware detection
via a POSIX TAR file with an initial [aliases] character sequence.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457">
<p>The TAR parser allows remote attackers to bypass malware detection
via a TAR archive entry with a length field that exceeds the total
TAR file size.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458">
<p>The Microsoft CHM file parser allows remote attackers to bypass
malware detection via a crafted reset interval in the LZXC header
of a CHM file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459">
<p>The TAR file parser allows remote attackers to bypass malware
detection via a TAR archive entry with a length field
corresponding to that entire entry, plus part of the header ofxi
the next entry.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1419</cvename>
<cvename>CVE-2012-1457</cvename>
<cvename>CVE-2012-1458</cvename>
<cvename>CVE-2012-1459</cvename>
</references>
<dates>
<discovery>2012-03-19</discovery>
<entry>2012-06-16</entry>
</dates>
</vuln>
<vuln vid="3c8d1e5b-b673-11e1-be25-14dae9ebcf89">
<topic>asterisk -- remote crash vulnerability</topic>
<affects>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Skinny Channel Driver Remote Crash Vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3553</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-009.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-06-14</discovery>
<entry>2012-06-14</entry>
</dates>
</vuln>
<vuln vid="5140dc69-b65e-11e1-9425-001b21614864">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<range><lt>6.7.6.4</lt></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><lt>6.7.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ImageMagick reports:</p>
<blockquote cite="http://www.cert.fi/en/reports/2012/vulnerability635606.html">
<p>Three vulnerabilities have been identified in ImageMagick's
handling of JPEG and TIFF files. With these vulnerabilities, it is
possible to cause a denial of service situation in the target
system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0259</cvename>
<cvename>CVE-2012-0260</cvename>
<cvename>CVE-2012-1798</cvename>
<url>http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629</url>
<url>http://www.cert.fi/en/reports/2012/vulnerability635606.html</url>
</references>
<dates>
<discovery>2012-03-28</discovery>
<entry>2012-06-14</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="55587adb-b49d-11e1-8df1-0004aca374af">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/06/09/1">
<p>Roland Becker and Damien Regad (MantisBT developers) found that
any user able to report issues via the SOAP interface could also
modify any bugnotes (comments) created by other users. In a
default/typical MantisBT installation, SOAP API is enabled and any
user can sign up to report new issues. This vulnerability therefore
impacts upon many public facing MantisBT installations.</p>
<p>Roland Becker (MantisBT developer) found that the
delete_attachments_threshold permission was not being checked when
a user attempted to delete an attachment from an issue. The more
generic update_bug_threshold permission was being checked instead.
MantisBT administrators may have been under the false impression
that their configuration of the delete_attachments_threshold was
successfully preventing unwanted users from deleting
attachments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2691</cvename>
<cvename>CVE-2012-2692</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/06/09/1</mlist>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev</mlist>
</references>
<dates>
<discovery>2012-06-09</discovery>
<entry>2012-06-12</entry>
<modified>2012-06-13</modified>
</dates>
</vuln>
<vuln vid="38195f00-b215-11e1-8132-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.236</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb12-14.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2034</cvename>
<cvename>CVE-2012-2035</cvename>
<cvename>CVE-2012-2036</cvename>
<cvename>CVE-2012-2037</cvename>
<cvename>CVE-2012-2038</cvename>
<cvename>CVE-2012-2039</cvename>
<cvename>CVE-2012-2040</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb12-14.html</url>
</references>
<dates>
<discovery>2012-06-08</discovery>
<entry>2012-06-09</entry>
</dates>
</vuln>
<vuln vid="bfecf7c1-af47-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>13.0,1</lt></range>
<range><lt>10.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.5,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.10</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>13.0</lt></range>
<range><lt>10.0.5</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)</p>
<p>MFSA 2012-36 Content Security Policy inline-script bypass</p>
<p>MFSA 2012-37 Information disclosure though Windows file shares and shortcut files</p>
<p>MFSA 2012-38 Use-after-free while replacing/inserting a node in a document</p>
<p>MFSA 2012-39 NSS parsing errors with zero length items</p>
<p>MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3101</cvename>
<cvename>CVE-2012-0441</cvename>
<cvename>CVE-2012-1938</cvename>
<cvename>CVE-2012-1939</cvename>
<cvename>CVE-2012-1937</cvename>
<cvename>CVE-2012-1940</cvename>
<cvename>CVE-2012-1941</cvename>
<cvename>CVE-2012-1944</cvename>
<cvename>CVE-2012-1945</cvename>
<cvename>CVE-2012-1946</cvename>
<cvename>CVE-2012-1947</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-34.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-36.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-37.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-38.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-39.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-40.html</url>
</references>
<dates>
<discovery>2012-06-05</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="1e14d46f-af1f-11e1-b242-00215af774f0">
<topic>quagga -- BGP OPEN denial of service vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><le>0.99.20.1</le></range>
</package>
<package>
<name>quagga-re</name>
<range><lt>0.99.17.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/962587">
<p>If a pre-configured BGP peer sends a specially-crafted OPEN
message with a malformed ORF capability TLV, Quagga bgpd process
will erroneously try to consume extra bytes from the input packet
buffer. The process will detect a buffer overrun attempt before
it happens and immediately terminate with an error message. All
BGP sessions established by the attacked router will be closed
and its BGP routing disrupted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1820</cvename>
<url>http://www.kb.cert.org/vuls/id/962587</url>
</references>
<dates>
<discovery>2012-06-04</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="de6d8290-aef7-11e1-898f-14dae938ec40">
<topic>mail/sympa* -- Multiple vulnerabilities in Sympa archive management</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.0.7</lt></range>
<range><gt>6.1.*</gt><lt>6.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Verdin reports:</p>
<blockquote cite="http://www.sympa.org/security_advisories#security_breaches_in_archives_management">
<p>Multiple vulnerabilities have been discovered in Sympa archive
management that allow to skip the scenario-based authorization
mechanisms.</p>
<p>This vulnerability allows the attacker to:</p>
<ul>
<li>display the archives management page ('arc_manage')</li>
<li>download the list's archives</li>
<li>delete the list's archives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.sympa.org/security_advisories#security_breaches_in_archives_management</url>
</references>
<dates>
<discovery>2012-05-15</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="1ecc0d3f-ae8e-11e1-965b-0024e88a8c98">
<topic>dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.1</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2012-1667">
<p>Processing of DNS resource records where the rdata field is zero length
may cause various issues for the servers handling them.</p>
<p>Processing of these records may lead to unexpected outcomes. Recursive
servers may crash or disclose some portion of memory to the client.
Secondary servers may crash on restart after transferring a zone
containing these records. Master servers may corrupt zone data if the
zone option "auto-dnssec" is set to "maintain". Other unexpected
problems that are not listed here may also be encountered.</p>
<p>Impact: This issue primarily affects recursive nameservers.
Authoritative nameservers will only be impacted if an administrator
configures experimental record types with no data. If the server is
configured this way, then secondaries can crash on restart after
transferring that zone. Zone data on the master can become corrupted if
the zone with those records has named configured to manage the DNSSEC
key rotation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1667</cvename>
<url>http://www.isc.org/software/bind/advisories/cve-2012-1667</url>
</references>
<dates>
<discovery>2012-06-04</discovery>
<entry>2012-06-04</entry>
<modified>2012-06-06</modified>
</dates>
</vuln>
<vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
<topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><gt>8.3.*</gt><lt>8.3.18_1</lt></range>
<range><gt>8.4.*</gt><lt>8.4.11_1</lt></range>
<range><gt>9.0.*</gt><lt>9.0.7_2</lt></range>
<range><gt>9.1.*</gt><lt>9.1.3_1</lt></range>
<range><gt>9.2.*</gt><lt>9.2.b1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1397/">
<p>Today the PHP, OpenBSD and FreeBSD communities announced updates to
patch a security hole involving their crypt() hashing algorithms. This
issue is described in CVE-2012-2143. This vulnerability also affects a
minority of PostgreSQL users, and will be fixed in an update release on
June 4, 2012.</p>
<p>Affected users are those who use the crypt(text, text) function
with DES encryption in the optional pg_crypto module. Passwords
affected are those that contain characters that cannot be
represented with 7-bit ASCII. If a password contains a character
that has the most significant bit set (0x80), and DES encryption
is used, that character and all characters after it will be ignored.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2143</cvename>
<url>http://www.postgresql.org/about/news/1397/</url>
<url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-05-30</entry>
<modified>2012-05-31</modified>
</dates>
</vuln>
<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
<topic>nut -- upsd can be remotely crashed</topic>
<affects>
<package>
<name>nut</name>
<range><ge>2.4.0</ge><le>2.6.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Networkupstools project reports:</p>
<blockquote cite="http://trac.networkupstools.org/projects/nut/changeset/3633">
<p>NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to
crashes when receiving random data from the network.</p>
<p>This issue is related to the way NUT parses characters, especially
from the network. Non printable characters were missed from strings
operation (such as strlen), but still copied to the buffer, causing
an overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2944</cvename>
<url>http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html</url>
<url>http://trac.networkupstools.org/projects/nut/changeset/3633</url>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-05-30</entry>
</dates>
</vuln>
<vuln vid="359f615d-a9e1-11e1-8a66-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><le>1.6.2.24</le></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.12.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote crash vulnerability in IAX2 channel driver.</p>
<p>Skinny Channel Driver Remote Crash Vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2947</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-007.html</url>
<cvename>CVE-2012-2948</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-008.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-05-29</discovery>
<entry>2012-05-29</entry>
<modified>2012-05-29</modified>
</dates>
</vuln>
<vuln vid="617959ce-a5f6-11e1-a284-0023ae8e59f0">
<topic>haproxy -- buffer overflow</topic>
<affects>
<package>
<name>haproxy</name>
<range><lt>1.4.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAProxy reports:</p>
<blockquote cite="http://haproxy.1wt.eu/news.html">
<p>A flaw was reported in HAProxy where, due to a boundary error
when copying data into the trash buffer, an external attacker could
cause a buffer overflow. Exploiting this flaw could lead to the
execution of arbitrary code, however it requires non-default settings
for the global.tune.bufsize configuration option (must be set to a
value greater than the default), and also that header rewriting is
enabled (via, for example, the regrep or rsprep directives).
This flaw is reported against 1.4.20, prior versions may also be
affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2391</cvename>
<url>https://secunia.com/advisories/49261/</url>
<url>http://haproxy.1wt.eu/download/1.4/src/CHANGELOG</url>
<url>http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b</url>
<url>http://haproxy.1wt.eu/news.html</url>
</references>
<dates>
<discovery>2012-05-21</discovery>
<entry>2012-05-24</entry>
<modified>2012-05-29</modified>
</dates>
</vuln>
<vuln vid="e0a969e4-a512-11e1-90b4-e0cb4e266481">
<topic>RT -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.6</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical report:</p>
<blockquote cite="http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html">
<p>Internal audits of the RT codebase have uncovered a
number of security vulnerabilities in RT. We are releasing
versions 3.8.12 and 4.0.6 to resolve these vulnerabilities,
as well as patches which apply atop all released versions of
3.8 and 4.0.</p>
<p>The vulnerabilities addressed by 3.8.12, 4.0.6, and the
below patches include the following:</p>
<p>The previously released tool to upgrade weak password
hashes as part of CVE-2011-0009 was an incomplete fix and
failed to upgrade passwords of disabled users.</p>
<p>RT versions 3.0 and above contain a number of cross-site
scripting (XSS) vulnerabilities which allow an attacker to
run JavaScript with the user's credentials. CVE-2011-2083 is
assigned to this vulnerability.</p>
<p>RT versions 3.0 and above are vulnerable to multiple
information disclosure vulnerabilities. This includes the
ability for privileged users to expose users' previous
password hashes -- this vulnerability is particularly
dangerous given RT's weak hashing previous to the fix in
CVE-2011-0009. A separate vulnerability allows privileged
users to obtain correspondence history for any ticket in
RT. CVE-2011-2084 is assigned to this vulnerability.</p>
<p>All publicly released versions of RT are vulnerable to
cross-site request forgery (CSRF). CVE-2011-2085 is assigned
to this vulnerability.</p>
<p>We have also added a separate configuration option
($RestrictLoginReferrer) to prevent login CSRF, a different
class of CSRF attack.</p>
<p>RT versions 3.6.1 and above are vulnerable to a remote
execution of code vulnerability if the optional VERP
configuration options ($VERPPrefix and $VERPDomain) are
enabled. RT 3.8.0 and higher are vulnerable to a limited
remote execution of code which can be leveraged for
privilege escalation. RT 4.0.0 and above contain a
vulnerability in the global $DisallowExecuteCode option,
allowing sufficiently privileged users to still execute code
even if RT was configured to not allow it. CVE-2011-4458 is
assigned to this set of vulnerabilities.</p>
<p>RT versions 3.0 and above may, under some circumstances,
still respect rights that a user only has by way of a
currently-disabled group. CVE-2011-4459 is assigned to this
vulnerability.</p>
<p>RT versions 2.0 and above are vulnerable to a SQL
injection attack, which allow privileged users to obtain
arbitrary information from the database. CVE-2011-4460 is
assigned to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0009</cvename>
<cvename>CVE-2011-2082</cvename>
<cvename>CVE-2011-2083</cvename>
<cvename>CVE-2011-2084</cvename>
<cvename>CVE-2011-2085</cvename>
<cvename>CVE-2011-4458</cvename>
<cvename>CVE-2011-4459</cvename>
<cvename>CVE-2011-4460</cvename>
<url>http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2012-05-22</discovery>
<entry>2012-05-23</entry>
</dates>
</vuln>
<vuln vid="78c39232-a345-11e1-9d81-d0df9acfd7e5">
<topic>sympa -- Multiple Security Bypass Vulnerabilities</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia team reports:</p>
<blockquote cite="http://secunia.com/advisories/49045/">
<p>Multiple vulnerabilities have been reported in Sympa, which can be
exploited by malicious people to bypass certain security
restrictions.</p>
<p>The vulnerabilities are caused due to the application allowing
access to archive functions without checking credentials. This can
be exploited to create, download, and delete an archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2352</cvename>
<url>http://secunia.com/advisories/49045/</url>
</references>
<dates>
<discovery>2012-05-14</discovery>
<entry>2012-05-21</entry>
</dates>
</vuln>
<vuln vid="495b46fd-a30f-11e1-82c9-d0df9acfd7e5">
<topic>foswiki -- Script Insertion Vulnerability via unchecked user registration fields</topic>
<affects>
<package>
<name>foswiki</name>
<range><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Foswiki team reports:</p>
<blockquote cite="http://foswiki.org/Support/SecurityAlert-CVE-2012-1004">
<p>When a new user registers, the new user can add arbitrary HTML and
script code into the user topic which is generated by the
RegistrationAgent via standard registration fields such as
"FirstName" or "OrganisationName".</p>
<p>By design, Foswiki's normal editing features allow arbitrary HTML
markup, including script code, to be inserted into any topic anyway,
assuming the authenticated user has CHANGE permission - which is the
case on many Foswiki sites. However, the assumption that only
authenticated users with CHANGE permission may create script content
is false if new users exploit the vulnerability detailed in this
alert to manipulate the registration agent into creating that
content for them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1004</cvename>
<url>http://foswiki.org/Support/SecurityAlert-CVE-2012-1004</url>
</references>
<dates>
<discovery>2012-04-13</discovery>
<entry>2012-05-21</entry>
</dates>
</vuln>
<vuln vid="b8ae4659-a0da-11e1-a294-bcaec565249c">
<topic>libxml2 -- An off-by-one out-of-bounds write by XPointer</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.7.8_3</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google chrome team reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html">
<p>An off-by-one out-of-bounds write flaw was found in the way libxml, a library
for providing XML and HTML support, evaluated certain XPointer parts (XPointer
is used by libxml to include only the part from the returned XML document, that
can be accessed using the XPath expression given with the XPointer). A remote
attacker could provide a specially-crafted XML file, which once opened in an
application, linked against libxml, would lead to that application crash, or,
potentially arbitrary code execution with the privileges of the user running
the application.</p>
<p>Note: The flaw to be exploited requires the particular application, linked
against libxml, to use the XPointer evaluation functionality.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3202</cvename>
<url>http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102</url>
</references>
<dates>
<discovery>2012-05-15</discovery>
<entry>2012-05-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="f5f00804-a03b-11e1-a284-0023ae8e59f0">
<topic>inspircd -- buffer overflow</topic>
<affects>
<package>
<name>inspircd</name>
<range><ge>1.2</ge><lt>1.2.9</lt></range>
<range><ge>2.0</ge><lt>2.0.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>InspIRCd reports:</p>
<blockquote cite="http://inspircd.github.com/">
<p>InspIRCd contains a heap corruption vulnerability that exists in the
dns.cpp code. The res[] buffer is allocated on the heap and can be
overflowed. The res[] buffer can be exploited during its deallocation.
The number of overflowed bytes can be controlled with DNS compression
features.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1836</cvename>
<url>http://inspircd.github.com/</url>
</references>
<dates>
<discovery>2012-03-19</discovery>
<entry>2012-05-17</entry>
<modified>2012-06-21</modified>
</dates>
</vuln>
<vuln vid="aa71daaa-9f8c-11e1-bd0a-0082a0c18826">
<topic>pidgin-otr -- format string vulnerability</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The authors report:</p>
<blockquote cite="http://www.cypherpunks.ca/otr/">
<p>Versions 3.2.0 and earlier of the pidgin-otr plugin contain
a format string security flaw. This flaw could potentially be
exploited by a remote attacker to cause arbitrary code to be
executed on the user's machine.</p>
<p>The flaw is in pidgin-otr, not in libotr. Other applications
that use libotr are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2369</cvename>
<url>http://www.cypherpunks.ca/otr/</url>
</references>
<dates>
<discovery>2012-05-16</discovery>
<entry>2012-05-16</entry>
</dates>
</vuln>
<vuln vid="b3435b68-9ee8-11e1-997c-002354ed89bc">
<topic>sudo -- netmask vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><le>1.8.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/netmask.html">
<p>Sudo supports granting access to commands on a per-host basis.
The host specification may be in the form of a host name, a
netgroup, an IP address, or an IP network (an IP address with an
associated netmask).</p>
<p>When IPv6 support was added to sudo, a bug was introduced that
caused the IPv6 network matching code to be called when an IPv4
network address does not match. Depending on the value of the
uninitialized portion of the IPv6 address, it is possible for the
IPv4 network number to match when it should not. This bug only
affects IP network matching and does not affect simple IP address
matching.</p>
<p>The reported configuration that exhibited the bug was an
LDAP-based sudo installation where the sudoRole object contained
multiple sudoHost entries, each containing a different IPv4
network. File-based sudoers should be affected as well as the
same matching code is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2337</cvename>
<url>http://www.sudo.ws/sudo/alerts/netmask.html</url>
</references>
<dates>
<discovery>2012-05-16</discovery>
<entry>2012-05-16</entry>
</dates>
</vuln>
<vuln vid="dba5d1c9-9f29-11e1-b511-003067c2616f">
<topic>OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120510.txt">
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
DTLS can be exploited in a denial of service attack on both clients and
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2333</cvename>
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
</references>
<dates>
<discovery>2012-05-10</discovery>
<entry>2012-05-10</entry>
</dates>
</vuln>
<vuln vid="6601127c-9e09-11e1-b5e0-000c299b62e1">
<topic>socat -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The socat development team reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv3.html">
<p>This vulnerability can be exploited when socat is invoked with the
READLINE address (this is usually only used interactively) without
option "prompt" and without option "noprompt" and an attacker succeeds
to provide malicious data to the other (arbitrary) address that is then
transferred by socat to the READLINE address for output.</p>
<p>Successful exploitation may allow an attacker to execute arbitrary
code with the privileges of the socat process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0219</cvename>
<url>www.dest-unreach.org/socat/contrib/socat-secadv3.html</url>
</references>
<dates>
<discovery>2012-05-14</discovery>
<entry>2012-05-14</entry>
</dates>
</vuln>
<vuln vid="59b68b1e-9c78-11e1-b5e0-000c299b62e1">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.3</lt></range>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Development Team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-08-1">
<p>The release of PHP 5.4.13 and 5.4.3 complete a fix for the
vulnerability in CGI-based setups as originally described in
CVE-2012-1823. (CVE-2012-2311)</p>
<p>Note: mod_php and php-fpm are not vulnerable to this attack.</p>
<p>PHP 5.4.3 fixes a buffer overflow vulnerability in the
apache_request_headers() (CVE-2012-2329).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1823</cvename>
<cvename>CVE-2012-2311</cvename>
<cvename>CVE-2012-2329</cvename>
</references>
<dates>
<discovery>2012-05-08</discovery>
<entry>2012-05-12</entry>
</dates>
</vuln>
<vuln vid="64f8b72d-9c4e-11e1-9c94-000bcdf0a03b">
<topic>libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pidgin reports:</p>
<blockquote cite="http://pidgin.im/news/security/?id=62">
<p>A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2214</cvename>
</references>
<dates>
<discovery>2012-05-06</discovery>
<entry>2012-05-12</entry>
</dates>
</vuln>
<vuln vid="0d3547ab-9b69-11e1-bdb1-525401003090">
<topic>PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><le>2.3.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>High-Tech Bridge reports:</p>
<blockquote cite="https://www.htbridge.com/advisory/HTB23087">
<p>Input passed via the "file" GET parameter to
/pivotx/ajaxhelper.php is not properly sanitised before
being returned to the user. This can be exploited to
execute arbitrary HTML and script code in administrator's
browser session in context of the affected website.</p>
</blockquote>
</body>
</description>
<references>
<bid>52159</bid>
<cvename>CVE-2012-2274</cvename>
<url>https://www.htbridge.com/advisory/HTB23087</url>
</references>
<dates>
<discovery>2012-05-09</discovery>
<entry>2012-05-12</entry>
<modified>2012-05-14</modified>
</dates>
</vuln>
<vuln vid="b91234e7-9a8b-11e1-b666-001636d274f3">
<topic>NVIDIA UNIX driver -- access to arbitrary system memory</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><gt>173.14.35_2</gt><lt>295.71</lt></range>
<range><gt>96.43.20_3</gt><lt>173.14.35</lt></range>
<range><gt>71.86.15_3</gt><lt>96.43.20_2</lt></range>
<range><lt>71.86.15_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3109">
<p>Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
was disclosed to NVIDIA on March 20th, 2012. The vulnerability
makes it possible for an attacker who has read and write access
to the GPU device nodes to reconfigure GPUs to gain access to
arbitrary system memory. NVIDIA is not aware of any reports of
this vulnerability, outside of the disclosure which was made
privately to NVIDIA.</p>
<p>NVIDIA has identified the root cause of the vulnerability and
has released updated drivers which close it. [NVIDIA encourages]
all users with Geforce 8 or newer, G80 Quadro or newer, and all
Tesla GPUs to update their drivers to 295.40 or later.</p>
</blockquote>
<p>Later, it was additionally discovered that similar exploit could
be achieved through remapping of VGA window:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3140">
<p>NVIDIA received notification of a security exploit that uses
NVIDIA UNIX device files to map and program registers to redirect
the VGA window. Through the VGA window, the exploit can access
any region of physical system memory. This arbitrary memory
access can be further exploited, for example, to escalate user
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0946</cvename>
<cvename>CVE-2012-4225</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-05-10</entry>
<modified>2012-09-12</modified>
</dates>
</vuln>
<vuln vid="3d55b961-9a2e-11e1-a2ef-001fd0af1a4c">
<topic>rubygem-mail -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-mail</name>
<range><lt>2.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rubygem-mail -- multiple vulnerabilities</p>
<blockquote cite="http://seclists.org/oss-sec/2012/q2/190">
<p>Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2139</cvename>
<cvename>CVE-2012-2140</cvename>
<url>http://seclists.org/oss-sec/2012/q2/190</url>
</references>
<dates>
<discovery>2012-03-14</discovery>
<entry>2012-05-09</entry>
</dates>
</vuln>
<vuln vid="a1d0911f-987a-11e1-a2ef-001fd0af1a4c">
<topic>node -- private information disclosure</topic>
<affects>
<package>
<name>node</name>
<name>node-devel</name>
<range><lt>0.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Private information disclosure</p>
<blockquote cite="http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/">
<p>An attacker can cause private information disclosure.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/</url>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-05-07</entry>
</dates>
</vuln>
<vuln vid="725ab25a-987b-11e1-a2ef-001fd0af1a4c">
<topic>p5-Config-IniFiles -- unsafe temporary file creation</topic>
<affects>
<package>
<name>p5-Config-IniFiles</name>
<range><lt>2.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unsafe Temporary file creation</p>
<blockquote cite="https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59">
<p>Config::IniFiles used a predictable name for its temporary
file without opening it correctly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2451</cvename>
<url>https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59</url>
</references>
<dates>
<discovery>2012-05-02</discovery>
<entry>2012-05-07</entry>
</dates>
</vuln>
<vuln vid="60de13d5-95f0-11e1-806a-001143cd36d8">
<topic>php -- vulnerability in certain CGI-based setups</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.2</lt></range>
<range><lt>5.3.12</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.12</lt></range>
</package>
<package>
<name>php4</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-03-1">
<p>Security Enhancements and Fixes in PHP 5.3.12:</p>
<ul>
<li>Initial fix for cgi-bin ?-s cmdarg parse issue
(CVE-2012-1823)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1823</cvename>
</references>
<dates>
<discovery>2012-05-03</discovery>
<entry>2012-05-05</entry>
</dates>
</vuln>
<vuln vid="18dffa02-946a-11e1-be9d-000c29cc39d3">
<topic>WebCalendar -- multiple vulnerabilities</topic>
<affects>
<package>
<name>WebCalendar-devel</name>
<range><le>1.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Boeck reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/04/28/1">
<p>Fixes [are now available] for various security vulnerabilities
including LFI (local file inclusion), XSS (cross site scripting)
and others.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1495</cvename>
<cvename>CVE-2012-1496</cvename>
<url>http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html</url>
<url>http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html</url>
<url>http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html</url>
</references>
<dates>
<discovery>2012-04-28</discovery>
<entry>2012-05-02</entry>
</dates>
</vuln>
<vuln vid="2cde1892-913e-11e1-b44c-001fd0af1a4c">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.11</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-04-26-1">
<p>Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:</p>
<ul>
<li>Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172) </li>
<li>Add open_basedir checks to readline_write_history and readline_read_history.</li>
</ul>
<p>Security Enhancements for both PHP 5.3.11 only:</p>
<ul>
<li>Regression in magic_quotes_gpc fix for CVE-2012-0831.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0831</cvename>
<cvename>CVE-2012-1172</cvename>
<url>http://www.php.net/archive/2012.php#id2012-04-26-1</url>
</references>
<dates>
<discovery>2012-03-01</discovery>
<entry>2012-04-28</entry>
<modified>2012-05-04</modified>
</dates>
</vuln>
<vuln vid="0fa15e08-92ec-11e1-a94a-00215c6a37bb">
<topic>samba -- incorrect permission checks vulnerability</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.17</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.15</lt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-2111">
<p>Samba versions 3.4.x to 3.6.4 inclusive are affected
by a vulnerability that allows arbitrary users to modify
privileges on a file server.</p>
<p>Security checks were incorrectly applied to the Local
Security Authority (LSA) remote proceedure calls (RPC)
CreateAccount, OpenAccount, AddAccountRights and
RemoveAccountRights allowing any authenticated user
to modify the privileges database.</p>
<p>This is a serious error, as it means that authenticated
users can connect to the LSA and grant themselves the
"take ownership" privilege. This privilege is used by the
smbd file server to grant the ability to change ownership
of a file or directory which means users could take ownership
of files or directories they do not own.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2111</cvename>
</references>
<dates>
<discovery>2012-04-30</discovery>
<entry>2012-04-30</entry>
</dates>
</vuln>
<vuln vid="b428e6b3-926c-11e1-8d7b-003067b2972c">
<topic>portupgrade-devel -- lack of distfile checksums</topic>
<affects>
<package>
<name>portupgrade-devel</name>
<range><lt>0,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ports security team reports:</p>
<p>The portupgrade-devel port fetched directly from a git
respository without checking against a known good
SHA hash. This means that it is possible that packages
built using this port may not match the one vetted
by the maintainer. Users are advised to rebuild
portupgrade-devel from known good sources.</p>
</body>
</description>
<references>
<mlist>http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI</mlist>
<mlist>http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports</mlist>
</references>
<dates>
<discovery>2012-04-30</discovery>
<entry>2012-04-30</entry>
<modified>2012-05-06</modified>
</dates>
</vuln>
<vuln vid="5d85976a-9011-11e1-b5e0-000c299b62e1">
<topic>net-snmp -- Remote DoS</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.7.1_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat Security Response Team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=815813">
<p>An array index error, leading to out-of heap-based buffer read flaw was
found in the way the net-snmp agent performed lookups in the
extension table. When certain MIB subtrees were handled by the
extend directive, a remote attacker (having read privileges to the
subntree) could use this flaw to cause a denial of service condition
via an SNMP GET request involving a non-existent extension table
entry.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2141</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=815813</url>
<url>http://www.openwall.com/lists/oss-security/2012/04/26/2</url>
</references>
<dates>
<discovery>2012-04-26</discovery>
<entry>2012-04-27</entry>
</dates>
</vuln>
<vuln vid="380e8c56-8e32-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>12.0,1</lt></range>
<range><lt>10.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.9</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.9</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>12.0</lt></range>
<range><lt>10.0.4</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)</p>
<p>MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9</p>
<p>MFSA 2012-22 use-after-free in IDBKeyRange</p>
<p>MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface</p>
<p>MFSA 2012-24 Potential XSS via multibyte content processing errors</p>
<p>MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite</p>
<p>MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error</p>
<p>MFSA 2012-27 Page load short-circuit can lead to XSS</p>
<p>MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions</p>
<p>MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues</p>
<p>MFSA 2012-30 Crash with WebGL content using textImage2D</p>
<p>MFSA 2012-31 Off-by-one error in OpenType Sanitizer</p>
<p>MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors</p>
<p>MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1187</cvename>
<cvename>CVE-2011-3062</cvename>
<cvename>CVE-2012-0467</cvename>
<cvename>CVE-2012-0468</cvename>
<cvename>CVE-2012-0469</cvename>
<cvename>CVE-2012-0470</cvename>
<cvename>CVE-2012-0471</cvename>
<cvename>CVE-2012-0472</cvename>
<cvename>CVE-2012-0473</cvename>
<cvename>CVE-2012-0474</cvename>
<cvename>CVE-2012-0475</cvename>
<cvename>CVE-2012-0477</cvename>
<cvename>CVE-2012-0478</cvename>
<cvename>CVE-2012-0479</cvename>
<cvename>CVE-2012-1126</cvename>
<cvename>CVE-2012-1127</cvename>
<cvename>CVE-2012-1128</cvename>
<cvename>CVE-2012-1129</cvename>
<cvename>CVE-2012-1130</cvename>
<cvename>CVE-2012-1131</cvename>
<cvename>CVE-2012-1132</cvename>
<cvename>CVE-2012-1133</cvename>
<cvename>CVE-2012-1134</cvename>
<cvename>CVE-2012-1135</cvename>
<cvename>CVE-2012-1136</cvename>
<cvename>CVE-2012-1137</cvename>
<cvename>CVE-2012-1138</cvename>
<cvename>CVE-2012-1139</cvename>
<cvename>CVE-2012-1140</cvename>
<cvename>CVE-2012-1141</cvename>
<cvename>CVE-2012-1142</cvename>
<cvename>CVE-2012-1143</cvename>
<cvename>CVE-2012-1144</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-20.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-21.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-22.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-23.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-24.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-25.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-26.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-27.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-28.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-29.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-30.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-31.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-32.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-33.html</url>
</references>
<dates>
<discovery>2012-04-24</discovery>
<entry>2012-04-24</entry>
</dates>
</vuln>
<vuln vid="a04247f1-8d9c-11e1-93c7-00215c6a37bb">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20120125_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Webber reports:</p>
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2487">
<p>Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2128</cvename>
<cvename>CVE-2012-2129</cvename>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="1c5abbe2-8d7f-11e1-a374-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.24</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.11.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote Crash Vulnerability in SIP Channel Driver</p>
<p>Heap Buffer Overflow in Skinny Channel Driver</p>
<p>Asterisk Manager User Unauthorized Shell Access</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.digium.com/pub/security/AST-2012-004.html</url>
<cvename>CVE-2012-2414</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-005.html</url>
<cvename>CVE-2012-2415</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-006.html</url>
<cvename>CVE-2012-2416</cvename>
</references>
<dates>
<discovery>2012-04-23</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="b384cc5b-8d56-11e1-8d7b-003067b2972c">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.3.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="https://codex.wordpress.org/Version_3.3.2">
<p>External code has been updated to
non-vulnerable versions.
In addition the following bugs have been fixed:</p>
<ul>
<li>Limited privilege escalation where a site administrator could
deactivate network-wide plugins when running a WordPress network under
particular circumstances.</li>
<li>Cross-site scripting vulnerability when making URLs
clickable.</li>
<li>Cross-site scripting vulnerabilities in redirects after posting
comments in older browsers, and when filtering URLs.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2399</cvename>
<cvename>CVE-2012-2400</cvename>
<cvename>CVE-2012-2401</cvename>
<cvename>CVE-2012-2402</cvename>
<cvename>CVE-2012-2403</cvename>
<cvename>CVE-2012-2404</cvename>
<url>https://codex.wordpress.org/Version_3.3.2</url>
</references>
<dates>
<discovery>2012-04-20</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="7184f92e-8bb8-11e1-8d7b-003067b2972c">
<topic>OpenSSL -- integer conversions result in memory corruption</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120419.txt">
<p>A potentially exploitable vulnerability has been discovered in the OpenSSL
function asn1_d2i_read_bio.
Any application which uses BIO or FILE based functions to read untrusted DER
format data is vulnerable. Affected functions are of the form d2i_*_bio or
d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2110</cvename>
<mlist msgid="20120419103522.GN30784@cmpxchg8b.com">http://marc.info/?l=full-disclosure&m=133483221408243</mlist>
<url>http://www.openssl.org/news/secadv_20120419.txt</url>
</references>
<dates>
<discovery>2012-04-19</discovery>
<entry>2012-04-21</entry>
</dates>
</vuln>
<vuln vid="09c87973-8b9d-11e1-b393-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.9</lt></range>
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.8/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Unauthorized Access</h1>
<p>Due to a lack of proper validation of the X-FORWARDED-FOR
header of an authentication request, an attacker could bypass
the current lockout policy used for protection against brute-
force password discovery. This vulnerability can only be
exploited if the 'inbound_proxies' parameter is set.</p>
<h1>Cross Site Scripting</h1>
<p>A JavaScript template used by buglist.cgi could be used
by a malicious script to permit an attacker to gain access
to some information about bugs he would not normally be
allowed to see, using the victim's credentials. To be
exploitable, the victim must be logged in when visiting
the attacker's malicious page.</p>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0465</cvename>
<cvename>CVE-2012-0466</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=728639</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=745397</url>
</references>
<dates>
<discovery>2012-04-18</discovery>
<entry>2012-04-21</entry>
</dates>
</vuln>
<vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0">
<topic>typo -- Cross-Site Scripting</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.6.0</ge><le>4.6.7</le></range>
<range><ge>4.5.0</ge><le>4.5.14</le></range>
<range><ge>4.4.0</ge><le>4.4.14</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/">
<p>Failing to properly encode the output, the default TYPO3
Exception Handler is susceptible to Cross-Site Scripting. We
are not aware of a possibility to exploit this vulnerability
without third party extensions being installed that put user
input in exception messages. However, it has come to our
attention that extensions using the extbase MVC framework can
be used to exploit this vulnerability if these extensions
accept objects in controller actions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2112</cvename>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-04-18</entry>
</dates>
</vuln>
<vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7">
<topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.0.15</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Buffer overflow in the ngx_http_mp4_module</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2089</cvename>
<url>http://nginx.org/en/security_advisories.html</url>
</references>
<dates>
<discovery>2012-04-12</discovery>
<entry>2012-04-16</entry>
</dates>
</vuln>
<vuln vid="c80a3d93-8632-11e1-a374-14dae9ebcf89">
<topic>phpmyfaq -- Remote PHP Code Execution Vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
<p>The bundled ImageManager library allows injection of arbitrary
PHP code to execute arbitrary PHP code and upload malware and
trojan horses.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/advisory_2012-04-14.php</url>
</references>
<dates>
<discovery>2012-04-14</discovery>
<entry>2012-04-14</entry>
</dates>
</vuln>
<vuln vid="607d2108-a0e4-423a-bf78-846f2a8f01b0">
<topic>puppet -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.7.*</gt><lt>2.7.12_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://puppetlabs.com/security/">
<p>Multiple vulnerabilities exist in puppet that can result in
arbitrary code execution, arbitrary file read access, denial of
service, and arbitrary file write access. Please review the
details in each of the CVEs for additional information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1906</cvename>
<cvename>CVE-2012-1986</cvename>
<cvename>CVE-2012-1987</cvename>
<cvename>CVE-2012-1988</cvename>
<cvename>CVE-2012-1989</cvename>
<url>http://puppetlabs.com/security/cve/cve-2012-1906/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1986/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1987/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1988/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1989/</url>
</references>
<dates>
<discovery>2012-03-26</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="baf37cd2-8351-11e1-894e-00215c6a37bb">
<topic>samba -- "root" credential remote code execution</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.16</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.14</lt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba development team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-1182">
<p>Samba versions 3.6.3 and all versions previous to this
are affected by a vulnerability that allows remote code
execution as the "root" user from an anonymous connection.</p>
<p>As this does not require an authenticated connection it
is the most serious vulnerability possible in a program,
and users and vendors are encouraged to patch their Samba
installations immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1182</cvename>
</references>
<dates>
<discovery>2012-04-10</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="7f448dc1-82ca-11e1-b393-20cf30e32f6d">
<topic>bugzilla Cross-Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>4.0.0</ge><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.4/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<ul>
<li>Due to a lack of validation of the enctype form attribute
when making POST requests to xmlrpc.cgi, a possible CSRF
vulnerability was discovered. If a user visits an HTML page
with some malicious HTML code in it, an attacker could make
changes to a remote Bugzilla installation on behalf of the
victim's account by using the XML-RPC API on a site running
mod_perl. Sites running under mod_cgi are not affected.
Also, the user would have had to be already logged in to the
target site for the vulnerability to work.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0453</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=725663</url>
</references>
<dates>
<discovery>2012-02-22</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="20923a0d-82ba-11e1-8d7b-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.228</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-07.html">
<p>Multiple Priority 2 vulnerabilities could cause a crash and
potentially allow an attacker to take control of the affected
system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0724</cvename>
<cvename>CVE-2012-0725</cvename>
<cvename>CVE-2012-0772</cvename>
<cvename>CVE-2012-0773</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-07.html</url>
</references>
<dates>
<discovery>2012-04-05</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="262b92fe-81c8-11e1-8899-001ec9578670">
<topic>png -- memory corruption/possible remote code execution</topic>
<affects>
<package>
<name>png</name>
<name>linux-f10-png</name>
<range><lt>1.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PNG project reports:</p>
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
<p>libpng fails to correctly handle malloc() failures for text
chunks (in png_set_text_2()), which can lead to memory
corruption and the possibility of remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3048</cvename>
<url>http://www.libpng.org/pub/png/libpng.html</url>
</references>
<dates>
<discovery>2012-03-29</discovery>
<entry>2012-04-08</entry>
</dates>
</vuln>
<vuln vid="462e2d6c-8017-11e1-a571-bcaec565249c">
<topic>freetype -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Freetype project reports:</p>
<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view">
<p>Multiple vulnerabilities exist in freetype that can result in
application crashes and remote code execution. Please review
the details in each of the CVEs for additional information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1126</cvename>
<cvename>CVE-2012-1127</cvename>
<cvename>CVE-2012-1128</cvename>
<cvename>CVE-2012-1129</cvename>
<cvename>CVE-2012-1130</cvename>
<cvename>CVE-2012-1131</cvename>
<cvename>CVE-2012-1132</cvename>
<cvename>CVE-2012-1133</cvename>
<cvename>CVE-2012-1134</cvename>
<cvename>CVE-2012-1135</cvename>
<cvename>CVE-2012-1136</cvename>
<cvename>CVE-2012-1137</cvename>
<cvename>CVE-2012-1138</cvename>
<cvename>CVE-2012-1139</cvename>
<cvename>CVE-2012-1140</cvename>
<cvename>CVE-2012-1141</cvename>
<cvename>CVE-2012-1142</cvename>
<cvename>CVE-2012-1143</cvename>
<cvename>CVE-2012-1144</cvename>
<url>https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=806270</url>
</references>
<dates>
<discovery>2012-03-08</discovery>
<entry>2012-04-06</entry>
</dates>
</vuln>
<vuln vid="49314321-7fd4-11e1-9582-001b2134ef46">
<topic>mutt-devel -- failure to check SMTP TLS server certificate</topic>
<affects>
<package>
<name>mutt-devel</name>
<range><lt>1.5.21_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dave B reports on Full Disclosure:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2011/Mar/87">
<p>It seems that mutt fails to check the validity of a SMTP
servers certificate during a TLS connection. [...]
This means that an attacker could potentially MITM a
mutt user connecting to their SMTP server even when the
user has forced a TLS connection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1429</cvename>
<url>http://seclists.org/fulldisclosure/2011/Mar/87</url>
</references>
<dates>
<discovery>2012-03-08</discovery>
<entry>2012-04-06</entry>
</dates>
</vuln>
<vuln vid="7289214f-7c55-11e1-ab3b-000bcdf0a03b">
<topic>libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1178">
<p>The msn_oim_report_to_user function in oim.c in the MSN protocol
plugin in libpurple in Pidgin before 2.10.2 allows remote servers
to cause a denial of service (application crash) via an OIM message
that lacks UTF-8 encoding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1178</cvename>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-04-01</entry>
</dates>
</vuln>
<vuln vid="a81161d2-790f-11e1-ac16-e0cb4e266481">
<topic>phpMyAdmin -- Path disclosure due to missing verification of file presence</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php">
<p>The show_config_errors.php scripts did not validate the presence
of the configuration file, so an error message shows the full path
of this file, leading to possible further attacks. For the error
messages to be displayed, php.ini's error_reporting must be set to
E_ALL and display_errors must be On (these settings are not
recommended on a production server in the PHP manual).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1902</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php</url>
</references>
<dates>
<discovery>2012-03-28</discovery>
<entry>2012-03-28</entry>
</dates>
</vuln>
<vuln vid="60f81af3-7690-11e1-9423-00235a5f2c9a">
<topic>raptor/raptor2 -- XXE in RDF/XML File Interpretation</topic>
<affects>
<package>
<name>raptor2</name>
<range><lt>2.0.7</lt></range>
</package>
<package>
<name>raptor</name>
<range><lt>1.4.21_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timothy D. Morgan reports:</p>
<blockquote cite="http://www.vsecurity.com/resources/advisory/20120324-1/">
<p>In December 2011, VSR identified a vulnerability in multiple open
source office products (including OpenOffice, LibreOffice, KOffice,
and AbiWord) due to unsafe interpretation of XML files with custom
entity declarations. Deeper analysis revealed that the
vulnerability was caused by acceptance of external entities by the
libraptor library, which is used by librdf and is in turn used by
these office products.</p>
<p>In the context of office applications, these vulnerabilities could
allow for XML External Entity (XXE) attacks resulting in file theft
and a loss of user privacy when opening potentially malicious ODF
documents. For other applications which depend on librdf or
libraptor, potentially serious consequences could result from
accepting RDF/XML content from untrusted sources, though the impact
may vary widely depending on the context.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0037</cvename>
<url>http://seclists.org/fulldisclosure/2012/Mar/281</url>
<url>http://www.vsecurity.com/resources/advisory/20120324-1/</url>
</references>
<dates>
<discovery>2012-03-24</discovery>
<entry>2012-03-25</entry>
</dates>
</vuln>
<vuln vid="42a2c82a-75b9-11e1-89b4-001ec9578670">
<topic>quagga -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.20.1</lt></range>
</package>
<package>
<name>quagga-re</name>
<range><lt>0.99.17.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/551715">
<p>The ospfd implementation of OSPF in Quagga allows a remote
attacker (on a local network segment with OSPF enabled) to cause
a denial of service (daemon aborts due to an assert) with a
malformed OSPF LS-Update message.</p>
<p>The ospfd implementation of OSPF in Quagga allows a remote
attacker (on a local network segment with OSPF enabled) to cause
a denial of service (daemon crash) with a malformed OSPF Network-
LSA message.</p>
<p>The bgpd implementation of BGP in Quagga allows remote attackers
to cause a denial of service (daemon aborts due to an assert) via
BGP Open message with an invalid AS4 capability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0249</cvename>
<cvename>CVE-2012-0250</cvename>
<cvename>CVE-2012-0255</cvename>
<url>http://www.kb.cert.org/vuls/id/551715</url>
</references>
<dates>
<discovery>2012-03-23</discovery>
<entry>2012-03-24</entry>
<modified>2012-03-26</modified>
</dates>
</vuln>
<vuln vid="acab2f88-7490-11e1-865f-00e0814cab4e">
<topic>Apache Traffic Server -- heap overflow vulnerability</topic>
<affects>
<package>
<name>trafficserver</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT-FI reports:</p>
<blockquote cite="https://www.cert.fi/en/reports/2012/vulnerability612884.html">
<p>A heap overflow vulnerability has been found in the HTTP
(Hypertext Transfer Protocol) protocol handling of Apache
Traffic Server. The vulnerability allows an attacker to cause
a denial of service or potentially to execute his own code by
sending a specially modified HTTP message to an affected
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0256</cvename>
</references>
<dates>
<discovery>2012-03-22</discovery>
<entry>2012-03-24</entry>
</dates>
</vuln>
<vuln vid="2e7e9072-73a0-11e1-a883-001cc0a36e12">
<topic>libtasn1 -- ASN.1 length decoding vulnerability</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>gnutls</name>
<range><lt>2.12.18</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><gt>2.99</gt><lt>3.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mu Dynamics, Inc. reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
<p>Various functions using the ASN.1 length decoding logic in
Libtasn1 were incorrectly assuming that the return value from
asn1_get_length_der is always less than the length of the
enclosing ASN.1 structure, which is only true for valid
structures and not for intentionally corrupt or otherwise
buggy structures.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1569</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-03-21</entry>
<modified>2012-03-24</modified>
</dates>
</vuln>
<vuln vid="aecee357-739e-11e1-a883-001cc0a36e12">
<topic>gnutls -- possible overflow/Denial of service vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.18</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><gt>2.99</gt><lt>3.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mu Dynamics, Inc. reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
<p>The block cipher decryption logic in GnuTLS assumed that a
record containing any data which was a multiple of the block
size was valid for further decryption processing, leading to
a heap corruption vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1573</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-03-21</entry>
<modified>2012-03-24</modified>
</dates>
</vuln>
<vuln vid="0d530174-6eef-11e1-afd6-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.44</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.23</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.10.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Stack Buffer Overflow in HTTP Manager</p>
<p>Remote Crash Vulnerability in Milliwatt Application</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2012-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2012-003.html</url>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="60eb344e-6eb1-11e1-8ad7-00e0815b8da8">
<topic>OpenSSL -- CMS and S/MIME Bleichenbacher attack</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120312.txt">
<p>A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
also known as the million message attack (MMA).</p>
<p>Only users of CMS, PKCS #7, or S/MIME decryption operations are
affected. A successful attack needs on average 2^20 messages. In
practice only automated systems will be affected as humans will
not be willing to process this many messages.</p>
<p>SSL/TLS applications are *NOT* affected by this problem since
the SSL/TLS code does not use the PKCS#7 or CMS decryption
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0884</cvename>
<url>http://www.openssl.org/news/secadv_20120312.txt</url>
</references>
<dates>
<discovery>2012-03-12</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="29194cb8-6e9f-11e1-8376-f0def16c5c1b">
<topic>nginx -- potential information leak</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.0.14,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.1.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nginx development team reports:</p>
<blockquote cite="http://nginx.net/CHANGES">
<p>Matthew Daley recently discovered a security problem
which may lead to a disclosure of previously freed memory
on specially crafted response from an upstream server,
potentially resulting in sensitive information leak.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.net/CHANGES</url>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="a1050b8b-6db3-11e1-8b37-0011856a6e37">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>10.0.3,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.28</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.3,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>10.0.3</lt></range>
<range><gt>3.1.*</gt><lt>3.1.20</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-13 XSS with Drag and Drop and Javascript: URL</p>
<p>MFSA 2012-14 SVG issues found with Address Sanitizer</p>
<p>MFSA 2012-15 XSS with multiple Content Security Policy headers</p>
<p>MFSA 2012-16 Escalation of privilege with Javascript: URL as home page</p>
<p>MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification</p>
<p>MFSA 2012-18 window.fullScreen writeable by untrusted content</p>
<p>MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0451</cvename>
<cvename>CVE-2012-0455</cvename>
<cvename>CVE-2012-0456</cvename>
<cvename>CVE-2012-0457</cvename>
<cvename>CVE-2012-0458</cvename>
<cvename>CVE-2012-0459</cvename>
<cvename>CVE-2012-0460</cvename>
<cvename>CVE-2012-0461</cvename>
<cvename>CVE-2012-0462</cvename>
<cvename>CVE-2012-0463</cvename>
<cvename>CVE-2012-0464</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-13.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-14.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-15.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-16.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-17.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-18.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-19.html</url>
</references>
<dates>
<discovery>2012-03-13</discovery>
<entry>2012-03-14</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="6d329b64-6bbb-11e1-9166-001e4f0fb9b1">
<topic>portaudit -- auditfile remote code execution</topic>
<affects>
<package>
<name>portaudit</name>
<range><lt>0.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Gmelin and Jörg Scheinert has reported a remote
command execution vulnerability in portaudit.</p>
<p>An attacker who can get the user to use a specially crafted
audit file will be able to run commands on the users system,
with the privileges of the user running running portaudit
(often root).</p>
<p>The attack could e.g. happen through DNS hijacking or a man
in the middle attack.</p>
<p>Note that if the user has set up portaudit to run from
periodic this attack could happen without direct user
interaction.</p>
<p>In the FreeBSD Ports Collection (bsd.port.mk) the check for
vulnerable ports at install-time directly operates on the
auditfile and has the same vulnerability as portaudit. As
the Ports Collection infrastructure does not have a version
number just be sure to have a Ports Collection new enough to
contain the fix for portaudit. Note that this is <em>only</em>
a problem for users which has portaudit installed, as they will
not have the audit database installed or downloaded
otherwise.</p>
</body>
</description>
<references>
<url>http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30</url>
<url>http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2012-03-11</entry>
</dates>
</vuln>
<vuln vid="9da3834b-6a50-11e1-91af-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.1r102.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-05.html">
<p>These vulnerabilities could cause a crash and potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0768</cvename>
<cvename>CVE-2012-0769</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-05.html</url>
</references>
<dates>
<discovery>2012-03-05</discovery>
<entry>2012-03-09</entry>
</dates>
</vuln>
<vuln vid="9448a82f-6878-11e1-865f-00e0814cab4e">
<topic>jenkins -- XSS vulnerability</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.453</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05">
<p>An XSS vulnerability was found in Jenkins core, which allows an
attacker to inject malicious HTMLs to pages served by Jenkins.
This allows an attacker to escalate his privileges by hijacking
sessions of other users. This vulnerability affects all
versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05</url>
</references>
<dates>
<discovery>2012-03-05</discovery>
<entry>2012-03-07</entry>
</dates>
</vuln>
<vuln vid="eba70db4-6640-11e1-98af-00262d8b701d">
<topic>dropbear -- arbitrary code execution</topic>
<affects>
<package>
<name>dropbear</name>
<range><ge>0.51</ge><lt>2012.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Dropbear project reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/73444">
<p>Dropbear SSH Server could allow a remote authenticated attacker
to execute arbitrary code on the system, caused by a use-after-
free error. If a command restriction is enforced, an attacker
could exploit this vulnerability to execute arbitrary code on
the system with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<bid>52159</bid>
<cvename>CVE-2012-0920</cvename>
<url>http://secunia.com/advisories/48147</url>
<url>http://xforce.iss.net/xforce/xfdb/73444</url>
</references>
<dates>
<discovery>2012-02-22</discovery>
<entry>2012-03-04</entry>
</dates>
</vuln>
<vuln vid="46aeba13-64a1-11e1-bc16-0023ae8e59f0">
<topic>openx -- undisclosed security issue</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenX does not provide information about vulnerabilities beyond their
existence.</p>
</body>
</description>
<references>
<url>http://blog.openx.org/12/security-matters-3</url>
</references>
<dates>
<discovery>2011-12-01</discovery>
<entry>2012-03-02</entry>
<modified>2012-07-08</modified>
</dates>
</vuln>
<vuln vid="174b8864-6237-11e1-be18-14dae938ec40">
<topic>databases/postgresql*-client -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql-client</name>
<range><lt>8.3.18</lt></range>
<range><ge>8.4</ge><lt>8.4.11</lt></range>
<range><ge>9</ge><lt>9.0.7</lt></range>
<range><ge>9.1</ge><lt>9.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1377/">
<p>These vulnerabilities could allow users to define triggers that
execute functions on which the user does not have EXECUTE
permission, allow SSL certificate spoofing and allow line breaks
in object names to be exploited to execute code when loading a
pg_dump file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0866</cvename>
<cvename>CVE-2012-0867</cvename>
<cvename>CVE-2012-0868</cvename>
<url>http://www.postgresql.org/about/news/1377/</url>
</references>
<dates>
<discovery>2012-02-27</discovery>
<entry>2012-02-28</entry>
</dates>
</vuln>
<vuln vid="f63bf080-619d-11e1-91af-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.1r102.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-03.html">
<p>These vulnerabilities could cause a crash and potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0751</cvename>
<cvename>CVE-2012-0752</cvename>
<cvename>CVE-2012-0753</cvename>
<cvename>CVE-2012-0754</cvename>
<cvename>CVE-2012-0755</cvename>
<cvename>CVE-2012-0756</cvename>
<cvename>CVE-2012-0767</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-03.html</url>
</references>
<dates>
<discovery>2012-02-15</discovery>
<entry>2012-02-27</entry>
</dates>
</vuln>
<vuln vid="57f1a624-6197-11e1-b98c-bcaec565249c">
<topic>libxml2 -- heap buffer overflow</topic>
<affects>
<package>
<name>libxml2</name>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google chrome team reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html">
<p>Heap-based buffer overflow in libxml2, allows remote attackers
to cause a denial of service or possibly have unspecified other
impact via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3919</cvename>
<url>http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html</url>
</references>
<dates>
<discovery>2012-01-05</discovery>
<entry>2012-02-27</entry>
</dates>
</vuln>
<vuln vid="ba51c2f7-5b43-11e1-8288-00262d5ed8ee">
<topic>plib -- remote code execution via buffer overflow</topic>
<affects>
<package>
<name>torcs</name>
<range><lt>1.3.3</lt></range>
</package>
<package>
<name>plib</name>
<range><le>1.8.5_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47297/">
<p>A vulnerability has been discovered in PLIB, which can be
exploited by malicious people to compromise an application using
the library.</p>
<p>The vulnerability is caused due to a boundary error within the
"ulSetError()" function (src/util/ulError.cxx) when creating the
error message, which can be exploited to overflow a static
buffer.</p>
<p>Successful exploitation allows the execution of arbitrary code
but requires that the attacker can e.g. control the content of
an overly long error message passed to the "ulSetError()"
function.</p>
<p>The vulnerability is confirmed in version 1.8.5. Other versions
may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4620</cvename>
<url>http://secunia.com/advisories/47297/</url>
<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79</url>
</references>
<dates>
<discovery>2011-12-21</discovery>
<entry>2012-02-19</entry>
</dates>
</vuln>
<vuln vid="fdd1c316-5a3d-11e1-8d3e-e0cb4e266481">
<topic>phpMyAdmin -- XSS in replication setup</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php">
<p>It was possible to conduct XSS using a crafted database name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1190</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php</url>
</references>
<dates>
<discovery>2012-02-18</discovery>
<entry>2012-02-18</entry>
</dates>
</vuln>
<vuln vid="da317bc9-59a6-11e1-bc16-0023ae8e59f0">
<topic>piwik -- xss and click-jacking issues</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik Team reports:</p>
<blockquote cite="http://piwik.org/blog/2012/02/7775/">
<p>We would like to thank the following security researchers for
their responsible disclosure of XSS and click-jacking issues:
Piotr Duszynski, Sergey Markov, Mauro Gentile.</p>
</blockquote>
</body>
</description>
<references>
<url>"http://piwik.org/blog/2012/02/7775/"</url>
</references>
<dates>
<discovery>2012-02-16</discovery>
<entry>2012-02-16</entry>
</dates>
</vuln>
<vuln vid="d7dbd2db-599c-11e1-a2fb-14dae9ebcf89">
<topic>mozilla -- heap-buffer overflow</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.27</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.7</ge><lt>2.7.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>10.0</ge><lt>10.0.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.7</ge><lt>2.7.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>10.0</ge><lt>10.0.2</lt></range>
<range><gt>3.1.*</gt><lt>3.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-11 libpng integer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3026</cvename>
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-11.html</url>
</references>
<dates>
<discovery>2012-02-16</discovery>
<entry>2012-02-17</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="b4f8be9e-56b2-11e1-9fb7-003067b2972c">
<topic>Python -- DoS via malformed XML-RPC / HTTP POST request</topic>
<affects>
<package>
<name>python32</name>
<range><le>3.2.2_2</le></range>
</package>
<package>
<name>python31</name>
<range><le>3.1.4_2</le></range>
</package>
<package>
<name>python27</name>
<range><le>2.7.2_3</le></range>
</package>
<package>
<name>python26</name>
<range><le>2.6.7_2</le></range>
</package>
<package>
<name>python25</name>
<range><le>2.5.6_2</le></range>
</package>
<package>
<name>python24</name>
<range><le>2.4.5_8</le></range>
</package>
<package>
<name>pypy</name>
<!-- note that it also affects 1.8 but we do not yet have
this version in ports. -->
<range><le>1.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports,</p>
<blockquote cite="http://bugs.python.org/issue14001">
<p>A denial of service flaw was found in the way Simple XML-RPC
Server module of Python processed client connections, that were
closed prior the complete request body has been received. A
remote attacker could use this flaw to cause Python Simple
XML-RPC based server process to consume excessive amount of
CPU.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0845</cvename>
<url>http://bugs.python.org/issue14001</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=789790</url>
<url>https://bugs.pypy.org/issue1047</url>
</references>
<dates>
<discovery>2012-02-13</discovery>
<entry>2012-02-14</entry>
<modified>2012-02-26</modified>
</dates>
</vuln>
<vuln vid="2b20fd5f-552e-11e1-9fb7-003067b2972c">
<topic>WebCalendar -- Persistent XSS</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><le>1.2.4</le></range>
</package>
<package>
<name>WebCalendar-devel</name>
<range><le>1.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tom reports,</p>
<blockquote cite="http://seclists.org/bugtraq/2012/Jan/128">
<p>There is no sanitation on the input of the location variable
allowing for persistent XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0846</cvename>
<url>http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870</url>
</references>
<dates>
<discovery>2012-01-11</discovery>
<entry>2012-02-12</entry>
<modified>2012-02-13</modified>
</dates>
</vuln>
<vuln vid="eba9aa94-549c-11e1-b6b7-0011856a6e37">
<topic>mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.7</ge><lt>2.7.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>10.0</ge><lt>10.0.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.7</ge><lt>2.7.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>10.0</ge><lt>10.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0452</cvename>
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-10.html</url>
</references>
<dates>
<discovery>2012-02-10</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="1c4cab30-5468-11e1-9fb7-003067b2972c">
<topic>bip -- buffer overflow</topic>
<affects>
<package>
<name>bip</name>
<range><le>0.8.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Julien Tinnes reports,</p>
<blockquote cite="https://projects.duckcorp.org/issues/269">
<p>Bip doesn't check if fd is equal or larger than FD_SETSIZE.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0806</cvename>
<url>https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c</url>
<url>https://projects.duckcorp.org/issues/269</url>
</references>
<dates>
<discovery>2012-01-07</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="039d057e-544e-11e1-9fb7-003067b2972c">
<topic>surf -- private information disclosure</topic>
<affects>
<package>
<name>surf</name>
<range><le>0.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>surf does not protect its cookie jar against access read access from
other local users</p>
</body>
</description>
<references>
<cvename>CVE-2012-0842</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296</url>
</references>
<dates>
<discovery>2012-02-10</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="7c769c89-53c2-11e1-8e52-00163e22ef61">
<topic>glpi -- remote attack via crafted POST request</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>0.80.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GLPI project reports:</p>
<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en">
<p>The autocompletion functionality in GLPI before 0.80.2 does not
blacklist certain username and password fields, which allows
remote attackers to obtain sensitive information via a crafted
POST request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en</url>
<url>https://forge.indepnet.net/issues/3017</url>
<cvename>CVE-2011-2720</cvename>
</references>
<dates>
<discovery>2011-07-20</discovery>
<entry>2012-02-10</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="10720fe8-51e0-11e1-91c1-00215c6a37bb">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.23</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="http://drupal.org/node/1425084">
<h3>Cross Site Request Forgery vulnerability in Aggregator
module</h3>
<p>CVE: CVE-2012-0826</p>
<p>An XSRF vulnerability can force an aggregator feed to update.
Since some services are rate-limited (e.g. Twitter limits
requests to 150 per hour) this could lead to a denial of
service.</p>
<p>This issue affects Drupal 6.x and 7.x.</p>
<h3>OpenID not verifying signed attributes in SREG and AX</h3>
<p>CVE: CVE-2012-0825</p>
<p>A group of security researchers identified a flaw in how some
OpenID relying parties implement Attribute Exchange (AX). Not
verifying that attributes being passed through AX have been
signed could allow an attacker to modify users' information.</p>
<p>This issue affects Drupal 6.x and 7.x.</p>
<h3>Access bypass in File module</h3>
<p>CVE: CVE-2012-0827</p>
<p>When using private files in combination with certain field
access modules, the File module will allow users to download
the file even if they do not have access to view the field it
was attached to.</p>
<p>This issue affects Drupal 7.x only.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0825</cvename>
<cvename>CVE-2012-0826</cvename>
<cvename>CVE-2012-0827</cvename>
</references>
<dates>
<discovery>2012-02-01</discovery>
<entry>2012-02-07</entry>
</dates>
</vuln>
<vuln vid="309542b5-50b9-11e1-b0d8-00151735203a">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.8</lt></range>
<range><ge>4.0.*</ge><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<ul>
<li>Account Impersonation:
When a user creates a new account, Bugzilla doesn't correctly
reject email addresses containing non-ASCII characters, which
could be used to impersonate another user account. Such email
addresses could look visually identical to other valid email
addresses, and an attacker could try to confuse other users
and be added to bugs he shouldn't have access to.</li>
<li>Cross-Site Request Forgery:
Due to a lack of validation of the Content-Type head when
making POST requests to jsonrpc.cgi, a possible CSRF
vulnerability was discovered. If a user visits an HTML page
with some malicious JS code in it, an attacker could make
changes to a remote Bugzilla installation on behalf of the
victim's account by using the JSON-RPC API. The user would
have had to be already logged in to the target site for the
vulnerability to work.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0448</cvename>
<cvename>CVE-2012-0440</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=714472</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=718319</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2012-02-06</entry>
</dates>
</vuln>
<vuln vid="3fd040be-4f0b-11e1-9e32-0025900931f8">
<topic>php -- arbitrary remote code execution vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.3.9</ge><lt>5.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47806/">
<p>A vulnerability has been reported in PHP, which can be exploited
by malicious people to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to a logic error within the
"php_register_variable_ex()" function (php_variables.c) when
hashing form posts and updating a hash table, which can be
exploited to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0830</cvename>
<url>http://www.php.net/archive/2012.php#id2012-02-02-1</url>
<url>http://secunia.com/advisories/47806/</url>
</references>
<dates>
<discovery>2012-02-02</discovery>
<entry>2012-02-04</entry>
<modified>2012-02-06</modified>
</dates>
</vuln>
<vuln vid="6e7ad1d7-4e27-11e1-8e12-90e6ba8a36a2">
<topic>mathopd -- directory traversal vulnerability</topic>
<affects>
<package>
<name>mathopd</name>
<range><lt>1.5p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michiel Boland reports:</p>
<blockquote cite="http://www.mathopd.org/security.html">
<p>The software has a vulnerability that could lead to directory
traversal if the '*' construct for mass virtual hosting is
used.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="4F2AFEF2.5040708@boland.org">http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html</mlist>
<url>http://www.mathopd.org/security.html</url>
</references>
<dates>
<discovery>2012-02-02</discovery>
<entry>2012-02-03</entry>
</dates>
</vuln>
<vuln vid="4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.*</gt><lt>2.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE MITRE reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<p>An exposure was found when using mod_proxy in reverse proxy
mode. In certain configurations using RewriteRule with proxy
flag or ProxyPassMatch, a remote attacker could cause the reverse
proxy to connect to an arbitrary server, possibly disclosing
sensitive information from internal web servers not directly
accessible to attacker.</p>
<p>Integer overflow in the ap_pregsub function in server/util.c in
the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through
2.2.21, when the mod_setenvif module is enabled, allows local
users to gain privileges via a .htaccess file with a crafted
SetEnvIf directive, in conjunction with a crafted HTTP request
header, leading to a heap-based buffer overflow.</p>
<p>An additional exposure was found when using mod_proxy in
reverse proxy mode. In certain configurations using RewriteRule
with proxy flag or ProxyPassMatch, a remote attacker could cause
the reverse proxy to connect to an arbitrary server, possibly
disclosing sensitive information from internal web servers
not directly accessible to attacker.</p>
<p>A flaw was found in mod_log_config. If the '%{cookiename}C' log
format string is in use, a remote attacker could send a specific
cookie causing a crash. This crash would only be a denial of
service if using a threaded MPM.</p>
<p>A flaw was found in the handling of the scoreboard. An
unprivileged child process could cause the parent process to
crash at shutdown rather than terminate cleanly.</p>
<p>A flaw was found in the default error response for status code
400. This flaw could be used by an attacker to expose
"httpOnly" cookies when no custom ErrorDocument is specified.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3368</cvename>
<cvename>CVE-2011-3607</cvename>
<cvename>CVE-2011-4317</cvename>
<cvename>CVE-2012-0021</cvename>
<cvename>CVE-2012-0031</cvename>
<cvename>CVE-2012-0053</cvename>
</references>
<dates>
<discovery>2011-10-05</discovery>
<entry>2012-01-31</entry>
</dates>
</vuln>
<vuln vid="0a9e2b72-4cb7-11e1-9146-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>10.0,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.26</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.7</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.7</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>10.0</lt></range>
<range><gt>3.1.*</gt><lt>3.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/
rv:1.9.2.26)</p>
<p>MFSA 2012-02 Overly permissive IPv6 literal syntax</p>
<p>MFSA 2012-03 iframe element exposed across domains via name
attribute</p>
<p>MFSA 2012-04 Child nodes from nsDOMAttribute still accessible
after removal of nodes</p>
<p>MFSA 2012-05 Frame scripts calling into untrusted objects bypass
security checks</p>
<p>MFSA 2012-06 Uninitialized memory appended when encoding icon
images may cause information disclosure</p>
<p>MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis
files</p>
<p>MFSA 2012-08 Crash with malformed embedded XSLT stylesheets</p>
<p>MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe
permission</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0442</cvename>
<cvename>CVE-2012-0443</cvename>
<cvename>CVE-2011-3670</cvename>
<cvename>CVE-2012-0445</cvename>
<cvename>CVE-2011-3659</cvename>
<cvename>CVE-2012-0446</cvename>
<cvename>CVE-2012-0447</cvename>
<cvename>CVE-2012-0449</cvename>
<cvename>CVE-2012-0450</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-01.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-02.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-03.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-04.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-05.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-06.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-07.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-08.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-09.html</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2012-02-01</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="7c920bb7-4b5f-11e1-9f47-00e0815b8da8">
<topic>sudo -- format string vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.8.0</ge><lt>1.8.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.gratisoft.us/sudo/alerts/sudo_debug.html">
<p>Sudo 1.8.0 introduced simple debugging support that was primarily
intended for use when developing policy or I/O logging plugins.
The sudo_debug() function contains a flaw where the program name
is used as part of the format string passed to the fprintf()
function. The program name can be controlled by the caller,
either via a symbolic link or, on some systems, by setting argv[0]
when executing sudo.</p>
<p>Using standard format string vulnerability exploitation
techniques it is possible to leverage this bug to achieve root
privileges.</p>
<p>Exploitation of the bug does not require that the attacker be
listed in the sudoers file. As such, we strongly suggest that
affected sites upgrade from affected sudo versions as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0809</cvename>
<url>http://www.gratisoft.us/sudo/alerts/sudo_debug.html</url>
</references>
<dates>
<discovery>2012-01-30</discovery>
<entry>2012-01-30</entry>
<modified>2012-01-31</modified>
</dates>
</vuln>
<vuln vid="e51d5b1a-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- pam_ssh() does not validate service names</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc">
<h1>Problem Description:</h1>
<p>Some third-party applications, including KDE's kcheckpass command,
allow the user to specify the name of the policy on the command
line. Since OpenPAM treats the policy name as a path relative to
/etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run
such an application can craft their own policies and cause the
application to load and execute their own modules.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:10.pam</freebsdsa>
<cvename>CVE-2011-4122</cvename>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="eda151d8-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc">
<h1>Problem Description:</h1>
<p>The OpenSSL library call used to decrypt private keys ignores the
passphrase argument if the key is not encrypted. Because the
pam_ssh module only checks whether the passphrase provided by the
user is null, users with unencrypted SSH private keys may
successfully authenticate themselves by providing a dummy
passphrase.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:09.pam_ssh</freebsdsa>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2012-01-29</entry>
<modified>2013-06-18</modified>
</dates>
</vuln>
<vuln vid="f56390a4-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- Buffer overflow in handling of UNIX socket addresses</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_8</lt></range>
<range><ge>7.4</ge><lt>7.4_4</lt></range>
<range><ge>8.1</ge><lt>8.1_6</lt></range>
<range><ge>8.2</ge><lt>8.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc">
<h1>Problem Description:</h1>
<p>When a UNIX-domain socket is attached to a location using the
bind(2) system call, the length of the provided path is not
validated. Later, when this address was returned via other system
calls, it is copied into a fixed-length buffer.</p>
<p>Linux uses a larger socket address structure for UNIX-domain
sockets than FreeBSD, and the FreeBSD's linux emulation code did
not translate UNIX-domain socket addresses into the correct size
of structure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:05.unix</freebsdsa>
</references>
<dates>
<discovery>2011-09-28</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="fee94342-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_7</lt></range>
<range><ge>7.4</ge><lt>7.4_3</lt></range>
<range><ge>8.1</ge><lt>8.1_5</lt></range>
<range><ge>8.2</ge><lt>8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc">
<h1>Problem Description:</h1>
<p>The code used to decompress a file created by compress(1) does not
do sufficient boundary checks on compressed code words, allowing
reference beyond the decompression table, which may result in a
stack overflow or an infinite loop when the decompressor encounters
a corrupted file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:04.compress</freebsdsa>
<cvename>CVE-2011-2895</cvename>
</references>
<dates>
<discovery>2011-09-28</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="87261557-a450-11e2-9898-001060e06fd4">
<topic>FreeBSD -- Network ACL mishandling in mountd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_5</lt></range>
<range><ge>7.4</ge><lt>7.4_1</lt></range>
<range><ge>8.1</ge><lt>8.1_3</lt></range>
<range><ge>8.2</ge><lt>8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc">
<h1>Problem Description:</h1>
<p>While parsing the exports(5) table, a network mask in the form of
"-network=netname/prefixlength" results in an incorrect network mask
being computed if the prefix length is not a multiple of 8.</p>
<p>For example, specifying the ACL for an export as "-network
192.0.2.0/23" would result in a netmask of 255.255.127.0 being used
instead of the correct netmask of 255.255.254.0.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:01.mountd</freebsdsa>
<cvename>CVE-2011-1739</cvename>
</references>
<dates>
<discovery>2011-04-20</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="93688f8f-4935-11e1-89b4-001ec9578670">
<topic>postfixadmin -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>postfixadmin</name>
<range><lt>2.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Postfix Admin Team reports:</p>
<blockquote cite="http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778">
<p>Multiple XSS vulnerabilities exist:<br/>
- XSS with $_GET[domain] in templates/menu.php and
edit-vacation<br/>
- XSS in some create-domain input fields<br/>
- XSS in create-alias and edit-alias error message<br/>
- XSS (by values stored in the database) in fetchmail list
view, list-domain and list-virtual</p>
<p>Multiple SQL injection issues exist:<br/>
- SQL injection in pacrypt() (if $CONF[encrypt] ==
'mysql_encrypt')<br/>
- SQL injection in backup.php - the dump was not mysql_escape()d,
therefore users could inject SQL (for example in the vacation message)
which will be executed when restoring the database dump.
WARNING: database dumps created with backup.php from 2.3.4 or older
might contain malicious SQL. Double-check before using them!</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0811</cvename>
<cvename>CVE-2012-0812</cvename>
<url>http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778</url>
</references>
<dates>
<discovery>2012-01-27</discovery>
<entry>2012-01-27</entry>
</dates>
</vuln>
<vuln vid="e465159c-4817-11e1-89b4-001ec9578670">
<topic>mpack -- Information disclosure</topic>
<affects>
<package>
<name>mpack</name>
<range><lt>1.6_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The oss-security list reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2011/12/31/1">
<p>Incorrect permissions on temporary files can lead to
information disclosure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4919</cvename>
<url>http://openwall.com/lists/oss-security/2011/12/31/1</url>
</references>
<dates>
<discovery>2011-12-31</discovery>
<entry>2012-01-26</entry>
</dates>
</vuln>
<vuln vid="fa2f386f-4814-11e1-89b4-001ec9578670">
<topic>acroread9 -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>acroread9</name>
<range><lt>9.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Adobe Security Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-04.html">
<p>An unspecified vulnerability in the U3D component allows
remote attackers to execute arbitrary code (or cause a denial
of service attack) via unknown vectors.</p>
</blockquote>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-24.html">
<p>A heap-based buffer overflow allows attackers to execute
arbitrary code via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2462</cvename>
<cvename>CVE-2011-1353</cvename>
<cvename>CVE-2011-2431</cvename>
<cvename>CVE-2011-2432</cvename>
<cvename>CVE-2011-2433</cvename>
<cvename>CVE-2011-2434</cvename>
<cvename>CVE-2011-2435</cvename>
<cvename>CVE-2011-2436</cvename>
<cvename>CVE-2011-2437</cvename>
<cvename>CVE-2011-2438</cvename>
<cvename>CVE-2011-2439</cvename>
<cvename>CVE-2011-2440</cvename>
<cvename>CVE-2011-2441</cvename>
<cvename>CVE-2011-2442</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-24.html</url>
<url>http://www.adobe.com/support/security/advisories/apsa11-04.html</url>
</references>
<dates>
<discovery>2011-12-07</discovery>
<entry>2012-01-26</entry>
</dates>
</vuln>
<vuln vid="3ebb2dc8-4609-11e1-9f47-00e0815b8da8">
<topic>Wireshark -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.6.5.html">
<p>Laurent Butti discovered that Wireshark failed to properly check
record sizes for many packet capture file formats</p>
<p>Wireshark could dereference a NULL pointer and crash.</p>
<p>The RLC dissector could overflow a buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0041</cvename>
<cvename>CVE-2012-0066</cvename>
<cvename>CVE-2012-0067</cvename>
<cvename>CVE-2012-0068</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-01.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-02.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-03.html</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391</url>
</references>
<dates>
<discovery>2010-01-10</discovery>
<entry>2012-01-23</entry>
</dates>
</vuln>
<vuln vid="7d2336c2-4607-11e1-9f47-00e0815b8da8">
<topic>spamdyke -- Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>spamdyke</name>
<range><lt>4.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
<p>Fixed a number of very serious errors in the usage of
snprintf()/vsnprintf().</p>
<p>The return value was being used as the length of the string
printed into the buffer, but the return value really indicates
the length of the string that *could* be printed if the buffer
were of infinite size. Because the returned value could be
larger than the buffer's size, this meant remotely exploitable
buffer overflows were possible, depending on spamdyke's
configuration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0802</cvename>
<url>https://secunia.com/advisories/47548/</url>
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
</references>
<dates>
<discovery>2012-01-15</discovery>
<entry>2012-01-23</entry>
</dates>
</vuln>
<vuln vid="5c5f19ce-43af-11e1-89b4-001ec9578670">
<topic>OpenSSL -- DTLS Denial of Service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120118.txt">
<p>A flaw in the fix to CVE-2011-4108 can be exploited in a
denial of service attack. Only DTLS applications using OpenSSL
1.0.0f and 0.9.8s are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0050</cvename>
<url>http://www.openssl.org/news/secadv_20120118.txt</url>
</references>
<dates>
<discovery>2012-01-18</discovery>
<entry>2012-01-20</entry>
</dates>
</vuln>
<vuln vid="dd698b76-42f7-11e1-a1b6-14dae9ebcf89">
<topic>asterisk -- SRTP Video Remote Crash Vulnerability</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>1.8.8.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><lt>10.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2012-001.html">
<p>An attacker attempting to negotiate a secure video stream can
crash Asterisk if video support has not been enabled and the
res_srtp Asterisk module is loaded.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2012-001.html</url>
</references>
<dates>
<discovery>2012-01-15</discovery>
<entry>2012-01-20</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="7f5ccb1d-439b-11e1-bc16-0023ae8e59f0">
<topic>tomcat -- Denial of Service</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.35</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.34</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>7.0.0</gt><lt>7.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tomcat security team reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35">
<p>Analysis of the recent hash collision vulnerability identified
unrelated inefficiencies with Apache Tomcat's handling of large
numbers of parameters and parameter values. These inefficiencies
could allow an attacker, via a specially crafted request, to
cause large amounts of CPU to be used which in turn could create
a denial of service. The issue was addressed by modifying the
Tomcat parameter handling code to efficiently process large
numbers of parameters and parameter values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0022</cvename>
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35</url>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23</url>
</references>
<dates>
<discovery>2011-10-21</discovery>
<entry>2012-01-17</entry>
</dates>
</vuln>
<vuln vid="1ac858b0-3fae-11e1-a127-0013d3ccd9df">
<topic>OpenTTD -- Denial of service (server) via slow read attack</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.5</ge><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2012-0049">
<p>Using a slow read type attack it is possible to prevent anyone
from joining a server with virtually no resources. Once
downloading the map no other downloads of the map can start, so
downloading really slowly will prevent others from joining.
This can be further aggravated by the pause-on-join setting in
which case the game is paused and the players cannot continue
the game during such an attack. This attack requires that the
user is not banned and passes the authorization to the server,
although for many servers there is no server password and thus
authorization is easy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0049</cvename>
<url>http://security.openttd.org/en/CVE-2012-0049</url>
</references>
<dates>
<discovery>2012-01-06</discovery>
<entry>2012-01-16</entry>
</dates>
</vuln>
<vuln vid="91be81e7-3fea-11e1-afc7-2c4138874f7d">
<topic>Multiple implementations -- DoS via hash algorithm collision</topic>
<affects>
<package>
<name>jruby</name>
<range><lt>1.6.5.1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby+nopthreads</name>
<name>ruby+nopthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><lt>1.8.7.357,1</lt></range>
</package>
<package>
<name>rubygem-rack</name>
<range><lt>1.3.6,3</lt></range>
</package>
<package>
<name>v8</name>
<range><lt>3.8.5</lt></range>
</package>
<package>
<name>redis</name>
<range><le>2.4.6</le></range>
</package>
<package>
<name>node</name>
<range><lt>0.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2011-003.html">
<p>A variety of programming languages suffer from a denial-of-service
(DoS) condition against storage functions of key/value pairs in
hash data structures, the condition can be leveraged by exploiting
predictable collisions in the underlying hashing algorithms.</p>
<p>The issue finds particular exposure in web server applications
and/or frameworks. In particular, the lack of sufficient limits
for the number of parameters in POST requests in conjunction with
the predictable collision properties in the hashing functions of
the underlying languages can render web applications vulnerable
to the DoS condition. The attacker, using specially crafted HTTP
requests, can lead to a 100% of CPU usage which can last up to
several hours depending on the targeted application and server
performance, the amplification effect is considerable and
requires little bandwidth and time on the attacker side.</p>
<p>The condition for predictable collisions in the hashing functions
has been reported for the following language implementations:
Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the
Ruby language, the 1.9.x branch is not affected by the
predictable collision condition since this version includes a
randomization of the hashing function.</p>
<p>The vulnerability outlined in this advisory is practically
identical to the one reported in 2003 and described in the paper
Denial of Service via Algorithmic Complexity Attacks which
affected the Perl language.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4838</cvename>
<cvename>CVE-2011-4815</cvename>
<cvename>CVE-2011-5036</cvename>
<cvename>CVE-2011-5037</cvename>
<url>http://www.ocert.org/advisories/ocert-2011-003.html</url>
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
</references>
<dates>
<discovery>2011-12-28</discovery>
<entry>2012-01-16</entry>
<modified>2012-01-20</modified>
</dates>
</vuln>
<vuln vid="ea2ddc49-3e8e-11e1-8095-5404a67eef98">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>0.7.11,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-1320-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-1320-1">
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed QDM2 streams. If a user were tricked into opening
a crafted QDM2 stream file, an attacker could cause a denial of
service via application crash, or possibly execute arbitrary code
with the privileges of the user invoking the program.
(CVE-2011-4351)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed VP3 streams. If a user were tricked into opening
a crafted file, an attacker could cause a denial of service via
application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4352)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed VP5 and VP6 streams. If a user were tricked into
opening a crafted file, an attacker could cause a denial of service
via application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4353)</p>
<p>It was discovered that FFmpeg incorrectly handled certain
malformed VMD files. If a user were tricked into opening a crafted
VMD file, an attacker could cause a denial of service via
application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4364)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed SVQ1 streams. If a user were tricked into opening
a crafted SVQ1 stream file, an attacker could cause a denial of
service via application crash, or possibly execute arbitrary code
with the privileges of the user invoking the program.
(CVE-2011-4579)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4351</cvename>
<cvename>CVE-2011-4352</cvename>
<cvename>CVE-2011-4353</cvename>
<cvename>CVE-2011-4364</cvename>
<cvename>CVE-2011-4579</cvename>
<url>http://www.ubuntu.com/usn/usn-1320-1</url>
</references>
<dates>
<discovery>2011-09-14</discovery>
<entry>2012-01-14</entry>
</dates>
</vuln>
<vuln vid="78cc8a46-3e56-11e1-89b4-001ec9578670">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20120104.txt">
<p>6 security flaws have been fixed in OpenSSL 1.0.0f:</p>
<p>If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
then a policy check failure can lead to a double-free.</p>
<p>OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
bytes used as block cipher padding in SSL 3.0 records.
As a result, in each record, up to 15 bytes of
uninitialized memory may be sent, encrypted, to the SSL
peer. This could include sensitive contents of
previously freed memory.</p>
<p>RFC 3779 data can be included in certificates, and if
it is malformed, may trigger an assertion failure.
This could be used in a denial-of-service attack.</p>
<p>Support for handshake restarts for server gated
cryptograpy (SGC) can be used in a denial-of-service
attack.</p>
<p>A malicious TLS client can send an invalid set of GOST
parameters which will cause the server to crash due to
lack of error checking. This could be used in a
denial-of-service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4108</cvename>
<cvename>CVE-2011-4109</cvename>
<cvename>CVE-2011-4576</cvename>
<cvename>CVE-2011-4577</cvename>
<cvename>CVE-2011-4619</cvename>
<cvename>CVE-2012-0027</cvename>
<url>http://openssl.org/news/secadv_20120104.txt</url>
</references>
<dates>
<discovery>2012-01-04</discovery>
<entry>2012-01-14</entry>
</dates>
</vuln>
<vuln vid="1800886c-3dde-11e1-89b4-001ec9578670">
<topic>isc-dhcp-server -- DoS in DHCPv6</topic>
<affects>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/dhcp/advisories/cve-2011-4868">
<p>Due to improper handling of a DHCPv6 lease structure, ISC DHCP
servers that are serving IPv6 address pools AND using Dynamic
DNS can encounter a segmentation fault error while updating lease
status under certain conditions.</p>
<p>The potential exists for this condition to be intentionally
triggered, resulting in effective denial of service to
clients expecting service from the affected server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4868</cvename>
<url>https://www.isc.org/software/dhcp/advisories/cve-2011-4868</url>
</references>
<dates>
<discovery>2012-01-13</discovery>
<entry>2012-01-13</entry>
</dates>
</vuln>
<vuln vid="3338f87c-3d5f-11e1-a00a-000c6eb41cf7">
<topic>PowerDNS -- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>powerdns</name>
<name>powerdns-devel</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PowerDNS Team reports:</p>
<blockquote cite="http://www.powerdns.com/news/powerdns-security-advisory-2012-01.html">
<p>Using well crafted UDP packets, one or more PowerDNS servers
could be made to enter a tight packet loop, causing temporary
denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0206</cvename>
</references>
<dates>
<discovery>2012-01-10</discovery>
<entry>2012-01-12</entry>
</dates>
</vuln>
<vuln vid="d3921810-3c80-11e1-97e8-00215c6a37bb">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-exif</name>
<range><lt>5.3.9</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_5</lt></range>
</package>
<package>
<name>php52-exif</name>
<range><lt>5.2.17_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-01-11-1">
<p>Security Enhancements and Fixes in PHP 5.3.9:</p>
<ul>
<li>Added max_input_vars directive to prevent attacks
based on hash collisions. (CVE-2011-4885)</li>
<li>Fixed bug #60150 (Integer overflow during the parsing
of invalid exif header). (CVE-2011-4566)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4566</cvename>
<cvename>CVE-2011-4885</cvename>
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
</references>
<dates>
<discovery>2011-12-29</discovery>
<entry>2012-01-11</entry>
<modified>2012-01-19</modified>
</dates>
</vuln>
<vuln vid="e7fd27b2-3ae9-11e1-8b5c-00262d5ed8ee">
<topic>torcs -- untrusted local library loading</topic>
<affects>
<package>
<name>torcs</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TORCS News reports:</p>
<blockquote cite="http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77">
<p>An insecure change to LD_LIBRARY_PATH allows loading of libraries
in directories other than the standard paths. This can be a
problem when downloading and installing untrusted content from the
Internet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3384</cvename>
<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=3089384&group_id=3777&atid=103777</url>
</references>
<dates>
<discovery>2010-10-20</discovery>
<entry>2012-01-09</entry>
</dates>
</vuln>
<vuln vid="a47af810-3a17-11e1-a1be-00e0815b8da8">
<topic>spamdyke -- STARTTLS Plaintext Injection Vulnerability</topic>
<affects>
<package>
<name>spamdyke</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47435/">
<p>The vulnerability is caused due to the TLS implementation not
properly clearing transport layer buffers when upgrading from
plaintext to ciphertext after receiving the "STARTTLS" command.
This can be exploited to insert arbitrary plaintext data (e.g.
SMTP commands) during the plaintext phase, which will then be
executed after upgrading to the TLS ciphertext phase.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0070</cvename>
<url>http://secunia.com/advisories/47435/</url>
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
</references>
<dates>
<discovery>2012-01-04</discovery>
<entry>2012-01-08</entry>
<modified>2012-01-23</modified>
</dates>
</vuln>
<vuln vid="0c7a3ee2-3654-11e1-b404-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.7</lt></range>
<range><ge>4.0.*</ge><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
<p>The following security issues have been discovered in Bugzilla:</p>
<ul>
<li>Tabular and graphical reports, as well as new charts have
a debug mode which displays raw data as plain text. This
text is not correctly escaped and a crafted URL could use
this vulnerability to inject code leading to XSS.</li>
<li>The User.offer_account_by_email WebService method ignores
the user_can_create_account setting of the authentication
method and generates an email with a token in it which the
user can use to create an account. Depending on the
authentication method being active, this could allow the
user to log in using this account.
Installations where the createemailregexp parameter is
empty are not vulnerable to this issue.</li>
<li>The creation of bug reports and of attachments is not
protected by a token and so they can be created without the
consent of a user if the relevant code is embedded in an
HTML page and the user visits this page. This behavior was
intentional to let third-party applications submit new bug
reports and attachments easily. But as this behavior can be
abused by a malicious user, it has been decided to block
submissions with no valid token starting from version 4.2rc1.
Older branches are not patched to not break these third-party
applications after the upgrade.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3657</cvename>
<cvename>CVE-2011-3667</cvename>
<cvename>CVE-2011-3668</cvename>
<cvename>CVE-2011-3669</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=697699</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=711714</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703975</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703983</url>
</references>
<dates>
<discovery>2011-11-28</discovery>
<entry>2012-01-05</entry>
</dates>
</vuln>
<vuln vid="810df820-3664-11e1-8fe3-00215c6a37bb">
<topic>WordPress -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WordPress development team reports:</p>
<blockquote cite="http://wordpress.org/news/2012/01/wordpress-3-3-1/">
<p>WordPress 3.3.1 is now available. This maintenance release
fixes 15 issues with WordPress 3.3, as well as a fix for a
cross-site scripting vulnerability that affected version 3.3.
Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and
the Go Daddy security team for responsibly disclosing the bug
to our security team.</p>
</blockquote>
</body>
</description>
<references>
<url>http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312</url>
</references>
<dates>
<discovery>2012-01-03</discovery>
<entry>2012-01-03</entry>
</dates>
</vuln>
<vuln vid="048c77df-3211-11e1-9583-14dae938ec40">
<topic>zabbix-frontend -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>zabbix-frontend</name>
<range><lt>1.8.10,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martina Matari reports:</p>
<blockquote cite="https://support.zabbix.com/browse/ZBX-4015">
<p>These URLs (hostgroups.php, usergrps.php) are vulnerable to
persistent XSS attacks due to improper sanitation of gname
variable when creating user and host groups.</p>
</blockquote>
</body>
</description>
<references>
<url>https://support.zabbix.com/browse/ZBX-4015</url>
</references>
<dates>
<discovery>2011-08-04</discovery>
<entry>2011-12-29</entry>
</dates>
</vuln>
<vuln vid="c6521b04-314b-11e1-9cf4-5404a67eef98">
<topic>lighttpd -- remote DoS in HTTP authentication</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4362">
<p>Integer signedness error in the base64_decode function in the
HTTP authentication functionality (http_auth.c) in lighttpd 1.4
before 1.4.30 and 1.5 before SVN revision 2806 allows remote
attackers to cause a denial of service (segmentation fault)
via crafted base64 input that triggers an out-of-bounds read
with a negative index.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4362</cvename>
</references>
<dates>
<discovery>2011-11-29</discovery>
<entry>2011-12-28</entry>
</dates>
</vuln>
<vuln vid="4ddc78dc-300a-11e1-a2aa-0016ce01e285">
<topic>krb5-appl -- telnetd code execution vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>krb5-appl</name>
<range><lt>1.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos Team reports:</p>
<blockquote cite="http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc">
<p>When an encryption key is supplied via the TELNET protocol,
its length is not validated before the key is copied into a
fixed-size buffer. Also see MITKRB5-SA-2011-008.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:08.telnetd</freebsdsa>
<cvename>CVE-2011-4862</cvename>
<url>http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc</url>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt</url>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2011-12-26</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="022a4c77-2da4-11e1-b356-00215c6a37bb">
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_6</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.3g_1</lt></range>
</package>
<package>
<name>proftpd-devel</name>
<range><lt>1.3.3.r4_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc">
<p>If ftpd is configured to place a user in a chroot environment,
then an attacker who can log in as that user may be able to run
arbitrary code(...).</p>
</blockquote>
<p>Proftpd shares the same problem of a similar nature.</p>
</body>
</description>
<references>
<freebsdsa>SA-11:07.chroot</freebsdsa>
<url>http://seclists.org/fulldisclosure/2011/Nov/452</url>
</references>
<dates>
<discovery>2011-11-30</discovery>
<entry>2011-12-23</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="8c83145d-2c95-11e1-89b4-001ec9578670">
<topic>phpMyAdmin -- Multiple XSS</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.9.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
<p>Using crafted url parameters, it was possible to produce XSS on
the export panels in the server, database and table sections.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
<p>Crafted values entered in the setup interface can produce XSS;
also, if the config directory exists and is writeable, the XSS
payload can be saved to this directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4780</cvename>
<cvename>CVE-2011-4782</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php</url>
</references>
<dates>
<discovery>2011-12-16</discovery>
<entry>2011-12-22</entry>
</dates>
</vuln>
<vuln vid="e3ff776b-2ba6-11e1-93c6-0011856a6e37">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>9.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.6</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>9.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)</p>
<p>MFSA 2011-54 Potentially exploitable crash in the YARR regular
expression library</p>
<p>MFSA 2011-55 nsSVGValue out-of-bounds access</p>
<p>MFSA 2011-56 Key detection without JavaScript via SVG
animation</p>
<p>MFSA 2011-58 Crash scaling video to extreme sizes</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3658</cvename>
<cvename>CVE-2011-3660</cvename>
<cvename>CVE-2011-3661</cvename>
<cvename>CVE-2011-3663</cvename>
<cvename>CVE-2011-3665</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-53.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-54.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-55.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-56.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-58.html</url>
</references>
<dates>
<discovery>2011-12-20</discovery>
<entry>2011-12-21</entry>
<modified>2011-12-21</modified>
</dates>
</vuln>
<vuln vid="7ba65bfd-2a40-11e1-b96e-00215af774f0">
<topic>unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://www.unbound.net/downloads/CVE-2011-4528.txt">
<p>Unbound crashes when confronted with a non-standard response
from a server for a domain. This domain produces duplicate RRs
from a certain type and is DNSSEC signed. Unbound also crashes
when confronted with a query that eventually, and under specific
circumstances, resolves to a domain that misses expected NSEC3
records.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4528</cvename>
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt</url>
</references>
<dates>
<discovery>2011-12-19</discovery>
<entry>2011-12-19</entry>
</dates>
</vuln>
<vuln vid="3c957a3e-2978-11e1-89b4-001ec9578670">
<topic>typo3 -- Remote Code Execution</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.6</ge><lt>4.6.2</lt></range>
<range><lt>4.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The typo3 security team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/">
<p>A crafted request to a vulnerable TYPO3 installation will allow
an attacker to load PHP code from an external source and to
execute it on the TYPO3 installation.</p>
<p>This is caused by a PHP file, which is part of the workspaces
system extension, that does not validate passed arguments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4614</cvename>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/</url>
</references>
<dates>
<discovery>2011-12-16</discovery>
<entry>2011-12-18</entry>
</dates>
</vuln>
<vuln vid="6c7d9a35-2608-11e1-89b4-001ec9578670">
<topic>krb5 -- KDC null pointer dereference in TGS handling</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.9</ge><lt>1.9.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos Team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt">
<p>In releases krb5-1.9 and later, the KDC can crash due to a NULL
pointer dereference in code that handles TGS (Ticket Granting
Service) requests. The trigger condition is trivial to produce
using unmodified client software, but requires the ability to
authenticate as a principal in the KDC's realm.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1530</cvename>
<url>http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt</url>
</references>
<dates>
<discovery>2011-12-11</discovery>
<entry>2011-12-14</entry>
</dates>
</vuln>
<vuln vid="a4a809d8-25c8-11e1-b531-00215c6a37bb">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>11.60</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>11.60,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera software reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1160/">
<ul>
<li>Fixed a moderately severe issue; details will be
disclosed at a later date</li>
<li>Fixed an issue that could allow pages to set cookies
or communicate cross-site for some top level domains;
see our <a href="http://www.opera.com/support/kb/view/1003/">advisory</a></li>
<li>Improved handling of certificate revocation corner
cases</li>
<li>Added a fix for a weakness in the SSL v3.0 and TLS 1.0
specifications, as reported by Thai Duong and Juliano Rizzo;
see our <a href="http://www.opera.com/support/kb/view/1004/">advisory</a></li>
<li>Fixed an issue where the JavaScript "in" operator
allowed leakage of cross-domain information, as reported
by David Bloom; see our <a href="http://www.opera.com/support/kb/view/1005/">advisory</a></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3389</cvename>
<cvename>CVE-2011-4681</cvename>
<cvename>CVE-2011-4682</cvename>
<cvename>CVE-2011-4683</cvename>
<url>http://www.opera.com/support/kb/view/1003/</url>
<url>http://www.opera.com/support/kb/view/1004/</url>
<url>http://www.opera.com/support/kb/view/1005/</url>
</references>
<dates>
<discovery>2011-12-06</discovery>
<entry>2011-12-13</entry>
</dates>
</vuln>
<vuln vid="bbd5f486-24f1-11e1-95bc-080027ef73ec">
<topic>PuTTY -- Password vulnerability</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.59</ge><lt>0.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html">
<p>PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61.
If you log in using SSH-2 keyboard-interactive authentication
(which is the usual method used by modern servers to request a
password), the password you type was accidentally kept in PuTTY's
memory for the rest of its run, where it could be retrieved by
other processes reading PuTTY's memory, or written out to swap
files or crash dumps.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4607</cvename>
<mlist>http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2011-12-12</entry>
<modified>2013-08-07</modified>
</dates>
</vuln>
<vuln vid="bb389137-21fb-11e1-89b4-001ec9578670">
<topic>asterisk -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>1.8.7.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>1.6.2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-013.html">
<p>It is possible to enumerate SIP usernames when the general and
user/peer NAT settings differ in whether to respond to the port
a request is sent from or the port listed for responses in the
Via header.</p>
</blockquote>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-014.html">
<p>When the "automon" feature is enabled in features.conf, it is
possible to send a sequence of SIP requests that cause Asterisk
to dereference a NULL pointer and crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4597</cvename>
<cvename>CVE-2011-4598</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-013.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-014.html</url>
</references>
<dates>
<discovery>2011-12-08</discovery>
<entry>2011-12-09</entry>
</dates>
</vuln>
<vuln vid="93be487e-211f-11e1-89b4-001ec9578670">
<topic>isc-dhcp-server -- Remote DoS</topic>
<affects>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.3_1</lt></range>
</package>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4539">
<p>A bug exists which allows an attacker who is able to send DHCP
Request packets, either directly or through a relay, to remotely
crash an ISC DHCP server if that server is configured to evaluate
expressions using a regular expression (i.e. uses the "~=" or
"~~" comparison operators).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4539</cvename>
</references>
<dates>
<discovery>2011-12-07</discovery>
<entry>2011-12-07</entry>
</dates>
</vuln>
<vuln vid="ed536336-1c57-11e1-86f4-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.8.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
<p>Using crafted database names, it was possible to produce XSS
in the Database Synchronize and Database rename panels. Using
an invalid and crafted SQL query, it was possible to produce
XSS when editing a query on a table overview panel or when
using the view creation dialog. Using a crafted column type,
it was possible to produce XSS in the table search and create
index dialogs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4634</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php</url>
</references>
<dates>
<discovery>2011-11-24</discovery>
<entry>2011-12-01</entry>
</dates>
</vuln>
<vuln vid="eef56761-11eb-11e1-bb94-001c140104d4">
<topic>hiawatha -- memory leak in PreventSQLi routine</topic>
<affects>
<package>
<name>hiawatha</name>
<range><ge>7.6</ge><lt>7.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hugo Leisink reports via private mail to maintainer:</p>
<blockquote>
<p>The memory leak was introduced in version 7.6. It is in the
routing that checks for SQL injections. So, if you have set
PreventSQLi to 'no', there is no problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hiawatha-webserver.org/changelog</url>
</references>
<dates>
<discovery>2011-11-18</discovery>
<entry>2011-11-18</entry>
</dates>
</vuln>
<vuln vid="90cc1494-10ac-11e1-b3ec-0024e830109b">
<topic>BIND -- Remote DOS</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R5.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.4.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Internet Systems Consortium reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4313">
<p>Organizations across the Internet reported crashes interrupting
service on BIND 9 nameservers performing recursive queries.
Affected servers crashed after logging an error in query.c with
the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))"
Multiple versions were reported being affected, including all
currently supported release versions of ISC BIND 9.</p>
<p>Because it may be possible to trigger this bug even on networks
that do not allow untrusted users to access the recursive name
servers (perhaps via specially crafted e-mail messages, and/or
malicious web sites) it is recommended that ALL operators of
recursive name servers upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:06.bind</freebsdsa>
<cvename>CVE-2011-4313</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313</url>
<url>https://www.isc.org/software/bind/advisories/cve-2011-4313</url>
</references>
<dates>
<discovery>2011-11-16</discovery>
<entry>2011-11-16</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="d8c901ff-0f0f-11e1-902b-20cf30e32f6d">
<topic>Apache 1.3 -- mod_proxy reverse proxy exposure</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><lt>1.3.43.1.59_2</lt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.41+2.8.31_4</lt></range>
</package>
<package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.41+2.8.31_4</lt></range>
</package>
<package>
<name>ru-apache-1.3</name>
<range><lt>1.3.43+30.23_1</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.43+30.23_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
<p>An exposure was found when using mod_proxy in reverse proxy mode.
In certain configurations using RewriteRule with proxy flag, a
remote attacker could cause the reverse proxy to connect to an
arbitrary server, possibly disclosing sensitive information from
internal web servers not directly accessible to attacker. There
is no patch against this issue!</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3368</cvename>
<url>http://httpd.apache.org/security/vulnerabilities_13.html</url>
<url>http://seclists.org/fulldisclosure/2011/Oct/232</url>
</references>
<dates>
<discovery>2011-10-05</discovery>
<entry>2011-11-14</entry>
</dates>
</vuln>
<vuln vid="7fb9e739-0e6d-11e1-87cd-00235a5f2c9a">
<topic>kdeutils4 -- Directory traversal vulnerability</topic>
<affects>
<package>
<name>kdeutils</name>
<range><ge>4.0.*</ge><lt>4.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Brown from Nth Dimention reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2011/Oct/351">
<p>I recently discovered that the Ark archiving tool is vulnerable
to directory traversal via malformed. When attempts are made to
view files within the malformed Zip file in Ark's default view,
the wrong file may be displayed due to incorrect construction of
the temporary file name. Whilst this does not allow the wrong
file to be overwritten, after closing the default view, Ark will
then attempt to delete the temporary file which could result in
the deletion of the incorrect file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2725</cvename>
<url>http://seclists.org/fulldisclosure/2011/Oct/351</url>
</references>
<dates>
<discovery>2011-10-19</discovery>
<entry>2011-11-14</entry>
</dates>
</vuln>
<vuln vid="38560d79-0e42-11e1-902b-20cf30e32f6d">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr0</name>
<range><lt>0.9.20.0.9.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-0.9">
<p>Reimplement apr_fnmatch() from scratch using a non-recursive
algorithm; now has improved compliance with the fnmatch()
spec.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement0.9.html</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2011-11-13</entry>
</dates>
</vuln>
<vuln vid="1f6ee708-0d22-11e1-b5bd-14dae938ec40">
<topic>phpmyadmin -- Local file inclusion</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.7.1</lt></range>
<range><lt>3.3.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
<p>Importing a specially-crafted XML file which contains an XML
entity injection permits to retrieve a local file (limited by the
privileges of the user running the web server).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4107</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php</url>
</references>
<dates>
<discovery>2011-11-10</discovery>
<entry>2011-11-12</entry>
</dates>
</vuln>
<vuln vid="0e8e1212-0ce5-11e1-849b-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.11</lt></range>
<range><gt>11</gt><lt>11.1r102.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-28.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 11.0.1.152 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier
versions for Android.</p>
</blockquote>
<p>In addition a patch was released for users of flash10.</p>
</body>
</description>
<references>
<cvename>CVE-2011-2445</cvename>
<cvename>CVE-2011-2450</cvename>
<cvename>CVE-2011-2451</cvename>
<cvename>CVE-2011-2452</cvename>
<cvename>CVE-2011-2453</cvename>
<cvename>CVE-2011-2454</cvename>
<cvename>CVE-2011-2455</cvename>
<cvename>CVE-2011-2456</cvename>
<cvename>CVE-2011-2457</cvename>
<cvename>CVE-2011-2458</cvename>
<cvename>CVE-2011-2459</cvename>
<cvename>CVE-2011-2460</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb11-28.html</url>
</references>
<dates>
<discovery>2011-11-10</discovery>
<entry>2011-11-11</entry>
</dates>
</vuln>
<vuln vid="7be92050-a450-11e2-9898-001060e06fd4">
<topic>libxml -- Integer overflow</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
<package>
<name>libxml2</name>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Integer overflow in xpath.c, allows context-dependent attackers
to to cause a denial of service (crash) and possibly execute
arbitrary code via a crafted XML file that triggers a heap-based
buffer overflow when adding a new namespace node, related to
handling of XPath expressions.</p>
</body>
</description>
<references>
<cvename>CVE-2011-1944</cvename>
</references>
<dates>
<discovery>2011-09-02</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="ce4b3af8-0b7c-11e1-846b-00235409fd3e">
<topic>libxml -- Multiple use-after-free vulnerabilities</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple use-after-free vulnerabilities in libxml 1.8.17 that
allow context-dependent attackers to cause a denial of service
(application crash) via crafted (1) Notation or (2) Enumeration
attribute types in an XML file.</p>
</body>
</description>
<references>
<cvename>CVE-2009-2416</cvename>
</references>
<dates>
<discovery>2009-08-03</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="5a7d4110-0b7a-11e1-846b-00235409fd3e">
<topic>libxml -- Stack consumption vulnerability</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stack consumption vulnerability allows context-dependent
attackers to cause a denial of service (application crash) via
a large depth of element declarations in a DTD.</p>
</body>
</description>
<references>
<cvename>CVE-2009-2414</cvename>
</references>
<dates>
<discovery>2009-08-03</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="bdec8dc2-0b3b-11e1-b722-001cc0476564">
<topic>gnutls -- client session resumption vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS team reports:</p>
<blockquote cite="http://www.gnu.org/software/gnutls/security.html">
<p>GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4128</cvename>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2011-11-10</entry>
</dates>
</vuln>
<vuln vid="6c8ad3e8-0a30-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>8.0,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.24,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.24</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>8.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>8.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>8.0</lt></range>
<range><lt>3.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope
parameter (1.9.2 branch)</p>
<p>MFSA 2011-47 Potential XSS against sites using Shift-JIS</p>
<p>MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)</p>
<p>MFSA 2011-49 Memory corruption while profiling using Firebug</p>
<p>MFSA 2011-50 Cross-origin data theft using canvas and Windows
D2D</p>
<p>MFSA 2011-51 Cross-origin image theft on Mac with integrated
Intel GPU</p>
<p>MFSA 2011-52 Code execution via NoWaiverWrapper</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3647</cvename>
<cvename>CVE-2011-3648</cvename>
<cvename>CVE-2011-3649</cvename>
<cvename>CVE-2011-3650</cvename>
<cvename>CVE-2011-3651</cvename>
<cvename>CVE-2011-3652</cvename>
<cvename>CVE-2011-3653</cvename>
<cvename>CVE-2011-3654</cvename>
<cvename>CVE-2011-3655</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-46.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-47.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-48.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-49.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-50.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-51.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-52.html</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2011-11-08</entry>
</dates>
</vuln>
<vuln vid="9dde9dac-08f4-11e1-af36-003067b2972c">
<topic>caml-light -- insecure use of temporary files</topic>
<affects>
<package>
<name>caml-light</name>
<range><le>0.75</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>caml-light uses mktemp() insecurely, and also does
unsafe things in /tmp during make install.</p>
</body>
</description>
<references>
<cvename>CVE-2011-4119</cvename>
<mlist msgid="20111106200911.GC13652@netbsd.org">http://seclists.org/oss-sec/2011/q4/249</mlist>
</references>
<dates>
<discovery>2011-11-02</discovery>
<entry>2011-11-06</entry>
</dates>
</vuln>
<vuln vid="54075e39-04ac-11e1-a94e-bcaec565249c">
<topic>freetype -- Some type 1 fonts handling vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeType project reports:</p>
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view">
<p>A couple of vulnerabilities in handling Type 1 fonts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3256</cvename>
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view</url>
<url>https://bugzilla.redhat.com/attachment.cgi?id=528829&action=diff</url>
</references>
<dates>
<discovery>2011-10-12</discovery>
<entry>2011-11-01</entry>
</dates>
</vuln>
<vuln vid="f08e2c15-ffc9-11e0-b0f3-bcaec565249c">
<topic>cacti -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti Group reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_7h.php">
<p>SQL injection issue with user login, and cross-site scripting
issues.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cacti.net/release_notes_0_8_7h.php</url>
</references>
<dates>
<discovery>2011-09-26</discovery>
<entry>2011-10-26</entry>
</dates>
</vuln>
<vuln vid="395e0faa-ffa7-11e0-8ac4-6c626dd55a41">
<topic>phpmyfaq -- Remote PHP Code Injection Vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
<p>The phpMyFAQ Team has learned of a serious security issue that
has been discovered in our bundled ImageManager library we use
in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library
allows injection of arbitrary PHP code via POST requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/advisory_2011-10-25.php</url>
<url>http://forum.phpmyfaq.de/viewtopic.php?f=3&t=13402</url>
</references>
<dates>
<discovery>2011-10-25</discovery>
<entry>2011-10-26</entry>
</dates>
</vuln>
<vuln vid="edf47177-fe3f-11e0-a207-0014a5e3cda6">
<topic>phpLDAPadmin -- Remote PHP code injection vulnerability</topic>
<affects>
<package>
<name>phpldapadmin</name>
<range><ge>1.2.0</ge><lt>1.2.1.1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>EgiX (n0b0d13s at gmail dot com) reports:</p>
<blockquote cite="http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt">
<p>The $sortby parameter passed to 'masort' function in file
lib/functions.php isn't properly sanitized before being used in
a call to create_function() at line 1080. This can be exploited
to inject and execute arbitrary PHP code. The only possible
attack vector is when handling the 'query_engine' command, in
which input passed through $_REQUEST['orderby'] is passed as
$sortby parameter to 'masort' function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt</url>
<url>http://sourceforge.net/tracker/?func=detail&aid=3417184&group_id=61828&atid=498546</url>
</references>
<dates>
<discovery>2011-10-23</discovery>
<entry>2011-10-24</entry>
</dates>
</vuln>
<vuln vid="6d21a287-fce0-11e0-a828-00235a5f2c9a">
<topic>kdelibs4, rekonq -- input validation failure</topic>
<affects>
<package>
<name>kdelibs</name>
<range><ge>4.0.*</ge><lt>4.7.2</lt></range>
</package>
<package>
<name>rekonq</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20111003-1.txt">
<p>The default rendering type for a QLabel is QLabel::AutoText,
which uses heuristics to determine whether to render the given
content as plain text or rich text. KSSL and Rekonq did not
properly force its QLabels to use QLabel::PlainText. As a result,
if given a certificate containing rich text in its fields, they
would render the rich text. Specifically, a certificate
containing a common name (CN) that has a table element will cause
the second line of the table to be displayed. This can allow
spoofing of the certificate's common name.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.kde.org/info/security/advisory-20111003-1.txt</url>
<url>http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc</url>
<cvename>CVE-2011-3365</cvename>
<cvename>CVE-2011-3366</cvename>
</references>
<dates>
<discovery>2011-10-03</discovery>
<entry>2011-10-23</entry>
</dates>
</vuln>
<vuln vid="411ecb79-f9bc-11e0-a7e6-6c626dd55a41">
<topic>piwik -- unknown critical vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><gt>1.1</gt><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/46461/">
<p>Multiple vulnerabilities with an unknown impact have been
reported in Piwik. The vulnerabilities are caused due to
unspecified errors. No further information is currently
available.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/46461/</url>
<url>http://piwik.org/blog/2011/10/piwik-1-6/</url>
</references>
<dates>
<discovery>2011-10-18</discovery>
<entry>2011-10-20</entry>
</dates>
</vuln>
<vuln vid="8441957c-f9b4-11e0-a78a-bcaec565249c">
<topic>Xorg server -- two vulnerabilities in X server lock handling code</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.7.7_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html">
<p>It is possible to deduce if a file exists or not by exploiting
the way that Xorg creates its lock files. This is caused by the
fact that the X server is behaving differently if the lock file
already exists as a symbolic link pointing to an existing or
non-existing file.</p>
<p>It is possible for a non-root user to set the permissions for
all users on any file or directory to 444, giving unwanted read
access or causing denies of service (by removing execute
permission). This is caused by a race between creating the lock
file and setting its access modes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4028</cvename>
<cvename>CVE-2011-4029</cvename>
</references>
<dates>
<discovery>2011-10-18</discovery>
<entry>2011-10-18</entry>
</dates>
</vuln>
<vuln vid="a95092a6-f8f1-11e0-a7ea-00215c6a37bb">
<topic>asterisk -- remote crash vulnerability in SIP channel driver</topic>
<affects>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.7.1</lt></range>
</package>
<package>
<name>asterisk</name>
<range><gt>10.0.0.*</gt><lt>10.0.0.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-012.html">
<p>A remote authenticated user can cause a crash with a malformed
request due to an unitialized variable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4063</cvename>
</references>
<dates>
<discovery>2011-10-17</discovery>
<entry>2011-10-17</entry>
</dates>
</vuln>
<vuln vid="e454ca2f-f88d-11e0-b566-00163e01a509">
<topic>PivotX -- Remote File Inclusion Vulnerability of TimThumb</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PivotX team reports:</p>
<blockquote cite="http://blog.pivotx.net/page/security">
<p>TimThumb domain name security bypass and insecure cache
handling. PivotX before 2.3.0 includes a vulnerable version
of TimThumb.</p>
</blockquote>
<blockquote cite="http://blog.pivotx.net/2011-10-14/timthumb-update-for-older-pivotx-installs">
<p>If you are still running PivotX 2.2.6, you might be vulnerable
to a security exploit, that was patched previously. Version
2.3.0 doesn't have this issue, but any older version of PivotX
might be vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<bid>48963</bid>
<url>https://secunia.com/advisories/45416/</url>
</references>
<dates>
<discovery>2011-08-03</discovery>
<entry>2011-10-17</entry>
</dates>
</vuln>
<vuln vid="9bad5ab1-f3f6-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Multiple buffer overflows in validation of external data</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3343">
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow local
users to cause a denial of service (daemon crash) or possibly
gain privileges via (1) a crafted BMP file with RLE compression
or (2) crafted dimensions in a BMP file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3343</cvename>
<url>http://security.openttd.org/en/CVE-2011-3343</url>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="78c25ed7-f3f9-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Buffer overflows in savegame loading</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3342">
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow remote
attackers to cause a denial of service (daemon crash) or possibly
execute arbitrary code via vectors related to (1) NAME, (2) PLYR,
(3) CHTS, or (4) AIPL (aka AI config) chunk loading from a
savegame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3342</cvename>
<url>http://security.openttd.org/en/CVE-2011-3342</url>
</references>
<dates>
<discovery>2011-08-08</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="e77befb5-f3f9-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Denial of service via improperly validated commands</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.5</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3341">
<p>Multiple off-by-one errors in order_cmd.cpp in OpenTTD before
1.1.3 allow remote attackers to cause a denial of service (daemon
crash) or possibly execute arbitrary code via a crafted
CMD_INSERT_ORDER command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3341</cvename>
<url>http://security.openttd.org/en/CVE-2011-3341</url>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="ab9be2c8-ef91-11e0-ad5a-00215c6a37bb">
<topic>quagga -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT-FI reports:</p>
<blockquote cite="https://www.cert.fi/en/reports/2011/vulnerability539178.html">
<p>Five vulnerabilities have been found in the BGP, OSPF, and
OSPFv3 components of Quagga. The vulnerabilities allow an
attacker to cause a denial of service or potentially to
execute his own code by sending a specially modified packets
to an affected server. Routing messages are typically accepted
from the routing peers. Exploiting these vulnerabilities may
require an established routing session (BGP peering or
OSPF/OSPFv3 adjacency) to the router.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327">CVE-2011-3327</a>
is related to the extended communities handling in BGP
messages. Receiving a malformed BGP update can result
in a buffer overflow and disruption of IPv4 routing.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326">CVE-2011-3326</a>
results from the handling of LSA (Link State Advertisement)
states in the OSPF service. Receiving a modified Link State
Update message with malicious state information can result in
denial of service in IPv4 routing.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325">CVE-2011-3325</a>
is a denial of service vulnerability related to Hello message
handling by the OSPF service. As Hello messages are used to
initiate adjacencies, exploiting the vulnerability may be
feasible from the same broadcast domain without an established
adjacency. A malformed packet may result in denial of service
in IPv4 routing.</p>
<p>The vulnerabilities <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324">CVE-2011-3324</a>
and <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323">CVE-2011-3323</a>
are related to the IPv6 routing protocol (OSPFv3) implemented
in ospf6d daemon. Receiving modified Database Description and
Link State Update messages, respectively, can result in denial
of service in IPv6 routing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3323</cvename>
<cvename>CVE-2011-3324</cvename>
<cvename>CVE-2011-3325</cvename>
<cvename>CVE-2011-3326</cvename>
<cvename>CVE-2011-3327</cvename>
</references>
<dates>
<discovery>2011-09-26</discovery>
<entry>2011-10-05</entry>
</dates>
</vuln>
<vuln vid="1fade8a3-e9e8-11e0-9580-4061862b8c22">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>7.0,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.23,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.23</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>7.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>7.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.4</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>7.0</lt></range>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 /
rv:1.9.2.23)</p>
<p>MFSA 2011-37 Integer underflow when using JavaScript RegExp</p>
<p>MFSA 2011-38 XSS via plugins and shadowed window.location
object</p>
<p>MFSA 2011-39 Defense against multiple Location headers due to
CRLF Injection</p>
<p>MFSA 2011-40 Code installation through holding down Enter</p>
<p>MFSA 2011-41 Potentially exploitable WebGL crashes</p>
<p>MFSA 2011-42 Potentially exploitable crash in the YARR regular
expression library</p>
<p>MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope
parameter</p>
<p>MFSA 2011-44 Use after free reading OGG headers</p>
<p>MFSA 2011-45 Inferring Keystrokes from motion data</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2372</cvename>
<cvename>CVE-2011-2995</cvename>
<cvename>CVE-2011-2996</cvename>
<cvename>CVE-2011-2997</cvename>
<cvename>CVE-2011-2999</cvename>
<cvename>CVE-2011-3000</cvename>
<cvename>CVE-2011-3001</cvename>
<cvename>CVE-2011-3002</cvename>
<cvename>CVE-2011-3003</cvename>
<cvename>CVE-2011-3004</cvename>
<cvename>CVE-2011-3005</cvename>
<cvename>CVE-2011-3232</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-36.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-37.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-38.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-39.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-40.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-41.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-42.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-43.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-44.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-45.html</url>
</references>
<dates>
<discovery>2011-09-27</discovery>
<entry>2011-09-28</entry>
</dates>
</vuln>
<vuln vid="53e531a7-e559-11e0-b481-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-26.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.3.183.7 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier
versions for Android. These vulnerabilities could cause a crash
and potentially allow an attacker to take control of the
affected system.</p>
<p>There are reports that one of these vulnerabilities
(CVE-2011-2444) is being exploited in the wild in active
targeted attacks designed to trick the user into clicking on
a malicious link delivered in an email message. This universal
cross-site scripting issue could be used to take actions on a
user's behalf on any website or webmail provider if the user
visits a malicious website.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.adobe.com/support/security/bulletins/apsb11-26.html</url>
<cvename>CVE-2011-2426</cvename>
<cvename>CVE-2011-2427</cvename>
<cvename>CVE-2011-2428</cvename>
<cvename>CVE-2011-2429</cvename>
<cvename>CVE-2011-2430</cvename>
<cvename>CVE-2011-2444</cvename>
</references>
<dates>
<discovery>2011-06-06</discovery>
<entry>2011-09-22</entry>
</dates>
</vuln>
<vuln vid="e44fe906-df27-11e0-a333-001cc0a36e12">
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php">
<p>Firstly, if a row contains javascript code, after inline
editing this row and saving, the code is executed. Secondly,
missing sanitization on the db, table and column names leads
to XSS vulnerabilities.</p>
<p>Versions 3.4.0 to 3.4.4 were found vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php</url>
</references>
<dates>
<discovery>2011-09-11</discovery>
<entry>2011-09-14</entry>
</dates>
</vuln>
<vuln vid="d01d10c7-de2d-11e0-b215-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><ge>1.3</ge><lt>1.3.1</lt></range>
<range><ge>1.2</ge><lt>1.2.7</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>16758,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/</url>
</references>
<dates>
<discovery>2011-09-09</discovery>
<entry>2011-09-13</entry>
<modified>2011-11-01</modified>
</dates>
</vuln>
<vuln vid="4ae68e7c-dda4-11e0-a906-00215c6a37bb">
<topic>roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.5.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube development Team reports:</p>
<blockquote cite="http://sourceforge.net/news/?group_id=139281&id=302769">
<p>We just published a new release which fixes a recently
reported XSS vulnerability as an update to the stable 0.5
branch. Please update your installations with this new
version or patch them with the fix which is also published
in the downloads section or our sourceforge.net page.</p>
</blockquote>
<p>and:</p>
<blockquote cite="http://trac.roundcube.net/ticket/1488030">
<p>During one of pen-tests I found that _mbox parameter is not
properly sanitized and reflected XSS attack is possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2937</cvename>
</references>
<dates>
<discovery>2011-08-09</discovery>
<entry>2011-09-13</entry>
</dates>
</vuln>
<vuln vid="b9f3ffa3-dd6c-11e0-b7fc-000a5e1e33c6">
<topic>libsndfile -- PAF file processing integer overflow</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.0.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/45125/">
<p>Hossein Lotfi has discovered a vulnerability in libsndfile,
which can be exploited by malicious people to potentially
compromise an application using the library. The vulnerability
is caused due to an integer overflow error in the "paf24_init()"
function (src/paf.c) when processing Paris Audio (PAF) files.
This can be exploited to cause a heap-based buffer overflow via
a specially crafted file. Successful exploitation may allow
execution of arbitrary code. The vulnerability is confirmed in
version 1.0.24. Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2696</cvename>
<url>http://secunia.com/advisories/45125/</url>
</references>
<dates>
<discovery>2011-07-12</discovery>
<entry>2011-09-12</entry>
</dates>
</vuln>
<vuln vid="2ecb7b20-d97e-11e0-b2e2-00215c6a37bb">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.0</ge><lt>1.0.0_6</lt></range>
<range><ge>0.9.8</ge><lt>1.0.0</lt></range>
</package>
<package>
<name>linux-f10-openssl</name>
<range><ge>0.9.8</ge><lt>0.9.8r</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20110906.txt">
<p>Two security flaws have been fixed in OpenSSL 1.0.0e</p>
<p>Under certain circumstances OpenSSL's internal certificate
verification routines can incorrectly accept a CRL whose
nextUpdate field is in the past. (CVE-2011-3207)</p>
<p>OpenSSL server code for ephemeral ECDH ciphersuites is not
thread-safe, and furthermore can crash if a client violates
the protocol by sending handshake messages in incorrect
order. (CVE-2011-3210)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3207</cvename>
<cvename>CVE-2011-3210</cvename>
<url>http://www.openssl.org/news/secadv_20110906.txt</url>
</references>
<dates>
<discovery>2011-09-06</discovery>
<entry>2011-09-07</entry>
<modified>2014-04-10</modified>
</dates>
</vuln>
<vuln vid="a83f25df-d775-11e0-8bf1-003067b2972c">
<topic>XSS issue in MantisBT</topic>
<affects>
<package>
<name>mantis</name>
<range><ge>1.2.0</ge><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.mantisbt.org/blog/?p=142">
<p>Net.Edit0r from BlACK Hat Group reported an XSS issue in
search.php. All MantisBT users (including anonymous users that
are not logged in to public bug trackers) could be impacted by
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/160368</freebsdpr>
<cvename>CVE-2011-2938</cvename>
</references>
<dates>
<discovery>2011-08-18</discovery>
<entry>2011-09-05</entry>
</dates>
</vuln>
<vuln vid="e55f948f-d729-11e0-abd1-0017f22d6707">
<topic>security/cfs -- buffer overflow</topic>
<affects>
<package>
<name>cfs</name>
<range><le>1.4.1_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="http://www.debian.org/security/2002/dsa-116">
<p>Zorgon found several buffer overflows in cfsd, a daemon that
pushes encryption services into the Unix(tm) file system.
We are not yet sure if these overflows can successfully be
exploited to gain root access to the machine running the CFS
daemon. However, since cfsd can easily be forced to die, a
malicious user can easily perform a denial of service attack
to it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2002-0351</cvename>
<url>http://www.debian.org/security/2002/dsa-116</url>
</references>
<dates>
<discovery>2002-03-02</discovery>
<entry>2011-09-04</entry>
</dates>
</vuln>
<vuln vid="1b27af46-d6f6-11e0-89a6-080027ef73ec">
<topic>ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle</topic>
<affects>
<package>
<name>ca_root_nss</name>
<range><lt>3.12.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports that the ca-bundle.pl used in older
versions of the ca_root_nss FreeBSD port before 3.12.11 did not
take the Mozilla/NSS/CKBI untrusted markers into account and
would add certificates to the trust bundle that were marked
unsafe by Mozilla.</p>
</body>
</description>
<references>
<freebsdpr>ports/160455</freebsdpr>
</references>
<dates>
<discovery>2011-09-04</discovery>
<entry>2011-09-04</entry>
</dates>
</vuln>
<vuln vid="aa5bc971-d635-11e0-b3cf-080027ef73ec">
<topic>nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.12.11</lt></range>
<!-- this builds on the assumption that 3.12.11 in ports actually
contains the CKBI 1.87 update to the built-in certificates
as commited by kwm@ on September 3rd, 2011 -->
</package>
<package>
<name>ca_root_nss</name>
<range><lt>3.12.11</lt></range>
<!-- this builds on the assumption that 3.12.11 in ports actually
contains the CKBI 1.87 update to the built-in certificates
as commited by mandree@ on September 4th, 2011 -->
</package>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.22,1</lt></range>
<range><gt>4.0.*,1</gt><lt>6.0.2,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.3.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.22,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>3.1.*</gt><lt>3.1.14</lt></range>
<range><gt>5.0.*</gt><lt>6.0.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.14</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Heather Adkins, Google's Information Security Manager, reported that
Google received</p>
<blockquote cite="http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html">
<p>[...] reports of attempted SSL man-in-the-middle (MITM)
attacks against Google users, whereby someone tried to get between
them and encrypted Google services. The people affected were
primarily located in Iran. The attacker used a fraudulent SSL
certificate issued by DigiNotar, a root certificate authority that
should not issue certificates for Google (and has since revoked
it). [...]</p>
</blockquote>
<p>VASCO Data Security International Inc., owner of DigiNotar, issued a
press statement confirming this incident:</p>
<blockquote cite="http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx">
<p>On July 19th 2011, DigiNotar detected an intrusion
into its Certificate Authority (CA) infrastructure, which resulted
in the fraudulent issuance of public key certificate requests for
a number of domains, including Google.com. [...] an external
security audit concluded that all fraudulently issued certificates
were
revoked. Recently, it was discovered that at least one fraudulent
certificate had not been revoked at the time. [...]</p>
</blockquote>
<p>Mozilla, maintainer of the NSS package, from which FreeBSD derived
ca_root_nss, stated that they:</p>
<blockquote cite="https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/">
<p>revoked our trust in the DigiNotar certificate authority from
all Mozilla software. This is not a temporary suspension, it is
a complete removal from our trusted root program. Complete
revocation of trust is a decision we treat with careful
consideration, and employ as a last resort.
</p><p>Three central issues informed our decision:</p>
<ol><li>Failure to notify. [...]</li>
<li>The scope of the breach remains unknown. [...]</li>
<li>The attack is not theoretical.</li></ol>
</blockquote>
</body>
</description>
<references>
<url>http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-34.html</url>
<url>http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2011-09-03</entry>
<modified>2011-09-06</modified>
</dates>
</vuln>
<vuln vid="7f6108d2-cea8-11e0-9d58-0800279895ea">
<topic>apache -- Range header DoS vulnerability</topic>
<affects>
<package>
<name>apache</name>
<name>apache-event</name>
<name>apache-itk</name>
<name>apache-peruser</name>
<name>apache-worker</name>
<range><gt>2.*</gt><lt>2.2.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192">
<p>A denial of service vulnerability has been found in the way
the multiple overlapping ranges are handled by Apache HTTPD
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3192</cvename>
<url>https://people.apache.org/~dirkx/CVE-2011-3192.txt</url>
<url>https://svn.apache.org/viewvc?view=revision&revision=1161534</url>
<url>https://svn.apache.org/viewvc?view=revision&revision=1162874</url>
</references>
<dates>
<discovery>2011-08-24</discovery>
<entry>2011-08-30</entry>
<modified>2011-09-01</modified>
</dates>
</vuln>
<vuln vid="cdeb34e6-d00d-11e0-987e-00215c6a37bb">
<topic>stunnel -- heap corruption vulnerability</topic>
<affects>
<package>
<name>stunnel</name>
<range><ge>4.40</ge><lt>4.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Trojnara reports:</p>
<blockquote cite="http://www.stunnel.org/pipermail/stunnel-announce/2011-August/000059.html">
<p>Version 4.42, 2011.08.18, urgency: HIGH:</p>
<p>Fixed a heap corruption vulnerability in versions 4.40 and 4.41.
It may possibly be leveraged to perform DoS or remote code
execution attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>49254</bid>
<cvename>CVE-2011-2940</cvename>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-08-26</entry>
</dates>
</vuln>
<vuln vid="75e26236-ce9e-11e0-b26a-00215c6a37bb">
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php">
<p>Multiple XSS in the Tracking feature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3181</cvename>
</references>
<dates>
<discovery>2011-08-24</discovery>
<entry>2011-08-24</entry>
</dates>
</vuln>
<vuln vid="3f1df2f9-cd22-11e0-9bb2-00215c6a37bb">
<topic>PHP -- crypt() returns only the salt for MD5</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.3.7</ge><lt>5.3.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=55439">
<p>If crypt() is executed with MD5 salts, the return value
consists of the salt only. DES and BLOWFISH salts work as
expected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=55439</url>
</references>
<dates>
<discovery>2011-08-17</discovery>
<entry>2011-08-23</entry>
<modified>2011-08-30</modified>
</dates>
</vuln>
<vuln vid="057bf770-cac4-11e0-aea3-00215c6a37bb">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-sockets</name>
<range><lt>5.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.3.7">
<p>Security Enhancements and Fixes in PHP 5.3.7:</p>
<ul>
<li>Updated crypt_blowfish to 1.2. (CVE-2011-2483)</li>
<li>Fixed crash in error_log(). Reported by Mateusz
Kocielski</li>
<li>Fixed buffer overflow on overlog salt in crypt().</li>
<li>Fixed bug #54939 (File path injection vulnerability
in RFC1867 File upload filename). Reported by Krzysztof
Kotowicz. (CVE-2011-2202)</li>
<li>Fixed stack buffer overflow in socket_connect().
(CVE-2011-1938)</li>
<li>Fixed bug #54238 (use-after-free in substr_replace()).
(CVE-2011-1148)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>49241</bid>
<cvename>CVE-2011-2483</cvename>
<cvename>CVE-2011-2202</cvename>
<cvename>CVE-2011-1938</cvename>
<cvename>CVE-2011-1148</cvename>
</references>
<dates>
<discovery>2011-08-18</discovery>
<entry>2011-08-20</entry>
</dates>
</vuln>
<vuln vid="be77eff6-ca91-11e0-aea3-00215c6a37bb">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/49179/discuss">
<p>Ruby on Rails is prone to multiple vulnerabilities
including SQL-injection, information-disclosure,
HTTP-header-injection, security-bypass and cross-site
scripting issues.</p>
</blockquote>
</body>
</description>
<references>
<bid>49179</bid>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</url>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-19</entry>
</dates>
</vuln>
<vuln vid="0b53f5f7-ca8a-11e0-aea3-00215c6a37bb">
<topic>dovecot -- denial of service vulnerability</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.2.17</lt></range>
<range><gt>2.0</gt><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="http://dovecot.org/pipermail/dovecot/2011-May/059086.html">
<p> Fixed potential crashes and other problems when parsing header
names that contained NUL characters.</p>
</blockquote>
</body>
</description>
<references>
<bid>47930</bid>
<cvename>CVE-2011-1929</cvename>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-08-19</entry>
</dates>
</vuln>
<vuln vid="86baa0d4-c997-11e0-8a8e-00151735203a">
<topic>OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.1.*</gt><lt>3.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2011-03-en/">
<ul>
<li>An attacker with valid session and admin permissions could
get read access to any file on the servers local operating
system. For this it would be needed minimum one installed
OTRS package.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2746</cvename>
<url>http://otrs.org/advisory/OSA-2011-03-en/</url>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-18</entry>
</dates>
</vuln>
<vuln vid="834591a9-c82f-11e0-897d-6c626dd55a41">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.20,1</lt></range>
<range><gt>5.0.*,1</gt><lt>6.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.20,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-29 Security issues addressed in Firefox 6</p>
<p>MFSA 2011-28 Security issues addressed in Firefox 3.6.20</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-29.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-30.html</url>
<cvename>CVE-2011-2982</cvename>
<cvename>CVE-2011-0084</cvename>
<cvename>CVE-2011-2981</cvename>
<cvename>CVE-2011-2378</cvename>
<cvename>CVE-2011-2984</cvename>
<cvename>CVE-2011-2980</cvename>
<cvename>CVE-2011-2983</cvename>
<cvename>CVE-2011-2989</cvename>
<cvename>CVE-2011-2991</cvename>
<cvename>CVE-2011-2992</cvename>
<cvename>CVE-2011-2985</cvename>
<cvename>CVE-2011-2993</cvename>
<cvename>CVE-2011-2988</cvename>
<cvename>CVE-2011-2987</cvename>
<cvename>CVE-2011-0084</cvename>
<cvename>CVE-2011-2990</cvename>
<cvename>CVE-2011-2986</cvename>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-16</entry>
</dates>
</vuln>
<vuln vid="56f4b3a6-c82c-11e0-a498-00215c6a37bb">
<topic>Samba -- cross site scripting and request forgery vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.14</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba security advisory reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2522">
<p>All current released versions of Samba are vulnerable to a
cross-site request forgery in the Samba Web Administration Tool
(SWAT). By tricking a user who is authenticated with SWAT into
clicking a manipulated URL on a different web page, it is
possible to manipulate SWAT.</p>
</blockquote>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2694">
<p>All current released versions of Samba are vulnerable to a
cross-site scripting issue in the Samba Web Administration Tool
(SWAT). On the "Change Password" field, it is possible to insert
arbitrary content into the "user" field.</p>
</blockquote>
</body>
</description>
<references>
<bid>48901</bid>
<bid>48899</bid>
<cvename>CVE-2011-2522</cvename>
<cvename>CVE-2011-2694</cvename>
</references>
<dates>
<discovery>2011-07-27</discovery>
<entry>2011-08-16</entry>
</dates>
</vuln>
<vuln vid="510b630e-c43b-11e0-916c-00e0815b8da8">
<topic>isc-dhcp-server -- server halt upon processing certain packets</topic>
<affects>
<package>
<name>isc-dhcp31-server</name>
<range><lt>3.1.ESV_1,1</lt></range>
</package>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_2,2</lt></range>
</package>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-2748">
<p>A pair of defects cause the server to halt upon processing
certain packets. The patch is to properly discard or process
those packets.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2748</cvename>
<cvename>CVE-2011-2749</cvename>
</references>
<dates>
<discovery>2011-08-10</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="dc8741b9-c5d5-11e0-8a8e-00151735203a">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.6</lt></range>
<range><ge>4.0.*</ge><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.11/">
<p>The following security issues have been discovered in Bugzilla:</p>
<ul>
<li>Internet Explorer 8 and older, and Safari before 5.0.6 do
content sniffing when viewing a patch in "Raw Unified" mode,
which could trigger a cross-site scripting attack due to
the execution of malicious code in the attachment.</li>
<li>It is possible to determine whether or not certain group
names exist while creating or updating bugs.</li>
<li>Attachment descriptions with a newline in them could lead
to the injection of crafted headers in email notifications sent
to the requestee or the requester when editing an attachment
flag.</li>
<li>If an attacker has access to a user's session, he can modify
that user's email address without that user being notified
of the change.</li>
<li>Temporary files for uploaded attachments are not deleted
on Windows, which could let a user with local access to
the server read them.</li>
<li>Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised,
it can be used to inject HTML code when viewing a bug report,
leading to a cross-site scripting attack.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2379</cvename>
<cvename>CVE-2011-2380</cvename>
<cvename>CVE-2011-2979</cvename>
<cvename>CVE-2011-2381</cvename>
<cvename>CVE-2011-2978</cvename>
<cvename>CVE-2011-2977</cvename>
<cvename>CVE-2011-2976</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=637981</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=653477</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=674497</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=657158</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=670868</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660502</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660053</url>
</references>
<dates>
<discovery>2011-08-04</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="879b0242-c5b6-11e0-abd1-0017f22d6707">
<topic>dtc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dtc</name>
<range><lt>0.32.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansgar Burchardt reports:</p>
<blockquote cite="http://www.debian.org/security/2011/dsa-2179">
<p>Ansgar Burchardt discovered several vulnerabilities in DTC, a
web control panel for admin and accounting hosting services:
The bw_per_moth.php graph contains an SQL injection
vulnerability; insufficient checks in bw_per_month.php can lead
to bandwidth usage information disclosure; after a registration,
passwords are sent in cleartext email messages and Authenticated
users could delete accounts using an obsolete interface which
was incorrectly included in the package.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0434</cvename>
<cvename>CVE-2011-0435</cvename>
<cvename>CVE-2011-0436</cvename>
<cvename>CVE-2011-0437</cvename>
<url>http://www.debian.org/security/2011/dsa-2179</url>
</references>
<dates>
<discovery>2011-03-02</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="304409c3-c3ef-11e0-8aa5-485d60cb5385">
<topic>libXfont -- possible local privilege escalation</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.4_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=725760">
<p>The compress/ LZW decompress implentation does not correctly
handle compressed streams that contain code words that were not
yet added to the decompression table. This may lead to
arbitrary memory corruption. Successfull exploitation may
possible lead to a local privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2895</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=725760</url>
</references>
<dates>
<discovery>2011-07-26</discovery>
<entry>2011-08-11</entry>
<modified>2012-03-13</modified>
</dates>
</vuln>
<vuln vid="5d374b01-c3ee-11e0-8aa5-485d60cb5385">
<topic>freetype2 -- execute arbitrary code or cause denial of service</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vincent Danen reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226">
<p>Due to an error within the t1_decoder_parse_charstrings()
function (src/psaux/t1decode.c) and can be exploited to corrupt
memory by tricking a user into processing a specially-crafted
postscript Type1 font in an application that uses the freetype
library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0226</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2011-08-11</entry>
</dates>
</vuln>
<vuln vid="2c12ae0c-c38d-11e0-8eb7-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-21.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.3.181.36 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.185.25 and
earlier versions for Android. These vulnerabilities could
cause a crash and potentially allow an attacker to take control
of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2130</cvename>
<cvename>CVE-2011-2134</cvename>
<cvename>CVE-2011-2135</cvename>
<cvename>CVE-2011-2136</cvename>
<cvename>CVE-2011-2137</cvename>
<cvename>CVE-2011-2138</cvename>
<cvename>CVE-2011-2139</cvename>
<cvename>CVE-2011-2140</cvename>
<cvename>CVE-2011-2414</cvename>
<cvename>CVE-2011-2415</cvename>
<cvename>CVE-2011-2416</cvename>
<cvename>CVE-2011-2417</cvename>
<cvename>CVE-2011-2425</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb11-21.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-08-10</entry>
<modified>2012-11-05</modified>
</dates>
</vuln>
<vuln vid="30cb4522-b94d-11e0-8182-485d60cb5385">
<topic>libsoup -- unintentionally allow access to entire local filesystem</topic>
<affects>
<package>
<name>libsoup</name>
<range><lt>2.32.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dan Winship reports:</p>
<blockquote cite="http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html">
<p>Fixed a security hole that caused some SoupServer users to
unintentionally allow accessing the entire local filesystem when
they thought they were only providing access to a single
directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2054</cvename>
<url>http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=653258</url>
</references>
<dates>
<discovery>2011-06-23</discovery>
<entry>2011-07-28</entry>
</dates>
</vuln>
<vuln vid="d79fc873-b5f9-11e0-89b4-001ec9578670">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
<p>XSS in table Print view.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
<p>Via a crafted MIME-type transformation parameter, an attacker can
perform a local file inclusion.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
<p>In the 'relational schema' code a parameter was not sanitized before
being used to concatenate a class name.</p>
<p>The end result is a local file inclusion vulnerability and code
execution.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
<p>It was possible to manipulate the PHP session superglobal using
some of the Swekey authentication code.</p>
<p>This is very similar to PMASA-2011-5, documented in
7e4e5c53-a56c-11e0-b180-00216aa06fc2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2642</cvename>
<cvename>CVE-2011-2643</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php</url>
</references>
<dates>
<discovery>2011-07-23</discovery>
<entry>2011-07-24</entry>
<modified>2011-07-28</modified>
</dates>
</vuln>
<vuln vid="9f14cb36-b6fc-11e0-a044-445c73746d79">
<topic>opensaml2 -- unauthenticated login</topic>
<affects>
<package>
<name>opensaml2</name>
<range><gt>0</gt><lt>2.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSAML developer reports:</p>
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20110725.txt">
<p>The Shibboleth software relies on the OpenSAML libraries to
perform verification of signed XML messages such as attribute
queries or SAML assertions. Both the Java and C++ versions are
vulnerable to a so-called "wrapping attack" that allows a remote,
unauthenticated attacker to craft specially formed messages that
can be successfully verified, but contain arbitrary content.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1411</cvename>
<mlist msgid="CA530061.113D6%cantor.2@osu.edu">https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9</mlist>
</references>
<dates>
<discovery>2011-07-25</discovery>
<entry>2011-07-25</entry>
</dates>
</vuln>
<vuln vid="9a777c23-b310-11e0-832d-00215c6a37bb">
<topic>rsync -- incremental recursion memory corruption vulnerability</topic>
<affects>
<package>
<name>rsync</name>
<range><gt>3.0</gt><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rsync development team reports:</p>
<blockquote cite="http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS">
<p>Fixed a data-corruption issue when preserving hard-links
without preserving file ownership, and doing deletions either
before or during the transfer (CVE-2011-1097). This
fixes some assert errors in the hard-linking code, and some
potential failed checksums (via -c) that should have matched.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1097</cvename>
<url>https://bugzilla.samba.org/show_bug.cgi?id=7936</url>
</references>
<dates>
<discovery>2011-04-08</discovery>
<entry>2011-07-20</entry>
</dates>
</vuln>
<vuln vid="fd64188d-a71d-11e0-89b4-001ec9578670">
<topic>BIND -- Remote DoS against authoritative and recursive servers</topic>
<affects>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R4.3</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.3.3</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2464">
<p>A defect in the affected BIND 9 versions allows an attacker to
remotely cause the "named" process to exit using a specially
crafted packet.</p>
<p>This defect affects both recursive and authoritative servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2464</cvename>
<url>https://www.isc.org/software/bind/advisories/cve-2011-2464</url>
</references>
<dates>
<discovery>2011-07-05</discovery>
<entry>2011-07-05</entry>
</dates>
</vuln>
<vuln vid="4ccee784-a721-11e0-89b4-001ec9578670">
<topic>BIND -- Remote DoS with certain RPZ configurations</topic>
<affects>
<package>
<name>bind98</name>
<range><lt>9.8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2465">
<p>Two defects were discovered in ISC's BIND 9.8 code. These
defects only affect BIND 9.8 servers which have recursion
enabled and which use a specific feature of the software known
as Response Policy Zones (RPZ) and where the RPZ zone contains
a specific rule/action pattern.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2465</cvename>
<url>https://www.isc.org/software/bind/advisories/cve-2011-2465</url>
</references>
<dates>
<discovery>2011-07-05</discovery>
<entry>2011-07-05</entry>
</dates>
</vuln>
<vuln vid="7e4e5c53-a56c-11e0-b180-00216aa06fc2">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
<p>It was possible to manipulate the PHP session superglobal using
some of the Swekey authentication code. This could open a path
for other attacks.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
<p>An unsanitized key from the Servers array is written in a comment
of the generated config. An attacker can modify this key by
modifying the SESSION superglobal array. This allows the attacker
to close the comment and inject code.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
<p>Through a possible bug in PHP running on Windows systems a NULL
byte can truncate the pattern string allowing an attacker to
inject the /e modifier causing the preg_replace function to
execute its second argument as PHP code.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
<p>Fixed filtering of a file path in the MIME-type transformation
code, which allowed for directory traversal.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2505</cvename>
<cvename>CVE-2011-2506</cvename>
<cvename>CVE-2011-2507</cvename>
<cvename>CVE-2011-2508</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php</url>
</references>
<dates>
<discovery>2011-07-02</discovery>
<entry>2011-07-03</entry>
<modified>2011-07-28</modified>
</dates>
</vuln>
<vuln vid="40544e8c-9f7b-11e0-9bec-6c626dd55a41">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.41.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.18.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://www.asterisk.org/node/51650">
<p>AST-2011-008: If a remote user sends a SIP packet containing a
NULL, Asterisk assumes available data extends past the null to
the end of the packet when the buffer is actually truncated when
copied. This causes SIP header parsing to modify data past the
end of the buffer altering unrelated memory structures. This
vulnerability does not affect TCP/TLS connections.</p>
<p>AST-2011-009: A remote user sending a SIP packet containing a
Contact header with a missing left angle bracket causes Asterisk
to access a null pointer.</p>
<p>AST-2011-010: A memory address was inadvertently transmitted
over the network via IAX2 via an option control frame and the
remote party would try to access it.</p>
<p>Possible enumeration of SIP users due to differing
authentication responses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2529</cvename>
<cvename>CVE-2011-2535</cvename>
<cvename>CVE-2011-2536</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-008.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-009.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-010.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-011.html</url>
</references>
<dates>
<discovery>2011-06-24</discovery>
<entry>2011-06-25</entry>
<modified>2011-06-29</modified>
</dates>
</vuln>
<vuln vid="01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6">
<topic>ejabberd -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>2.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It's reported in CVE advisory that:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1753">
<p>expat_erl.c in ejabberd before 2.1.7 and 3.x before
3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect
recursion during entity expansion, which allows remote attackers
to cause a denial of service (memory and CPU consumption) via a
crafted XML document containing a large number of nested entity
references, a similar issue to CVE-2003-1564.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1753</cvename>
<url>http://www.ejabberd.im/ejabberd-2.1.7</url>
</references>
<dates>
<discovery>2011-04-27</discovery>
<entry>2011-06-24</entry>
</dates>
</vuln>
<vuln vid="dfe40cff-9c3f-11e0-9bec-6c626dd55a41">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.20,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.18,1</lt></range>
<range><gt>4.0.*,1</gt><lt>5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.18,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-19 Miscellaneous memory safety hazards
(rv:3.0/1.9.2.18)</p>
<p>MFSA 2011-20 Use-after-free vulnerability when viewing XUL
document with script disabled</p>
<p>MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace
images</p>
<p>MFSA 2011-22 Integer overflow and arbitrary code execution in
Array.reduceRight()</p>
<p>MFSA 2011-23 Multiple dangling pointer vulnerabilities</p>
<p>MFSA 2011-24 Cookie isolation error</p>
<p>MFSA 2011-25 Stealing of cross-domain images using WebGL
textures</p>
<p>MFSA 2011-26 Multiple WebGL crashes</p>
<p>MFSA 2011-27 XSS encoding hazard with inline SVG</p>
<p>MFSA 2011-28 Non-whitelisted site can trigger xpinstall</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-19.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-20.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-21.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-22.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-23.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-24.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-25.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-26.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-27.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-28.html</url>
</references>
<dates>
<discovery>2011-06-21</discovery>
<entry>2011-06-21</entry>
<modified>2011-06-23</modified>
</dates>
</vuln>
<vuln vid="bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41">
<topic>Samba -- Denial of service - memory corruption</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.12</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-0719.html">
<p>Samba is vulnerable to a denial of service, caused by a memory
corruption error related to missing range checks on file
descriptors being used in the "FD_SET" macro. By performing a
select on a bad file descriptor set, a remote attacker could
exploit this vulnerability to cause the application to crash or
possibly execute arbitrary code on the system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0719</cvename>
<url>http://www.samba.org/samba/security/CVE-2011-0719.html</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719</url>
</references>
<dates>
<discovery>2011-02-28</discovery>
<entry>2011-06-21</entry>
</dates>
</vuln>
<vuln vid="23c8423e-9bff-11e0-8ea2-0019d18c446a">
<topic>Piwik -- remote command execution vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><ge>1.2</ge><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik security advisory reports:</p>
<blockquote cite="http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/">
<p>The Piwik 1.5 release addresses a critical security
vulnerability, which affect all Piwik users that have let
granted some access to the "anonymous" user.</p>
<p>Piwik contains a remotely exploitable vulnerability that could
allow a remote attacker to execute arbitrary code. Only
installations that have granted untrusted view access to their
stats (ie. grant "view" access to a website to anonymous) are
at risk.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/158084</freebsdpr>
<url>http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/</url>
</references>
<dates>
<discovery>2011-06-21</discovery>
<entry>2011-06-21</entry>
</dates>
</vuln>
<vuln vid="0b535cd0-9b90-11e0-800a-00215c6a37bb">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20110525a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dokuwiki reports:</p>
<blockquote cite="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">
<p>We just released a Hotfix Release "2011-05-25a Rincewind".
It contains the following changes:</p>
<p>Security fix for a Cross Site Scripting vulnerability.
Malicious users could abuse DokuWiki's RSS embedding mechanism
to create links containing arbitrary JavaScript. Note: this
security problem is present in at least Anteater and Rincewind
but probably in older releases as well.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</url>
</references>
<dates>
<discovery>2011-06-14</discovery>
<entry>2011-06-20</entry>
</dates>
</vuln>
<vuln vid="55a528e8-9787-11e0-b24a-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-18.html">
<p>A critical vulnerability has been identified in Adobe Flash
Player 10.3.181.23 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.185.23 and
earlier versions for Android. This memory corruption
vulnerability (CVE-2011-2110) could cause a crash and
potentially allow an attacker to take control of the affected
system. There are reports that this vulnerability is being
exploited in the wild in targeted attacks via malicious Web
pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2110</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-18.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-06-15</entry>
</dates>
</vuln>
<vuln vid="3145faf1-974c-11e0-869e-000c29249b2e">
<topic>ikiwiki -- tty hijacking via ikiwiki-mass-rebuild</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20110608</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The IkiWiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index40h2">
<p>Ludwig Nussel discovered a way for users to hijack root's tty
when ikiwiki-mass-rebuild was run. Additionally, there was
some potential for information disclosure via symlinks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1408</cvename>
<url>http://ikiwiki.info/security/#index40h2</url>
</references>
<dates>
<discovery>2011-06-08</discovery>
<entry>2011-06-15</entry>
</dates>
</vuln>
<vuln vid="57573136-920e-11e0-bdc9-001b2134ef46">
<topic>linux-flashplugin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-13.html">
<p>An important vulnerability has been identified in Adobe
Flash Player 10.3.181.16 and earlier versions for Windows,
Macintosh, Linux and Solaris, and Adobe Flash Player
10.3.185.22 and earlier versions for Android. This universal
cross-site scripting vulnerability (CVE-2011-2107) could be
used to take actions on a user's behalf on any website or
webmail provider, if the user visits a malicious website.
There are reports that this vulnerability is being exploited
in the wild in active targeted attacks designed to trick
the user into clicking on a malicious link delivered in an
email message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2107</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-13.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-06-08</entry>
</dates>
</vuln>
<vuln vid="1e1421f0-8d6f-11e0-89b4-001ec9578670">
<topic>BIND -- Large RRSIG RRsets and Negative Caching DoS</topic>
<affects>
<package>
<name>bind9-sdb-ldap</name>
<name>bind9-sdb-postgresql</name>
<range><lt>9.4.3.4</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R4.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.3.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.0.2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_6</lt></range>
<range><ge>7.4</ge><lt>7.4_2</lt></range>
<range><ge>8.1</ge><lt>8.1_4</lt></range>
<range><ge>8.2</ge><lt>8.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2011-1910">
<p>A BIND 9 DNS server set up to be a caching resolver is
vulnerable to a user querying a domain with very large resource
record sets (RRSets) when trying to negatively cache a response.
This can cause the BIND 9 DNS server (named process) to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1910</cvename>
<freebsdsa>SA-11:02.bind</freebsdsa>
<url>http://www.isc.org/software/bind/advisories/cve-2011-1910</url>
</references>
<dates>
<discovery>2011-05-26</discovery>
<entry>2011-06-04</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="f7d838f2-9039-11e0-a051-080027ef73ec">
<topic>fetchmail -- STARTTLS denial of service</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2011-01.txt">
<p>Fetchmail version 5.9.9 introduced STLS support for POP3,
version 6.0.0 added STARTTLS for IMAP. However, the actual
S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded
by a timeout.</p>
<p>Depending on the operating system defaults as to TCP stream
keepalive mode, fetchmail hangs in excess of one week after
sending STARTTLS were observed if the connection failed without
notifying the operating system, for instance, through network
outages or hard server crashes.</p>
<p>A malicious server that does not respond, at the network level,
after acknowledging fetchmail's STARTTLS or STLS request, can
hold fetchmail in this protocol state, and thus render fetchmail
unable to complete the poll, or proceed to the next server,
effecting a denial of service.</p>
<p>SSL-wrapped mode on dedicated ports was unaffected by this
problem, so can be used as a workaround.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1947</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2011-01.txt</url>
<url>https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314</url>
</references>
<dates>
<discovery>2011-04-28</discovery>
<entry>2011-06-06</entry>
</dates>
</vuln>
<vuln vid="34ce5817-8d56-11e0-b5a2-6c626dd55a41">
<topic>asterisk -- Remote crash vulnerability</topic>
<affects>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-June/000325.html">
<p>If a remote user initiates a SIP call and the recipient picks
up, the remote user can reply with a malformed Contact header
that Asterisk will improperly handle and cause a crash due to a
segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2216</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-007.pdf</url>
</references>
<dates>
<discovery>2011-06-02</discovery>
<entry>2011-06-02</entry>
</dates>
</vuln>
<vuln vid="e27a1af3-8d21-11e0-a45d-001e8c75030d">
<topic>Subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><lt>1.6.17</lt></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><lt>1.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1752-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will
dereference a NULL pointer if asked to deliver baselined WebDAV
resources.</p>
<p>This can lead to a DoS. An exploit has been tested, and tools
or users have been observed triggering this problem in the
wild.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1783-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module may in
certain scenarios enter a logic loop which does not exit and
which allocates memory in each iteration, ultimately exhausting
all the available memory on the server.</p>
<p>This can lead to a DoS. There are no known instances of this
problem being observed in the wild, but an exploit has been
tested.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1921-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module may leak to
remote users the file contents of files configured to be
unreadable by those users.</p>
<p>There are no known instances of this problem being observed in
the wild, but an exploit has been tested.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1752</cvename>
<cvename>CVE-2011-1783</cvename>
<cvename>CVE-2011-1921</cvename>
</references>
<dates>
<discovery>2011-05-28</discovery>
<entry>2011-06-02</entry>
</dates>
</vuln>
<vuln vid="1acf9ec5-877d-11e0-b937-001372fd0af2">
<topic>drupal6 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/1168756">
<p>A reflected cross site scripting vulnerability was discovered
in Drupal's error handler. Drupal displays PHP errors in the
messages area, and a specially crafted URL can cause malicious
scripts to be injected into the message. The issue can be
mitigated by disabling on-screen error display at admin /
settings / error-reporting. This is the recommended setting
for production sites.</p>
<p>When using re-colorable themes, color inputs are not sanitized.
Malicious color values can be used to insert arbitrary CSS and
script code. Successful exploitation requires the "Administer
themes" permission.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/1168756</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-26</entry>
</dates>
</vuln>
<vuln vid="e4833927-86e5-11e0-a6b4-000a5e1e33c6">
<topic>Erlang -- ssh library uses a weak random number generator</topic>
<affects>
<package>
<name>erlang</name>
<range><lt>r14b03</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/178990">
<p>The Erlang/OTP ssh library implements a number of
cryptographic operations that depend on cryptographically
strong random numbers. Unfortunately the RNG used by the
library is not cryptographically strong, and is further
weakened by the use of predictable seed material. The RNG
(Wichman-Hill) is not mixed with an entropy source.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0766</cvename>
<url>http://www.erlang.org/download/otp_src_R14B03.readme</url>
<url>https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-25</entry>
</dates>
</vuln>
<vuln vid="dc96ac1f-86b1-11e0-9e85-00215af774f0">
<topic>Unbound -- an empty error packet handling assertion failure</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt">
<p>NLnet Labs was notified of an error in Unbound's code-path
for error replies which is triggered under special conditions.
The error causes the program to abort.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1922</cvename>
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-25</entry>
</dates>
</vuln>
<vuln vid="115a1389-858e-11e0-a76c-000743057ca2">
<topic>Pubcookie Login Server -- XSS vulnerability</topic>
<affects>
<package>
<name>pubcookie-login-server</name>
<range><lt>3.3.2d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors, Pubcookie Project reports:</p>
<blockquote cite="http://pubcookie.org/news/20070606-login-secadv.html">
<p>A new non-persistent XSS vulnerability was found in the
Pubcookie login server's compiled binary "index.cgi" CGI
program. The CGI program mishandles untrusted data when
printing responses to the browser. This makes the program
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to his or her local Pubcookie login page
and attempt to exploit the XSS vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pubcookie.org/news/20070606-login-secadv.html</url>
</references>
<dates>
<discovery>2007-05-25</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="1ca8228f-858d-11e0-a76c-000743057ca2">
<topic>mod_pubcookie -- Empty Authentication Security Advisory</topic>
<affects>
<package>
<name>ap20-mod_pubcookie</name>
<range><ge>3.1.0</ge><lt>3.3.2b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors, Pubcookie Project reports:</p>
<blockquote cite="http://pubcookie.org/news/20061106-empty-auth-secadv.html">
<p>An Abuse of Functionality vulnerability in the Pubcookie
authentication process was found. This vulnerability allows an
attacker to appear as if he or she were authenticated using an
empty userid when such a userid isn't expected. Unauthorized
access to web content and applications may result where access
is restricted to users who can authenticate successfully but
where no additional authorization is performed after
authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pubcookie.org/news/20061106-empty-auth-secadv.html</url>
</references>
<dates>
<discovery>2006-10-04</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="7af2fb85-8584-11e0-96b7-00300582f9fc">
<topic>ViewVC -- user-reachable override of cvsdb row limit</topic>
<affects>
<package>
<name>viewvc</name>
<range><lt>1.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ViewVC.org reports:</p>
<blockquote cite="http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2536&r2=2574">
<p>Security fix: remove user-reachable override of cvsdb row limit.</p>
</blockquote>
</body>
</description>
<references>
<url>http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES</url>
</references>
<dates>
<discovery>2011-05-17</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="99a5590c-857e-11e0-96b7-00300582f9fc">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.5.1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
<p>A flaw was discovered in the apr_fnmatch() function in the
Apache Portable Runtime (APR) library 1.4.4 (or any backported
versions that contained the upstream fix for CVE-2011-0419).
This could cause httpd workers to enter a hung state (100% CPU
utilization).</p>
<p>apr-util 1.3.11 could cause crashes with httpd's
mod_authnz_ldap in some situations.</p>
</blockquote>
</body>
</description>
<references>
<bid>47929</bid>
<cvename>CVE-2011-1928</cvename>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="d226626c-857f-11e0-95cc-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-12.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.2.159.1 and earlier versions (Adobe Flash Player
10.2.154.28 and earlier for Chrome users) for Windows,
Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51
and earlier versions for Android. These vulnerabilities could
cause the application to crash and could potentially allow an
attacker to take control of the affected system. There are
reports of malware attempting to exploit one of the
vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf)
file embedded in a Microsoft Word (.doc) or Microsoft Excel
(.xls) file delivered as an email attachment targeting the
Windows platform. However, to date, Adobe has not obtained a
sample that successfully completes an attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0579</cvename>
<cvename>CVE-2011-0618</cvename>
<cvename>CVE-2011-0619</cvename>
<cvename>CVE-2011-0620</cvename>
<cvename>CVE-2011-0621</cvename>
<cvename>CVE-2011-0622</cvename>
<cvename>CVE-2011-0623</cvename>
<cvename>CVE-2011-0624</cvename>
<cvename>CVE-2011-0625</cvename>
<cvename>CVE-2011-0626</cvename>
<cvename>CVE-2011-0627</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-12.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="e666498a-852a-11e0-8f78-080027ef73ec">
<topic>Opera -- code injection vulnerability through broken frameset handling</topic>
<affects>
<package><name>opera</name><range><lt>11.11</lt></range></package>
<package><name>opera-devel</name><range><lt>11.11</lt></range></package>
<package><name>linux-opera</name><range><lt>11.11</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1111/">
<p>Fixed an issue with framesets that could allow execution of
arbitrary code, as reported by an anonymous contributor working
with the SecuriTeam Secure Disclosure program.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/docs/changelogs/unix/1111/</url>
<url>http://www.opera.com/support/kb/view/992/</url>
</references>
<dates>
<discovery>2011-05-18</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="1495f931-8522-11e0-a1c1-00215c6a37bb">
<topic>pureftpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pure-ftpd</name>
<range><lt>1.0.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pure-FTPd development team reports:</p>
<blockquote cite="http://www.pureftpd.org/project/pure-ftpd/news">
<p>Support for braces expansion in directory listings has been
disabled -- Cf. CVE-2011-0418.</p>
<p>Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411.
If you're using TLS, upgrading is recommended.</p>
</blockquote>
</body>
</description>
<references>
<bid>46767</bid>
<cvename>CVE-2011-0418</cvename>
<cvename>CVE-2011-1575</cvename>
</references>
<dates>
<discovery>2011-04-01</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="36594c54-7be7-11e0-9838-0022156e8794">
<topic>Exim -- remote code execution and information disclosure</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.70</ge><lt>4.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Release notes for Exim 4.76 says:</p>
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.76">
<p>Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to
a format-string attack -- SECURITY: remote arbitrary code
execution.</p>
<p>DKIM signature header parsing was double-expanded, second
time unintentionally subject to list matching rules, letting
the header cause arbitrary Exim lookups (of items which can
occur in lists, *not* arbitrary string expansion). This
allowed for information disclosure.</p>
</blockquote>
<p>Also, impact assessment was redone shortly after the original
announcement:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html">
<p>Further analysis revealed that the second security was
more severe than I realised at the time that I wrote the
announcement. The second security issue has been assigned
CVE-2011-1407 and is also a remote code execution flaw.
For clarity: both issues were introduced with 4.70.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1764</cvename>
<cvename>CVE-2011-1407</cvename>
<mlist msgid="20110512102909.GA58484@redoubt.spodhuis.org">https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html</mlist>
<url>http://bugs.exim.org/show_bug.cgi?id=1106</url>
</references>
<dates>
<discovery>2011-05-10</discovery>
<entry>2011-05-14</entry>
</dates>
</vuln>
<vuln vid="00b296b6-7db1-11e0-96b7-00300582f9fc">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.4.1.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
<p>Note especially a security fix to APR 1.4.4, excessive CPU
consumption was possible due to an unconstrained, recursive
invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards.
Reimplement apr_fnmatch() from scratch using a non-recursive
algorithm now has improved compliance with the fnmatch() spec.
(William Rowe)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
</references>
<dates>
<discovery>2011-05-10</discovery>
<entry>2011-05-12</entry>
</dates>
</vuln>
<vuln vid="34e8ccf5-7d71-11e0-9d83-000c29cc39d3">
<topic>Zend Framework -- potential SQL injection when using PDO_MySql</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2011-02">
<p>Developers using non-ASCII-compatible encodings in conjunction
with the MySQL PDO driver of PHP may be vulnerable to SQL
injection attacks. Developers using ASCII-compatible encodings
like UTF8 or latin1 are not affected by this PHP issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://framework.zend.com/security/advisory/ZF2011-02</url>
<url>http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html</url>
</references>
<dates>
<discovery>2011-05-06</discovery>
<entry>2011-05-13</entry>
</dates>
</vuln>
<vuln vid="3fadb7c6-7b0a-11e0-89b4-001ec9578670">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.16.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html">
<p>(Bug 28534) XSS vulnerability for IE 6 clients. This is the
third attempt at fixing bug 28235.</p>
<p>(Bug 28639) Potential privilege escalation when
$wgBlockDisablesLogin is enabled.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28534</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28639</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html</url>
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES</url>
</references>
<dates>
<discovery>2011-04-14</discovery>
<entry>2011-05-12</entry>
</dates>
</vuln>
<vuln vid="3eb2c100-738b-11e0-89f4-001e90d46635">
<topic>Postfix -- memory corruption vulnerability</topic>
<affects>
<package>
<name>postfix</name>
<name>postfix-base</name>
<range><ge>2.8.*,1</ge><lt>2.8.3,1</lt></range>
<range><ge>2.7.*,1</ge><lt>2.7.4,1</lt></range>
<range><ge>2.6.*,1</ge><lt>2.6.10,1</lt></range>
<range><ge>2.5.*,2</ge><lt>2.5.13,2</lt></range>
<range><le>2.4.16,1</le></range>
</package>
<package>
<name>postfix-current</name>
<name>postfix-current-base</name>
<range><lt>2.9.20110501,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Postfix SMTP server has a memory corruption error, when the
Cyrus SASL library is used with authentication mechanisms other
than PLAIN and LOGIN (ANONYMOUS is not affected, but should not
be used for other reasons). This memory corruption is known to
result in a program crash (SIGSEV).</p>
</body>
</description>
<references>
<cvename>CVE-2011-1720</cvename>
<url>http://www.postfix.org/CVE-2011-1720.html</url>
</references>
<dates>
<discovery>2011-05-09</discovery>
<entry>2011-05-09</entry>
</dates>
</vuln>
<vuln vid="04b7d46c-7226-11e0-813a-6c626dd55a41">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.17,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.19,1</lt></range>
<range><gt>4.0.*,1</gt><lt>4.0.1,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.17</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.17,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.19</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-12 Miscellaneous memory safety hazards</p>
<p>MFSA 2011-13 Multiple dangling pointer vulnerabilities</p>
<p>MFSA 2011-14 Information stealing via form history</p>
<p>MFSA 2011-15 Escalation of privilege through Java Embedding Plugin</p>
<p>MFSA 2011-16 Directory traversal in resource: protocol</p>
<p>MFSA 2011-17 WebGLES vulnerabilities</p>
<p>MFSA 2011-18 XSLT generate-id() function heap address leak</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-12.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-13.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-14.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-15.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-16.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-17.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-18.html</url>
</references>
<dates>
<discovery>2011-04-28</discovery>
<entry>2011-04-29</entry>
</dates>
</vuln>
<vuln vid="3c7d565a-6c64-11e0-813a-6c626dd55a41">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.40.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.17.3</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-April/000316.html">
<p>It is possible for a user of the Asterisk Manager Interface to
bypass a security check and execute shell commands when they
should not have that ability. Sending the "Async" header with
the "Application" header during an Originate action, allows
authenticated manager users to execute shell commands. Only
users with the "system" privilege should be able to do this.</p>
<p>On systems that have the Asterisk Manager Interface, Skinny, SIP
over TCP, or the built in HTTP server enabled, it is possible for
an attacker to open as many connections to asterisk as he wishes.
This will cause Asterisk to run out of available file descriptors
and stop processing any new calls. Additionally, disk space can
be exhausted as Asterisk logs failures to open new file
descriptors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1507</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-005.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-006.pdf</url>
</references>
<dates>
<discovery>2011-04-21</discovery>
<entry>2011-04-21</entry>
</dates>
</vuln>
<vuln vid="6a4bfe75-692a-11e0-bce7-001eecdd401a">
<topic>VLC -- Heap corruption in MP4 demultiplexer</topic>
<affects>
<package>
<name>vlc</name>
<range><ge>1.0.0</ge><lt>1.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1103.html">
<p>When parsing some MP4 (MPEG-4 Part 14) files, insufficient
buffer size might lead to corruption of the heap.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1103.html</url>
</references>
<dates>
<discovery>2011-04-07</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="32b05547-6913-11e0-bdc4-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r159.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-02.html">
<p>A critical vulnerability exists in Flash Player 10.2.153.1
and earlier versions (Adobe Flash Player 10.2.154.25 and
earlier for Chrome users) for Windows, Macintosh, Linux
and Solaris, Adobe Flash Player 10.2.156.12 and earlier
versions for Android, and the Authplay.dll component that
ships with Adobe Reader and Acrobat X (10.0.2) and earlier
10.x and 9.x versions for Windows and Macintosh operating
systems.</p>
<p>This vulnerability (CVE-2011-0611) could cause a crash
and potentially allow an attacker to take control of the
affected system. There are reports that this vulnerability
is being exploited in the wild in targeted attacks via a
malicious Web page or a Flash (.swf) file embedded in a
Microsoft Word (.doc) or Microsoft Excel (.xls) file
delivered as an email attachment, targeting the Windows
platform. At this time, Adobe is not aware of any attacks
via PDF targeting Adobe Reader and Acrobat. Adobe Reader
X Protected Mode mitigations would prevent an exploit of
this kind from executing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0611</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa11-02.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="bf171509-68dd-11e0-afe6-0003ba02bf30">
<topic>rt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rt36</name>
<range><lt>3.6.11</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html">
<p>In the process of preparing the release of RT 4.0.0, we performed
an extensive security audit of RT's source code. During this
audit, several vulnerabilities were found which affect earlier
releases of RT.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1685</cvename>
<cvename>CVE-2011-1686</cvename>
<cvename>CVE-2011-1687</cvename>
<cvename>CVE-2011-1688</cvename>
<cvename>CVE-2011-1689</cvename>
<cvename>CVE-2011-1690</cvename>
<url>http://secunia.com/advisories/44189</url>
</references>
<dates>
<discovery>2011-04-14</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="6a3c3e5c-66cb-11e0-a116-c535f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt">
<p>The password-changing capability of the MIT krb5 administration
daemon (kadmind) has a bug that can cause it to attempt to free()
an invalid pointer under certain error conditions. This can cause
the daemon to crash or induce the execution of arbitrary code
(which is believed to be difficult). No exploit that executes
arbitrary code is known to exist, but it is easy to trigger a
denial of service manually.</p>
<p>Some platforms detect attempted freeing of invalid pointers and
protectively terminate the process, preventing arbitrary code
execution on those platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0285</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt</url>
</references>
<dates>
<discovery>2011-04-12</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="7edac52a-66cd-11e0-9398-5d45f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt">
<p>The MIT Kerberos 5 Key Distribution Center (KDC) daemon is
vulnerable to a double-free condition if the Public Key
Cryptography for Initial Authentication (PKINIT) capability is
enabled, resulting in daemon crash or arbitrary code execution
(which is believed to be difficult).</p>
<p>An unauthenticated remote attacker can induce a double-free
event, causing the KDC daemon to crash (denial of service),
or to execute arbitrary code. Exploiting a double-free event
to execute arbitrary code is believed to be difficult.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0284</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt</url>
</references>
<dates>
<discovery>2011-03-15</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="4ab413ea-66ce-11e0-bf05-d445f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><le>1.8.4</le></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt">
<p>The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable
to denial of service attacks from unauthenticated remote
attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs
using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9
KDCs.</p>
<p>Exploit code is not known to exist, but the vulnerabilities are
easy to trigger manually. The trigger for CVE-2011-0281 has
already been disclosed publicly, but that fact might not be
obvious to casual readers of the message in which it was
disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283
have not yet been disclosed publicly, but they are also
trivial.</p>
<p>CVE-2011-0281: An unauthenticated remote attacker can cause a KDC
configured with an LDAP back end to become completely unresponsive
until restarted.</p>
<p>CVE-2011-0282: An unauthenticated remote attacker can cause a KDC
configured with an LDAP back end to crash with a null pointer
dereference.</p>
<p>CVE-2011-0283: An unauthenticated remote attacker can cause a
krb5-1.9 KDC with any back end to crash with a null pointer
dereference.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0281</cvename>
<cvename>CVE-2011-0282</cvename>
<cvename>CVE-2011-0283</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="64f24a1e-66cf-11e0-9deb-f345f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-001, kpropd denial of service</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt">
<p>The MIT krb5 KDC database propagation daemon (kpropd) is
vulnerable to a denial-of-service attack triggered by invalid
network input. If a kpropd worker process receives invalid
input that causes it to exit with an abnormal status, it can
cause the termination of the listening process that spawned it,
preventing the slave KDC it was running on from receiving
database updates from the master KDC.</p>
<p>Exploit code is not known to exist, but the vulnerabilities are
easy to trigger manually.</p>
<p>An unauthenticated remote attacker can cause kpropd running in
standalone mode (the "-S" option) to terminate its listening
process, preventing database propagations to the KDC host on
which it was running. Configurations where kpropd runs in
incremental propagation mode ("iprop") or as an inetd server
are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4022</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="2eccb24f-61c0-11e0-b199-0015f2db7bde">
<topic>xrdb -- root hole via rogue hostname</topic>
<affects>
<package>
<name>xrdb</name>
<range><lt>1.0.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Hopf reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html">
<p>By crafting hostnames with shell escape characters, arbitrary
commands can be executed in a root environment when a display
manager reads in the resource database via xrdb.</p>
<p>These specially crafted hostnames can occur in two environments:</p>
<p>Systems are affected are: systems set their hostname via DHCP,
and the used DHCP client allows setting of hostnames with illegal
characters. And systems that allow remote logins via xdmcp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0465</cvename>
<url>http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html</url>
</references>
<dates>
<discovery>2011-04-05</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="a4372a68-652c-11e0-a25a-00151735203a">
<topic>OTRS -- Several XSS attacks possible</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.3.*</gt><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2011-01-en/">
<ul>
<li>Several XSS attacks possible:
An attacker could trick a logged in user to following a prepared
URL inside of the OTRS system which causes a page to be shown that
possibly includes malicious !JavaScript code because of incorrect
escaping during the generation of the HTML page.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1518</cvename>
<url>http://otrs.org/advisory/OSA-2011-01-en/</url>
</references>
<dates>
<discovery>2011-03-12</discovery>
<entry>2011-04-12</entry>
</dates>
</vuln>
<vuln vid="7e69f00d-632a-11e0-9f3a-001d092480a4">
<topic>isc-dhcp-client -- dhclient does not strip or escape shell meta-characters</topic>
<affects>
<package>
<name>isc-dhcp31-client</name>
<range><lt>3.1.ESV_1,1</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0997">
<p>ISC dhclient did not strip or escape certain shell meta-characters
in responses from the dhcp server (like hostname) before passing the
responses on to dhclient-script. Depending on the script and OS,
this can result in execution of exploit code on the client.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0997</cvename>
<certvu>107886</certvu>
</references>
<dates>
<discovery>2011-04-05</discovery>
<entry>2011-04-10</entry>
</dates>
</vuln>
<vuln vid="b9281fb9-61b2-11e0-b1ce-0019d1a7ece2">
<topic>tinyproxy -- ACL lists ineffective when range is configured</topic>
<affects>
<package>
<name>tinyproxy</name>
<range><lt>1.8.2_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When including a line to allow a network of IP addresses, the access to tinyproxy
56 is actually allowed for all IP addresses.</p>
</body>
</description>
<references>
<cvename>CVE-2011-1499</cvename>
<url>https://banu.com/bugzilla/show_bug.cgi?id=90</url>
</references>
<dates>
<discovery>2010-05-18</discovery>
<entry>2011-04-08</entry>
</dates>
</vuln>
<vuln vid="b2a40507-5c88-11e0-9e85-00215af774f0">
<topic>quagga -- two DoS vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.17_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quagga developers report:</p>
<blockquote cite="http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200">
<p>Quagga 0.99.18 has been released.
This release fixes 2 denial of services in bgpd, which can be
remotely triggered by malformed AS-Pathlimit or Extended-Community
attributes. These issues have been assigned CVE-2010-1674 and
CVE-2010-1675. Support for AS-Pathlimit has been removed with this
release.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1674</cvename>
<cvename>CVE-2010-1675</cvename>
<url>http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200</url>
</references>
<dates>
<discovery>2010-04-30</discovery>
<entry>2011-04-01</entry>
</dates>
</vuln>
<vuln vid="c6fbd447-59ed-11e0-8d04-0015f2db7bde">
<topic>gdm -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>2.30.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html">
<p>It was discovered that the GNOME Display Manager (gdm) cleared the cache
directory, which is owned by an unprivileged user, with the privileges of the
root user. A race condition exists in gdm where a local user could take
advantage of this by writing to the cache directory between ending the session
and the signal to clean up the session, which could lead to the execution of
arbitrary code as the root user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0727</cvename>
<url>http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=688323</url>
</references>
<dates>
<discovery>2011-03-28</discovery>
<entry>2011-03-29</entry>
</dates>
</vuln>
<vuln vid="fe853666-56ce-11e0-9668-001fd0d616cf">
<topic>php -- ZipArchive segfault with FL_UNCHANGED on empty archive</topic>
<affects>
<package>
<name>php5-zip</name>
<range><lt>5.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0421">
<p>The _zip_name_locate function in zip_name_locate.c in the Zip extension
in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED
argument, which might allow context-dependent attackers to cause a
denial of service (application crash) via an empty ZIP archive that is
processed with a (1) locateName or (2) statName operation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0421</cvename>
</references>
<dates>
<discovery>2011-03-20</discovery>
<entry>2011-03-25</entry>
</dates>
</vuln>
<vuln vid="cc3bfec6-56cd-11e0-9668-001fd0d616cf">
<topic>php -- crash on crafted tag in exif</topic>
<affects>
<package>
<name>php5-exif</name>
<range><lt>5.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0708">
<p>exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms
performs an incorrect cast, which allows remote attackers to cause a
denial of service (application crash) via an image with a crafted
Image File Directory (IFD) that triggers a buffer over-read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0708</cvename>
</references>
<dates>
<discovery>2011-03-20</discovery>
<entry>2011-03-25</entry>
</dates>
</vuln>
<vuln vid="501ee07a-5640-11e0-985a-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-01.html">
<p>A critical vulnerability exists in Adobe Flash Player
10.2.152.33 and earlier versions (Adobe Flash Player
10.2.154.18 and earlier for Chrome users) for Windows,
Macintosh, Linux and Solaris operating systems, Adobe
Flash Player 10.1.106.16 and earlier versions for Android,
and the Authplay.dll component that ships with Adobe Reader
and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of
Reader and Acrobat for Windows and Macintosh operating systems.</p>
<p>This vulnerability (CVE-2011-0609) could cause a crash and
potentially allow an attacker to take control of the affected
system. There are reports that this vulnerability is being
exploited in the wild in targeted attacks via a Flash (.swf)
file embedded in a Microsoft Excel (.xls) file delivered as
an email attachment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0609</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa11-01.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-03-24</entry>
</dates>
</vuln>
<vuln vid="b2f09169-55af-11e0-9d6f-000f20797ede">
<topic>mozilla -- update to HTTPS certificate blacklist</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.16,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.18,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.16</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.16,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.18</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-11 Update to HTTPS certificate blacklist</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-11.html</url>
</references>
<dates>
<discovery>2011-03-22</discovery>
<entry>2011-03-24</entry>
</dates>
</vuln>
<vuln vid="14a6f516-502f-11e0-b448-bbfa2731f9c7">
<topic>postfix -- plaintext command injection with SMTP over TLS</topic>
<affects>
<package>
<name>postfix</name>
<name>postfix-base</name>
<range><ge>2.7.*,1</ge><lt>2.7.3,1</lt></range>
<range><ge>2.6.*,1</ge><lt>2.6.9,1</lt></range>
<range><ge>2.5.*,2</ge><lt>2.5.12,2</lt></range>
<range><ge>2.4.*,1</ge><lt>2.4.16,1</lt></range>
</package>
<package>
<name>postfix-current</name>
<name>postfix-current-base</name>
<range><lt>2.9.20100120,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wietse Venema has discovered a software flaw that allows
an attacker to inject client commands into an SMTP session
during the unprotected plaintext SMTP protocol phase, such
that the server will execute those commands during the SMTP-
over-TLS protocol phase when all communication is supposed
to be protected.</p>
</body>
</description>
<references>
<cvename>CVE-2011-0411</cvename>
<url>http://www.postfix.org/CVE-2011-0411.html</url>
<url>http://secunia.com/advisories/43646/</url>
</references>
<dates>
<discovery>2011-03-07</discovery>
<entry>2011-03-19</entry>
</dates>
</vuln>
<vuln vid="b13414c9-50ba-11e0-975a-000c29cc39d3">
<topic>hiawatha -- integer overflow in Content-Length header parsing</topic>
<affects>
<package>
<name>hiawatha</name>
<range><lt>7.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hugo Leisink reports:</p>
<blockquote cite="http://www.hiawatha-webserver.org/weblog/16">
<p>A bug has been found in version 7.4 of the Hiawatha webserver,
which could lead to a server crash. This is caused by an integer
overflow in the routine that reads the HTTP request. A too large
value of the Content-Length HTTP header results in an overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hiawatha-webserver.org/weblog/16</url>
<url>http://secunia.com/advisories/43660/</url>
<url>http://securityvulns.com/Zdocument902.html</url>
<url>http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html</url>
<url>http://seclists.org/bugtraq/2011/Mar/65</url>
</references>
<dates>
<discovery>2011-02-25</discovery>
<entry>2011-03-17</entry>
</dates>
</vuln>
<vuln vid="bfe9c75e-5028-11e0-b2d2-00215c6a37bb">
<topic>asterisk -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.17.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://www.venturevoip.com/news.php?rssid=2521">
<p>The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1
resolve two issues:</p>
<ul>
<li>Resource exhaustion in Asterisk Manager Interface
(AST-2011-003)</li>
<li>Remote crash vulnerability in TCP/TLS server
(AST-2011-004)</li>
</ul>
<p>The issues and resolutions are described in the AST-2011-003
and AST-2011-004 security advisories.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-003.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-004.html</url>
</references>
<dates>
<discovery>2011-03-01</discovery>
<entry>2011-03-16</entry>
</dates>
</vuln>
<vuln vid="8b986a05-4dbe-11e0-8b9a-02e0184b8d35">
<topic>avahi -- denial of service</topic>
<affects>
<package>
<name>avahi</name>
<name>avahi-app</name>
<name>avahi-autoipd</name>
<name>avahi-gtk</name>
<name>avahi-libdns</name>
<name>avahi-qt3</name>
<name>avahi-qt4</name>
<name>avahi-sharp</name>
<range><lt>0.6.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Avahi developers reports:</p>
<blockquote cite="http://secunia.com/advisories/43361/">
<p>A vulnerability has been reported in Avahi, which can be exploited
by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error when processing certain
UDP packets, which can be exploited to trigger an infinite loop by
e.g. sending an empty packet to port 5353/UDP.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1002</cvename>
<cvename>CVE-2010-2244</cvename>
<url>http://secunia.com/advisories/43361/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=667187</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2011-03-13</entry>
</dates>
</vuln>
<vuln vid="64691c49-4b22-11e0-a226-00e0815b8da8">
<topic>mailman -- XSS vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707">
<p>Multiple cross-site scripting (XSS) vulnerabilities in
Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote
attackers to inject arbitrary web script or HTML via the (1)
full name or (2) username field in a confirmation message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0707</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html</url>
</references>
<dates>
<discovery>2011-02-13</discovery>
<entry>2011-03-10</entry>
</dates>
</vuln>
<vuln vid="cf96cd8d-48fb-11e0-98a6-0050569b2d21">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><gt>1.0</gt><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Philippe Lang reports:</p>
<blockquote cite="http://www.redmine.org/news/53">
<p>This maintenance release for 1.1.x users includes
13 bug fixes since 1.1.1 and a security fix (XSS
vulnerability affecting all Redmine versions from
1.0.1 to 1.1.1).
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/53</url>
</references>
<dates>
<discovery>2011-03-07</discovery>
<entry>2011-03-07</entry>
</dates>
</vuln>
<vuln vid="e27ca763-4721-11e0-bdc4-001e8c75030d">
<topic>subversion -- remote HTTP DoS vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.6</ge><le>1.6.15</le></range>
<range><ge>1.5</ge><le>1.6.9</le></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><ge>1.6</ge><le>1.6.15</le></range>
<range><ge>1.5</ge><le>1.6.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-0715-advisory.txt">
<p>Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive)
are vulnerable to a remotely triggerable NULL-pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0715</cvename>
</references>
<dates>
<discovery>2011-02-27</discovery>
<entry>2011-03-05</entry>
</dates>
</vuln>
<vuln vid="45f102cd-4456-11e0-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.14,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.17,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.14</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.14,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.17</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>3.1</ge><lt>3.1.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)</p>
<p>MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true</p>
<p>MFSA 2011-03 Use-after-free error in JSON.stringify</p>
<p>MFSA 2011-04 Buffer overflow in JavaScript upvarMap</p>
<p>MFSA 2011-05 Buffer overflow in JavaScript atom map</p>
<p>MFSA 2011-06 Use-after-free error using Web Workers</p>
<p>MFSA 2011-07 Memory corruption during text run construction (Windows)</p>
<p>MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents</p>
<p>MFSA 2011-09 Crash caused by corrupted JPEG image</p>
<p>MFSA 2011-10 CSRF risk with plugins and 307 redirects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1585</cvename>
<cvename>CVE-2011-0051</cvename>
<cvename>CVE-2011-0053</cvename>
<cvename>CVE-2011-0054</cvename>
<cvename>CVE-2011-0055</cvename>
<cvename>CVE-2011-0056</cvename>
<cvename>CVE-2011-0057</cvename>
<cvename>CVE-2011-0058</cvename>
<cvename>CVE-2011-0059</cvename>
<cvename>CVE-2011-0061</cvename>
<cvename>CVE-2011-0062</cvename>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-01.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-02.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-03.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-04.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-05.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-06.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-07.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-08.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-09.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-10.html</url>
</references>
<dates>
<discovery>2011-03-01</discovery>
<entry>2011-03-01</entry>
</dates>
</vuln>
<vuln vid="be3dfe33-410b-11e0-9e02-00215c6a37bb">
<topic>openldap -- two security bypass vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><gt>2.4.0</gt><lt>2.4.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43331/">
<p>Two vulnerabilities have been reported in
OpenLDAP, which can be exploited by malicious
people to bypass certain security restrictions.</p>
<p>The vulnerabilities are reported in versions
prior to 2.4.24.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/43331/</url>
</references>
<dates>
<discovery>2011-02-14</discovery>
<entry>2011-02-25</entry>
</dates>
</vuln>
<vuln vid="65d16342-3ec8-11e0-9df7-001c42d23634">
<topic>asterisk -- Exploitable Stack and Heap Array Overflows</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.39.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.16.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-February/000302.html">
<p>The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and
1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple
heap based arrays can be made to overflow by specially
crafted packets. Systems configured for T.38 pass through or
termination are vulnerable. The issue and resolution are described
in the AST-2011-002 security advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-002.html</url>
<url>http://secunia.com/advisories/43429/</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2011-02-22</entry>
</dates>
</vuln>
<vuln vid="ae0e5835-3cad-11e0-b654-00215c6a37bb">
<topic>PivotX -- administrator password reset vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/175068">
<p>PivotX contains a vulnerability that allows an
attacker to change the password of any account
just by guessing the username. Version 2.2.4 has
been reported to not be affected.
This vulnerability is being exploited in the wild
and users should immediately upgrade to 2.2.5 or
later. Mitigation steps for users that have been
compromised have been posted to the <a href="http://forum.pivotx.net/viewtopic.php?f=2&t=1967">PivotX
Support Community</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1035</cvename>
</references>
<dates>
<discovery>2011-02-18</discovery>
<entry>2011-02-20</entry>
</dates>
</vuln>
<vuln vid="553ec4ed-38d6-11e0-94b1-000c29ba66d2">
<topic>tomcat -- Cross-site scripting vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.32</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.30</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>7.0.0</gt><lt>7.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tomcat security team reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32">
<p>The HTML Manager interface displayed web applciation
provided data, such as display names, without filtering.
A malicious web application could trigger script execution
by an administartive user when viewing the manager pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0013</cvename>
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32</url>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6</url>
</references>
<dates>
<discovery>2010-11-12</discovery>
<entry>2011-02-15</entry>
<modified>2011-09-30</modified>
</dates>
</vuln>
<vuln vid="cd68ff50-362b-11e0-ad36-00215c6a37bb">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.9.2</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
<p>It was possible to create a bookmark which would be executed
unintentionally by other users.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
<p>When the files README, ChangeLog or LICENSE have been removed
from their original place (possibly by the distributor), the
scripts used to display these files can show their full path,
leading to possible further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-11</entry>
</dates>
</vuln>
<vuln vid="4a3482da-3624-11e0-b995-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r152</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-02.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player 10.1.102.64 and earlier versions for
Windows, Macintosh, Linux, and Solaris. These vulnerabilities
could cause the application to crash and could potentially
allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0558</cvename>
<cvename>CVE-2011-0559</cvename>
<cvename>CVE-2011-0560</cvename>
<cvename>CVE-2011-0561</cvename>
<cvename>CVE-2011-0571</cvename>
<cvename>CVE-2011-0572</cvename>
<cvename>CVE-2011-0573</cvename>
<cvename>CVE-2011-0574</cvename>
<cvename>CVE-2011-0575</cvename>
<cvename>CVE-2011-0577</cvename>
<cvename>CVE-2011-0578</cvename>
<cvename>CVE-2011-0607</cvename>
<cvename>CVE-2011-0608</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-02.html</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-11</entry>
</dates>
</vuln>
<vuln vid="53bde960-356b-11e0-8e81-0022190034c0">
<topic>mupdf -- Remote System Access</topic>
<affects>
<package>
<name>mupdf</name>
<range><lt>0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43020/">
<p>The vulnerability is caused due to an error within the
"closedctd()" function in fitz/filt_dctd.c when processing PDF
files containing certain malformed JPEG images. This can be
exploited to cause a stack corruption by e.g. tricking a user
into opening a specially crafted PDF file.</p>
</blockquote>
</body>
</description>
<references>
<bid>46027</bid>
<url>http://secunia.com/advisories/43020/</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="1cae628c-3569-11e0-8e81-0022190034c0">
<topic>rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability</topic>
<affects>
<package>
<name>rubygem-mail</name>
<range><lt>2.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43077/">
<p>Input passed via an email from address is not properly sanitised
in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb)
before being used as a command line argument. This can be exploited
to inject arbitrary shell commands.</p>
</blockquote>
</body>
</description>
<references>
<bid>46021</bid>
<cvename>CVE-2011-0739</cvename>
<url>http://secunia.com/advisories/43077/</url>
<url>http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1</url>
</references>
<dates>
<discovery>2011-01-25</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="7c492ea2-3566-11e0-8e81-0022190034c0">
<topic>plone -- Remote Security Bypass</topic>
<affects>
<package>
<name>plone</name>
<range><ge>2.5</ge><lt>3</lt></range>
</package>
<package>
<name>plone3</name>
<range><ge>3</ge><le>3.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone developer reports:</p>
<blockquote cite="http://plone.org/products/plone/security/advisories/cve-2011-0720">
<p>This is an escalation of privileges attack that can be used by
anonymous users to gain access to a Plone site's administration
controls, view unpublished content, create new content and modify a
site's skin. The sandbox protecting access to the underlying
system is still in place, and it does not grant access to other
applications running on the same Zope instance.</p>
</blockquote>
</body>
</description>
<references>
<bid>46102</bid>
<cvename>CVE-2011-0720</cvename>
<url>http://plone.org/products/plone/security/advisories/cve-2011-0720</url>
</references>
<dates>
<discovery>2011-02-02</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="44ccfab0-3564-11e0-8e81-0022190034c0">
<topic>exim -- local privilege escalation</topic>
<affects>
<package>
<name>exim</name>
<name>exim-ldap</name>
<name>exim-ldap2</name>
<name>exim-mysql</name>
<name>exim-postgresql</name>
<name>exim-sa-exim</name>
<range><lt>4.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>exim.org reports:</p>
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74">
<p>CVE-2011-0017 - check return value of setuid/setgid. This is a
privilege escalation vulnerability whereby the Exim run-time user
can cause root to append content of the attacker's choosing to
arbitrary files.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0017</cvename>
<url>ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74</url>
</references>
<dates>
<discovery>2011-01-31</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="f2b43905-3545-11e0-8e81-0022190034c0">
<topic>openoffice.org -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openoffice.org</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenOffice.org Security Team reports:</p>
<blockquote cite="http://www.openoffice.org/security/bulletin.html">
<p>Fixed in OpenOffice.org 3.3</p>
<ul>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html">
CVE-2010-2935 / CVE-2010-2936</a>: Security Vulnerability in OpenOffice.org related to PowerPoint document processing</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3450.html">
CVE-2010-3450</a>: Security Vulnerability in OpenOffice.org related to Extensions and filter package files</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html">
CVE-2010-3451 / CVE-2010-3452</a>: Security Vulnerability in OpenOffice.org related to RTF document processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html">
CVE-2010-3453 / CVE-2010-3454</a>: Security Vulnerability in OpenOffice.org related to Word document processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3689.html">
CVE-2010-3689</a>: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html">
CVE-2010-3702 / CVE-2010-3704</a>: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html">
CVE-2010-4008 / CVE-2010-4494</a>: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2 </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4253.html">
CVE-2010-4253</a>: Security Vulnerability in OpenOffice.org related to PNG file processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4643.html">
CVE-2010-4643</a>: Security Vulnerability in OpenOffice.org related to TGA file processing </li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/bulletin.html</url>
<url>http://secunia.com/advisories/40775/</url>
</references>
<dates>
<discovery>2010-08-04</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="35ecdcbe-3501-11e0-afcd-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vurnabilities.</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405">
<p>This release has essentially security fixes. Refer to the
WebKit/gtk/NEWS file inside the tarball for details. We would like
to thank the Red Hat security team (Huzaifa Sidhpurwala in
particular) and Michael Gilbert from Debian for their help in
checking (and pushing!) security issues affecting the WebKitGTK+
stable branch for this release.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2901</cvename>
<cvename>CVE-2010-4040</cvename>
<cvename>CVE-2010-4042</cvename>
<cvename>CVE-2010-4199</cvename>
<cvename>CVE-2010-4492</cvename>
<cvename>CVE-2010-4493</cvename>
<cvename>CVE-2010-4578</cvename>
<cvename>CVE-2011-0482</cvename>
<cvename>CVE-2011-0778</cvename>
<url>https://bugs.webkit.org/show_bug.cgi?id=48328</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50710</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50840</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50932</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=51993</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=53265</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=53276</url>
<url>http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="ce6ce2f8-34ac-11e0-8103-00215c6a37bb">
<topic>awstats -- arbitrary commands execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.0,1</lt></range>
</package>
<package>
<name>awstats-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Awstats change log reports:</p>
<blockquote cite="http://awstats.sourceforge.net/docs/awstats_changelog.txt">
<ul>
<li>Security fix (Traverse directory of LoadPlugin)</li>
<li>Security fix (Limit config to defined directory
to avoid access to external config file via a nfs
or webdav link).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4367</cvename>
<url>http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html</url>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
</references>
<dates>
<discovery>2010-05-01</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="2eda0c54-34ab-11e0-8103-00215c6a37bb">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>11.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1101/">
<p>Opera 11.01 is a recommended upgrade offering security and
stability enhancements.</p>
<p>The following security vulnerabilities have been fixed:</p>
<ul>
<li>Removed support for "<code>javascript:</code>" URLs in
CSS -o-link values, to make it easier for sites to filter
untrusted CSS.</li>
<li>Fixed an issue where large form inputs could allow
execution of arbitrary code, as reported by Jordi Chancel;
see our <a href="http://www.opera.com/support/kb/view/982/">advisory</a>.</li>
<li>Fixed an issue which made it possible to carry out
clickjacking attacks against internal opera: URLs;
see our <a href="http://www.opera.com/support/kb/view/983/">advisory</a>.</li>
<li>Fixed issues which allowed web pages to gain limited
access to files on the user's computer; see our
<a href="http://www.opera.com/support/kb/view/984/">advisory</a>.</li>
<li>Fixed an issue where email passwords were not immediately
deleted when deleting private data; see our
<a href="http://www.opera.com/support/kb/view/986/">advisory</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0450</cvename>
<cvename>CVE-2011-0681</cvename>
<cvename>CVE-2011-0682</cvename>
<cvename>CVE-2011-0683</cvename>
<cvename>CVE-2011-0684</cvename>
<cvename>CVE-2011-0685</cvename>
<cvename>CVE-2011-0686</cvename>
<cvename>CVE-2011-0687</cvename>
<url>http://www.opera.com/support/kb/view/982/</url>
<url>http://www.opera.com/support/kb/view/983/</url>
<url>http://www.opera.com/support/kb/view/984/</url>
<url>http://secunia.com/advisories/43023</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="bd760627-3493-11e0-8103-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.5</lt></range>
<range><gt>1.1</gt><lt>1.1.4</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>15470,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2011/feb/08/security/">
<p>Today the Django team is issuing multiple releases --
Django 1.2.5 and Django 1.1.4 -- to remedy three security
issues reported to us. All users of affected versions of
Django are urged to upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.djangoproject.com/weblog/2011/feb/08/security/</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-09</entry>
</dates>
</vuln>
<vuln vid="8d04cfbd-344d-11e0-8669-0025222482c5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Medawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html">
<p>An arbitrary script inclusion vulnerability was discovered. The
vulnerability only allows execution of files with names ending in
".php" which are already present in the local filesystem. Only servers
running Microsoft Windows and possibly Novell Netware are affected.
Despite these mitigating factors, all users are advised to upgrade,
since there is a risk of complete server compromise. MediaWiki 1.8.0
and later is affected.</p>
<p>Security researcher mghack discovered a CSS injection
vulnerability. For Internet Explorer and similar browsers, this is
equivalent to an XSS vulnerability, that is to say, it allows the
compromise of wiki user accounts. For other browsers, it allows private
data such as IP addresses and browsing patterns to be sent to a malicious
external web server. It affects all versions of MediaWiki. All users are
advised to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0047</cvename>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27094</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27093</url>
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html</url>
</references>
<dates>
<discovery>2011-02-01</discovery>
<entry>2011-02-09</entry>
</dates>
</vuln>
<vuln vid="8c93e997-30e0-11e0-b300-485d605f4717">
<topic>wordpress -- SQL injection vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.0.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vendor reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
<p>SQL injection vulnerability in the do_trackbacks function in
wp-includes/comment.php in WordPress before 3.0.2 allows remote
authenticated users to execute arbitrary SQL commands via the Send
Trackbacks field.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4257</cvename>
<url>http://www.cvedetails.com/cve/CVE-2010-4257/</url>
</references>
<dates>
<discovery>2010-11-16</discovery>
<entry>2011-02-05</entry>
<modified>2011-02-09</modified>
</dates>
</vuln>
<vuln vid="f9258873-2ee2-11e0-afcd-0015f2db7bde">
<topic>vlc -- Insufficient input validation in MKV demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>1.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VLC team reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1102.html">
<p>When parsing an invalid MKV (Matroska or WebM) file, input
validation are insufficient.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1102.html</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-02</entry>
</dates>
</vuln>
<vuln vid="8015600f-2c80-11e0-9cc1-00163e5bf4f9">
<topic>maradns -- denial of service when resolving a long DNS hostname</topic>
<affects>
<package>
<name>maradns</name>
<range><lt>1.4.06</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MaraDNS developer Sam Trenholme reports:</p>
<blockquote cite="http://samiam.org/blog/20110129.html">
<p>... a mistake in allocating an array of integers, allocating it
in bytes instead of sizeof(int) units. This resulted in a buffer
being too small, allowing it to be overwritten. The impact of this
programming error is that MaraDNS can be crashed by sending
MaraDNS a single "packet of death". Since the data placed in the
overwritten array cannot be remotely controlled (it is a list of
increasing integers), there is no way to increase privileges
exploiting this bug.</p>
</blockquote>
</body>
</description>
<references>
<bid>45966</bid>
<cvename>CVE-2011-0520</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834</url>
</references>
<dates>
<discovery>2011-01-23</discovery>
<entry>2011-01-31</entry>
</dates>
</vuln>
<vuln vid="dc9f8335-2b3b-11e0-a91b-00e0815b8da8">
<topic>isc-dhcp-server -- DHCPv6 crash</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><le>4.1.2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0413">
<p>When the DHCPv6 server code processes a message for an address
that was previously declined and internally tagged as abandoned
it can trigger an assert failure resulting in the server crashing.
This could be used to crash DHCPv6 servers remotely. This issue
only affects DHCPv6 servers. DHCPv4 servers are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0413</cvename>
<url>http://www.isc.org/software/dhcp/advisories/cve-2011-0413</url>
<url>http://www.kb.cert.org/vuls/id/686084</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-01-28</entry>
</dates>
</vuln>
<vuln vid="c8c927e5-2891-11e0-8f26-00151735203a">
<topic>bugzilla -- multiple serious vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.14.*</ge><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.9/">
<p>This advisory covers three security issues that have recently been
fixed in the Bugzilla code:</p>
<ul>
<li>A weakness in Bugzilla could allow a user to gain unauthorized
access to another Bugzilla account.</li>
<li>A weakness in the Perl CGI.pm module allows injecting HTTP
headers and content to users via several pages in Bugzilla.</li>
<li>If you put a harmful "javascript:" or "data:" URL into
Bugzilla's "URL" field, then there are multiple situations in
which Bugzilla will unintentionally make that link clickable.</li>
<li>Various pages lack protection against cross-site request
forgeries.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<bid>25425</bid>
<cvename>CVE-2010-4568</cvename>
<cvename>CVE-2010-2761</cvename>
<cvename>CVE-2010-4411</cvename>
<cvename>CVE-2010-4572</cvename>
<cvename>CVE-2010-4567</cvename>
<cvename>CVE-2010-0048</cvename>
<cvename>CVE-2011-0046</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621591</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619594</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=591165</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621572</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619588</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=628034</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621090</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621105</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621107</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621108</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621109</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621110</url>
</references>
<dates>
<discovery>2011-01-24</discovery>
<entry>2011-01-25</entry>
</dates>
</vuln>
<vuln vid="7580f00e-280c-11e0-b7c8-00215c6a37bb">
<topic>dokuwiki -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20101107a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dokuwiki reports:</p>
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2136">
<p>This security update fixes problems in the XMLRPC
interface where ACLs where not checked correctly
sometimes, making it possible to access and write
information that should not have been accessible/writable.
This only affects users who have enabled the XMLRPC
interface (default is off) and have enabled XMLRPC
access for users who can't access/write all content
anyway (default is nobody, see <a href="http://www.dokuwiki.org/config:xmlrpcuser">http://www.dokuwiki.org/config:xmlrpcuser</a>
for details).</p>
<p>This update also includes a fix for a problem in
the general ACL checking function that could be exploited
to gain access to restricted pages and media files in rare
conditions (when you had rights for an id you could get
the same rights on ids where one character has been
replaced by a ".").</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.dokuwiki.org/index.php?do=details&task_id=2136</url>
</references>
<dates>
<discovery>2011-01-16</discovery>
<entry>2011-01-24</entry>
</dates>
</vuln>
<vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30">
<topic>asterisk -- Exploitable Stack Buffer Overflow</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.39.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html">
<p>The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an
outgoing SIP request while in pedantic mode, which can cause a stack
buffer to be made to overflow if supplied with carefully crafted
caller ID information. The issue and resolution are described in the
AST-2011-001 security advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url>
</references>
<dates>
<discovery>2011-01-18</discovery>
<entry>2011-01-19</entry>
</dates>
</vuln>
<vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8">
<topic>tarsnap -- cryptographic nonce reuse</topic>
<affects>
<package>
<name>tarsnap</name>
<range><ge>1.0.22</ge><le>1.0.27</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html">
<p>In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value
is not incremented after each chunk is encrypted. (The CTR counter
is correctly incremented after each 16 bytes of data was processed,
but this counter is reset to zero for each new chunk.)</p>
<p>Note that since the Tarsnap client-server protocol is encrypted,
being able to intercept Tarsnap client-server traffic does not
provide an attacker with access to the data.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html</url>
</references>
<dates>
<discovery>2011-01-18</discovery>
<entry>2011-01-19</entry>
</dates>
</vuln>
<vuln vid="4c017345-1d89-11e0-bbee-0014a5e3cda6">
<topic>MoinMoin -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MoinMoin developers reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES">
<p>Fix XSS in Despam action (CVE-2010-0828)</p>
</blockquote>
<blockquote cite="http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg">
<p>Fix XSS issues</p>
<ul>
<li>by escaping template name in messages</li>
<li>by fixing other places that had similar issues</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>39110</bid>
<cvename>CVE-2010-0828</cvename>
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES</url>
<url>http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg</url>
</references>
<dates>
<discovery>2010-04-05</discovery>
<entry>2011-01-11</entry>
</dates>
</vuln>
<vuln vid="38bdf10e-2293-11e0-bfa4-001676740879">
<topic>tor -- remote code execution and crash</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.1.29</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.2.21.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Jan-2011/msg00000.html">
<p>A remote heap overflow vulnerability that can allow remote
code execution. Other fixes address a variety of assert and crash
bugs, most of which we think are hard to exploit remotely.
All Tor users should upgrade.</p>
</blockquote>
</body>
</description>
<references>
<bid>45832</bid>
<cvename>CVE-2011-0427</cvename>
<freebsdpr>ports/154099</freebsdpr>
<mlist msgid="20110117155813.GG3300@moria.seul.org">http://archives.seul.org/or/announce/Jan-2011/msg00000.html</mlist>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
</references>
<dates>
<discovery>2011-01-15</discovery>
<entry>2011-01-17</entry>
</dates>
</vuln>
<vuln vid="908f4cf2-1e8b-11e0-a587-001b77d09812">
<topic>sudo -- local privilege escalation</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.7.0</ge><lt>1.7.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group_pw.html">
<p>Beginning with sudo version 1.7.0 it has been possible
to grant permission to run a command using a specified
group via sudo's -g option (run as group), if allowed by
the sudoers file. A flaw exists in sudo's password
checking logic that allows a user to run a command
with only the group changed without being prompted
for a password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0010</cvename>
<url>http://www.sudo.ws/sudo/alerts/runas_group_pw.html</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</url>
</references>
<dates>
<discovery>2011-01-11</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="71612099-1e93-11e0-a587-001b77d09812">
<topic>subversion -- multiple DoS</topic>
<affects>
<package>
<name>subversion</name>
<range><lt>1.6.15</lt></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Entry for CVE-2010-4539 says:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4539">
<p>The walk function in repos.c in the mod_dav_svn module
for the Apache HTTP Server, as distributed in Apache
Subversion before 1.6.15, allows remote authenticated
users to cause a denial of service (NULL pointer
dereference and daemon crash) via vectors that trigger
the walking of SVNParentPath collections.</p>
</blockquote>
<p>Entry for CVE-2010-4644 says:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4644">
<p>Multiple memory leaks in rev_hunt.c in Apache Subversion
before 1.6.15 allow remote authenticated users to cause
a denial of service (memory consumption and daemon crash)
via the -g option to the blame command.</p>
</blockquote>
</body>
</description>
<references>
<bid>45655</bid>
<cvename>CVE-2010-4539</cvename>
<cvename>CVE-2010-4644</cvename>
</references>
<dates>
<discovery>2011-01-02</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="2b6ed5c7-1a7f-11e0-b61d-000c29d1636d">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.5</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers reports:</p>
<blockquote cite="http://www.php.net/releases/5_3_5.php">
<p>Security Enhancements and Fixes in PHP 5.3.5:</p>
<ul>
<li>Fixed bug #53632 (PHP hangs on numeric value
2.2250738585072011e-308). (CVE-2010-4645)</li>
</ul>
</blockquote>
<blockquote cite="http://www.php.net/releases/5_2_17.php">
<p>Security Enhancements and Fixes in PHP 5.2.17:</p>
<ul>
<li>Fixed bug #53632 (PHP hangs on numeric value
2.2250738585072011e-308). (CVE-2010-4645)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4645</cvename>
</references>
<dates>
<discovery>2011-01-06</discovery>
<entry>2011-01-09</entry>
<modified>2011-01-09</modified>
</dates>
</vuln>
<vuln vid="e4fcf020-0447-11e0-becc-0022156e8794">
<topic>exim -- local privilege escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Woodhouse reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3">
<p>Secondly a privilege escalation where the trusted 'exim'
user is able to tell Exim to use arbitrary config files,
in which further ${run ...} commands will be invoked as
root.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4345</cvename>
<url>http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-08</entry>
</dates>
</vuln>
<vuln vid="e177c410-1943-11e0-9d1c-000c29ba66d2">
<topic>mediawiki -- Clickjacking vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><gt>1.16</gt><lt>1.16.1</lt></range>
<range><gt>1.15</gt><lt>1.15.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clickjacking vulnerabilities:</p>
<blockquote cite="https://bugzilla.wikimedia.org/show_bug.cgi?id=26561">
<p>Clickjacking is a type of vulnerability discovered in 2008, which
is similar to CSRF. The attack involves displaying the target webpage
in a iframe embedded in a malicious website. Using CSS, the submit button
of the form on the targeit webpage is made invisible, and then overlaid
with some button or link on the malicious website that encourages
the user to click on it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=26561</url>
</references>
<dates>
<discovery>2011-01-04</discovery>
<entry>2011-01-06</entry>
</dates>
</vuln>
<vuln vid="06a12e26-142e-11e0-bea2-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
<p>The patches to fix the following CVEs are included with help
from Huzaifa Sidhpurwala from the Red Hat security team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1791</cvename>
<cvename>CVE-2010-3812</cvename>
<cvename>CVE-2010-3813</cvename>
<cvename>CVE-2010-4197</cvename>
<cvename>CVE-2010-4198</cvename>
<cvename>CVE-2010-4204</cvename>
<cvename>CVE-2010-4206</cvename>
<cvename>CVE-2010-4577</cvename>
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
</references>
<dates>
<discovery>2010-12-28</discovery>
<entry>2010-12-30</entry>
</dates>
</vuln>
<vuln vid="14a37474-1383-11e0-8a58-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.4</lt></range>
<range><gt>1.1</gt><lt>1.1.3</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>15032,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2010/dec/22/security/">
<p>Today the Django team is issuing multiple releases
-- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 --
to remedy two security issues reported to us. All users
of affected versions of Django are urged to upgrade
immediately.</p>
<h3>Information leakage in Django administrative interface</h3>
<p>The Django administrative interface, django.contrib.admin
supports filtering of displayed lists of objects by fields
on the corresponding models, including across database-level
relationships. This is implemented by passing lookup arguments
in the querystring portion of the URL, and options on the
ModelAdmin class allow developers to specify particular
fields or relationships which will generate automatic links
for filtering.</p>
<h3>Denial-of-service attack in password-reset mechanism</h3>
<p>Django's bundled authentication framework,
django.contrib.auth, offers views which allow users to
reset a forgotten password. The reset mechanism involves
generating a one-time token composed from the user's ID,
the timestamp of the reset request converted to a base36
integer, and a hash derived from the user's current password
hash (which will change once the reset is complete, thus
invalidating the token).</p>
</blockquote>
</body>
</description>
<references>
<bid>45562</bid>
<bid>45563</bid>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=665373</url>
<url>http://secunia.com/advisories/42715/</url>
</references>
<dates>
<discovery>2010-12-22</discovery>
<entry>2010-12-29</entry>
</dates>
</vuln>
<vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794">
<topic>Drupal Views plugin -- cross-site scripting</topic>
<affects>
<package>
<name>drupal6-views</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal security team reports:</p>
<blockquote cite="http://drupal.org/node/999380">
<p>The Views module provides a flexible method for Drupal site
designers to control how lists and tables of content are
presented. Under certain circumstances, Views could display
parts of the page path without escaping, resulting in a
relected Cross Site Scripting (XSS) vulnerability. An attacker
could exploit this to gain full administrative access.</p>
<p>Mitigating factors: This vulnerability only occurs with a
specific combination of configuration options for a specific
View, but this combination is used in the default Views
provided by some additional modules. A malicious user would
need to get an authenticated administrative user to visit a
specially crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4521</cvename>
<url>http://drupal.org/node/999380</url>
</references>
<dates>
<discovery>2010-12-15</discovery>
<entry>2010-12-28</entry>
</dates>
</vuln>
<vuln vid="584c506d-0e98-11e0-b59b-0050569b2d21">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Philippe Lang reports:</p>
<blockquote cite="http://www.redmine.org/news/49">
<p>This release also fixes 3 security issues reported by
joernchen of Phenoelit:</p>
<ul>
<li>logged in users may be able to access private data
(affected versions: 1.0.x)</li>
<li>persistent XSS vulnerability in textile formatter
(affected versions: all previous releases)</li>
<li>remote command execution in bazaar repository adapter
(affected versions: 0.9.x, 1.0.x)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/49</url>
</references>
<dates>
<discovery>2010-12-23</discovery>
<entry>2010-12-23</entry>
</dates>
</vuln>
<vuln vid="4bd33bc5-0cd6-11e0-bfa4-001676740879">
<topic>tor -- remote crash and potential remote code execution</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.1.28</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.2.20-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Dec-2010/msg00000.html">
<p>Remotely exploitable bug that could be used to crash instances
of Tor remotely by overflowing on the heap. Remote-code execution
hasn't been confirmed, but can't be ruled out. Everyone should
upgrade.</p>
</blockquote>
</body>
</description>
<references>
<bid>45500</bid>
<cvename>CVE-2010-1676</cvename>
<freebsdpr>ports/153326</freebsdpr>
<mlist msgid="20101220135830.GU3300@moria.seul.org">http://archives.seul.org/or/announce/Dec-2010/msg00000.html</mlist>
<mlist msgid="20101220141526.GS3255@moria.seul.org">http://archives.seul.org/or/talk/Dec-2010/msg00167.html</mlist>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
</references>
<dates>
<discovery>2010-12-17</discovery>
<entry>2010-12-22</entry>
</dates>
</vuln>
<vuln vid="d560b346-08a2-11e0-bcca-0050568452ac">
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
<affects>
<package>
<name>yahoo-ui</name>
<range><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The YUI team reports:</p>
<blockquote cite="http://yuilibrary.com/support/2.8.2/">
<p>A security-related defect was introduced in the YUI 2 Flash
component infrastructure beginning with the YUI 2.4.0 release.
This defect allows JavaScript injection exploits to be created
against domains that host affected YUI .swf files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4207</cvename>
<cvename>CVE-2010-4208</cvename>
<cvename>CVE-2010-4209</cvename>
<url>http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/</url>
<url>http://secunia.com/advisories/41955</url>
<url>http://www.openwall.com/lists/oss-security/2010/11/07/1</url>
<url>http://yuilibrary.com/support/2.8.2/</url>
</references>
<dates>
<discovery>2010-10-25</discovery>
<entry>2010-12-15</entry>
</dates>
</vuln>
<vuln vid="2a41233d-10e7-11e0-becc-0022156e8794">
<topic>php-zip -- multiple Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>php5-zip</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-zip</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS conditions in Zip extension
were fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<ul>
<li>
<blockquote cite="http://www.php.net/releases/5_3_4.php">
<p>Fixed crash in zip extract method (possible
CWE-170).</p>
</blockquote>
</li>
<li>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3709">
<p>The ZipArchive::getArchiveComment function
in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3
allows context-dependent attackers to cause a denial
of service (NULL pointer dereference and application
crash) via a crafted ZIP archive.</p>
</blockquote>
</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2010-3709</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
<url>http://securityreason.com/achievement_securityalert/90</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="c623f058-10e7-11e0-becc-0022156e8794">
<topic>php-filter -- Denial of Service</topic>
<affects>
<package>
<name>php5-filter</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-filter</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS condition in filter extension
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3710">
<p>Stack consumption vulnerability in the filter_var
function in PHP 5.2.x through 5.2.14 and 5.3.x through
5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows
remote attackers to cause a denial of service (memory
consumption and application crash) via a long e-mail
address string.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3710</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="1a0704e7-0edf-11e0-becc-0022156e8794">
<topic>php-imap -- Denial of Service</topic>
<affects>
<package>
<name>php5-imap</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-imap</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS condition in IMAP extension
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<blockquote cite="http://securitytracker.com/alerts/2010/Nov/1024761.html">
<p>A remote user can send specially crafted IMAP user name
or password data to trigger a double free memory error
in 'ext/imap/php_imap.c' and cause the target service
to crash.</p>
<p>It may be possible to execute arbitrary code.
However, code execution was not confirmed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4150</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="da3d381b-0ee6-11e0-becc-0022156e8794">
<topic>pecl-phar -- format string vulnerability</topic>
<affects>
<package>
<name>pecl-phar</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Entry for CVE-2010-2094 says:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094">
<p>Multiple format string vulnerabilities in the phar
extension in PHP 5.3 before 5.3.2 allow context-dependent
attackers to obtain sensitive information (memory
contents) and possibly execute arbitrary code via a
crafted phar:// URI that is not properly handled by the
(1) phar_stream_flush, (2) phar_wrapper_unlink,
(3) phar_parse_url, or (4) phar_wrapper_open_url functions
in ext/phar/stream.c; and the (5) phar_wrapper_open_dir
function in ext/phar/dirstream.c, which triggers errors
in the php_stream_wrapper_log_error function.</p>
</blockquote>
<p>PECL source code for PHAR extension shares the same code,
so it is vulnerable too.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2094</cvename>
<url>http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html</url>
<url>http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="3761df02-0f9c-11e0-becc-0022156e8794">
<topic>php -- NULL byte poisoning</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP-specific version of NULL-byte poisoning was briefly
described by ShAnKaR:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded">
<p>Poison NULL byte vulnerability for perl CGI applications
was described in
<a href="http://artofhacking.com/files/phrack/phrack55/P55-07.TXT">[1]</a>.
ShAnKaR noted, that same vulnerability also affects
different PHP applications.</p>
</blockquote>
<p>PHP developers report that branch 5.3 received a fix:</p>
<blockquote cite="http://www.php.net/releases/5_3_4.php">
<p>Paths with NULL in them (foo\0bar.txt) are now considered
as invalid (CVE-2006-7243).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-7243</cvename>
<url>http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded</url>
<url>http://artofhacking.com/files/phrack/phrack55/P55-07.TXT</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
<modified>2012-11-25</modified>
</dates>
</vuln>
<vuln vid="73634294-0fa7-11e0-becc-0022156e8794">
<topic>php -- open_basedir bypass</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3436">
<p>fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow
remote attackers to bypass open_basedir restrictions via
vectors related to the length of a filename.</p>
</blockquote>
</body>
</description>
<references>
<bid>44723</bid>
<cvename>CVE-2010-3436</cvename>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="f3148a05-0fa7-11e0-becc-0022156e8794">
<topic>php -- corruption of $GLOBALS and $this variables via extract() method</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Off-by-one error in the sanity validator for the extract()
method allowed attackers to replace the values of $GLOBALS
and $this when mode EXTR_OVERWRITE was used.</p>
</body>
</description>
<references>
<url>http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="6887828f-0229-11e0-b84d-00262d5ed8ee">
<cancelled/>
</vuln>
<vuln vid="b2a6fc0e-070f-11e0-a6e9-00215c6a37bb">
<cancelled/>
</vuln>
<vuln vid="1d8ff4a2-0445-11e0-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.13,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.16,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.13</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.13,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.16</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>3.1</ge><lt>3.1.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.11</lt></range>
<range><ge>3.1</ge><lt>3.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)</p>
<p>MFSA 2010-75 Buffer overflow while line breaking after document.write with long string</p>
<p>MFSA 2010-76 Chrome privilege escalation with window.open and isindex element</p>
<p>MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree</p>
<p>MFSA 2010-78 Add support for OTS font sanitizer</p>
<p>MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh</p>
<p>MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver</p>
<p>MFSA 2010-81 Integer overflow vulnerability in NewIdArray</p>
<p>MFSA 2010-82 Incomplete fix for CVE-2010-0179</p>
<p>MFSA 2010-83 Location bar SSL spoofing using network error page</p>
<p>MFSA 2010-84 XSS hazard in multiple character encodings</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3766</cvename>
<cvename>CVE-2010-3767</cvename>
<cvename>CVE-2010-3768</cvename>
<cvename>CVE-2010-3769</cvename>
<cvename>CVE-2010-3770</cvename>
<cvename>CVE-2010-3771</cvename>
<cvename>CVE-2010-3772</cvename>
<cvename>CVE-2010-3773</cvename>
<cvename>CVE-2010-3774</cvename>
<cvename>CVE-2010-3775</cvename>
<cvename>CVE-2010-3776</cvename>
<cvename>CVE-2010-3777</cvename>
<cvename>CVE-2010-3778</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-74.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-75.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-76.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-77.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-78.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-79.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-80.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-81.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-82.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-83.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-84.html</url>
</references>
<dates>
<discovery>2010-12-09</discovery>
<entry>2010-12-10</entry>
</dates>
</vuln>
<vuln vid="4ccbd40d-03f7-11e0-bf50-001a926c7637">
<topic>krb5 -- client impersonation vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 KDC may issue tickets not requested
by a client, based on an attacker-chosen KrbFastArmoredReq.</p>
<p>An authenticated remote attacker that controls a legitimate service
principal could obtain a valid service ticket to itself containing
valid KDC-generated authorization data for a client whose TGS-REQ it
has intercepted. The attacker could then use this ticket for
S4U2Proxy to impersonate the targeted client even if the client
never authenticated to the subverted service. The vulnerable
configuration is believed to be rare.</p>
</blockquote>
</body>
</description>
<references>
<bid>45122</bid>
<cvename>CVE-2010-4021</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69607</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="1d193bba-03f6-11e0-bf50-001a926c7637">
<topic>krb5 -- RFC 3961 key-derivation checksum handling vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 (releases incorrectly accepts RFC 3961
key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
and AD-KDC-ISSUED authorization data.</p>
<p>An authenticated remote attacker that controls a legitimate service
principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
if the TGT key is RC4, allowing it to use self-generated "evidence"
tickets for S4U2Proxy, instead of tickets obtained from the user or
with S4U2Self. Configurations using RC4 for the TGT key are
believed to be rare.</p>
<p>An authenticated remote attacker has a 1/256 chance of forging
AD-KDC-ISSUED signatures on authdata elements in tickets having
an RC4 service key, resulting in privilege escalation against
a service that relies on these signatures. There are no known
uses of the KDC-ISSUED authdata container at this time.</p>
</blockquote>
</body>
</description>
<references>
<bid>45117</bid>
<cvename>CVE-2010-4020</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69608</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="9f971cea-03f5-11e0-bf50-001a926c7637">
<topic>krb5 -- unkeyed PAC checksum handling vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 incorrectly accepts an unkeyed checksum for PAC
signatures.</p>
<p>An authenticated remote attacker can forge PACs if using a KDC that
does not filter client-provided PAC data. This can result in
privilege escalation against a service that relies on PAC contents
to make authorization decisions.</p>
</blockquote>
</body>
</description>
<references>
<bid>45116</bid>
<cvename>CVE-2010-1324</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69609</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="0d57c1d9-03f4-11e0-bf50-001a926c7637">
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb incorrectly accepts an unkeyed
checksum with DES session keys for version 2 (RFC 4121)
of the GSS-API krb5 mechanism.</p>
<p>An unauthenticated remote attacker can forge GSS tokens that are
intended to be integrity-protected but unencrypted, if the targeted
pre-existing application session uses a DES session key.</p>
<p>MIT krb5 KDC incorrectly accepts RFC
3961 key-derivation checksums using RC4 keys when verifying the
req-checksum in a KrbFastArmoredReq.</p>
<p>An unauthenticated remote attacker has a 1/256 chance of swapping a
client-issued KrbFastReq into a different KDC-REQ, if the armor
key is RC4. The consequences are believed to be minor.</p>
</blockquote>
</body>
</description>
<references>
<bid>45116</bid>
<cvename>CVE-2010-1324</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69609</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="11bbccbc-03ee-11e0-bcdb-001fc61c2a55">
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.3.0</ge><lt>1.7.2</lt></range>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 clients incorrectly accept an unkeyed checksums
in the SAM-2 preauthentication challenge.</p>
<p>An unauthenticated remote attacker could alter a SAM-2 challenge,
affecting the prompt text seen by the user or the kind of response
sent to the KDC. Under some circumstances, this can negate the
incremental security benefit of using a single-use authentication
mechanism token.</p>
<p>MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums
using RC4 keys when verifying KRB-SAFE messages.</p>
<p>An unauthenticated remote attacker has a 1/256 chance of forging
KRB-SAFE messages in an application protocol if the targeted
pre-existing session uses an RC4 session key. Few application
protocols use KRB-SAFE messages.</p>
</blockquote>
</body>
</description>
<references>
<bid>45118</bid>
<cvename>CVE-2010-1323</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69610</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="ed7fa1b4-ff59-11df-9759-080027284eaa">
<topic>proftpd -- Compromised source packages backdoor</topic>
<affects>
<package>
<name>proftpd</name>
<range><eq>1.3.3c_2</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ProFTPD Project team reports:</p>
<blockquote cite="http://proftpd.org/">
<p>The security issue is caused due to the distribution of compromised
ProFTPD 1.3.3c source code packages via the project's main FTP server
and all of the mirror servers, which contain a backdoor allowing
remote root access.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org</url>
<url>http://secunia.com/advisories/42449</url>
</references>
<dates>
<discovery>2010-11-28</discovery>
<entry>2010-12-04</entry>
</dates>
</vuln>
<vuln vid="753f8185-5ba9-42a4-be02-3f55ee580093">
<topic>phpMyAdmin -- XSS attack in database search</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.8.1</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php">
<p>It was possible to conduct a XSS attack using spoofed request on the
db search script.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/152685</freebsdpr>
<freebsdpr>ports/152686</freebsdpr>
<cvename>CVE-2010-4329</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php</url>
</references>
<dates>
<discovery>2010-11-29</discovery>
<entry>2010-11-30</entry>
</dates>
</vuln>
<vuln vid="f154a3c7-f7f4-11df-b617-00e0815b8da8">
<topic>isc-dhcp-server -- Empty link-address denial of service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><ge>4.1.0</ge><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2010-3611">
<p>If the server receives a DHCPv6 packet containing one or more
Relay-Forward messages, and none of them supply an address in the
Relay-Forward link-address field, then the server will crash. This
can be used as a single packet crash attack vector.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3611</cvename>
<url>http://www.isc.org/software/dhcp/advisories/cve-2010-3611</url>
<url>http://www.kb.cert.org/vuls/id/102047</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-24</entry>
</dates>
</vuln>
<vuln vid="373e412e-f748-11df-96cd-0015f2db7bde">
<topic>OpenTTD -- Denial of service (server/client) via invalid read</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>1.0.0</ge><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2010-4168">
<p>When a client disconnects, without sending the "quit" or
"client error" message, the server has a chance of reading and
writing a just freed piece of memory. The writing can only
happen while the server is sending the map. Depending on what
happens directly after freeing the memory there is a chance of
segmentation fault, and thus a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4168</cvename>
<url>http://security.openttd.org/en/CVE-2010-4168</url>
</references>
<dates>
<discovery>2010-11-20</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="a3314314-f731-11df-a757-0011098ad87f">
<topic>horde-base -- XSS: VCARD attachments vulnerability</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/532">
<p>The major changes compared to Horde version 3.3.10 are:</p>
<p>* Fixed XSS vulnerability when viewing details of a vCard.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/532</url>
<url>http://bugs.horde.org/ticket/9357</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
<topic>proftpd -- remote code execution vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.3c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tippingpoint reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
<p>This vulnerability allows remote attackers to execute arbitrary
code on vulnerable installations of ProFTPD. Authentication is not
required to exploit this vulnerability.</p>
<p>The flaw exists within the proftpd server component which
listens by default on TCP port 21. When reading user input if a
TELNET_IAC escape sequence is encountered the process
miscalculates a buffer length counter value allowing a user
controlled copy of data to a stack buffer. A remote attacker can
exploit this vulnerability to execute arbitrary code under the
context of the proftpd process.</p>
</blockquote>
</body>
</description>
<references>
<bid>44562</bid>
<cvename>CVE-2010-4221</cvename>
<url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
<topic>openssl -- TLS extension parsing race condition</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20101116.txt">
<p>Rob Hulswit has found a flaw in the OpenSSL TLS server extension
code parsing which on affected servers can be exploited in a buffer
overrun attack.</p>
<p>Any OpenSSL based TLS server is vulnerable if it is multi-threaded
and uses OpenSSL's internal caching mechanism. Servers that are
multi-process and/or disable internal session caching are NOT
affected.</p>
<p>In particular the Apache HTTP server (which never uses OpenSSL
internal caching) and Stunnel (which includes its own workaround)
are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3864</cvename>
<url>http://openssl.org/news/secadv_20101116.txt</url>
</references>
<dates>
<discovery>2010-10-08</discovery>
<entry>2010-11-17</entry>
</dates>
</vuln>
<vuln vid="76b597e4-e9c6-11df-9e10-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r289</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-26.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player 10.1.85.3 and earlier versions for
Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player
10.1.95.1 for Android. These vulnerabilities, including
CVE-2010-3654 referenced in Security Advisory APSA10-05,
could cause the application to crash and could potentially
allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3636</cvename>
<cvename>CVE-2010-3637</cvename>
<cvename>CVE-2010-3638</cvename>
<cvename>CVE-2010-3639</cvename>
<cvename>CVE-2010-3640</cvename>
<cvename>CVE-2010-3641</cvename>
<cvename>CVE-2010-3642</cvename>
<cvename>CVE-2010-3643</cvename>
<cvename>CVE-2010-3644</cvename>
<cvename>CVE-2010-3645</cvename>
<cvename>CVE-2010-3646</cvename>
<cvename>CVE-2010-3647</cvename>
<cvename>CVE-2010-3648</cvename>
<cvename>CVE-2010-3649</cvename>
<cvename>CVE-2010-3650</cvename>
<cvename>CVE-2010-3652</cvename>
<cvename>CVE-2010-3654</cvename>
<cvename>CVE-2010-3676</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-26.html</url>
<url>http://www.adobe.com/support/security/advisories/apsa10-05.html</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-11-06</entry>
</dates>
</vuln>
<vuln vid="b2eaa7c2-e64a-11df-bc65-0022156e8794">
<topic>Wireshark -- DoS in the BER-based dissectors</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41535">
<p>A vulnerability has been discovered in Wireshark, which can
be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an infinite recursion
error in the "dissect_unknown_ber()" function in
epan/dissectors/packet-ber.c and can be exploited to cause a
stack overflow e.g. via a specially crafted SNMP packet.</p>
<p>The vulnerability is confirmed in version 1.4.0 and
reported in version 1.2.11 and prior and version 1.4.0 and
prior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3445</cvename>
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html</url>
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html</url>
</references>
<dates>
<discovery>2010-09-16</discovery>
<entry>2010-11-05</entry>
</dates>
</vuln>
<vuln vid="4ab29e12-e787-11df-adfa-00e0815b8da8">
<topic>Mailman -- cross-site scripting in web interface</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41265">
<p>Two vulnerabilities have been reported in Mailman, which
can be exploited by malicious users to conduct script
insertion attacks.</p>
<p>Certain input passed via the list descriptions is not
properly sanitised before being displayed to the user. This
can be exploited to insert arbitrary HTML and script code,
which will be executed in a user's browser session in context
of an affected site when the malicious data is being
viewed.</p>
<p>Successful exploitation requires "list owner" permissions.</p>
</blockquote>
</body>
</description>
<references>
<bid>43187</bid>
<cvename>CVE-2010-3089</cvename>
<url>http://secunia.com/advisories/41265</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-11-03</entry>
</dates>
</vuln>
<vuln vid="96e776c7-e75c-11df-8f26-00151735203a">
<topic>OTRS -- Multiple XSS and denial of service vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.3.*</gt><lt>2.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2010-02-en/">
<ul>
<li>Multiple Cross Site Scripting issues:
Missing HTML quoting allows authenticated agents or
customers to inject HTML tags. This vulnerability
allows an attacker to inject script code into the OTRS
web-interface which will be loaded and executed
in the browsers of system users.</li>
<li>Possible Denial of Service Attack:
Perl's regular expressions consume 100% CPU time
on the server if an agent or customer views an affected
article. To exploit this vulnerability the malicious user
needs to send extremely large HTML emails to your
system address.</li>
</ul>
</blockquote>
<blockquote cite="http://otrs.org/advisory/OSA-2010-03-en/">
<p>AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:</p>
<p>Whenever a customer sends an HTML e-mail and RichText is enabled
in OTRS, javascript contained in the email can do everything
in the OTRS agent interface that the agent himself could do.</p>
<p>Most relevant is that this type of exploit can be used in such
a way that the agent won't even detect he is being exploited.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2080</cvename>
<cvename>CVE-2010-4071</cvename>
<url>http://otrs.org/advisory/OSA-2010-02-en/</url>
<url>http://otrs.org/advisory/OSA-2010-03-en/</url>
</references>
<dates>
<discovery>2010-09-15</discovery>
<entry>2010-11-03</entry>
</dates>
</vuln>
<vuln vid="c223b00d-e272-11df-8e32-000f20797ede">
<topic>mozilla -- Heap buffer overflow mixing document.write and DOM insertion</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.12,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.15,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.12</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.12,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.15</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.0.10</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.10</lt></range>
<range><ge>3.1</ge><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3765</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-73.html</url>
</references>
<dates>
<discovery>2010-10-27</discovery>
<entry>2010-10-28</entry>
</dates>
</vuln>
<vuln vid="aab187d4-e0f3-11df-b1ea-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Desktop Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1063/">
<ul>
<li>Fixed an issue that allowed cross-domain checks to be bypassed,
allowing limited data theft using CSS, as reported by Isaac
Dawson.</li>
<li>Fixed an issue where manipulating the window could be used to
spoof the page address.</li>
<li>Fixed an issue with reloads and redirects that could allow
spoofing and cross-site scripting.</li>
<li>Fixed an issue that allowed private video streams to be
intercepted, as reported by Nirankush Panchbhai of Microsoft
Vulnerability Research.</li>
<li>Fixed an issue that caused JavaScript to run in the wrong
security context after manual interaction.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/971/</url>
<url>http://www.opera.com/support/kb/view/972/</url>
<url>http://www.opera.com/support/kb/view/973/</url>
<url>http://www.opera.com/support/kb/view/974/</url>
<url>http://www.opera.com/support/kb/view/976/</url>
</references>
<dates>
<discovery>2010-10-12</discovery>
<entry>2010-10-26</entry>
</dates>
</vuln>
<vuln vid="0ddb57a9-da20-4e99-b048-4366092f3d31">
<topic>bzip2 -- integer overflow vulnerability</topic>
<affects>
<package>
<name>bzip2</name>
<range><lt>1.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41452">
<p>A vulnerability has been reported in bzip2, which can be exploited by
malicious people to cause a DoS (Denial of Service) or potentially
compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an integer overflow in the
"BZ2_decompress()" function in decompress.c and can be exploited to
cause a crash or potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-10:08.bzip2</freebsdsa>
<freebsdpr>ports/151364</freebsdpr>
<cvename>CVE-2010-0405</cvename>
<bid>43331</bid>
<mlist>http://www.openwall.com/lists/oss-security/2010/09/21/4</mlist>
<url>http://secunia.com/advisories/41452</url>
</references>
<dates>
<discovery>2010-09-21</discovery>
<entry>2010-10-25</entry>
</dates>
</vuln>
<vuln vid="18dc48fe-ca42-11df-aade-0050568f000c">
<topic>FreeBSD -- Integer overflow in bzip2 decompression</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.4</ge><lt>6.4_11</lt></range>
<range><ge>7.1</ge><lt>7.1_14</lt></range>
<range><ge>7.3</ge><lt>7.3_3</lt></range>
<range><ge>8.0</ge><lt>8.0_5</lt></range>
<range><ge>8.1</ge><lt>8.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When decompressing data, the run-length encoded values are not
adequately sanity-checked, allowing for an integer overflow.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:08.bzip2</freebsdsa>
</references>
<dates>
<discovery>2010-09-20</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="7a09a8df-ca41-11df-aade-0050568f000c">
<topic>FreeBSD -- Lost mbuf flag resulting in data corruption</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.1</ge><lt>7.1_13</lt></range>
<range><ge>7.3</ge><lt>7.3_2</lt></range>
<range><ge>8.0</ge><lt>8.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The read-only flag is not correctly copied when a mbuf buffer
reference is duplicated. When the sendfile(2) system call is used to
transmit data over the loopback interface, this can result in the
backing pages for the transmitted file being modified, causing data
corruption.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:07.mbuf</freebsdsa>
</references>
<dates>
<discovery>2010-07-13</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0dc91089-ca41-11df-aade-0050568f000c">
<topic>FreeBSD -- Unvalidated input in nfsclient</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.2</ge><lt>7.2_8</lt></range>
<range><ge>7.3</ge><lt>7.3_1</lt></range>
<range><ge>8.0</ge><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The NFS client subsystem fails to correctly validate the length of a
parameter provided by the user when a filesystem is mounted.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:06.nfsclient</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="768cfe70-ca40-11df-aade-0050568f000c">
<topic>FreeBSD -- OPIE off-by-one stack overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.4</ge><lt>6.4_10</lt></range>
<range><ge>7.1</ge><lt>7.1_12</lt></range>
<range><ge>7.2</ge><lt>7.2_8</lt></range>
<range><ge>7.3</ge><lt>7.3_1</lt></range>
<range><ge>8.0</ge><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the OPIE library could allow an off-by-one
buffer overflow to write a single zero byte beyond the end of an
on-stack buffer.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:05.opie</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="f6eb2279-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- Insufficient environment sanitization in jail(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>8.0</ge><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The jail(8) utility does not change the current working directory
while imprisoning. The current working directory can be accessed by
its descendants.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:04.jail</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="97f09f2f-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- ZFS ZIL playback with insecure permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.1</ge><lt>7.1_10</lt></range>
<range><ge>7.2</ge><lt>7.2_6</lt></range>
<range><ge>8.0</ge><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When replaying setattr transaction, the replay code would set the
attributes with certain insecure defaults, when the logged
transaction did not touch these attributes.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:03.zfs</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="48103b0a-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- ntpd mode 7 denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_15</lt></range>
<range><ge>6.4</ge><lt>6.4_9</lt></range>
<range><ge>7.1</ge><lt>7.1_10</lt></range>
<range><ge>7.2</ge><lt>7.2_6</lt></range>
<range><ge>8.0</ge><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If ntpd receives a mode 7 (MODE_PRIVATE) request or error response
from a source address not listed in either a 'restrict ... noquery'
or a 'restrict ... ignore' section it will log the even and send a
mode 7 error response.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:02.ntpd</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="e500b9bf-ca3e-11df-aade-0050568f000c">
<topic>FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_15</lt></range>
<range><ge>6.4</ge><lt>6.4_9</lt></range>
<range><ge>7.1</ge><lt>7.1_10</lt></range>
<range><ge>7.2</ge><lt>7.2_6</lt></range>
<range><ge>8.0</ge><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If a client requests DNSSEC records with the Checking Disabled (CD)
flag set, BIND may cache the unvalidated responses. These responses
may later be returned to another client that has not set the CD
flag.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:01.bind</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6e87b696-ca3e-11df-aade-0050568f000c">
<topic>FreeBSD -- Inappropriate directory permissions in freebsd-update(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_14</lt></range>
<range><ge>6.4</ge><lt>6.4_8</lt></range>
<range><ge>7.1</ge><lt>7.1_9</lt></range>
<range><ge>7.2</ge><lt>7.2_5</lt></range>
<range><ge>8.0</ge><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When downloading updates to FreeBSD via 'freebsd-update fetch' or
'freebsd-update upgrade', the freebsd-update(8) utility copies
currently installed files into its working directory
(/var/db/freebsd-update by default) both for the purpose of merging
changes to configuration files and in order to be able to roll back
installed updates.</p>
<p>The default working directory used by freebsd-update(8) is normally
created during the installation of FreeBSD with permissions which
allow all local users to see its contents, and freebsd-update(8) does
not take any steps to restrict access to files stored in said
directory.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:17.freebsd-update</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ad08d14b-ca3d-11df-aade-0050568f000c">
<topic>FreeBSD -- Improper environment sanitization in rtld(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.1</ge><lt>7.1_9</lt></range>
<range><ge>7.2</ge><lt>7.2_5</lt></range>
<range><ge>8.0</ge><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When running setuid programs rtld will normally remove potentially
dangerous environment variables. Due to recent changes in FreeBSD
environment variable handling code, a corrupt environment may
result in attempts to unset environment variables failing.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:16.rtld</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="406779fd-ca3b-11df-aade-0050568f000c">
<topic>FreeBSD -- SSL protocol flaw</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_14</lt></range>
<range><ge>6.4</ge><lt>6.4_8</lt></range>
<range><ge>7.1</ge><lt>7.1_9</lt></range>
<range><ge>7.2</ge><lt>7.2_5</lt></range>
<range><ge>8.0</ge><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SSL version 3 and TLS protocols support session
renegotiation without cryptographically tying the new
session parameters to the old parameters.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:15.ssl</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c9a6ae4a-df8b-11df-9573-00262d5ed8ee">
<topic>monotone -- remote denial of service in default setup</topic>
<affects>
<package>
<name>monotone</name>
<range><lt>0.48.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The monotone developers report:</p>
<blockquote cite="http://www.monotone.ca/NEWS">
<p>Running "mtn ''" or "mtn ls ''" doesn't cause an internal
error anymore. In monotone 0.48 and earlier this behavior
could be used to crash a server remotely (but only if it was
configured to allow execution of remote commands).</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/151665</freebsdpr>
<url>http://www.monotone.ca/NEWS</url>
<url>http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/</url>
</references>
<dates>
<discovery>2010-10-21</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="c4f067b9-dc4a-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.11,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.14,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.11</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.11,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.9</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.9</lt></range>
<range><ge>3.1</ge><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)</p>
<p>MFSA 2010-65 Buffer overflow and memory corruption using document.write</p>
<p>MFSA 2010-66 Use-after-free error in nsBarProp</p>
<p>MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter</p>
<p>MFSA 2010-68 XSS in gopher parser when parsing hrefs</p>
<p>MFSA 2010-69 Cross-site information disclosure via modal calls</p>
<p>MFSA 2010-70 SSL wildcard certificate matching IP addresses</p>
<p>MFSA 2010-71 Unsafe library loading vulnerabilities</p>
<p>MFSA 2010-72 Insecure Diffie-Hellman key exchange</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3170</cvename>
<cvename>CVE-2010-3173</cvename>
<cvename>CVE-2010-3174</cvename>
<cvename>CVE-2010-3175</cvename>
<cvename>CVE-2010-3176</cvename>
<cvename>CVE-2010-3177</cvename>
<cvename>CVE-2010-3178</cvename>
<cvename>CVE-2010-3179</cvename>
<cvename>CVE-2010-3180</cvename>
<cvename>CVE-2010-3181</cvename>
<cvename>CVE-2010-3182</cvename>
<cvename>CVE-2010-3183</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-64.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-65.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-66.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-67.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-68.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-69.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-70.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-71.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-72.html</url>
</references>
<dates>
<discovery>2010-10-19</discovery>
<entry>2010-10-20</entry>
</dates>
</vuln>
<vuln vid="e5090d2a-dbbe-11df-82f8-0015f2db7bde">
<topic>Webkit-gtk2 -- Multiple Vulnabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
<p>The patches to fix the following CVEs are included with help from
Vincent Danen and other members of the Red Hat security team:</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1780</cvename>
<cvename>CVE-2010-1807</cvename>
<cvename>CVE-2010-1812</cvename>
<cvename>CVE-2010-1814</cvename>
<cvename>CVE-2010-1815</cvename>
<cvename>CVE-2010-3113</cvename>
<cvename>CVE-2010-3114</cvename>
<cvename>CVE-2010-3115</cvename>
<cvename>CVE-2010-3116</cvename>
<cvename>CVE-2010-3255</cvename>
<cvename>CVE-2010-3257</cvename>
<cvename>CVE-2010-3259</cvename>
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
</references>
<dates>
<discovery>2010-10-01</discovery>
<entry>2010-10-19</entry>
</dates>
</vuln>
<vuln vid="dd943fbb-d0fe-11df-95a8-00219b0fc4d8">
<topic>apr -- multiple vunerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.2.1.3.10</lt></range>
</package>
<package>
<name>apr0</name>
<range><lt>0.9.19.0.9.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41701">
<p>Multiple vulnerabilities have been reported in APR-util, which can
be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>Two XML parsing vulnerabilities exist in the bundled version of
expat.</p>
<p>An error within the "apr_brigade_split_line()" function in
buckets/apr_brigade.c can be exploited to cause high memory
consumption.</p>
</blockquote>
</body>
</description>
<references>
<bid>43673</bid>
<cvename>CVE-2009-3560</cvename>
<cvename>CVE-2009-3720</cvename>
<cvename>CVE-2010-1623</cvename>
<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
<url>http://secunia.com/advisories/41701</url>
</references>
<dates>
<discovery>2010-10-02</discovery>
<entry>2010-10-06</entry>
<modified>2010-10-20</modified>
</dates>
</vuln>
<vuln vid="99021f88-ca3c-11df-be21-00e018aa7788">
<topic>phpmyfaq -- cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2010-09-28.php">
<p>The phpMyFAQ Team has learned of a security issue that has been
discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize
some variables in different pages correctly. With a
properly crafted URL it is e.g. possible to inject
JavaScript code into the output of a page, which could
result in the leakage of domain cookies (f.e. session
identifiers)..</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/151055</freebsdpr>
<url>http://www.phpmyfaq.de/advisory_2010-09-28.php</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-10-02</entry>
</dates>
</vuln>
<vuln vid="e08c596e-cb28-11df-9c1b-0011098ad87f">
<topic>horde-gollem -- XSS vulnerability</topic>
<affects>
<package>
<name>horde-gollem</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/523">
<p>The major changes compared to Gollem version H3 (1.1.1) are:</p>
<p>* Fixed an XSS vulnerability in the file viewer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/523</url>
<url>http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&r1=1.114.2.55&r2=1.114.2.59&ty=h</url>
<url>http://bugs.horde.org/ticket/9191</url>
</references>
<dates>
<discovery>2010-08-21</discovery>
<entry>2010-09-28</entry>
</dates>
</vuln>
<vuln vid="6c4db192-cb23-11df-9c1b-0011098ad87f">
<topic>horde-imp -- XSS vulnerability</topic>
<affects>
<package>
<name>horde-imp</name>
<range><gt>4.2,1</gt><lt>4.3.8,1</lt></range>
<range><lt>4.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/516">
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
vulnerability.</p>
<p>The major changes compared to IMP version H3 (4.3.7) are:</p>
<p>* Fixed an XSS vulnerability in the Fetchmail configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/516</url>
<url>http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-09-28</entry>
<modified>2011-09-23</modified>
</dates>
</vuln>
<vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f">
<topic>horde-base -- XSS and CSRF vulnerabilities</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515">
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
vulnerability.</p>
<p>Thanks to Secunia for releasing an advisory for the new CSRF
protection in the preference interface</p>
<p>The major changes compared to Horde version 3.3.8 are:</p>
<p>* Fixed XSS vulnerability in util/icon_browser.php.</p>
<p>* Protected preference forms against CSRF attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/515</url>
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h</url>
<url>http://secunia.com/advisories/39860/</url>
<url>http://holisticinfosec.org/content/view/145/45/</url>
</references>
<dates>
<discovery>2010-06-03</discovery>
<entry>2010-09-28</entry>
</dates>
</vuln>
<vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1">
<topic>openx -- remote code execution vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenX project reported:</p>
<blockquote cite="http://blog.openx.org/09/security-update/">
<p>It has been brought to our attention that there is a vulnerability
in the 2.8 downloadable version of OpenX that can result in a server
running the downloaded version of OpenX being compromised.</p>
</blockquote>
<p>This vulnerability exists in the file upload functionality
and allows attackers to upload and execute PHP code of
their choice.</p>
</body>
</description>
<references>
<url>http://blog.openx.org/09/security-update/</url>
<url>http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-09-26</entry>
</dates>
</vuln>
<vuln vid="e4dac715-c818-11df-a92c-0015587e2cc1">
<topic>squid -- Denial of service vulnerability in request handling</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.1</ge><lt>3.0.25_3</lt></range>
<range><ge>3.1.0.1</ge><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2010:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_3.txt">
<p>Due to an internal error in string handling Squid is
vulnerable to a denial of service attack when processing
specially crafted requests.</p>
<p>This problem allows any trusted client to perform a
denial of service attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3072</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2010_3.txt</url>
</references>
<dates>
<discovery>2010-08-30</discovery>
<entry>2010-09-24</entry>
</dates>
</vuln>
<vuln vid="8a34d9e6-c662-11df-b2e1-001b2134ef46">
<topic>linux-flashplugin -- remote code execution</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r283</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa10-03.html">
<p>A critical vulnerability exists in Adobe Flash Player
10.1.82.76 and earlier versions for Windows, Macintosh,
Linux, Solaris, and Adobe Flash Player 10.1.92.10 for
Android. This vulnerability also affects Adobe Reader
9.3.4 and earlier versions for Windows, Macintosh and
UNIX, and Adobe Acrobat 9.3.4 and earlier versions for
Windows and Macintosh. This vulnerability (CVE-2010-2884)
could cause a crash and potentially allow an attacker
to take control of the affected system. There are
reports that this vulnerability is being actively
exploited in the wild against Adobe Flash Player on
Windows. Adobe is not aware of any attacks exploiting
this vulnerability against Adobe Reader or Acrobat to
date.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2884</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa10-03.html</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-09-22</entry>
</dates>
</vuln>
<vuln vid="3ff95dd3-c291-11df-b0dc-00215c6a37bb">
<topic>django -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.2</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>13698,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">
<p>The provided template tag for inserting the CSRF
token into forms -- {% csrf_token %} -- explicitly
trusts the cookie value, and displays it as-is.
Thus, an attacker who is able to tamper with the
value of the CSRF cookie can cause arbitrary content
to be inserted, unescaped, into the outgoing HTML of
the form, enabling cross-site scripting (XSS) attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>43116</bid>
<cvename>CVE-2010-3082</cvename>
<url>http://xforce.iss.net/xforce/xfdb/61729</url>
</references>
<dates>
<discovery>2010-09-13</discovery>
<entry>2010-09-17</entry>
</dates>
</vuln>
<vuln vid="9bcfd7b6-bcda-11df-9a6a-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8">
<p>With help from Vincent Danen and other members of the Red Hat
security team, the following CVE's where fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1781</cvename>
<cvename>CVE-2010-1782</cvename>
<cvename>CVE-2010-1784</cvename>
<cvename>CVE-2010-1785</cvename>
<cvename>CVE-2010-1786</cvename>
<cvename>CVE-2010-1787</cvename>
<cvename>CVE-2010-1788</cvename>
<cvename>CVE-2010-1790</cvename>
<cvename>CVE-2010-1792</cvename>
<cvename>CVE-2010-1793</cvename>
<cvename>CVE-2010-2647</cvename>
<cvename>CVE-2010-2648</cvename>
<cvename>CVE-2010-3119</cvename>
<url>http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8</url>
</references>
<dates>
<discovery>2010-09-07</discovery>
<entry>2010-09-10</entry>
</dates>
</vuln>
<vuln vid="f866d2af-bbba-11df-8a8d-0008743bf21a">
<topic>vim6 -- heap-based overflow while parsing shell metacharacters</topic>
<affects>
<package>
<name>vim6</name>
<name>vim6+ruby</name>
<range><ge>6.2.429</ge><lt>6.3.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Description for CVE-2008-3432 says:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432">
<p>Heap-based buffer overflow in the mch_expand_wildcards
function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted
attackers to execute arbitrary code via shell metacharacters
in filenames, as demonstrated by the netrw.v3 test case.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3432</cvename>
<url>http://www.openwall.com/lists/oss-security/2008/07/15/4</url>
</references>
<dates>
<discovery>2008-07-31</discovery>
<entry>2010-09-09</entry>
</dates>
</vuln>
<vuln vid="4a21ce2c-bb13-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.9,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.12,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.9</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.9,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.12</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.7</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)</p>
<p>MFSA 2010-50 Frameset integer overflow vulnerability</p>
<p>MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array</p>
<p>MFSA 2010-52 Windows XP DLL loading vulnerability</p>
<p>MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText</p>
<p>MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection</p>
<p>MFSA 2010-55 XUL tree removal crash and remote code execution</p>
<p>MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView</p>
<p>MFSA 2010-57 Crash and remote code execution in normalizeDocument</p>
<p>MFSA 2010-58 Crash on Mac using fuzzed font in data: URL</p>
<p>MFSA 2010-59 SJOW creates scope chains ending in outer object</p>
<p>MFSA 2010-60 XSS using SJOW scripted function</p>
<p>MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute</p>
<p>MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS</p>
<p>MFSA 2010-63 Information leak via XMLHttpRequest statusText</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2762</cvename>
<cvename>CVE-2010-2763</cvename>
<cvename>CVE-2010-2764</cvename>
<cvename>CVE-2010-2765</cvename>
<cvename>CVE-2010-2766</cvename>
<cvename>CVE-2010-2767</cvename>
<cvename>CVE-2010-2768</cvename>
<cvename>CVE-2010-2769</cvename>
<cvename>CVE-2010-2770</cvename>
<cvename>CVE-2010-2760</cvename>
<cvename>CVE-2010-3131</cvename>
<cvename>CVE-2010-3166</cvename>
<cvename>CVE-2010-3167</cvename>
<cvename>CVE-2010-3168</cvename>
<cvename>CVE-2010-3169</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-49.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-50.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-51.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-52.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-53.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-54.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-55.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-56.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-57.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-58.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-59.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-60.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-61.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-62.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-63.html</url>
</references>
<dates>
<discovery>2010-09-07</discovery>
<entry>2010-09-08</entry>
<modified>2010-09-15</modified>
</dates>
</vuln>
<vuln vid="67b514c3-ba8f-11df-8f6e-000c29a67389">
<topic>sudo -- Flaw in Runas group matching</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.7.0</ge><lt>1.7.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group.html">
<p>Beginning with sudo version 1.7.0 it has been possible to grant
permission to run a command using a specified group via sudo -g
option (run as group). A flaw exists in the logic that matches
Runas groups in the sudoers file when the -u option is also
specified (run as user). This flaw results in a positive match for
the user specified via -u so long as the group specified via -g
is allowed by the sudoers file.</p>
<p>Exploitation of the flaw requires that Sudo be configured with
sudoers entries that contain a Runas group. Entries that do not
contain a Runas group, or only contain a Runas user are not
affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2956</cvename>
<url>http://www.sudo.ws/sudo/alerts/runas_group.html</url>
</references>
<dates>
<discovery>2010-09-07</discovery>
<entry>2010-09-07</entry>
</dates>
</vuln>
<vuln vid="29b7e3f4-b6a9-11df-ae63-f255a795cb21">
<topic>lftp -- multiple HTTP client download filename vulnerability</topic>
<affects>
<package>
<name>lftp</name>
<range><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The get1 command, as used by lftpget, in LFTP before 4.0.6 does
not properly validate a server-provided filename before determining
the destination filename of a download, which allows remote servers
to create or overwrite arbitrary files via a Content-Disposition
header that suggests a crafted filename, and possibly execute
arbitrary code as a consequence of writing to a dotfile in a home
directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2251</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=591580</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-09-03</entry>
</dates>
</vuln>
<vuln vid="d754b7d2-b6a7-11df-826c-e464a695cb21">
<topic>wget -- multiple HTTP client download filename vulnerability</topic>
<affects>
<package>
<name>wget</name>
<name>wget-devel</name>
<range><le>1.12_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Wget version 1.12 and earlier uses a server-provided filename
instead of the original URL to determine the destination filename of
a download, which allows remote servers to create or overwrite
arbitrary files via a 3xx redirect to a URL with a .wgetrc filename
followed by a 3xx redirect to a URL with a crafted filename, and
possibly execute arbitrary code as a consequence of writing to a
dotfile in a home directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2252</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=602797</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-09-03</entry>
</dates>
</vuln>
<vuln vid="3a7c5fc4-b50c-11df-977b-ecc31dd8ad06">
<topic>p5-libwww -- possibility to remote servers to create file with a .(dot) character</topic>
<affects>
<package>
<name>p5-libwww</name>
<range><lt>5.835</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lwp-download in libwww-perl before 5.835 does not reject downloads
to filenames that begin with a `.' (dot) character, which allows
remote servers to create or overwrite files via a 3xx redirect to a
URL with a crafted filename or a Content-Disposition header that
suggests a crafted filename, and possibly execute arbitrary code as
a consequence of writing to a dotfile in a home directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2253</cvename>
<url>http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-08-31</entry>
</dates>
</vuln>
<vuln vid="167953a4-b01c-11df-9a98-0015587e2cc1">
<topic>quagga -- stack overflow and DoS vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat security team reported two vulnerabilities:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/08/24/3">
<p>A stack buffer overflow flaw was found in the way Quagga's bgpd
daemon processed Route-Refresh messages. A configured
Border Gateway Protocol (BGP) peer could send a
Route-Refresh message with specially-crafted Outbound
Route Filtering (ORF) record, which would cause the
master BGP daemon (bgpd) to crash or, possibly, execute
arbitrary code with the privileges of the user running
bgpd.</p>
<p>A NULL pointer dereference flaw was found in the way
Quagga's bgpd daemon parsed paths of autonomous systems
(AS). A configured BGP peer could send a BGP update AS
path request with unknown AS type, which could lead to
denial of service (bgpd daemon crash).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2010/08/24/3</url>
<url>http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100</url>
</references>
<dates>
<discovery>2010-08-24</discovery>
<entry>2010-08-25</entry>
</dates>
</vuln>
<vuln vid="8cbf4d65-af9a-11df-89b8-00151735203a">
<topic>bugzilla -- information disclosure, denial of service</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>2.17.1</gt><lt>3.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.7/">
<ul>
<li>Remote Information Disclosure:
An unprivileged user is normally not allowed to view
other users' group membership. But boolean charts
let the user use group-based pronouns, indirectly
disclosing group membership. This security fix
restricts the use of pronouns to groups the user
belongs to.</li>
<li>Notification Bypass:
Normally, when a user is impersonated, he receives
an email informing him that he is being impersonated,
containing the identity of the impersonator. However,
it was possible to impersonate a user without this
notification being sent.</li>
<li>Remote Information Disclosure:
An error message thrown by the "Reports" and "Duplicates"
page confirmed the non-existence of products, thus
allowing users to guess confidential product names.
(Note that the "Duplicates" page was not vulnerable
in Bugzilla 3.6rc1 and above though.)</li>
<li>Denial of Service:
If a comment contained the phrases "bug X" or
"attachment X", where X was an integer larger than the
maximum 32-bit signed integer size, PostgreSQL would
throw an error, and any page containing that comment would
not be viewable. On most Bugzillas, any user can enter
a comment on any bug, so any user could have used this to
deny access to one or all bugs. Bugzillas running on
databases other than PostgreSQL are not affected.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2756</cvename>
<cvename>CVE-2010-2757</cvename>
<cvename>CVE-2010-2758</cvename>
<cvename>CVE-2010-2759</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=417048</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=450013</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=577139</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=519835</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=583690</url>
</references>
<dates>
<discovery>2010-08-05</discovery>
<entry>2010-08-24</entry>
</dates>
</vuln>
<vuln vid="b6069837-aadc-11df-82df-0015f2db7bde">
<topic>OpenTTD -- Denial of service (server) via infinite loop</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>1.0.1</ge><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2010-2534">
<p>When multiple commands are queued (at the server) for execution
in the next game tick and an client joins the server can get into
an infinite loop. With the default settings triggering this bug
is difficult (if not impossible), however the larger value of
the "frame_freq" setting is easier it is to trigger the bug.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2534</cvename>
<url>http://security.openttd.org/en/CVE-2010-2534</url>
</references>
<dates>
<discovery>2010-06-27</discovery>
<entry>2010-08-22</entry>
</dates>
</vuln>
<vuln vid="67a1c3ae-ad69-11df-9be6-0015587e2cc1">
<topic>corkscrew -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>corkscrew</name>
<range><le>2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The affected corkscrew versions use sscanf calls without proper
bounds checking. In the authentication file parsing routine
this can cause an exploitable buffer overflow condition.
A similar but issue exists in the server response code but
appears to be non-exploitable.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt</url>
</references>
<dates>
<discovery>2010-08-21</discovery>
<entry>2010-08-21</entry>
</dates>
</vuln>
<vuln vid="274922b8-ad20-11df-af1f-00e0814cab4e">
<topic>phpmyadmin -- Several XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.5.1</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
<p>It was possible to conduct a XSS attack using crafted URLs org
POST parameters on several pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3056</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php</url>
</references>
<dates>
<discovery>2010-08-09</discovery>
<entry>2010-08-21</entry>
</dates>
</vuln>
<vuln vid="68c7187a-abd2-11df-9be6-0015587e2cc1">
<topic>slim -- insecure PATH assignment</topic>
<affects>
<package>
<name>slim</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SLiM assigns logged on users a PATH in which the current
working directory ("./") is included. This PATH can allow
unintentional code execution through planted binaries and
has therefore been fixed SLiM version 1.3.2.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2945</cvename>
<url>http://seclists.org/oss-sec/2010/q3/198</url>
</references>
<dates>
<discovery>2010-05-12</discovery>
<entry>2010-08-19</entry>
<modified>2010-08-20</modified>
</dates>
</vuln>
<vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8">
<topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range>
<range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/">
<p>WEBrick have had a cross-site scripting vulnerability that allows
an attacker to inject arbitrary script or HTML via a crafted URI.
This does not affect user agents that strictly implement HTTP/1.1,
however, some user agents do not.</p>
</blockquote>
</body>
</description>
<references>
<bid>40895</bid>
<cvename>CVE-2010-0541</cvename>
<url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url>
</references>
<dates>
<discovery>2010-08-16</discovery>
<entry>2010-08-17</entry>
<modified>2010-08-20</modified>
</dates>
</vuln>
<vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76">
<topic>isolate -- local root exploit</topic>
<affects>
<package>
<name>isolate</name>
<range><lt>20100717</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://code.google.com/p/isolate/">
<p>Isolate currently suffers from some bad security bugs! These
are local root privilege escalation bugs. Thanks to the helpful
person who reported them (email Chris if you want credit!).
We're working to fix them ASAP, but until then, isolate is
unsafe and you should uninstall it. Sorry!</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/148911</freebsdpr>
<url>http://code.google.com/p/isolate/</url>
</references>
<dates>
<discovery>2010-07-29</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="e7d91a3c-a7c9-11df-870c-00242b513d7c">
<topic>vlc -- invalid id3v2 tags may lead to invalid memory dereferencing</topic>
<affects>
<package>
<name>vlc</name>
<range><gt>0.9.0,3</gt><lt>1.1.2_1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1004.html">
<p>VLC fails to perform sufficient input validation when trying to
extract some meta-informations about input media through ID3v2
tags. In the failure case, VLC attempt dereference an invalid
memory address, and a crash will ensure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2937</cvename>
<url>http://www.videolan.org/security/sa1004.html</url>
</references>
<dates>
<discovery>2010-07-29</discovery>
<entry>2010-08-14</entry>
</dates>
</vuln>
<vuln vid="e19e74a4-a712-11df-b234-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r280</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-16.html">
<p>Critical vulnerabilities have been identified in Adobe
Flash Player version 10.1.53.64 and earlier. These
vulnerabilities could cause the application to crash and
could potentially allow an attacker to take control of the
affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0209</cvename>
<cvename>CVE-2010-2188</cvename>
<cvename>CVE-2010-2213</cvename>
<cvename>CVE-2010-2214</cvename>
<cvename>CVE-2010-2215</cvename>
<cvename>CVE-2010-2216</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-16.html</url>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="71273c4d-a6ec-11df-8a8d-0008743bf21a">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Destkop Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1061/">
<ul>
<li>Fixed an issue where heap buffer overflow in HTML5 canvas could
be used to execute arbitrary code, as reported by Kuzzcc.</li>
<li>Fixed an issue where unexpected changes in tab focus could be
used to run programs from the Internet, as reported by Jakob Balle
and Sven Krewitt of Secunia.</li>
<li>Fixed an issue where news feed preview could subscribe to feeds
without interaction, as reported by Alexios Fakos.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/search/view/966/</url>
<url>http://www.opera.com/support/search/view/967/</url>
<url>http://www.opera.com/support/search/view/968/</url>
</references>
<dates>
<discovery>2010-08-12</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="c2eac2b5-9a7d-11df-8e32-000f20797ede">
<topic>firefox -- Dangling pointer crash regression from plugin parameter array fix</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2755</cvename>
<url>https://www.mozilla.org/security/announce/2010/mfsa2010-48.html</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-08-09</entry>
</dates>
</vuln>
<vuln vid="26e1c48a-9fa7-11df-81b5-00e0814cab4e">
<topic>Piwik -- Local File Inclusion Vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><gt>0.6</gt><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary,
remote file inclusion using a directory traversal pattern infinite
a crafted request for a data renderer.</p>
<blockquote cite="http://secunia.com/advisories/40703">
<p>A vulnerability has been reported in Piwik, which can before
exploited by malicious people to disclose potentially
sensitive information. Input passed to unspecified parameters
when requesting a data renderer is not properly verified before
being used to include files. This can be exploited to includes
arbitrary files from local resources via directory traversal
attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2786</cvename>
<url>http://secunia.com/advisories/40703</url>
</references>
<dates>
<discovery>2010-07-28</discovery>
<entry>2010-08-04</entry>
</dates>
</vuln>
<vuln vid="43024078-9b63-11df-8983-001d60d86f38">
<topic>libmspack -- infinite loop denial of service</topic>
<affects>
<package>
<name>libmspack</name>
<range><le>0.0.20060920</le></range>
</package>
<package>
<name>cabextract</name>
<range><lt>1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.</p>
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/40719/">
<p>The vulnerability is caused due to an error when copying data
from an uncompressed block (block type 0) and can be exploited
to trigger an infinite loop by tricking an application using the
library into processing specially crafted MS-ZIP archives.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/40719/</url>
</references>
<dates>
<discovery>2010-07-26</discovery>
<entry>2010-07-30</entry>
</dates>
</vuln>
<vuln vid="28a7310f-9855-11df-8d36-001aa0166822">
<topic>apache -- Remote DoS bug in mod_cache and mod_dav</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.2.0</ge><lt>2.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache ChangeLog reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.16">
<p>mod_dav, mod_cache: Fix Handling of requests without a path segment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1452</cvename>
<url>http://www.apache.org/dist/httpd/CHANGES_2.2.16</url>
<url>https://issues.apache.org/bugzilla/show_bug.cgi?id=49246</url>
<url>http://svn.apache.org/viewvc?view=revision&revision=966349</url>
</references>
<dates>
<discovery>2010-07-21</discovery>
<entry>2010-07-26</entry>
</dates>
</vuln>
<vuln vid="827bc2b7-95ed-11df-9160-00e0815b8da8">
<topic>git -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>git</name>
<range><ge>1.5.6</ge><lt>1.7.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Greg Brockman reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/07/22/1">
<p>If an attacker were to create a crafted working copy where the
user runs any git command, the attacker could force execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2542</cvename>
<url>http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc</url>
<url>http://www.openwall.com/lists/oss-security/2010/07/22/1</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-07-23</entry>
</dates>
</vuln>
<vuln vid="0502c1cb-8f81-11df-a0bb-0050568452ac">
<topic>codeigniter -- file upload class vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>1.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Jones reports:</p>
<blockquote cite="http://codeigniter.com/news/codeigniter_1.7.2_security_patch/">
<p>A fix has been implemented for a security flaw in
CodeIgniter 1.7.2. All applications using the File
Upload class should install the patch to ensure that
their application is not subject to a vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://codeigniter.com/news/codeigniter_1.7.2_security_patch/</url>
<url>http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch</url>
</references>
<dates>
<discovery>2010-07-12</discovery>
<entry>2010-07-21</entry>
</dates>
</vuln>
<vuln vid="8c2ea875-9499-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.7,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.11,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.7,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.11</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)</p>
<p>MFSA 2010-35 DOM attribute cloning remote code execution vulnerability</p>
<p>MFSA 2010-36 Use-after-free error in NodeIterator</p>
<p>MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability</p>
<p>MFSA 2010-38 Arbitrary code execution using SJOW and fast native function</p>
<p>MFSA 2010-39 nsCSSValue::Array index integer overflow</p>
<p>MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability</p>
<p>MFSA 2010-41 Remote code execution using malformed PNG image</p>
<p>MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts</p>
<p>MFSA 2010-43 Same-origin bypass using canvas context</p>
<p>MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish</p>
<p>MFSA 2010-45 Multiple location bar spoofing vulnerabilities</p>
<p>MFSA 2010-46 Cross-domain data theft using CSS</p>
<p>MFSA 2010-47 Cross-origin data leakage from script filename in error messages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0654</cvename>
<cvename>CVE-2010-1205</cvename>
<cvename>CVE-2010-1206</cvename>
<cvename>CVE-2010-1207</cvename>
<cvename>CVE-2010-1208</cvename>
<cvename>CVE-2010-1209</cvename>
<cvename>CVE-2010-1210</cvename>
<cvename>CVE-2010-1211</cvename>
<cvename>CVE-2010-1212</cvename>
<cvename>CVE-2010-1213</cvename>
<cvename>CVE-2010-1214</cvename>
<cvename>CVE-2010-1215</cvename>
<cvename>CVE-2010-2751</cvename>
<cvename>CVE-2010-2752</cvename>
<cvename>CVE-2010-2753</cvename>
<cvename>CVE-2010-2754</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-34.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-35.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-36.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-37.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-38.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-39.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-40.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-41.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-42.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-43.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-44.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-45.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-46.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-47.html</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-07-21</entry>
</dates>
</vuln>
<vuln vid="9a8fecef-92c0-11df-b140-0015f2db7bde">
<topic>vte -- Classic terminal title set+query attack</topic>
<affects>
<package>
<name>vte</name>
<range><lt>0.24.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kees Cook reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/512388">
<p>Janne Snabb discovered that applications using VTE, such as
gnome-terminal, did not correctly filter window and icon title
request escape codes. If a user were tricked into viewing
specially crafted output in their terminal, a remote attacker
could execute arbitrary commands with user privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2713</cvename>
<url>http://www.securityfocus.com/archive/1/512388</url>
</references>
<dates>
<discovery>2010-07-15</discovery>
<entry>2010-07-18</entry>
</dates>
</vuln>
<vuln vid="19419b3b-92bd-11df-b140-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha reports:</p>
<blockquote cite="http://blog.kov.eti.br/?p=116">
<p>Debian's Michael Gilbert has done a great job going through all
CVEs released about WebKit, and including patches in the Debian
package. 1.2.3 includes all of the commits from trunk to fix those,
too.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1386</cvename>
<cvename>CVE-2010-1392</cvename>
<cvename>CVE-2010-1405</cvename>
<cvename>CVE-2010-1407</cvename>
<cvename>CVE-2010-1416</cvename>
<cvename>CVE-2010-1417</cvename>
<cvename>CVE-2010-1418</cvename>
<cvename>CVE-2010-1421</cvename>
<cvename>CVE-2010-1422</cvename>
<cvename>CVE-2010-1501</cvename>
<cvename>CVE-2010-1664</cvename>
<cvename>CVE-2010-1665</cvename>
<cvename>CVE-2010-1758</cvename>
<cvename>CVE-2010-1759</cvename>
<cvename>CVE-2010-1760</cvename>
<cvename>CVE-2010-1761</cvename>
<cvename>CVE-2010-1762</cvename>
<cvename>CVE-2010-1767</cvename>
<cvename>CVE-2010-1770</cvename>
<cvename>CVE-2010-1771</cvename>
<cvename>CVE-2010-1772</cvename>
<cvename>CVE-2010-1773</cvename>
<cvename>CVE-2010-1774</cvename>
<cvename>CVE-2010-2264</cvename>
<url>http://blog.kov.eti.br/?p=116</url>
</references>
<dates>
<discovery>2010-07-16</discovery>
<entry>2010-07-18</entry>
</dates>
</vuln>
<vuln vid="ba61ce15-8a7b-11df-87ec-0050569b2d21">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>0.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Davis reports:</p>
<blockquote cite="http://www.redmine.org/news/41">
<p>This security release addresses some security
vulnerabilities found in the advanced subversion
integration module (Redmine.pm perl script).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/41</url>
</references>
<dates>
<discovery>2010-07-08</discovery>
<entry>2010-07-10</entry>
</dates>
</vuln>
<vuln vid="25ed4ff8-8940-11df-a339-0026189baca3">
<topic>bogofilter -- heap underrun on malformed base64 input</topic>
<affects>
<package>
<name>bogofilter</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>bogofilter-sqlite</name>
<range><lt>1.2.1_1</lt></range>
</package>
<package>
<name>bogofilter-tc</name>
<range><lt>1.2.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Julius Plenz reports:</p>
<blockquote cite="http://www.bogofilter.org/pipermail/bogofilter-dev/2010-June/003475.html">
<p>I found a bug in the base64_decode function which may cause memory
corruption when the function is executed on a malformed base64
encoded string.</p>
<p>If a string starting with an equal-sign is passed to the
base64_decode function it triggers a memory corruption that
in some cases makes bogofilter crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2494</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01</url>
</references>
<dates>
<discovery>2010-06-28</discovery>
<entry>2010-07-06</entry>
</dates>
</vuln>
<vuln vid="f1331504-8849-11df-89b8-00151735203a">
<topic>bugzilla -- information disclosure</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>2.17.1</gt><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.6/">
<ul>
<li>Normally, information about time-tracking (estimated
hours, actual hours, hours worked, and deadlines) is
restricted to users in the "time-tracking group".
However, any user was able, by crafting their own
search URL, to search for bugs based using those
fields as criteria, thus possibly exposing sensitive
time-tracking information by a user seeing that a bug
matched their search.</li>
<li>If $use_suexec was set to "1" in the localconfig file,
then the localconfig file's permissions were set as
world-readable by checksetup.pl. This allowed any user
with local shell access to see the contents of the file,
including the database password and the site_wide_secret
variable used for CSRF protection.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1204</cvename>
<cvename>CVE-2010-0180</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=309952</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=561797</url>
</references>
<dates>
<discovery>2010-06-24</discovery>
<entry>2010-07-05</entry>
</dates>
</vuln>
<vuln vid="8685d412-8468-11df-8d45-001d7d9eb79a">
<topic>kvirc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>kvirc</name>
<name>kvirc-devel</name>
<range><lt>4.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two security vulnerabilities have been discovered:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2451">
<p>Multiple format string vulnerabilities in the DCC functionality
in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2452">
<p>Directory traversal vulnerability in the DCC functionality
in KVIrc 3.4 and 4.0 allows remote attackers to overwrite
arbitrary files via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2451</cvename>
<cvename>CVE-2010-2452</cvename>
<url>http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html</url>
</references>
<dates>
<discovery>2010-05-17</discovery>
<entry>2010-06-30</entry>
</dates>
</vuln>
<vuln vid="edef3f2f-82cf-11df-bcce-0018f3e2eb82">
<topic>png -- libpng decompression buffer overflow</topic>
<affects>
<package>
<name>png</name>
<range>
<lt>1.4.3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PNG project describes the problem in an advisory:</p>
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
<p>Several versions of libpng through 1.4.2 (and through 1.2.43
in the older series) contain a bug whereby progressive
applications such as web browsers (or the rpng2 demo app included
in libpng) could receive an extra row of image data beyond the
height reported in the header, potentially leading to an
out-of-bounds write to memory (depending on how the application
is written) and the possibility of execution of an attacker's
code with the privileges of the libpng user (including remote
compromise in the case of a libpng-based browser visiting a
hostile web site).</p>
</blockquote>
</body>
</description>
<references>
<bid>41174</bid>
<cvename>CVE-2010-1205</cvename>
<url>http://www.libpng.org/pub/png/libpng.html</url>
</references>
<dates>
<discovery>2010-03-30</discovery>
<entry>2010-06-28</entry>
<modified>2010-06-28</modified>
</dates>
</vuln>
<vuln vid="66759ce6-7530-11df-9c33-000c29ba66d2">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle</name>
<range><lt>1.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Moodle release notes report multiple vulnerabilities
which could allow cross site scripting, XSS attacks,
unauthorised deletion of attempts in some instances.</p>
</body>
</description>
<references>
<url>http://docs.moodle.org/en/Moodle_1.9.9_release_notes</url>
</references>
<dates>
<discovery>2010-06-08</discovery>
<entry>2010-06-28</entry>
</dates>
</vuln>
<vuln vid="1cd87e2a-81e3-11df-81d8-00262d5ed8ee">
<topic>mDNSResponder -- corrupted stack crash when parsing bad resolv.conf</topic>
<affects>
<package>
<name>mDNSResponder</name>
<range><le>214</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Juli Mallett reports:</p>
<blockquote>
<p>mdnsd will crash on some systems with a corrupt stack and once
that's fixed it will still leak a file descriptor when parsing
resolv.conf. The crash is because scanf is used with %10s for a
buffer that is only 10 chars long. The buffer size needs increased
to 11 chars to hold the trailing NUL. To fix the leak, an fclose
needs added.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/147007</freebsdpr>
</references>
<dates>
<discovery>2010-05-26</discovery>
<entry>2010-06-27</entry>
</dates>
</vuln>
<vuln vid="77b9f9bc-7fdf-11df-8a8d-0008743bf21a">
<topic>opera -- Data URIs can be used to allow cross-site scripting</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.11</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><le>10.20_2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Desktop Team reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/955/">
<p>Data URIs are allowed to run scripts that manipulate
pages from the site that directly opened them. In some cases, the opening site
is not correctly detected. In these cases, Data URIs may erroneously be able to
run scripts so that they interact with sites that did not directly cause them to
be opened.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/955/</url>
</references>
<dates>
<discovery>2010-06-21</discovery>
<entry>2010-06-25</entry>
</dates>
</vuln>
<vuln vid="e02e6a4e-6b26-11df-96b2-0015587e2cc1">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7f</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported to exist in older version of
Cacti. The release notes of Cacti 0.8.7f summarizes the problems as
follows:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_7f.php">
<ul>
<li>SQL injection and shell escaping issues</li>
<li>Cross-site scripting issues</li>
<li>Cacti Graph Viewer SQL injection vulnerability</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html</url>
<url>http://www.cacti.net/release_notes_0_8_7f.php</url>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
<url>http://www.vupen.com/english/advisories/2010/1204</url>
</references>
<dates>
<discovery>2010-05-24</discovery>
<entry>2010-06-24</entry>
</dates>
</vuln>
<vuln vid="99858b7c-7ece-11df-a007-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.4,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.10,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.5</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-33 User tracking across sites using Math.random()</p>
<p>MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present</p>
<p>MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes</p>
<p>MFSA 2010-30 Integer Overflow in XSLT Node Sorting</p>
<p>MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal</p>
<p>MFSA 2010-28 Freed object reuse across plugin instances</p>
<p>MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()</p>
<p>MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)</p>
<p>MFSA 2010-25 Re-use of freed object due to scope confusion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5913</cvename>
<cvename>CVE-2010-0183</cvename>
<cvename>CVE-2010-1121</cvename>
<cvename>CVE-2010-1125</cvename>
<cvename>CVE-2010-1197</cvename>
<cvename>CVE-2010-1199</cvename>
<cvename>CVE-2010-1196</cvename>
<cvename>CVE-2010-1198</cvename>
<cvename>CVE-2010-1200</cvename>
<cvename>CVE-2010-1201</cvename>
<cvename>CVE-2010-1202</cvename>
<cvename>CVE-2010-1203</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-33.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-32.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-31.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-30.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-29.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-28.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-27.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-26.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
</references>
<dates>
<discovery>2010-06-22</discovery>
<entry>2010-06-23</entry>
</dates>
</vuln>
<vuln vid="25673e6e-786b-11df-a921-0245fb008c0b">
<topic>ziproxy -- security vulnerability in PNG decoder</topic>
<affects>
<package>
<name>ziproxy</name>
<range><ge>3.1.0</ge></range>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Mealha Cabrita reports:</p>
<blockquote cite="http://ziproxy.sourceforge.net/#news">
<p>Fixed security vulnerability (heap-related) in PNG decoder.
(new bug from 3.1.0)</p>
</blockquote>
</body>
</description>
<references>
<url>http://ziproxy.sourceforge.net/#news</url>
<mlist msgid="201006150731.30474.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net</mlist>
</references>
<dates>
<discovery>2010-06-15</discovery>
<entry>2010-06-15</entry>
</dates>
</vuln>
<vuln vid="8816bf3a-7929-11df-bcce-0018f3e2eb82">
<topic>tiff -- Multiple integer overflows</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.9.4</lt></range>
</package>
<package>
<name>linux-tiff</name>
<name>linux-f10-tiff</name>
<range><lt>3.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tielei Wang:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-012.html">
<p>Multiple integer overflows in inter-color spaces conversion
tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow
context-dependent attackers to execute arbitrary code via a
TIFF image with large (1) width and (2) height values, which
triggers a heap-based buffer overflow in the (a) cvt_whole_image
function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2347</cvename>
<url>http://www.remotesensing.org/libtiff/v3.9.4.html</url>
<url>http://www.ocert.org/advisories/ocert-2009-012.html</url>
</references>
<dates>
<discovery>2009-05-22</discovery>
<entry>2010-06-16</entry>
</dates>
</vuln>
<vuln vid="144e524a-77eb-11df-ae06-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r277</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-14.html">
<p>Critical vulnerabilities have been identified in Adobe
Flash Player version 10.0.45.2 and earlier. These
vulnerabilities could cause the application to crash and
could potentially allow an attacker to take control of the
affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4546</cvename>
<cvename>CVE-2009-3793</cvename>
<cvename>CVE-2010-1297</cvename>
<cvename>CVE-2010-2160</cvename>
<cvename>CVE-2010-2161</cvename>
<cvename>CVE-2010-2162</cvename>
<cvename>CVE-2010-2163</cvename>
<cvename>CVE-2010-2164</cvename>
<cvename>CVE-2010-2165</cvename>
<cvename>CVE-2010-2166</cvename>
<cvename>CVE-2010-2167</cvename>
<cvename>CVE-2010-2169</cvename>
<cvename>CVE-2010-2170</cvename>
<cvename>CVE-2010-2171</cvename>
<cvename>CVE-2010-2172</cvename>
<cvename>CVE-2010-2173</cvename>
<cvename>CVE-2010-2174</cvename>
<cvename>CVE-2010-2175</cvename>
<cvename>CVE-2010-2176</cvename>
<cvename>CVE-2010-2177</cvename>
<cvename>CVE-2010-2178</cvename>
<cvename>CVE-2010-2179</cvename>
<cvename>CVE-2010-2180</cvename>
<cvename>CVE-2010-2181</cvename>
<cvename>CVE-2010-2182</cvename>
<cvename>CVE-2010-2183</cvename>
<cvename>CVE-2010-2184</cvename>
<cvename>CVE-2010-2185</cvename>
<cvename>CVE-2010-2186</cvename>
<cvename>CVE-2010-2187</cvename>
<cvename>CVE-2010-2188</cvename>
<cvename>CVE-2010-2189</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-14.html</url>
</references>
<dates>
<discovery>2008-10-02</discovery>
<entry>2010-06-14</entry>
</dates>
</vuln>
<vuln vid="313da7dc-763b-11df-bcce-0018f3e2eb82">
<topic>tiff -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.9.3</lt></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin Finisterre reports:</p>
<blockquote cite="http://support.apple.com/kb/HT4196">
<p>Multiple integer overflows in the handling of TIFF files may
result in a heap buffer overflow. Opening a maliciously crafted
TIFF file may lead to an unexpected application termination or
arbitrary code execution. The issues are addressed through
improved bounds checking. Credit to Kevin Finisterre of
digitalmunition.com for reporting these issues.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1411</cvename>
<url>http://www.remotesensing.org/libtiff/v3.9.3.html</url>
<url>http://support.apple.com/kb/HT4196</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-06-12</entry>
</dates>
</vuln>
<vuln vid="d42e5b66-6ea0-11df-9c8d-00e0815b8da8">
<topic>sudo -- Secure path vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://sudo.ws/sudo/alerts/secure_path.html">
<p>Most versions of the C library function getenv() return the
first instance of an environment variable to the caller. However,
some programs, notably the GNU Bourne Again SHell (bash), do
their own environment parsing and may choose the last instance
of a variable rather than the first one.</p>
<p>An attacker may manipulate the environment of the process that
executes Sudo such that a second PATH variable is present. When
Sudo runs a bash script, it is this second PATH variable that
is used by bash, regardless of whether or not Sudo has overwritten
the first instance of PATH. This may allow an attacker to
subvert the program being run under Sudo and execute commands
he/she would not otherwise be allowed to run.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1646</cvename>
<url>http://sudo.ws/sudo/alerts/secure_path.html</url>
</references>
<dates>
<discovery>2010-06-02</discovery>
<entry>2010-06-02</entry>
</dates>
</vuln>
<vuln vid="b43004b8-6a53-11df-bc7b-0245fb008c0b">
<topic>ziproxy -- atypical huge picture files vulnerability</topic>
<affects>
<package>
<name>ziproxy</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ziproxy 3.0.1 release fixes a security vulnerability related
to atypical huge picture files (>4GB of size once expanded).</p>
</body>
</description>
<references>
<bid>40344</bid>
<cvename>CVE-2010-1513</cvename>
<url>http://ziproxy.sourceforge.net/#news</url>
<url>http://secunia.com/advisories/39941</url>
<mlist msgid="201005210019.37119.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net</mlist>
</references>
<dates>
<discovery>2010-05-20</discovery>
<entry>2010-05-28</entry>
</dates>
</vuln>
<vuln vid="fc55e396-6deb-11df-8b8e-000c29ba66d2">
<topic>mediawiki -- two security vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.15.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two security vulnerabilities were discovered:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html">
<p>Noncompliant CSS parsing behaviour in Internet Explorer
allows attackers to construct CSS strings which are treated
as safe by previous versions of MediaWiki, but are decoded
to unsafe strings by Internet Explorer.</p>
<p>A CSRF vulnerability was discovered in our login interface.
Although regular logins are protected as of 1.15.3, it was
discovered that the account creation and password reset
reset features were not protected from CSRF. This could lead
to unauthorised access to private wikis.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/39922/</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html</url>
</references>
<dates>
<discovery>2010-05-28</discovery>
<entry>2010-06-02</entry>
</dates>
</vuln>
<vuln vid="fcc39d22-5777-11df-bf33-001a92771ec2">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>0.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redmine release announcement reports that
several cross side scripting vulnerabilities
and a potential data disclosure vulnerability have
been fixed in the latest release.</p>
</body>
</description>
<references>
<url>http://www.redmine.org/news/39</url>
</references>
<dates>
<discovery>2010-05-01</discovery>
<entry>2010-05-14</entry>
</dates>
</vuln>
<vuln vid="28022228-5a0e-11df-942d-0015587e2cc1">
<topic>wireshark -- DOCSIS dissector denial of service</topic>
<affects>
<package>
<name>wireshark</name>
<range><le>1.2.6_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability found in the DOCSIS dissector can cause
Wireshark to crash when a malformed packet trace file is
opened. This means that an attacker will have to trick a
victim into opening such a trace file before being able
to crash the application</p>
</body>
</description>
<references>
<cvename>CVE-2010-1455</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2010-03.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2010-04.html</url>
</references>
<dates>
<discovery>2010-05-05</discovery>
<entry>2010-05-07</entry>
</dates>
</vuln>
<vuln vid="c0869649-5a0c-11df-942d-0015587e2cc1">
<topic>piwik -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><le>0.5.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik security advisory reports:</p>
<blockquote cite="http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/">
<p>A non-persistent, cross-site scripting vulnerability
(XSS) was found in Piwik's Login form that reflected
the form_url parameter without being properly escaped
or filtered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1453</cvename>
<url>http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-05-07</entry>
</dates>
</vuln>
<vuln vid="7132c842-58e2-11df-8d80-0015587e2cc1">
<topic>spamass-milter -- remote command execution vulnerability</topic>
<affects>
<package>
<name>spamass-milter</name>
<range><le>0.3.1_8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The spamassassin milter plugin contains a vulnerability
that can allow remote attackers to execute commands on
affected systems.</p>
<p>The vulnerability can be exploited trough a special-crafted
email header when the plugin was started with the '-x'
(expand) flag.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1132</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html</url>
<url>http://xforce.iss.net/xforce/xfdb/56732</url>
</references>
<dates>
<discovery>2010-03-07</discovery>
<entry>2010-05-06</entry>
</dates>
</vuln>
<vuln vid="694da5b4-5877-11df-8d80-0015587e2cc1">
<topic>mediawiki -- authenticated CSRF vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.15.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A MediaWiki security announcement reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html">
<p>MediaWiki was found to be vulnerable to login CSRF.
An attacker who controls a user account on the target
wiki can force the victim to log in as the attacker,
via a script on an external website.</p>
<p>If the wiki is configured to allow user scripts, say
with "$wgAllowUserJs = true" in LocalSettings.php, then
the attacker can proceed to mount a phishing-style
attack against the victim to obtain their password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1150</cvename>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=23076</url>
</references>
<dates>
<discovery>2010-04-07</discovery>
<entry>2010-05-05</entry>
</dates>
</vuln>
<vuln vid="0491d15a-5875-11df-8d80-0015587e2cc1">
<topic>lxr -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>lxr</name>
<range><le>0.9.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dan Rosenberg reports:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com">
<p>There are several cross-site scripting vulnerabilities
in LXR. These vulnerabilities could allow an attacker
to execute scripts in a user's browser, steal cookies
associated with vulnerable domains, redirect the user
to malicious websites, etc.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4497</cvename>
<freebsdpr>ports/146337</freebsdpr>
<url>http://secunia.com/advisories/38117</url>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com</url>
</references>
<dates>
<discovery>2010-01-05</discovery>
<entry>2010-05-05</entry>
</dates>
</vuln>
<vuln vid="752ce039-5242-11df-9139-00242b513d7c">
<topic>vlc -- unintended code execution with specially crafted data</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>1.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1003.html">
<p>VLC media player suffers from various vulnerabilities when
attempting to parse malformatted or overly long byte streams.</p>
</blockquote>
</body>
</description>
<references>
<bid>39629</bid>
<url>http://www.videolan.org/security/sa1003.html</url>
</references>
<dates>
<discovery>2010-04-19</discovery>
<entry>2010-05-01</entry>
<modified>2010-05-05</modified>
</dates>
</vuln>
<vuln vid="8d10038e-515c-11df-83fb-0015587e2cc1">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla15</name>
<range><ge>1.5.1</ge><le>1.5.15</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! reported the following vulnerabilities:</p>
<blockquote cite="http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html">
<p>If a user entered a URL with a negative query limit
or offset, a PHP notice would display revealing information
about the system..</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html">
<p>The migration script in the Joomla! installer does not
check the file type being uploaded. If the installation
application is present, an attacker could use it to
upload malicious files to a server.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html">
<p>Session id doesn't get modified when user logs in. A
remote site may be able to forward a visitor to the
Joomla! site and set a specific cookie. If the user
then logs in, the remote site can use that cookie to
authenticate as that user.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html">
<p>When a user requests a password reset, the reset tokens
were stored in plain text in the database. While this
is not a vulnerability in itself, it allows user accounts
to be compromised if there is an extension on the site
with an SQL injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html</url>
<url>http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html</url>
<url>http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html</url>
<url>http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html</url>
</references>
<dates>
<discovery>2010-04-23</discovery>
<entry>2010-04-26</entry>
</dates>
</vuln>
<vuln vid="5198ef84-4fdc-11df-83fb-0015587e2cc1">
<topic>cacti -- SQL injection and command execution vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.7e4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bonsai information security reports:</p>
<blockquote cite="http://www.bonsai-sec.com/en/research/vulnerability.php">
<p>A Vulnerability has been discovered in Cacti, which
can be exploited by any user to conduct SQL Injection
attacks. Input passed via the "export_item_id" parameter
to "templates_export.php" script is not properly sanitized
before being used in a SQL query.</p>
</blockquote>
<p>The same source also reported a command execution
vulnerability. This second issue can be exploited by
Cacti users who have the rights to modify device or
graph configurations.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1431</cvename>
<freebsdpr>ports/146021</freebsdpr>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php</url>
<url>http://www.debian.org/security/2010/dsa-2039</url>
</references>
<dates>
<discovery>2010-04-21</discovery>
<entry>2010-04-24</entry>
<modified>2013-06-16</modified>
</dates>
</vuln>
<vuln vid="f6429c24-4fc9-11df-83fb-0015587e2cc1">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle</name>
<range><lt>1.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Moodle release notes report multiple vulnerabilities
which could allow remote attackers to perform, amongst
others, cross site scripting, user enumeration and SQL
injection attacks.</p>
</body>
</description>
<references>
<url>http://docs.moodle.org/en/Moodle_1.9.8_release_notes</url>
</references>
<dates>
<discovery>2010-03-25</discovery>
<entry>2010-04-24</entry>
</dates>
</vuln>
<vuln vid="3383e706-4fc3-11df-83fb-0015587e2cc1">
<topic>tomcat -- information disclosure vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.30</lt></range>
<range><gt>6.0.0</gt><lt>6.0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache software foundation reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2010/Apr/200">
<p>The "WWW-Authenticate" header for BASIC and DIGEST
authentication includes a realm name. If a <realm-name>
element is specified for the application in web.xml it
will be used. However, a <realm-name> is not
specified then Tomcat will generate one.</p>
<p>In some circumstances this can expose the local
hostname or IP address of the machine running Tomcat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1157</cvename>
<freebsdpr>ports/146022</freebsdpr>
<url>http://seclists.org/bugtraq/2010/Apr/200</url>
</references>
<dates>
<discovery>2010-04-22</discovery>
<entry>2010-04-24</entry>
</dates>
</vuln>
<vuln vid="f6b6beaa-4e0e-11df-83fb-0015587e2cc1">
<cancelled/>
</vuln>
<vuln vid="86b8b655-4d1a-11df-83fb-0015587e2cc1">
<topic>krb5 -- KDC double free vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt">
<p>An authenticated remote attacker can crash the KDC by
inducing the KDC to perform a double free. Under some
circumstances on some platforms, this could also allow
malicious code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1320</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt</url>
</references>
<dates>
<discovery>2010-04-20</discovery>
<entry>2010-04-21</entry>
</dates>
</vuln>
<vuln vid="a4746a86-4c89-11df-83fb-0015587e2cc1">
<topic>e107 -- code execution and XSS vulnerabilities</topic>
<affects>
<package>
<name>e107</name>
<range><lt>0.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reported two vulnerabilities in e107:</p>
<p>The first problem affects installations that have the
Content Manager plugin enabled. This plugin does not
sanitize the "content_heading" parameter correctly and
is therefore vulnerable to a cross site scripting attack.</p>
<p>The second vulnerability is related to the avatar upload
functionality. Images containing PHP code can be uploaded
and executed.</p>
</body>
</description>
<references>
<bid>39540</bid>
<cvename>CVE-2010-0996</cvename>
<cvename>CVE-2010-0997</cvename>
<freebsdpr>ports/145885</freebsdpr>
<url>http://e107.org/comment.php?comment.news.864</url>
<url>http://secunia.com/secunia_research/2010-43/</url>
<url>http://secunia.com/secunia_research/2010-44/</url>
<url>http://xforce.iss.net/xforce/xfdb/57932</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="09910d76-4c82-11df-83fb-0015587e2cc1">
<topic>fetchmail -- denial of service vulnerability</topic>
<affects>
<package>
<name>fetchmail</name>
<range>
<ge>4.6.3</ge>
<le>6.3.16</le>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fetchmail developer Matthias Andree reported a vulnerability
that allows remote attackers to crash the application
when it is runs in verbose mode.</p>
<blockquote cite="http://gitorious.org/fetchmail/fetchmail/commit/ec06293">
<p>Fetchmail before release 6.3.17 did not properly
sanitize external input (mail headers and UID). When a
multi-character locale (such as UTF-8) was in use, this
could cause memory exhaustion and thus a denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1167</cvename>
<freebsdpr>ports/145857</freebsdpr>
<url>http://gitorious.org/fetchmail/fetchmail/commit/ec06293</url>
<url>http://seclists.org/oss-sec/2010/q2/76</url>
</references>
<dates>
<discovery>2010-04-18</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="a2c4d3d5-4c7b-11df-83fb-0015587e2cc1">
<topic>pidgin -- multiple remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>pidgin</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>libpurple</name>
<range><lt>2.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Three denial of service vulnerabilities where found in
pidgin and allow remote attackers to crash the application.
The developers summarized these problems as follows:</p>
<blockquote cite="http://pidgin.im/news/security/?id=45">
<p>Pidgin can become unresponsive when displaying large
numbers of smileys</p>
</blockquote>
<blockquote cite="http://pidgin.im/news/security/?id=44">
<p>Certain nicknames in group chat rooms can trigger a
crash in Finch</p>
</blockquote>
<blockquote cite="http://pidgin.im/news/security/?id=43">
<p>Failure to validate all fields of an incoming message
can trigger a crash</p>
</blockquote>
</body>
</description>
<references>
<bid>38294</bid>
<cvename>CVE-2010-0277</cvename>
<cvename>CVE-2010-0420</cvename>
<cvename>CVE-2010-0423</cvename>
<url>http://pidgin.im/news/security/?id=43</url>
<url>http://pidgin.im/news/security/?id=44</url>
<url>http://pidgin.im/news/security/?id=45</url>
</references>
<dates>
<discovery>2010-02-18</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="4fb5d2cd-4c77-11df-83fb-0015587e2cc1">
<topic>png -- libpng decompression denial of service</topic>
<affects>
<package>
<name>png</name>
<range>
<gt>1.2.43</gt>
<lt>1.4.1</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability in libpng can result in denial of service
conditions when a remote attacker tricks a victim to open
a specially-crafted PNG file.</p>
<p>The PNG project describes the problem in an advisory:</p>
<blockquote cite="http://libpng.sourceforge.net/ADVISORY-1.4.1.html">
<p>Because of the efficient compression method used in
Portable Network Graphics (PNG) files, a small PNG file
can expand tremendously, acting as a "decompression
bomb".</p>
<p>Malformed PNG chunks can consume a large amount of CPU
and wall-clock time and large amounts of memory, up to
all memory available on a system</p>
</blockquote>
</body>
</description>
<references>
<bid>38478</bid>
<certvu>576029</certvu>
<cvename>CVE-2010-0205</cvename>
<url>http://libpng.sourceforge.net/ADVISORY-1.4.1.html</url>
<url>http://secunia.com/advisories/38774</url>
<url>http://xforce.iss.net/xforce/xfdb/56661</url>
</references>
<dates>
<discovery>2010-02-27</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="c8c31c41-49ed-11df-83fb-0015587e2cc1">
<topic>curl -- libcurl buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range>
<ge>7.10.5</ge>
<lt>7.20.0</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports in a security advisory:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20100209.html">
<p>Using the affected libcurl version to download compressed
content over HTTP, an application can ask libcurl to
automatically uncompress data. When doing so, libcurl
can wrongly send data up to 64K in size to the callback
which thus is much larger than the documented maximum
size.</p>
<p>An application that blindly trusts libcurl's max limit
for a fixed buffer size or similar is then a possible
target for a buffer overflow vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0734</cvename>
<url>http://curl.haxx.se/docs/adv_20100209.html</url>
<url>http://www.debian.org/security/2010/dsa-2023</url>
<url>http://www.openwall.com/lists/oss-security/2010/02/09/5</url>
</references>
<dates>
<discovery>2010-02-09</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="a04a3c13-4932-11df-83fb-0015587e2cc1">
<topic>ejabberd -- queue overload denial of service vulnerability</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat security response team reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/01/29/1">
<p>A remotely exploitable DoS from XMPP client to ejabberd
server via too many "client2server" messages (causing the
message queue on the server to get overloaded, leading
to server crash) has been found.</p>
</blockquote>
</body>
</description>
<references>
<bid>38003</bid>
<cvename>CVE-2010-0305</cvename>
<url>http://secunia.com/advisories/38337</url>
<url>http://support.process-one.net/browse/EJAB-1173</url>
<url>http://www.openwall.com/lists/oss-security/2010/01/29/1</url>
<url>http://xforce.iss.net/xforce/xfdb/56025</url>
</references>
<dates>
<discovery>2010-01-29</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="3b7967f1-49e8-11df-83fb-0015587e2cc1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>0.8.15</lt></range>
</package>
<package>
<name>zh-irssi</name>
<range><lt>0.8.15</lt></range>
</package>
<package>
<name>irssi-devel</name>
<range><lt>20100325</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two vulnerabilities have found in irssi. The first issue
could allow man-in-the-middle attacks due to a missing
comparison of SSL server hostnames and the certificate
domain names (e.g. CN).</p>
<p>A second vulnerability, related to the nick matching code,
could be triggered by remote attackers in order to crash
an irssi client when leaving a channel.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1155</cvename>
<cvename>CVE-2010-1156</cvename>
<url>http://xforce.iss.net/xforce/xfdb/57790</url>
<url>http://xforce.iss.net/xforce/xfdb/57791</url>
</references>
<dates>
<discovery>2010-04-16</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="a30573dc-4893-11df-a5f9-001641aeabdf">
<topic>krb5 -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.6.3_9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An authenticated remote attacker can causing a denial
of service by using a newer version of the kadmin protocol
than the server supports.</p>
<p>The MIT Kerberos team also reports the cause:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt">
<p>The Kerberos administration daemon (kadmind) can crash
due to referencing freed memory.</p>
</blockquote>
</body>
</description>
<references>
<bid>39247</bid>
<cvename>CVE-2010-0629</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt</url>
</references>
<dates>
<discovery>2010-04-06</discovery>
<entry>2010-04-18</entry>
</dates>
</vuln>
<vuln vid="9ac0f9c4-492b-11df-83fb-0015587e2cc1">
<topic>krb5 -- multiple denial of service vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range>
<ge>1.7</ge><le>1.7_2</le>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two vulnerabilities in krb5 can be used by remote
attackers in denial of service attacks. The MIT security
advisories report this as follows:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt">
<p>An unauthenticated remote attacker can send an invalid
request to a KDC process that will cause it to crash
due to an assertion failure, creating a denial of
service.</p>
</blockquote>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt">
<p>An unauthenticated remote attacker could cause a GSS-API
application, including the Kerberos administration
daemon (kadmind) to crash.</p>
</blockquote>
</body>
</description>
<references>
<bid>38260</bid>
<bid>38904</bid>
<cvename>CVE-2010-0283</cvename>
<cvename>CVE-2010-0628</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt</url>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt</url>
</references>
<dates>
<discovery>2010-02-16</discovery>
<entry>2010-04-19</entry>
<modified>2013-06-16</modified>
</dates>
</vuln>
<vuln vid="5053420c-4935-11df-83fb-0015587e2cc1">
<topic>mahara -- sql injection vulnerability</topic>
<affects>
<package>
<name>mahara</name>
<range><lt>1.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian security team reports:</p>
<blockquote cite="http://www.debian.org/security/2010/dsa-2030">
<p>It was discovered that mahara, an electronic portfolio,
weblog, and resume builder is not properly escaping input
when generating a unique username based on a remote user
name from a single sign-on application. An attacker can
use this to compromise the mahara database via crafted
user names.</p>
</blockquote>
</body>
</description>
<references>
<bid>39253</bid>
<cvename>CVE-2010-0400</cvename>
<url>http://www.debian.org/security/2010/dsa-2030</url>
</references>
<dates>
<discovery>2010-04-06</discovery>
<entry>2010-04-18</entry>
</dates>
</vuln>
<vuln vid="1a9f678d-48ca-11df-85f8-000c29a67389">
<topic>sudo -- Privilege escalation with sudoedit</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.7.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="">
<p>Sudo's command matching routine expects actual commands to include
one or more slash ('/') characters. The flaw is that sudo's path
resolution code did not add a "./" prefix to commands found in the
current working directory. This creates an ambiguity between a
"sudoedit" command found in the cwd and the "sudoedit"
pseudo-command in the sudoers file. As a result, a user may be
able to run an arbitrary command named "sudoedit" in the current
working directory. For the attack to be successful, the PATH
environment variable must include "." and may not include any other
directory that contains a "sudoedit" command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1163</cvename>
<url>http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html</url>
<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html</url>
</references>
<dates>
<discovery>2010-04-09</discovery>
<entry>2010-04-15</entry>
</dates>
</vuln>
<vuln vid="3987c5d1-47a9-11df-a0d5-0016d32f24fb">
<topic>KDM -- local privilege escalation vulnerability</topic>
<affects>
<package>
<name>kdebase</name>
<range><le>3.5.10_6</le></range>
</package>
<package>
<name>kdebase-workspace</name>
<range><le>4.3.5_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20100413-1.txt">
<p>KDM contains a race condition that allows local attackers
to make arbitrary files on the system world-writeable.
This can happen while KDM tries to create its control
socket during user login. A local attacker with a valid
local account can under certain circumstances make use of
this vulnerability to execute arbitrary code as root.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0436</cvename>
<url>http://www.kde.org/info/security/advisory-20100413-1.txt</url>
</references>
<dates>
<discovery>2010-04-13</discovery>
<entry>2010-04-14</entry>
<modified>2010-04-14</modified>
</dates>
</vuln>
<vuln vid="805603a1-3e7a-11df-a5a1-0050568452ac">
<topic>dojo -- cross-site scripting and other vulnerabilities</topic>
<affects>
<package>
<name>dojo</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Dojo Toolkit team reports:</p>
<blockquote cite="http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/">
<p>Some PHP files did not properly escape input.</p>
<p>Some files could operate like "open redirects". A bad actor
could form an URL that looks like it came from a trusted
site, but the user would be redirected or load content from
the bad actor's site.</p>
<p>A file exposed a more serious cross-site scripting
vulnerability with the possibility of executing code on the
domain where the file exists.</p>
<p>The Dojo build process defaulted to copying over tests and
demos, which are normally not needed and just increased the
number of files that could be targets of attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
<url>http://secunia.com/advisories/38964</url>
<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
</references>
<dates>
<discovery>2010-03-11</discovery>
<entry>2010-04-06</entry>
</dates>
</vuln>
<vuln vid="8ad1c404-3e78-11df-a5a1-0050568452ac">
<topic>Zend Framework -- security issues in bundled Dojo library</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-07">
<p>Several files in the bundled Dojo library were identified
as having potential exploits, and the Dojo team also advised
disabling or removing any PHP scripts in the Dojo library tree
when deploying to production.</p>
</blockquote>
</body>
</description>
<references>
<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
<url>http://framework.zend.com/security/advisory/ZF2010-07</url>
<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
<url>http://secunia.com/advisories/38964</url>
<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
</references>
<dates>
<discovery>2010-04-01</discovery>
<entry>2010-04-06</entry>
</dates>
</vuln>
<vuln vid="ec8f449f-40ed-11df-9edc-000f20797ede">
<topic>firefox -- Re-use of freed object due to scope confusion</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6,1</gt><lt>3.6.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2009-25 Re-use of freed object due to scope confusion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1121</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
</references>
<dates>
<discovery>2010-04-01</discovery>
<entry>2010-04-05</entry>
</dates>
</vuln>
<vuln vid="9ccfee39-3c3b-11df-9edc-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>seamonkey</name>
<range><gt>2.0</gt><lt>2.0.4</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.4</lt></range>
</package>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.9,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.19,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.0.19,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.9</lt></range>
</package>
<package>
<name>nss</name>
<name>linux-f10-nss</name>
<range><lt>3.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy</p>
<p>MFSA 2010-23 Image src redirect to mailto: URL opens email editor</p>
<p>MFSA 2010-22 Update NSS to support TLS renegotiation indication</p>
<p>MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy</p>
<p>MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop</p>
<p>MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray</p>
<p>MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView</p>
<p>MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection</p>
<p>MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0181</cvename>
<cvename>CVE-2009-3555</cvename>
<cvename>CVE-2010-0179</cvename>
<cvename>CVE-2010-0178</cvename>
<cvename>CVE-2010-0177</cvename>
<cvename>CVE-2010-0176</cvename>
<cvename>CVE-2010-0175</cvename>
<cvename>CVE-2010-0174</cvename>
<cvename>CVE-2010-0173</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-24.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-23.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-22.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-21.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-20.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-19.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-18.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-17.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-16.html</url>
</references>
<dates>
<discovery>2010-03-30</discovery>
<entry>2010-03-30</entry>
</dates>
</vuln>
<vuln vid="e050119b-3856-11df-b2b2-002170daae37">
<topic>postgresql -- bitsubstr overflow</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><ge>7.4</ge><lt>7.4.28</lt></range>
<range><ge>8.0</ge><lt>8.0.24</lt></range>
<range><ge>8.1</ge><lt>8.1.20</lt></range>
<range><ge>8.2</ge><lt>8.2.16</lt></range>
<range><ge>8.3</ge><lt>8.3.10</lt></range>
<range><ge>8.4</ge><lt>8.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/37973">
<p>PostgreSQL is prone to a buffer-overflow
vulnerability because the application fails to
perform adequate boundary checks on user-supplied
data.</p>
<p>Attackers can exploit this issue to execute
arbitrary code with elevated privileges or
crash the affected application.</p>
</blockquote>
</body>
</description>
<references>
<bid>37973</bid>
<cvename>CVE-2010-0442</cvename>
</references>
<dates>
<discovery>2010-01-27</discovery>
<entry>2010-03-25</entry>
</dates>
</vuln>
<vuln vid="c175d72f-3773-11df-8bb8-0211d880e350">
<topic>gtar -- buffer overflow in rmt client</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.22_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakob Lell reports:</p>
<blockquote cite="http://www.agrs.tu-berlin.de/index.php?id=78327">
<p>The rmt client implementation of GNU Tar/Cpio contains
a heap-based buffer overflow which possibly allows
arbitrary code execution.</p>
<p>The problem can be exploited when using an
untrusted/compromised rmt server.</p>
</blockquote>
</body>
</description> <references>
<cvename>CVE-2010-0624</cvename>
<url>http://www.agrs.tu-berlin.de/index.php?id=78327</url>
</references> <dates>
<discovery>2010-03-24</discovery> <entry>2010-03-24</entry>
</dates>
</vuln>
<vuln vid="5d5ed535-3653-11df-9edc-000f20797ede">
<topic>firefox -- WOFF heap corruption due to integer overflow</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6,1</gt><lt>3.6.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-08 WOFF heap corruption due to integer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1028</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-08.html</url>
</references>
<dates>
<discovery>2010-03-22</discovery>
<entry>2010-03-23</entry>
</dates>
</vuln>
<vuln vid="56cfe192-329f-11df-abb2-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.19</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch</p>
<p>MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail</p>
<p>MFSA 2009-68 NTLM reflection vulnerability</p>
<p>MFSA 2009-62 Download filename spoofing with RTL override</p>
<p>MFSA 2009-59 Heap buffer overflow in string to number conversion</p>
<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0161</cvename>
<cvename>CVE-2010-0163</cvename>
<cvename>CVE-2009-3075</cvename>
<cvename>CVE-2009-3072</cvename>
<cvename>CVE-2009-2463</cvename>
<cvename>CVE-2009-3385</cvename>
<cvename>CVE-2009-3983</cvename>
<cvename>CVE-2009-3376</cvename>
<cvename>CVE-2009-0689</cvename>
<cvename>CVE-2009-3077</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-07.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-06.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
</references>
<dates>
<discovery>2010-03-16</discovery>
<entry>2010-03-19</entry>
</dates>
</vuln>
<vuln vid="e39caf05-2d6f-11df-aec2-000c29ba66d2">
<topic>egroupware -- two vulnerabilities</topic>
<affects>
<package>
<name>egroupware</name>
<range><lt>1.6.003</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Egroupware Team report:</p>
<blockquote cite="http://www.egroupware.org/Home?category_id=95&item=93">
<p>Nahuel Grisolia from CYBSEC S.A. Security Systems found two security
problems in EGroupware:</p>
<p>Serious remote command execution (allowing to run arbitrary command
on the web server by simply issuing a HTTP request!).</p>
<p>A reflected cross-site scripting (XSS).</p>
<p>Both require NO valid EGroupware account and work without being logged
in!</p>
</blockquote>
</body>
</description>
<references>
<bid>38609</bid>
<url>http://secunia.com/advisories/38859/</url>
<url>http://www.egroupware.org/Home?category_id=95&item=93</url>
</references>
<dates>
<discovery>2010-03-09</discovery>
<entry>2010-03-11</entry>
</dates>
</vuln>
<vuln vid="b3531fe1-2b03-11df-b6db-00248c9b4be7">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.22</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/731710">
<p>A user-supplied value is directly output during installation
allowing a malicious user to craft a URL and perform a cross-site
scripting attack. The exploit can only be conducted on sites not yet
installed.</p>
<p>The API function drupal_goto() is susceptible to a phishing attack.
An attacker could formulate a redirect in a way that gets the Drupal
site to send the user to an arbitrarily provided URL. No user
submitted data will be sent to that URL.</p>
<p>Locale module and dependent contributed modules do not sanitize the
display of language codes, native and English language names properly.
While these usually come from a preselected list, arbitrary
administrator input is allowed. This vulnerability is mitigated by the
fact that the attacker must have a role with the 'administer
languages' permission.</p>
<p>Under certain circumstances, a user with an open session that is
blocked can maintain his/her session on the Drupal site, despite being
blocked.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/731710</url>
</references>
<dates>
<discovery>2010-03-03</discovery>
<entry>2010-03-08</entry>
</dates>
</vuln>
<vuln vid="018a84d0-2548-11df-b4a3-00e0815b8da8">
<topic>sudo -- Privilege escalation with sudoedit</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.7.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="">
<p>When sudo performs its command matching, there is a special case
for pseudo-commands in the sudoers file (currently, the only
pseudo-command is sudoedit). Unlike a regular command,
pseudo-commands do not begin with a slash ('/'). The flaw is that
sudo's the matching code would only check against the list of
pseudo-commands if the user-specified command also contained no
slashes. As a result, if the user ran "sudo ./sudoedit" the normal
matching code path was followed, which uses stat(2) to verify that
the user-specified command matches the one in sudoers. In this
case, it would compare the "./sudoedit" specified by the user with
"sudoedit" from the sudoers file, resulting in a positive
match.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html</url>
<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html</url>
<url>http://secunia.com/advisories/38659</url>
<cvename>CVE-2010-0426</cvename>
<bid>38362</bid>
</references>
<dates>
<discovery>2010-01-29</discovery>
<entry>2010-03-01</entry>
</dates>
</vuln>
<vuln vid="c97d7a37-2233-11df-96dd-001b2134ef46">
<topic>openoffice.org -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openoffice.org</name>
<range><lt>3.2.0</lt></range>
<range><ge>3.2.20010101</ge><lt>3.2.20100203</lt></range>
<range><ge>3.3.20010101</ge><lt>3.3.20100207</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenOffice.org Security Team reports:</p>
<blockquote cite="http://www.openoffice.org/security/bulletin.html">
<p>Fixed in OpenOffice.org 3.2</p>
<p>CVE-2006-4339: Potential vulnerability from 3rd party
libxml2 libraries</p>
<p>CVE-2009-0217: Potential vulnerability from 3rd party
libxmlsec libraries</p>
<p>CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable
version of MSVC Runtime</p>
<p>CVE-2009-2949: Potential vulnerability related to XPM file
processing</p>
<p>CVE-2009-2950: Potential vulnerability related to GIF file
processing</p>
<p>CVE-2009-3301/2: Potential vulnerability related to MS-Word
document processing</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/bulletin.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2006-4339.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2009-0217.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2009-2493.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2009-2949.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2009-2950.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html</url>
<cvename>CVE-2006-4339</cvename>
<cvename>CVE-2009-0217</cvename>
<cvename>CVE-2009-2493</cvename>
<cvename>CVE-2009-2949</cvename>
<cvename>CVE-2009-2950</cvename>
<cvename>CVE-2009-3301</cvename>
<cvename>CVE-2009-3302</cvename>
</references>
<dates>
<discovery>2006-08-24</discovery>
<entry>2010-02-25</entry>
<modified>2010-02-27</modified>
</dates>
</vuln>
<vuln vid="f82c85d8-1c6e-11df-abb2-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.8,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.18,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.0.18,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-05 XSS hazard using SVG document and binary Content-Type</p>
<p>MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain</p>
<p>MFSA 2010-03 Use-after-free crash in HTML parser</p>
<p>MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability</p>
<p>MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0159</cvename>
<cvename>CVE-2010-0160</cvename>
<cvename>CVE-2009-1571</cvename>
<cvename>CVE-2009-3988</cvename>
<cvename>CVE-2010-0162</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-01.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-02.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-03.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-04.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-05.html</url>
</references>
<dates>
<discovery>2010-02-17</discovery>
<entry>2010-02-18</entry>
<modified>2010-02-28</modified>
</dates>
</vuln>
<vuln vid="1a3bd81f-1b25-11df-bd1a-002170daae37">
<topic>lighttpd -- denial of service vulnerability</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd security advisory reports:</p>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt">
<p>If you send the request data very slow (e.g. sleep
0.01 after each byte), lighttpd will easily use all
available memory and die (especially for parallel
requests), allowing a DoS within minutes.</p>
</blockquote>
</body>
</description>
<references>
<bid>38036</bid>
<cvename>CVE-2010-0295</cvename>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt</url>
</references>
<dates>
<discovery>2010-02-02</discovery>
<entry>2010-02-16</entry>
</dates>
</vuln>
<vuln vid="81d9dc0c-1988-11df-8e66-0019996bc1f7">
<topic>squid -- Denial of Service vulnerability in HTCP</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.7.1</ge><lt>2.7.7_4</lt></range>
<range><ge>3.0.1</ge><lt>3.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2010:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_2.txt">
<p>Due to incorrect processing Squid is vulnerable to a
denial of service attack when receiving specially crafted
HTCP packets.</p>
<p>This problem allows any machine to perform a denial
of service attack on the Squid service when its HTCP port
is open.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0639</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2010_2.txt</url>
</references>
<dates>
<discovery>2010-02-12</discovery>
<entry>2010-02-14</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="ff6519ad-18e5-11df-9bdd-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r262</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.0r45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-06.html">
<p>A critical vulnerability has been identified in Adobe
Flash Player version 10.0.42.34 and earlier. This
vulnerability (CVE-2010-0186) could subvert the domain sandbox
and make unauthorized cross-domain requests. This update also
resolves a potential Denial of Service issue (CVE-2010-0187).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0186</cvename>
<cvename>CVE-2010-0187</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-06.html</url>
</references>
<dates>
<discovery>2010-02-11</discovery>
<entry>2010-02-13</entry>
</dates>
</vuln>
<vuln vid="0a82ac0c-1886-11df-b0d1-0015f2db7bde">
<topic>gnome-screensaver -- Multiple monitor hotplug issues</topic>
<affects>
<package>
<name>gnome-screensaver</name>
<range><lt>2.28.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ray Strode reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609337">
<p>Under certain circumstances it is possible to circumvent the security of screen
locking functionality of gnome-screensaver by changing the systems physical
monitor configuration.</p>
</blockquote>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609789">
<p>gnome-screensaver can lose its keyboard grab when locked, exposing the system
to intrusion by adding and removing monitors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0414</cvename>
<cvename>CVE-2010-0422</cvename>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=609337</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=609789</url>
</references>
<dates>
<discovery>2010-02-08</discovery>
<entry>2010-02-13</entry>
</dates>
</vuln>
<vuln vid="2a6a966f-1774-11df-b5c1-0026189baca3">
<topic>fetchmail -- heap overflow on verbose X.509 display</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.11</ge><lt>6.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2010-01.txt">
<p>In verbose mode, fetchmail prints X.509 certificate subject and
issuer information to the user, and counts and allocates a malloc()
buffer for that purpose.</p>
<p>If the material to be displayed contains characters with high bit
set and the platform treats the "char" type as signed, this can cause
a heap buffer overrun because non-printing characters are escaped as
\xFF..FFnn, where nn is 80..FF in hex.</p>
</blockquote>
</body>
</description>
<references>
<bid>38088</bid>
<cvename>CVE-2010-0562</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2010-01.txt</url>
<mlist msgid="20100205014643.GA25506@merlin.emma.line.org">https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html</mlist>
</references>
<dates>
<discovery>2010-02-04</discovery>
<entry>2010-02-12</entry>
</dates>
</vuln>
<vuln vid="bb0a8795-15dc-11df-bf0a-002170daae37">
<topic>wireshark -- LWRES vulnerability</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark project reports:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2010-02.html">
<p>Babi discovered several buffer overflows in the
LWRES dissector.</p>
<p>It may be possible to make Wireshark crash remotely
or by convincing someone to read a malformed packet
trace file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0304</cvename>
<url>http://secunia.com/advisories/38257/</url>
<url>http://www.wireshark.org/security/wnpa-sec-2010-02.html</url>
</references>
<dates>
<discovery>2010-01-27</discovery>
<entry>2010-02-10</entry>
</dates>
</vuln>
<vuln vid="6b575419-14cf-11df-a628-001517351c22">
<topic>otrs -- SQL injection</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2010-01-en/">
<p>Missing security quoting for SQL statements allows agents and
customers to manipulate SQL queries. So it's possible for
authenticated users to inject SQL queries
via string manipulation of statements.</p>
<p>A malicious user may be able to manipulate SQL queries to read
or modify records in the database. This way it could also be
possible to get access to more permissions (e. g. administrator
permissions).</p>
<p>To use this vulnerability the malicious user needs to have
a valid Agent- or Customer-session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0438</cvename>
<url>http://otrs.org/advisory/OSA-2010-01-en/</url>
</references>
<dates>
<discovery>2010-02-08</discovery>
<entry>2010-02-08</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="cae01d7b-110d-11df-955a-00219b0fc4d8">
<topic>apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long)</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.42</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.42</lt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.42</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><ge>0</ge></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.42+30.23</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.42</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><lt>1.3.42.1.57_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><lt>1.3.41+2.8.27_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache ChangeLog reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_1.3.42">
<p>Integer overflow in the ap_proxy_send_fb function in
proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before
1.3.42 on 64-bit platforms allows remote origin servers to cause a
denial of service (daemon crash) or possibly execute arbitrary code
via a large chunk size that triggers a heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010</url>
<url>http://www.security-database.com/detail.php?alert=CVE-2010-0010</url>
<url>http://security-tracker.debian.org/tracker/CVE-2010-0010</url>
<url>http://www.vupen.com/english/Reference-CVE-2010-0010.php</url>
</references>
<dates>
<discovery>2009-06-30</discovery>
<entry>2010-02-03</entry>
<modified>2010-02-03</modified>
</dates>
</vuln>
<vuln vid="296ecb59-0f6b-11df-8bab-0019996bc1f7">
<topic>squid -- Denial of Service vulnerability in DNS handling</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.7.1</ge><lt>2.7.7_3</lt></range>
<range><ge>3.0.1</ge><lt>3.0.23</lt></range>
<range><ge>3.1.0.1</ge><lt>3.1.0.15_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2010:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_1.txt">
<p>Due to incorrect data validation Squid is vulnerable to a denial
of service attack when processing specially crafted DNS packets.</p>
<p>This problem allows any trusted client or external server who can
determine the squid receiving port to perform a short-term denial
of service attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0308</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2010_1.txt</url>
</references>
<dates>
<discovery>2010-01-14</discovery>
<entry>2010-02-01</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="696053c6-0f50-11df-a628-001517351c22">
<topic>bugzilla -- information leak</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>3.3.1</gt><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.0.10/">
<p>When moving a bug from one product to another, an intermediate
page is displayed letting you select the groups the bug should
be restricted to in the new product. However, a regression in
the 3.4.x series made it ignore all groups which are not
available in both products. As a workaround, you had to move
the bug to the new product first and then restrict it to the
desired groups, in two distinct steps, which could make the bug
temporarily public.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3387</cvename>
<url>http://www.bugzilla.org/security/3.0.10/</url>
</references>
<dates>
<discovery>2010-01-31</discovery>
<entry>2010-02-01</entry>
</dates>
</vuln>
<vuln vid="192609c8-0c51-11df-82a0-00248c9b4be7">
<topic>irc-ratbox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ircd-ratbox</name>
<range><lt>2.2.9</lt></range>
</package>
<package>
<name>ircd-ratbox-devel</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/509201">
<p>The first affects the /quote HELP module and allows a user
to trigger an IRCD crash on some platforms.</p>
<p>The second affects the /links processing module when the
flatten_links configuration option is not enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4016</cvename>
<cvename>CVE-2010-0300</cvename>
<url>http://www.debian.org/security/2010/dsa-1980</url>
<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html</url>
<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html</url>
</references>
<dates>
<discovery>2010-01-25</discovery>
<entry>2010-01-28</entry>
</dates>
</vuln>
<vuln vid="848539dc-0458-11df-8dd7-002170daae37">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20091225_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dokuwiki reports:</p>
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1853">
<p>The plugin does no checks against cross-site request
forgeries (CSRF) which can be exploited to e.g. change
the access control rules by tricking a logged in
administrator into visiting a malicious web site.</p>
</blockquote>
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1847">
<p>The bug allows listing the names of arbitrary file on
the webserver - not their contents. This could leak
private information about wiki pages and server structure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0288</cvename>
<cvename>CVE-2010-0287</cvename>
<cvename>CVE-2010-0289</cvename>
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1847</url>
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1853</url>
</references>
<dates>
<discovery>2010-01-17</discovery>
<entry>2010-01-18</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="c9263916-006f-11df-94cb-0050568452ac">
<topic>Zend Framework -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-06">
<p>Potential XSS or HTML Injection vector in Zend_Json.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-05">
<p>Potential XSS vector in Zend_Service_ReCaptcha_MailHide.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-04">
<p>Potential MIME-type Injection in Zend_File_Transfer
Executive Summary.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-03">
<p>Potential XSS vector in Zend_Filter_StripTags when
comments allowed.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-02">
<p>Potential XSS vector in Zend_Dojo_View_Helper_Editor.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-01">
<p>Potential XSS vectors due to inconsistent encodings.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-02">
<p>XSS vector in Zend_Filter_StripTags.</p>
</blockquote>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-01">
<p>LFI vector in Zend_View::setScriptPath() and render().</p>
</blockquote>
</body>
</description>
<references>
<url>http://framework.zend.com/security/advisory/ZF2010-06</url>
<url>http://framework.zend.com/security/advisory/ZF2010-05</url>
<url>http://framework.zend.com/security/advisory/ZF2010-04</url>
<url>http://framework.zend.com/security/advisory/ZF2010-03</url>
<url>http://framework.zend.com/security/advisory/ZF2010-02</url>
<url>http://framework.zend.com/security/advisory/ZF2010-01</url>
<url>http://framework.zend.com/security/advisory/ZF2009-02</url>
<url>http://framework.zend.com/security/advisory/ZF2009-01</url>
</references>
<dates>
<discovery>2009-12-31</discovery>
<entry>2010-01-11</entry>
</dates>
</vuln>
<vuln vid="dd8f2394-fd08-11de-b425-00215c6a37bb">
<topic>powerdns-recursor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>3.1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-01.html">
<p>PowerDNS Recursor up to and including 3.1.7.1 can be
brought down and probably exploited.</p>
</blockquote>
<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-02.html">
<p>PowerDNS Recursor up to and including 3.1.7.1 can be
spoofed into accepting bogus data</p>
</blockquote>
</body>
</description>
<references>
<bid>37650</bid>
<bid>37653</bid>
<cvename>CVE-2009-4010</cvename>
<cvename>CVE-2009-4009</cvename>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-01-09</entry>
</dates>
</vuln>
<vuln vid="56ba8728-f987-11de-b28d-00215c6a37bb">
<topic>PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection</topic>
<affects>
<package>
<name>pear-Net_Ping</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>pear-Net_Traceroute</name>
<range><lt>0.21.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PEAR Security Advisory reports:</p>
<blockquote cite="http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/">
<p>Multiple remote arbitrary command injections have been
found in the Net_Ping and Net_Traceroute.</p>
<p>When input from forms are used directly, the attacker
could pass variables that would allow him to execute
remote arbitrary command injections.</p>
</blockquote>
</body>
</description>
<references>
<bid>37093</bid>
<bid>37094</bid>
<cvename>CVE-2009-4024</cvename>
<cvename>CVE-2009-4025</cvename>
<url>http://pear.php.net/advisory20091114-01.txt</url>
</references>
<dates>
<discovery>2009-11-14</discovery>
<entry>2010-01-04</entry>
</dates>
</vuln>
<vuln vid="751823d4-f189-11de-9344-00248c9b4be7">
<topic>drupal -- multiple cross-site scripting</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.21</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/661586">
<p>The Contact module does not correctly handle certain user input
when displaying category information. Users privileged to create
contact categories can insert arbitrary HTML and script code into the
contact module administration page. Such a cross-site scripting attack
may lead to the malicious user gaining administrative access.</p>
<p>The Menu module does not correctly handle certain user input when
displaying the menu administration overview. Users privileged to
create new menus can insert arbitrary HTML and script code into the
menu module administration page. Such a cross-site scripting attack
may lead to the malicious user gaining administrative access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4370</cvename>
<url>http://drupal.org/node/661586</url>
</references>
<dates>
<discovery>2009-12-16</discovery>
<entry>2009-12-25</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="4d6076fe-ee7a-11de-9cd0-001a926c7637">
<topic>fuser -- missing user's privileges check</topic>
<affects>
<package>
<name>fuser</name>
<range><lt>1142334561_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Denis Barov reports:</p>
<blockquote>
<p>sysutils/fuser allows user to send any signal to any process when
installed with suid bit.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/141852</freebsdpr>
</references>
<dates>
<discovery>2009-09-15</discovery>
<entry>2009-12-21</entry>
</dates>
</vuln>
<vuln vid="4465c897-ee5c-11de-b6ef-00215c6a37bb">
<topic>monkey -- improper input validation vulnerability</topic>
<affects>
<package>
<name>monkey</name>
<range><lt>0.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Census Labs reports:</p>
<blockquote cite="http://census-labs.com/news/2009/12/14/monkey-httpd/">
<p>We have discovered a remotely exploitable
"improper input validation" vulnerability in the Monkey
web server that allows an attacker to perform denial of
service attacks by repeatedly crashing worker threads
that process HTTP requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://census-labs.com/news/2009/12/14/monkey-httpd/</url>
<url>http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/</url>
</references>
<dates>
<discovery>2009-12-14</discovery>
<entry>2009-12-21</entry>
</dates>
</vuln>
<vuln vid="39a25a63-eb5c-11de-b650-00215c6a37bb">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_12.php">
<p>This release focuses on improving the stability of the
PHP 5.2.x branch with over 60 bug fixes, some of which
are security related. All users of PHP 5.2 are encouraged
to upgrade to this release.</p>
<p>Security Enhancements and Fixes in PHP 5.2.12:</p>
<ul>
<li>Fixed a safe_mode bypass in tempnam() identified by
Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)</li>
<li>Fixed a open_basedir bypass in posix_mkfifo()
identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)</li>
<li>Added "max_file_uploads" INI directive, which can
be set to limit the number of file uploads per-request
to 20 by default, to prevent possible DOS via temporary
file exhaustion, identified by Bogdan Calin.
(CVE-2009-4017, Ilia)</li>
<li>Added protection for $_SESSION from interrupt
corruption and improved "session.save_path" check,
identified by Stefan Esser. (CVE-2009-4143, Stas)</li>
<li>Fixed bug #49785 (insufficient input string
validation of htmlspecialchars()). (CVE-2009-4142,
Moriyoshi, hello at iwamot dot com)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3557</cvename>
<cvename>CVE-2009-3558</cvename>
<cvename>CVE-2009-4017</cvename>
<cvename>CVE-2009-4142</cvename>
<cvename>CVE-2009-4143</cvename>
<url>http://www.php.net/releases/5_2_12.php</url>
</references>
<dates>
<discovery>2009-12-17</discovery>
<entry>2009-12-17</entry>
</dates>
</vuln>
<vuln vid="e7bc5600-eaa0-11de-bd9c-00215c6a37bb">
<topic>postgresql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql-client</name>
<name>postgresql-server</name>
<range><ge>7.4</ge><lt>7.4.27</lt></range>
<range><ge>8.0</ge><lt>8.0.23</lt></range>
<range><ge>8.1</ge><lt>8.1.19</lt></range>
<range><ge>8.2</ge><lt>8.2.15</lt></range>
<range><ge>8.3</ge><lt>8.3.9</lt></range>
<range><ge>8.4</ge><lt>8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034">
<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
and 8.4.x before 8.4.2 does not properly handle a '\0' character
in a domain name in the subject's Common Name (CN) field of an
X.509 certificate, which (1) allows man-in-the-middle attackers
to spoof arbitrary SSL-based PostgreSQL servers via a crafted
server certificate issued by a legitimate Certification Authority,
and (2) allows remote attackers to bypass intended client-hostname
restrictions via a crafted client certificate issued by a legitimate
Certification Authority, a related issue to CVE-2009-2408.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136">
<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
and 8.4.x before 8.4.2 does not properly manage session-local
state during execution of an index function by a database
superuser, which allows remote authenticated users to gain
privileges via a table with crafted index functions, as
demonstrated by functions that modify (1) search_path or
(2) a prepared statement, a related issue to CVE-2007-6600
and CVE-2009-3230.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4034</cvename>
<cvename>CVE-2009-4136</cvename>
</references>
<dates>
<discovery>2009-11-20</discovery>
<entry>2009-12-17</entry>
</dates>
</vuln>
<vuln vid="5486669e-ea9f-11de-bd9c-00215c6a37bb">
<topic>tptest -- pwd Remote Stack Buffer Overflow</topic>
<affects>
<package>
<name>tptest</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33785">
<p>TPTEST is prone to a remote stack-based buffer-overflow
vulnerability. An attacker can exploit this issue to
execute arbitrary code within the context of the affected
application. Failed exploit attempts will result in a
denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>33785</bid>
</references>
<dates>
<discovery>2009-02-16</discovery>
<entry>2009-12-17</entry>
</dates>
</vuln>
<vuln vid="01c57d20-ea26-11de-bd39-00248c9b4be7">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.6,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.16,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.0.16,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.0.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2009-71 GeckoActiveXObject exception messages can be used to
enumerate installed COM objects</p>
<p>MFSA 2009-70 Privilege escalation via chrome window.opener</p>
<p>MFSA 2009-69 Location bar spoofing vulnerabilities</p>
<p>MFSA 2009-68 NTLM reflection vulnerability</p>
<p>MFSA 2009-67 Integer overflow, crash in libtheora video
library</p>
<p>MFSA 2009-66 Memory safety fixes in liboggplay media library</p>
<p>MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/
1.9.0.16)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3388</cvename>
<cvename>CVE-2009-3389</cvename>
<cvename>CVE-2009-3979</cvename>
<cvename>CVE-2009-3980</cvename>
<cvename>CVE-2009-3981</cvename>
<cvename>CVE-2009-3982</cvename>
<cvename>CVE-2009-3983</cvename>
<cvename>CVE-2009-3984</cvename>
<cvename>CVE-2009-3985</cvename>
<cvename>CVE-2009-3986</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-71.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-70.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-69.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-67.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-66.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-65.html</url>
</references>
<dates>
<discovery>2009-12-16</discovery>
<entry>2009-12-16</entry>
<modified>2010-01-21</modified>
</dates>
</vuln>
<vuln vid="1b3f854b-e4bd-11de-b276-000d8787e1be">
<topic>freeradius -- remote packet of death vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<range><lt>1.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freeRADIUS Vulnerability Notifications reports:</p>
<blockquote cite="http://freeradius.org/security.html">
<p>2009.09.09 v1.1.7 - Anyone who can send packets to
the server can crash it by sending a Tunnel-Password
attribute in an Access-Request packet. This
vulnerability is not otherwise exploitable. We have
released 1.1.8 to correct this vulnerability.</p>
<p>This issue is similar to the previous Tunnel-Password
issue noted below. The vulnerable versions are 1.1.3
through 1.1.7. Version 2.x is not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3111</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111</url>
<url>http://freeradius.org/security.html</url>
<url>http://www.milw0rm.com/exploits/9642</url>
</references>
<dates>
<discovery>2009-09-09</discovery>
<entry>2009-12-14</entry>
<modified>2009-12-14</modified>
</dates>
</vuln>
<vuln vid="bec38383-e6cb-11de-bdd4-000c2930e89b">
<topic>pligg -- Cross-Site Scripting and Cross-Site Request Forgery</topic>
<affects>
<package>
<name>pligg</name>
<range><lt>1.0.3b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/37349">
<p>Russ McRee has discovered some vulnerabilities in Pligg, which can
be exploited by malicious people to conduct cross-site scripting and
request forgery attacks.</p>
<p>Input passed via the "Referer" HTTP header to various scripts (e.g.
admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php,
submit.php, submit_groups.php, user_add_remove_links.php, and
user_settings.php) is not properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.</p>
<p>The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests.
This can be exploited to e.g. create an arbitrary user with administrative
privileges if a logged-in administrative user visits a malicious web
site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4786</cvename>
<cvename>CVE-2009-4787</cvename>
<cvename>CVE-2009-4788</cvename>
<url>http://secunia.com/advisories/37349/</url>
<url>http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/</url>
</references>
<dates>
<discovery>2009-12-02</discovery>
<entry>2009-12-12</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="fcbf56dd-e667-11de-920a-00248c9b4be7">
<topic>piwik -- php code execution</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>0.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/37649">
<p>Stefan Esser has reported a vulnerability in Piwik, which can be
exploited by malicious people to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to the core/Cookie.php script using
"unserialize()" with user controlled input. This can be exploited to
e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()"
methods of a serialized object passed via an HTTP cookie.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4137</cvename>
<url>http://secunia.com/advisories/37649/</url>
<url>http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html</url>
<url>http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/</url>
</references>
<dates>
<discovery>2009-12-10</discovery>
<entry>2009-12-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="30211c45-e52a-11de-b5cd-00e0815b8da8">
<topic>dovecot -- Insecure directory permissions</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>1.2.*</ge><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot author reports:</p>
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2009-November/000143.html">
<p>Dovecot v1.2.x had been creating base_dir (and its parents if
necessary) with 0777 permissions. The base_dir's permissions get
changed to 0755 automatically at startup, but you may need to
chmod the parent directories manually.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3897</cvename>
<bid>37084</bid>
<url>http://secunia.com/advisories/37443</url>
</references>
<dates>
<discovery>2009-11-20</discovery>
<entry>2009-12-10</entry>
</dates>
</vuln>
<vuln vid="3c1a672e-e508-11de-9f4a-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r260</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.0r42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb09-19.html">
<p>Critical vulnerabilities have been identified in Adobe
Flash Player version 10.0.32.18 and earlier. These
vulnerabilities could cause the application to crash and
could potentially allow an attacker to take control of the
affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3794</cvename>
<cvename>CVE-2009-3796</cvename>
<cvename>CVE-2009-3797</cvename>
<cvename>CVE-2009-3798</cvename>
<cvename>CVE-2009-3799</cvename>
<cvename>CVE-2009-3800</cvename>
<cvename>CVE-2009-3951</cvename>
<url>http://www.zerodayinitiative.com/advisories/ZDI-09-092/</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-09-093/</url>
<url>http://www.adobe.com/support/security/bulletins/apsb09-19.html</url>
</references>
<dates>
<discovery>2009-07-14</discovery>
<entry>2009-12-09</entry>
</dates>
</vuln>
<vuln vid="eab8c3bd-e50c-11de-9cd0-001a926c7637">
<topic>ruby -- heap overflow vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9.1,1</ge><lt>1.9.1.376,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/">
<p>There is a heap overflow vulnerability in String#ljust,
String#center and String#rjust. This has allowed an attacker to run
arbitrary code in some rare cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4124</cvename>
<url>http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/</url>
</references>
<dates>
<discovery>2009-11-30</discovery>
<entry>2009-12-09</entry>
</dates>
</vuln>
<vuln vid="714c1406-e4cf-11de-883a-003048590f9e">
<topic>rt -- Session fixation vulnerability</topic>
<affects>
<package>
<name>rt</name>
<range><lt>3.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/37546">
<p>A vulnerability has been reported in RT, which can be exploited by
malicious people to conduct session fixation attacks.
The vulnerability is caused due to an error in the handling of
sessions and can be exploited to hijack another user's session by
tricking the user into logging in after following a specially crafted
link.</p>
</blockquote>
</body>
</description>
<references>
<bid>37162</bid>
<cvename>CVE-2009-3585</cvename>
</references>
<dates>
<discovery>2009-12-01</discovery>
<entry>2009-12-09</entry>
</dates>
</vuln>
<vuln vid="5f030587-e39a-11de-881e-001aa0166822">
<topic>expat2 -- Parser crash with specially formatted UTF-8 sequences</topic>
<affects>
<package>
<name>expat2</name>
<name>linux-f10-expat</name>
<range><lt>2.0.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
<p>The updatePosition function in lib/xmltok_impl.c in
libexpat in Expat 2.0.1, as used in Python, PyXML,
w3c-libwww, and other software, allows context-dependent
attackers to cause a denial of service (application crash)
via an XML document with crafted UTF-8 sequences that
trigger a buffer over-read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3720</cvename>
</references>
<dates>
<discovery>2009-01-17</discovery>
<entry>2009-12-08</entry>
</dates>
</vuln>
<vuln vid="e9fca207-e399-11de-881e-001aa0166822">
<topic>expat2 -- buffer over-read and crash</topic>
<affects>
<package>
<name>expat2</name>
<range><lt>2.0.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in
Expat 2.0.1, as used in the XML-Twig module for Perl, allows
context-dependent attackers to cause a denial of service
(application crash) via an XML document with malformed UTF-8
sequences that trigger a buffer over-read, related to the
doProlog function in lib/xmlparse.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3560</cvename>
</references>
<dates>
<discovery>2009-10-05</discovery>
<entry>2009-12-08</entry>
</dates>
</vuln>
<vuln vid="6431c4db-deb4-11de-9078-0030843d3802">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.10.20091120</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1010/">
<ul>
<li>Fixed a heap buffer overflow in string to number conversion</li>
<li>Fixed an issue where error messages could leak onto unrelated
sites</li>
<li>Fixed a moderately severe issue, as reported by Chris Evans of
the Google Security Team; details will be disclosed at a later
date.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0689</cvename>
<cvename>CVE-2009-4071</cvename>
<url>http://www.opera.com/support/kb/view/941/</url>
<url>http://www.opera.com/support/kb/view/942/</url>
</references>
<dates>
<discovery>2009-11-23</discovery>
<entry>2009-12-01</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="77c14729-dc5e-11de-92ae-02e0184b8d35">
<topic>libtool -- Library Search Path Privilege Escalation Issue</topic>
<affects>
<package>
<name>libtool</name>
<range><lt>2.2.6b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia.com</p>
<blockquote cite="http://secunia.com/advisories/37414/">
<p>Do not attempt to load an unqualified module.la file from the
current directory (by default) since doing so is insecure and is
not compliant with the documentation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3736</cvename>
<url>http://secunia.com/advisories/37414/</url>
<url>http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html</url>
</references>
<dates>
<discovery>2009-11-25</discovery>
<entry>2009-11-28</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="94edff42-d93d-11de-a434-0211d880e350">
<topic>libvorbis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.2.3_1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ubuntu security team reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-861-1">
<p>It was discovered that libvorbis did not correctly
handle certain malformed vorbis files. If a user were
tricked into opening a specially crafted vorbis file
with an application that uses libvorbis, an attacker
could cause a denial of service or possibly execute
arbitrary code with the user's privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2009-3379</cvename>
</references>
<dates>
<discovery>2009-11-24</discovery>
<entry>2009-11-24</entry>
</dates>
</vuln>
<vuln vid="92ca92c1-d859-11de-89f9-001517351c22">
<topic>bugzilla -- information leak</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>3.3.1</gt><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.3/">
<p>When a bug is in a group, none of its information
(other than its status and resolution) should be visible
to users outside that group. It was discovered that
as of 3.3.2, Bugzilla was showing the alias of the bug
(a very short string used as a shortcut for looking up
the bug) to users outside of the group, if the protected
bug ended up in the "Depends On" or "Blocks" list of any
other bug.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3386</cvename>
<url>http://www.bugzilla.org/security/3.4.3/</url>
</references>
<dates>
<discovery>2009-11-18</discovery>
<entry>2009-11-23</entry>
</dates>
</vuln>
<vuln vid="04104985-d846-11de-84e4-00215af774f0">
<topic>cacti -- cross-site scripting issues</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7e4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti development team reports:</p>
<blockquote cite="http://docs.cacti.net/#cross-site_scripting_fixes">
<p>The Cross-Site Scripting patch has been posted.</p>
<p>This patch addresses cross-site scripting issues reported
by Moritz Naumann.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4032</cvename>
<url>http://docs.cacti.net/#cross-site_scripting_fixes</url>
</references>
<dates>
<discovery>2009-11-21</discovery>
<entry>2009-11-23</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="0640198a-d117-11de-b667-0030843d3802">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>2.8.6,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>2.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/37332/">
<p>The security issue is caused due to the wp_check_filetype()
function in /wp-includes/functions.php improperly validating uploaded
files. This can be exploited to execute arbitrary PHP code by
uploading a malicious PHP script with multiple extensions.</p>
<p>Successful exploitation of this vulnerability requires that Apache
is not configured to handle the mime-type for media files with an e.g.
"gif", "jpg", "png", "tif", "wmv" extension.</p>
<p>Input passed via certain parameters to press-this.php is not
properly sanitised before being displayed to the user. This can be
exploited to insert arbitrary HTML and script code, which will be
executed in a user's browser session in context of an affected site
when the malicious data is being viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3890</cvename>
<cvename>CVE-2009-3891</cvename>
<url>http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/</url>
<url>http://secunia.com/advisories/37332/</url>
</references>
<dates>
<discovery>2009-11-12</discovery>
<entry>2009-11-14</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="68bda678-caab-11de-a97e-be89dfd1042e">
<topic>p5-HTML-Parser -- denial of service</topic>
<affects>
<package>
<name>p5-HTML-Parser</name>
<range><lt>3.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3627">
<p>The decode_entities function in util.c in HTML-Parser before
3.63 allows context-dependent attackers to cause a denial of service
(infinite loop) via an incomplete SGML numeric character reference,
which triggers generation of an invalid UTF-8 character.</p>
</blockquote>
</body>
</description>
<references>
<bid>36807</bid>
<cvename>CVE-2009-3627</cvename>
<url>http://secunia.com/advisories/37155</url>
</references>
<dates>
<discovery>2009-10-23</discovery>
<entry>2009-11-06</entry>
</dates>
</vuln>
<vuln vid="4e8344a3-ca52-11de-8ee8-00215c6a37bb">
<topic>gd -- '_gdGetColors' remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.0.35_2,1</lt></range>
</package>
<package>
<name>php5-gd</name>
<range><lt>5.2.11_2</lt></range>
</package>
<package>
<name>php4-gd</name>
<range><lt>4.4.9_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and
5.3.0, and the GD Graphics Library 2.x, does not properly
verify a certain colorsTotal structure member, which might
allow remote attackers to conduct buffer overflow or buffer
over-read attacks via a crafted GD file, a different
vulnerability than CVE-2009-3293.</p>
</blockquote>
</body>
</description>
<references>
<bid>36712</bid>
<cvename>CVE-2009-3546</cvename>
<url>http://secunia.com/advisories/37069</url>
<url>http://secunia.com/advisories/37080</url>
</references>
<dates>
<discovery>2009-10-15</discovery>
<entry>2009-11-05</entry>
<modified>2010-06-17</modified>
</dates>
</vuln>
<vuln vid="6693bad2-ca50-11de-8ee8-00215c6a37bb">
<topic>typo3 -- multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>4.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 develop team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/">
<p>Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12
and below, 4.2.9 and below, 4.3.0beta1 and below.</p>
<p>SQL injection, Cross-site scripting (XSS), Information
disclosure, Frame hijacking, Remote shell command execution
and Insecure Install Tool authentication/session handling.</p>
</blockquote>
</body>
</description>
<references>
<bid>36801</bid>
<cvename>CVE-2009-3628</cvename>
<cvename>CVE-2009-3629</cvename>
<cvename>CVE-2009-3630</cvename>
<cvename>CVE-2009-3631</cvename>
<cvename>CVE-2009-3632</cvename>
<cvename>CVE-2009-3633</cvename>
<cvename>CVE-2009-3634</cvename>
<cvename>CVE-2009-3635</cvename>
<cvename>CVE-2009-3636</cvename>
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/</url>
<url>http://secunia.com/advisories/37122/</url>
</references>
<dates>
<discovery>2009-10-22</discovery>
<entry>2009-11-05</entry>
</dates>
</vuln>
<vuln vid="3149ab1c-c8b9-11de-b87b-0011098ad87f">
<topic>vlc -- stack overflow in MPA, AVI and ASF demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><ge>0.5.0</ge><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN reports:</p>
<blockquote cite="http://www.videolan.org/security/sa0901.html">
<p>When parsing a MP4, ASF or AVI file with an overly deep box
structure, a stack overflow might occur. It would overwrite the
return address and thus redirect the execution flow.</p>
<p>If successful, a malicious third party could trigger execution
of arbitrary code within the context of the VLC media player.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa0901.html</url>
</references>
<dates>
<discovery>2009-09-14</discovery>
<entry>2009-11-03</entry>
</dates>
</vuln>
<vuln vid="6f358f5a-c7ea-11de-a9f3-0030843d3802">
<topic>KDE -- multiple vulnerabilities</topic>
<affects>
<package>
<name>kdebase-runtime</name>
<range><ge>4.0.*</ge><lt>4.3.1_2</lt></range>
</package>
<package>
<name>kdelibs</name>
<range><ge>4.0.*</ge><lt>4.3.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-015.html">
<p>Ark input sanitization errors: The KDE archiving tool, Ark,
performs insufficient validation which leads to specially crafted
archive files, using unknown MIME types, to be rendered using a KHTML
instance, this can trigger uncontrolled XMLHTTPRequests to remote
sites.</p>
<p>IO Slaves input sanitization errors: KDE protocol handlers perform
insufficient input validation, an attacker can craft malicious URI
that would trigger JavaScript execution. Additionally the 'help://'
protocol handler suffer from directory traversal. It should be noted
that the scope of this issue is limited as the malicious URIs cannot
be embedded in Internet hosted content.</p>
<p>KMail input sanitization errors: The KDE mail client, KMail, performs
insufficient validation which leads to specially crafted email
attachments, using unknown MIME types, to be rendered using a KHTML
instance, this can trigger uncontrolled XMLHTTPRequests to remote
sites.</p>
<p>The exploitation of these vulnerabilities is unlikely according to
Portcullis and KDE but the execution of active content is nonetheless
unexpected and might pose a threat.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2009-015.html</url>
</references>
<dates>
<discovery>2009-10-30</discovery>
<entry>2009-11-02</entry>
</dates>
</vuln>
<vuln vid="2fda6bd2-c53c-11de-b157-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.01.20091019</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>10.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Team Reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1001/">
<ul>
<li>Fixed an issue where certain domain names could allow execution
of arbitrary code, as reported by Chris Weber of Casaba Security</li>
<li>Fixed an issue where scripts can run on the feed subscription
page, as reported by Inferno</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3831</cvename>
<url>http://www.opera.com/support/kb/view/938/</url>
<url>http://www.opera.com/support/kb/view/939/</url>
</references>
<dates>
<discovery>2009-10-28</discovery>
<entry>2009-10-31</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="83d7d149-b965-11de-a515-0022156e8794">
<topic>Enhanced cTorrent -- stack-based overflow</topic>
<affects>
<package>
<name>ctorrent</name>
<range><lt>3.3.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34584">
<p>cTorrent and dTorrent are prone to a remote buffer-overflow
vulnerability because the software fails to properly
bounds-check user-supplied input before copying it to an
insufficiently sized memory buffer.</p>
<p>Successful exploits allow remote attackers to execute
arbitrary machine code in the context of a vulnerable
application. Failed exploit attempts will likely result in
denial-of-service conditions.</p>
</blockquote>
</body>
</description>
<references>
<bid>34584</bid>
<cvename>CVE-2009-1759</cvename>
<url>http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959</url>
</references>
<dates>
<discovery>2009-10-15</discovery>
<entry>2009-10-28</entry>
</dates>
</vuln>
<vuln vid="c87aa2d2-c3c4-11de-ab08-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.4,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.15,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.0.15</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<p>MFSA 2009-64 Crashes with evidence of memory
corruption (rv:1.9.1.4/ 1.9.0.15)</p>
<p>MFSA 2009-63 Upgrade media libraries to fix memory
safety bugs</p>
<p>MFSA 2009-62 Download filename spoofing with RTL
override</p>
<p>MFSA 2009-61 Cross-origin data theft through
document.getSelection()</p>
<p>MFSA 2009-59 Heap buffer overflow in string to
number conversion</p>
<p>MFSA 2009-57 Chrome privilege escalation in
XPCVariant::VariantDataToJS()</p>
<p>MFSA 2009-56 Heap buffer overflow in GIF color map
parser</p>
<p>MFSA 2009-55 Crash in proxy auto-configuration
regexp parsing</p>
<p>MFSA 2009-54 Crash with recursive web-worker calls</p>
<p>MFSA 2009-53 Local downloaded file tampering</p>
<p>MFSA 2009-52 Form history vulnerable to stealing</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3380</cvename>
<cvename>CVE-2009-3381</cvename>
<cvename>CVE-2009-3382</cvename>
<cvename>CVE-2009-3383</cvename>
<cvename>CVE-2009-3379</cvename>
<cvename>CVE-2009-3378</cvename>
<cvename>CVE-2009-3377</cvename>
<cvename>CVE-2009-3376</cvename>
<cvename>CVE-2009-3375</cvename>
<cvename>CVE-2009-1563</cvename>
<cvename>CVE-2009-3374</cvename>
<cvename>CVE-2009-3373</cvename>
<cvename>CVE-2009-3372</cvename>
<cvename>CVE-2009-3371</cvename>
<cvename>CVE-2009-3274</cvename>
<cvename>CVE-2009-3370</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-64.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-63.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-61.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-57.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-56.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-55.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-54.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-53.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-52.html</url>
</references>
<dates>
<discovery>2009-10-27</discovery>
<entry>2009-10-28</entry>
<modified>2009-12-14</modified>
</dates>
</vuln>
<vuln vid="2544f543-c178-11de-b175-001cc0377035">
<topic>elinks -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>elinks</name>
<range><lt>0.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/36574/discuss">
<p>ELinks is prone to an off-by-one buffer-overflow vulnerability
because the application fails to accurately reference the last
element of a buffer.</p>
<p>Attackers may leverage this issue to execute arbitrary code in
the context of the application. Failed attacks will cause
denial-of-service conditions.</p>
</blockquote>
</body>
</description>
<references>
<bid>36574</bid>
<cvename>CVE-2008-7224</cvename>
<mlist msgid="20080204235429.GA28006@diku.dk">http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html</mlist>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347</url>
</references>
<dates>
<discovery>2006-07-29</discovery>
<entry>2009-10-25</entry>
</dates>
</vuln>
<vuln vid="692ab645-bf5d-11de-849b-00151797c2d4">
<topic>squidGuard -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squidGuard</name>
<range><lt>1.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquidGuard website reports:</p>
<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015">
<p>Patch 20091015 fixes one buffer overflow problem
in sgLog.c when overlong URLs are requested.
SquidGuard will then go into emergency mode were
no blocking occurs. This is not required in this
situation.</p>
</blockquote>
<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019">
<p>Patch 20091019 fixes two bypass problems with URLs
which length is close to the limit defined by MAX_BUF
(default: 4096) in squidGuard and MAX_URL (default:
4096 in squid 2.x and 8192 in squid 3.x) in squid.
For this kind of URLs the proxy request exceeds MAX_BUF
causing squidGuard to complain about not being able to
parse the squid request. Increasing the buffer limit
to be higher than the one defined in MAX_URL solves the
issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3700</cvename>
<cvename>CVE-2009-3826</cvename>
<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015</url>
<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019</url>
</references>
<dates>
<discovery>2009-10-15</discovery>
<entry>2009-10-22</entry>
<modified>2010-05-06</modified>
</dates>
</vuln>
<vuln vid="8581189c-bd5f-11de-8709-0017a4cccfc6">
<topic>Xpdf -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.02_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/507261">
<p>Some vulnerabilities have been reported in Xpdf, which can be
exploited by malicious people to potentially compromise a user's
system.</p>
<p>1) Multiple integer overflows in "SplashBitmap::SplashBitmap()"
can be exploited to cause heap-based buffer overflows.</p>
<p>2) An integer overflow error in "ObjectStream::ObjectStream()"
can be exploited to cause a heap-based buffer overflow.</p>
<p>3) Multiple integer overflows in "Splash::drawImage()" can be
exploited to cause heap-based buffer overflows.</p>
<p>4) An integer overflow error in "PSOutputDev::doImageL1Sep()"
can be exploited to cause a heap-based buffer overflow when
converting a PDF document to a PS file.</p>
<p>Successful exploitation of the vulnerabilities may allow execution
of arbitrary code by tricking a user into opening a specially crafted
PDF file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/507261</url>
<url>http://secunia.com/advisories/37053/</url>
</references>
<dates>
<discovery>2009-10-14</discovery>
<entry>2009-10-20</entry>
</dates>
</vuln>
<vuln vid="87917d6f-ba76-11de-bac2-001a4d563a0f">
<topic>django -- denial-of-service attack</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><lt>1.1.1</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>11603,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2009/oct/09/security/">
<p>Django's forms library includes field types which perform
regular-expression-based validation of email addresses and
URLs. Certain addresses/URLs could trigger a pathological
performance case in these regular expression, resulting in
the server process/thread becoming unresponsive, and consuming
excessive CPU over an extended period of time. If deliberately
triggered, this could result in an effectively
denial-of-service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3695</cvename>
<url>http://www.djangoproject.com/weblog/2009/oct/09/security/</url>
</references>
<dates>
<discovery>2009-10-09</discovery>
<entry>2009-10-16</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="4769914e-b844-11de-b159-0030843d3802">
<topic>phpmyadmin -- XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.2.2.1</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php">
<p>Cross-site scripting (XSS) vulnerability allows remote attackers to
inject arbitrary web script or HTML via a crafted MySQL table name.</p>
<p>SQL injection vulnerability allows remote attackers to inject SQL via
various interface parameters of the PDF schema generator feature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3696</cvename>
<cvename>CVE-2009-3697</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php</url>
</references>
<dates>
<discovery>2009-10-13</discovery>
<entry>2009-10-13</entry>
</dates>
</vuln>
<vuln vid="437a68cf-b752-11de-b6eb-00e0815b8da8">
<topic>php5 -- Multiple security issues</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vendor reports</p>
<blockquote cite="http://www.php.net/releases/5_2_11.php">
<p>Security Enhancements and Fixes in PHP 5.2.11:
Fixed certificate validation inside
php_openssl_apply_verification_policy.
Fixed sanity check for the color index in imagecolortransparent.
Added missing sanity checks around exif processing.
Fixed bug 44683 popen crashes when an invalid mode is passed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/releases/5_2_11.php</url>
<cvename>CVE-2009-3291</cvename>
<cvename>CVE-2009-3292</cvename>
<cvename>CVE-2009-3293</cvename>
</references>
<dates>
<discovery>2009-09-17</discovery>
<entry>2009-10-12</entry>
</dates>
</vuln>
<vuln vid="ebeed063-b328-11de-b6a5-0030843d3802">
<topic>virtualbox -- privilege escalation</topic>
<affects>
<package>
<name>virtualbox</name>
<range><lt>3.0.51.r22902_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sun reports:</p>
<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1">
<p>A security vulnerability in the VBoxNetAdpCtl configuration tool
for certain Sun VirtualBox 3.0 packages may allow local unprivileged
users who are authorized to run VirtualBox to execute arbitrary
commands with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3692</cvename>
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1</url>
<url>http://secunia.com/advisories/36929</url>
</references>
<dates>
<discovery>2009-10-07</discovery>
<entry>2009-10-07</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="50383bde-b25b-11de-8c83-02e0185f8d72">
<topic>FreeBSD -- Devfs / VFS NULL pointer race condition</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_13</lt></range>
<range><ge>6.4</ge><lt>6.4_7</lt></range>
<range><ge>7.1</ge><lt>7.1_8</lt></range>
<range><ge>7.2</ge><lt>7.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to the interaction between devfs and VFS, a race condition
exists where the kernel might dereference a NULL pointer.</p>
<h1>Impact:</h1>
<p>Successful exploitation of the race condition can lead to local
kernel privilege escalation, kernel data corruption and/or
crash.</p>
<p>To exploit this vulnerability, an attacker must be able to run
code with user privileges on the target system.</p>
<h1>Workaround:</h1>
<p>An errata note, FreeBSD-EN-09:05.null has been released
simultaneously to this advisory, and contains a kernel patch
implementing a workaround for a more broad class of
vulnerabilities. However, prior to those changes, no workaround
is available.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:14.devfs</freebsdsa>
</references>
<dates>
<discovery>2009-10-02</discovery>
<entry>2009-10-06</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="90d2e58f-b25a-11de-8c83-02e0185f8d72">
<topic>FreeBSD -- kqueue pipe race conditions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.4_7</lt></range>
<range><ge>6.4</ge><lt>6.3_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A race condition exists in the pipe close() code relating
to kqueues, causing use-after-free for kernel memory, which
may lead to an exploitable NULL pointer vulnerability in the
kernel, kernel memory corruption, and other unpredictable
results.</p>
<h1>Impact:</h1>
<p>Successful exploitation of the race condition can lead to
local kernel privilege escalation, kernel data corruption
and/or crash.</p>
<p>To exploit this vulnerability, an attacker must be able to
run code on the target system.</p>
<h1>Workaround</h1>
<p>An errata notice, FreeBSD-EN-09:05.null has been released
simultaneously to this advisory, and contains a kernel patch
implementing a workaround for a more broad class of
vulnerabilities. However, prior to those changes, no
workaround is available.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:13.pipe</freebsdsa>
</references>
<dates>
<discovery>2009-10-02</discovery>
<entry>2009-10-06</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="beb6f4a8-add5-11de-8b55-0030843d3802">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb team reports:</p>
<blockquote cite="http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/">
<p>Input passed via avatar extensions is not properly sanitised before
being used in SQL queries. This can be exploited to manipulate SQL
queries by uploading specially named avatars.</p>
<p>The script allows to sign up with usernames containing zero width
space characters, which can be exploited to e.g. conduct spoofing
attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>36460</bid>
<url>http://dev.mybboard.net/issues/464</url>
<url>http://dev.mybboard.net/issues/418</url>
<url>http://secunia.com/advisories/36803</url>
<url>http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/</url>
</references>
<dates>
<discovery>2009-09-21</discovery>
<entry>2009-09-30</entry>
</dates>
</vuln>
<vuln vid="bad1b090-a7ca-11de-873f-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.20</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/579482">
<p>The core OpenID module does not correctly implement Form API for
the form that allows one to link user accounts with OpenID
identifiers. A malicious user is therefore able to use cross site
request forgeries to add attacker controlled OpenID identities to
existing accounts. These OpenID identities can then be used to gain
access to the affected accounts.</p>
<p>The OpenID module is not a compliant implementation of the OpenID
Authentication 2.0 specification. An implementation error allows a
user to access the account of another user when they share the same
OpenID 2.0 provider.</p>
<p>File uploads with certain extensions are not correctly processed by
the File API. This may lead to the creation of files that are
executable by Apache. The .htaccess that is saved into the files
directory by Drupal should normally prevent execution. The files are
only executable when the server is configured to ignore the directives
in the .htaccess file.</p>
<p>Drupal doesn't regenerate the session ID when an anonymous user
follows the one time login link used to confirm email addresses and
reset forgotten passwords. This enables a malicious user to fix and
reuse the session id of a victim under certain circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/579482</url>
<url>http://secunia.com/advisories/36787/</url>
<url>http://secunia.com/advisories/36786/</url>
<url>http://secunia.com/advisories/36781/</url>
<url>http://secunia.com/advisories/36776/</url>
<url>http://secunia.com/advisories/36785/</url>
</references>
<dates>
<discovery>2009-09-17</discovery>
<entry>2009-09-22</entry>
</dates>
</vuln>
<vuln vid="113cd7e9-a4e2-11de-84af-001195e39404">
<topic>fwbuilder -- security issue in temporary file handling</topic>
<affects>
<package>
<name>fwbuilder</name>
<range><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firewall Builder release notes reports:</p>
<blockquote cite="http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7">
<p>Vadim Kurland (vadim.kurland@fwbuilder.org) reports:</p>
<p>Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate
iptables scripts with a security issue when also used to
generate static routing configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4664</cvename>
<url>http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7</url>
</references>
<dates>
<discovery>2009-09-18</discovery>
<entry>2009-09-18</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="b9ec7fe3-a38a-11de-9c6b-003048818f40">
<topic>bugzilla -- two SQL injections, sensitive data exposure</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>3.3.1</gt><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4/">
<ul>
<li>It is possible to inject raw SQL into the Bugzilla
database via the "Bug.create" and "Bug.search" WebService
functions.</li>
<li>When a user would change his password, his new password would
be exposed in the URL field of the browser if he logged in right
after changing his password.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3125</cvename>
<cvename>CVE-2009-3165</cvename>
<cvename>CVE-2009-3166</cvename>
<url>http://www.bugzilla.org/security/3.0.8/</url>
</references>
<dates>
<discovery>2009-09-11</discovery>
<entry>2009-09-17</entry>
</dates>
</vuln>
<vuln vid="ee23aa09-a175-11de-96c0-0011098ad87f">
<topic>horde-base -- multiple vulnerabilities</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559">
<p>An error within the form library when handling image form fields can
be exploited to overwrite arbitrary local files.</p>
<p>An error exists within the MIME Viewer library when rendering unknown
text parts. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site if
malicious data is viewed.</p>
<p>The preferences system does not properly sanitise numeric preference
types. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in contact of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.horde.org/ticket/?id=8311</url>
<url>http://bugs.horde.org/ticket/?id=8399</url>
<url>http://secunia.com/advisories/36665/</url>
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559</url>
</references>
<dates>
<discovery>2009-05-28</discovery>
<entry>2009-09-14</entry>
<modified>2009-09-22</modified>
</dates>
</vuln>
<vuln vid="152b27f0-a158-11de-990c-e5b1d4c882e0">
<topic>nginx -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>0.7.62</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>0.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nginx development team reports:</p>
<blockquote cite="http://nginx.net/CHANGES">
<p>A segmentation fault might occur in worker process while
specially crafted request handling.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2629</cvename>
<url>http://nginx.net/CHANGES</url>
<mlist msgid="20090914155338.GA2529@ngolde.de">http://lists.debian.org/debian-security-announce/2009/msg00205.html</mlist>
</references>
<dates>
<discovery>2009-09-14</discovery>
<entry>2009-09-14</entry>
<modified>2009-09-15</modified>
</dates>
</vuln>
<vuln vid="6e8f54af-a07d-11de-a649-000c2955660f">
<topic>ikiwiki -- insufficient blacklisting in teximg plugin</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.1415926</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The IkiWiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index35h2">
<p>IkiWikis teximg plugin's blacklisting of insecure TeX commands
is insufficient; it can be bypassed and used to read arbitrary
files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2944</cvename>
<url>http://ikiwiki.info/security/#index35h2</url>
</references>
<dates>
<discovery>2009-08-28</discovery>
<entry>2009-09-13</entry>
</dates>
</vuln>
<vuln vid="b46f3a1e-a052-11de-a649-000c2955660f">
<topic>xapian-omega -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>xapian-omega</name>
<range><lt>1.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Olly Betts reports:</p>
<blockquote cite="http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html">
<p>There's a cross-site scripting issue in Omega - exception
messages don't currently get HTML entities escaped, but can
contain CGI parameter values in some cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2947</cvename>
<url>http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html</url>
</references>
<dates>
<discovery>2009-09-09</discovery>
<entry>2009-09-13</entry>
</dates>
</vuln>
<vuln vid="922d2398-9e2d-11de-a998-0030843d3802">
<topic>mozilla firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.3,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<p>MFSA 2009-51 Chrome privilege escalation with FeedWriter</p>
<p>MFSA 2009-50 Location bar spoofing via tall line-height Unicode
characters</p>
<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
<p>MFSA 2009-48 Insufficient warning for PKCS11 module installation
and removal</p>
<p>MFSA 2009-47 Crashes with evidence of memory corruption
(rv:1.9.1.3/1.9.0.14)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3069</cvename>
<cvename>CVE-2009-3070</cvename>
<cvename>CVE-2009-3071</cvename>
<cvename>CVE-2009-3072</cvename>
<cvename>CVE-2009-3073</cvename>
<cvename>CVE-2009-3074</cvename>
<cvename>CVE-2009-3075</cvename>
<cvename>CVE-2009-3076</cvename>
<cvename>CVE-2009-3077</cvename>
<cvename>CVE-2009-3078</cvename>
<cvename>CVE-2009-3079</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-47.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-48.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-50.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-51.html</url>
<url>http://secunia.com/advisories/36671/2/</url>
</references>
<dates>
<discovery>2009-09-10</discovery>
<entry>2009-09-10</entry>
</dates>
</vuln>
<vuln vid="012b495c-9d51-11de-8d20-001bd3385381">
<topic>cyrus-imapd -- Potential buffer overflow in Sieve</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><gt>2.2.0</gt><lt>2.2.13_6</lt></range>
<range><gt>2.3.0</gt><lt>2.3.14_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus IMAP Server ChangeLog states:</p>
<blockquote cite="http://cyrusimap.web.cmu.edu/imapd/changes.html">
<p>Fixed CERT VU#336053 - Potential buffer overflow in Sieve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2632</cvename>
<bid>36296</bid>
<url>http://www.kb.cert.org/vuls/id/336053</url>
<url>http://www.debian.org/security/2009/dsa-1881</url>
</references>
<dates>
<discovery>2009-09-02</discovery>
<entry>2009-09-09</entry>
<modified>2009-09-14</modified>
</dates>
</vuln>
<vuln vid="24aa9970-9ccd-11de-af10-000c29a67389">
<topic>silc-toolkit -- Format string vulnerabilities</topic>
<affects>
<package>
<name>silc-toolkit</name>
<range><lt>1.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SILC Changlog reports:</p>
<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10">
<p>An unspecified format string vulnerability exists in
silc-toolkit.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3051</cvename>
<url>http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10</url>
<url>http://www.openwall.com/lists/oss-security/2009/09/03/5</url>
</references>
<dates>
<discovery>2009-08-07</discovery>
<entry>2009-09-08</entry>
</dates>
</vuln>
<vuln vid="4582948a-9716-11de-83a5-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.00.20090830</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><le>10.00.b3_1,1</le></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>10.00</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Team Reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/1000/">
<ul>
<li>Issue where sites using revoked intermediate certificates might be shown as secure</li>
<li>Issue where the collapsed address bar didn't show the current domain</li>
<li>Issue where pages could trick users into uploading files</li>
<li>Some IDNA characters not correctly displaying in the address bar</li>
<li>Issue where Opera accepts nulls and invalid wild-cards in certificates</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/search/view/929/</url>
<url>http://www.opera.com/support/search/view/930/</url>
<url>http://www.opera.com/support/search/view/931/</url>
<url>http://www.opera.com/support/search/view/932/</url>
<url>http://www.opera.com/support/search/view/934/</url>
</references>
<dates>
<discovery>2009-09-01</discovery>
<entry>2009-09-04</entry>
<modified>2009-10-29</modified>
</dates>
</vuln>
<vuln vid="80aa98e0-97b4-11de-b946-0030843d3802">
<topic>dnsmasq -- TFTP server remote code injection vulnerability</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="http://www.thekelleys.org.uk/dnsmasq/CHANGELOG">
<p>Fix security problem which allowed any host permitted to
do TFTP to possibly compromise dnsmasq by remote buffer
overflow when TFTP enabled.</p>
<p>Fix a problem which allowed a malicious TFTP client to
crash dnsmasq.</p>
</blockquote>
</body>
</description>
<references>
<bid>36121</bid>
<bid>36120</bid>
<cvename>CVE-2009-2957</cvename>
<cvename>CVE-2009-2958</cvename>
<url>http://www.coresecurity.com/content/dnsmasq-vulnerabilities</url>
<url>https://rhn.redhat.com/errata/RHSA-2009-1238.html</url>
</references>
<dates>
<discovery>2009-08-31</discovery>
<entry>2009-09-02</entry>
</dates>
</vuln>
<vuln vid="e15f2356-9139-11de-8f42-001aa0166822">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.2.0</gt><lt>2.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache ChangeLog reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.12">
<p>CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.</p>
<p>CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.</p>
<p>CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.</p>
<p>CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.</p>
<p>CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1891</cvename><!-- vul: 2.2.11 -->
<cvename>CVE-2009-1195</cvename><!-- vul: 2.2.x to 2.2.11 -->
<cvename>CVE-2009-1890</cvename><!-- ok: 2.3.3 -->
<cvename>CVE-2009-1191</cvename><!-- vul: 2.2.11 -->
<cvename>CVE-2009-0023</cvename><!-- ok: apr 1.3.5 -->
<cvename>CVE-2009-1955</cvename><!-- ok: apr-util 1.3.7 -->
<cvename>CVE-2009-1956</cvename><!-- ok: apr-util 1.3.5 -->
</references>
<dates>
<discovery>2009-07-28</discovery><!-- release date of 2.2.12 -->
<entry>2009-08-25</entry>
</dates>
</vuln>
<vuln vid="59e7af2d-8db7-11de-883b-001e3300a30d">
<topic>pidgin -- MSN overflow parsing SLP messages</topic>
<affects>
<package>
<name>pidgin</name>
<name>libpurple</name>
<name>finch</name>
<range><lt>2.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/36384">
<p>A vulnerability has been reported in Pidgin, which can be
exploited by malicious people to potentially compromise a user's
system.</p>
<p>The vulnerability is caused due to an error in the
"msn_slplink_process_msg()" function when processing MSN SLP
messages and can be exploited to corrupt memory.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
<p>The vulnerability is reported in versions 2.5.8 and prior.
Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2694</cvename>
<url>http://secunia.com/advisories/36384/</url>
<url>http://www.pidgin.im/news/security/?id=34</url>
</references>
<dates>
<discovery>2009-08-18</discovery>
<entry>2009-08-20</entry>
</dates>
</vuln>
<vuln vid="b31a1088-460f-11de-a11a-0022156e8794">
<topic>GnuTLS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><lt>2.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34783/discuss">
<p>GnuTLS is prone to multiple remote vulnerabilities:</p>
<ul>
<li>A remote code-execution vulnerability.</li>
<li>A denial-of-service vulnerability.</li>
<li>A signature-generation vulnerability.</li>
<li>A signature-verification vulnerability.</li>
</ul>
<p>An attacker can exploit these issues to potentially execute
arbitrary code, trigger denial-of-service conditions, carry
out attacks against data signed with weak signatures, and
cause clients to accept expired or invalid certificates from
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1415</cvename>
<cvename>CVE-2009-1416</cvename>
<cvename>CVE-2009-1417</cvename>
<bid>34783</bid>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515</url>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516</url>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517</url>
</references>
<dates>
<discovery>2009-05-21</discovery>
<entry>2009-08-17</entry>
</dates>
</vuln>
<vuln vid="856a6f84-8b30-11de-8062-00e0815b8da8">
<topic>GnuTLS -- improper SSL certificate verification</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.8.3</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS reports:</p>
<blockquote cite="http://article.gmane.org/gmane.network.gnutls.general/1733">
<p>By using a NUL byte in CN/SAN fields, it was possible to fool
GnuTLS into 1) not printing the entire CN/SAN field value when
printing a certificate and 2) cause incorrect positive matches
when matching a hostname against a certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2730</cvename>
<url>http://article.gmane.org/gmane.network.gnutls.general/1733</url>
<url>http://secunia.com/advisories/36266</url>
</references>
<dates>
<discovery>2009-08-11</discovery>
<entry>2009-08-17</entry>
</dates>
</vuln>
<vuln vid="86ada694-8b30-11de-b9d0-000c6e274733">
<topic>memcached -- memcached stats maps Information Disclosure Weakness</topic>
<affects>
<package>
<name>memcached</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34915/">
<p>A weakness has been reported in memcached, which can be exploited
by malicious people to disclose system information.</p>
<p>The weakness is caused due to the application disclosing the
content of /proc/self/maps if a stats maps command is received.
This can be exploited to disclose e.g. the addresses of allocated
memory regions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1255</cvename>
<url>http://secunia.com/advisories/34915/</url>
</references>
<dates>
<discovery>2009-04-29</discovery>
<entry>2009-08-17</entry>
</dates>
</vuln>
<vuln vid="2430e9c3-8741-11de-938e-003048590f9e">
<topic>wordpress -- remote admin password reset vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>2.8.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>2.8.4</lt></range>
</package>
<package>
<name>wordpress-mu</name>
<range><lt>2.8.4a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WordPress reports:</p>
<blockquote cite="http://wordpress.org/development/2009/08/2-8-4-security-release/">
<p>A specially crafted URL could be requested that would allow an
attacker to bypass a security check to verify a user requested a
password reset. As a result, the first account without a key in the
database (usually the admin account) would have its password reset and
a new password would be emailed to the account owner.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2762</cvename>
<url>http://wordpress.org/development/2009/08/2-8-4-security-release/</url>
<url>http://www.milw0rm.com/exploits/9410</url>
</references>
<dates>
<discovery>2009-08-10</discovery>
<entry>2009-08-12</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="5179d85c-8683-11de-91b9-0022157515b2">
<topic>fetchmail -- improper SSL certificate subject verification</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2009-01.txt">
<p>Moxie Marlinspike demonstrated in July 2009 that some CAs would
sign certificates that contain embedded NUL characters in the
Common Name or subjectAltName fields of ITU-T X.509
certificates.</p>
<p>Applications that would treat such X.509 strings as
NUL-terminated C strings (rather than strings that contain an
explicit length field) would only check the part up to and
excluding the NUL character, so that certificate names such as
www.good.example\0www.bad.example.com would be mistaken as a
certificate name for www.good.example. fetchmail also had this
design and implementation flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2666</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2009-01.txt</url>
</references>
<dates>
<discovery>2009-08-06</discovery>
<entry>2009-08-11</entry>
<modified>2009-08-13</modified>
</dates>
</vuln>
<vuln vid="739b94a4-838b-11de-938e-003048590f9e">
<topic>joomla15 -- com_mailto Timeout Issue</topic>
<affects>
<package>
<name>joomla15</name>
<range><lt>1.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! Security Center reports:</p>
<blockquote cite="http://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html">
<p>In com_mailto, it was possible to bypass timeout protection against
sending automated emails.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security.html</url>
<url>http://secunia.com/advisories/36097/</url>
</references>
<dates>
<discovery>2009-07-22</discovery>
<entry>2009-08-07</entry>
<modified>2009-08-11</modified>
</dates>
</vuln>
<vuln vid="bce1f76d-82d0-11de-88ea-001a4d49522b">
<topic>subversion -- heap overflow vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<name>subversion-freebsd</name>
<name>p5-subversion</name>
<name>py-subversion</name>
<range><lt>1.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Subversion Security Advisory reports:</p>
<blockquote cite="http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt">
<p>Subversion clients and servers have multiple heap
overflow issues in the parsing of binary deltas. This is
related to an allocation vulnerability in the APR library
used by Subversion.</p>
<p>Clients with commit access to a vulnerable server can
cause a remote heap overflow; servers can cause a heap
overflow on vulnerable clients that try to do a checkout
or update.</p>
<p>This can lead to a DoS (an exploit has been tested) and
to arbitrary code execution (no exploit tested, but the
possibility is clear).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2411</cvename>
<url>http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt</url>
</references>
<dates>
<discovery>2009-08-06</discovery>
<entry>2009-08-06</entry>
<modified>2009-08-07</modified>
</dates>
</vuln>
<vuln vid="d67b517d-8214-11de-88ea-001a4d49522b">
<topic>bugzilla -- product name information leak</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>3.3.4</gt><lt>3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4/">
<p>Normally, users are only supposed to see products that
they can file bugs against in the "Product" drop-down on
the bug-editing page. Instead, users were being shown all
products, even those that they normally could not see. Any
user who could edit any bug could see all product
names.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.bugzilla.org/security/3.4/</url>
</references>
<dates>
<discovery>2009-07-30</discovery>
<entry>2009-08-05</entry>
</dates>
</vuln>
<vuln vid="49e8f2ee-8147-11de-a994-0030843d3802">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>3.*,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.2,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.18</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<p>MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name
longer than 15 characters</p>
<p>MFSA 2009-42: Compromise of SSL-protected communication</p>
<p>MFSA 2009-43: Heap overflow in certificate regexp parsing</p>
<p>MFSA 2009-44: Location bar and SSL indicator spoofing via window.open()
on invalid URL</p>
<p>MFSA 2009-45: Crashes with evidence of memory corruption
(rv:1.9.1.2/1.9.0.13)</p>
<p>MFSA 2009-46: Chrome privilege escalation due to incorrectly cached
wrapper</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2404</cvename>
<cvename>CVE-2009-2408</cvename>
<cvename>CVE-2009-2454</cvename>
<cvename>CVE-2009-2470</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-38.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-42.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-43.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-44.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-45.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-46.html</url>
</references>
<dates>
<discovery>2009-08-03</discovery>
<entry>2009-08-04</entry>
<modified>2009-09-04</modified>
</dates>
</vuln>
<vuln vid="4e306850-811f-11de-8a67-000c29a67389">
<topic>silc-client -- Format string vulnerability</topic>
<affects>
<package>
<name>silc-client</name>
<name>silc-irssi-client</name>
<range><lt>1.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SILC changelog reports:</p>
<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Client%201.1.8">
<p>An unspecified format string vulnerability exists in
silc-client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3051</cvename>
<url>http://silcnet.org/docs/changelog/SILC%20Client%201.1.8</url>
</references>
<dates>
<discovery>2009-07-31</discovery>
<entry>2009-08-04</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="0d0237d0-7f68-11de-984d-0011098ad87f">
<topic>SquirrelMail -- Plug-ins compromise</topic>
<affects>
<package>
<name>squirrelmail-multilogin-plugin</name>
<range><ge>2.3.4</ge><lt>2.3.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SquirrelMail Web Server has been compromised, and three plugins
are affected.</p>
<p>The port of squirrelmail-sasql-plugin is safe (right MD5), and
change_pass is not in the FreeBSD ports tree, but multilogin has a
wrong MD5.</p>
</body>
</description>
<references>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org</url>
<url>http://squirrelmail.org/index.php</url>
</references>
<dates>
<discovery>2009-07-31</discovery>
<entry>2009-08-02</entry>
</dates>
</vuln>
<vuln vid="83725c91-7c7e-11de-9672-00e0815b8da8">
<topic>BIND -- Dynamic update message remote DoS</topic>
<affects>
<package>
<name>bind9</name>
<range><lt>9.3.6.1.1</lt></range>
</package>
<package>
<name>bind9-sdb-postgresql</name>
<name>bind9-sdb-ldap</name>
<range><lt>9.4.3.3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_12</lt></range>
<range><ge>6.4</ge><lt>6.4_6</lt></range>
<range><ge>7.1</ge><lt>7.1_7</lt></range>
<range><ge>7.2</ge><lt>7.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When named(8) receives a specially crafted dynamic update
message an internal assertion check is triggered which causes
named(8) to exit.</p>
<p>To trigger the problem, the dynamic update message must contains
a record of type "ANY" and at least one resource record set (RRset)
for this fully qualified domain name (FQDN) must exist on the
server.</p>
<h1>Impact:</h1>
<p>An attacker which can send DNS requests to a nameserver can cause
it to exit, thus creating a Denial of Service situation.</p>
<h1>Workaround:</h1>
<p>No generally applicable workaround is available, but some firewalls
may be able to prevent nsupdate DNS packets from reaching the
nameserver.</p>
<p>NOTE WELL: Merely configuring named(8) to ignore dynamic updates
is NOT sufficient to protect it from this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2009-0696</cvename>
<freebsdsa>SA-09:12.bind</freebsdsa>
<url>http://www.kb.cert.org/vuls/id/725188</url>
<url>https://www.isc.org/node/474</url>
</references>
<dates>
<discovery>2009-07-28</discovery>
<entry>2009-08-01</entry>
<modified>2009-08-04</modified>
</dates>
</vuln>
<vuln vid="708c65a5-7c58-11de-a994-0030843d3802">
<topic>mono -- XML signature HMAC truncation spoofing</topic>
<affects>
<package>
<name>mono</name>
<range><lt>2.4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35852/">
<p>A security issue has been reported in Mono, which can be
exploited by malicious people to conduct spoofing attacks.</p>
<p>The security issue is caused due to an error when processing
certain XML signatures.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0217</cvename>
<url>http://secunia.com/advisories/35852/</url>
<url>http://www.kb.cert.org/vuls/id/466161</url>
</references>
<dates>
<discovery>2009-07-15</discovery>
<entry>2009-07-29</entry>
</dates>
</vuln>
<vuln vid="e1156e90-7ad6-11de-b26a-0048543d60ce">
<topic>squid -- several remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.1</ge><lt>3.0.17</lt></range>
<range><ge>3.1.0.1</ge><lt>3.1.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2009:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_2.txt">
<p>Due to incorrect buffer limits and related bound checks Squid
is vulnerable to a denial of service attack when processing
specially crafted requests or responses.</p>
<p>Due to incorrect data validation Squid is vulnerable to a
denial of service attack when processing specially crafted
responses.</p>
<p>These problems allow any trusted client or external server to
perform a denial of service attack on the Squid service.</p>
</blockquote>
<p>Squid-2.x releases are not affected.</p>
</body>
</description>
<references>
<cvename>CVE-2009-2621</cvename>
<cvename>CVE-2009-2622</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2009_2.txt</url>
</references>
<dates>
<discovery>2009-07-27</discovery>
<entry>2009-07-27</entry>
<modified>2009-08-06</modified>
</dates>
</vuln>
<vuln vid="c1ef9b33-72a6-11de-82ea-0030843d3802">
<topic>mozilla -- corrupt JIT state after deep return from native function</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>3.5.*,1</ge><lt>3.5.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/2009/mfsa2009-41.html">
<p>Firefox user zbyte reported a crash that we determined could result
in an exploitable memory corruption problem. In certain cases after a
return from a native function, such as escape(), the Just-in-Time
(JIT) compiler could get into a corrupt state. This could be exploited
by an attacker to run arbitrary code such as installing malware.</p>
<p>This vulnerability does not affect earlier versions of Firefox
which do not support the JIT feature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2477</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-41.html</url>
<url>http://www.kb.cert.org/vuls/id/443060</url>
</references>
<dates>
<discovery>2009-07-16</discovery>
<entry>2009-07-17</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="c444c8b7-7169-11de-9ab7-000c29a67389">
<topic>isc-dhcp-client -- Stack overflow vulnerability</topic>
<affects>
<package>
<name>isc-dhcp31-client</name>
<range><le>3.1.1</le></range>
</package>
<package>
<name>isc-dhcp30-client</name>
<range><lt>3.0.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/410676">
<p>The ISC DHCP dhclient application contains a stack buffer
overflow, which may allow a remote, unauthenticated attacker to
execute arbitrary code with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0692</cvename>
<url>https://www.isc.org/node/468</url>
<url>http://secunia.com/advisories/35785</url>
<url>http://www.kb.cert.org/vuls/id/410676</url>
</references>
<dates>
<discovery>2009-07-14</discovery>
<entry>2009-07-15</entry>
<modified>2009-07-21</modified>
</dates>
</vuln>
<vuln vid="be927298-6f97-11de-b444-001372fd0af2">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.19</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Security Team reports:</p>
<blockquote cite="http://drupal.org/node/507572">
<p>Cross-site scripting</p>
<p>The Forum module does not correctly handle certain arguments
obtained from the URL. By enticing a suitably privileged user
to visit a specially crafted URL, a malicious user is able to
insert arbitrary HTML and script code into forum pages. Such a
cross-site scripting attack may lead to the malicious user
gaining administrative access. Wikipedia has more information
about cross-site scripting (XSS).</p>
<p>User signatures have no separate input format, they use the
format of the comment with which they are displayed. A user
will no longer be able to edit a comment when an administrator
changes the comment's input format to a format that is not
accessible to the user. However they will still be able to
modify their signature, which will then be processed by the new
input format.</p>
<p>If the new format is very permissive, via their signature, the
user may be able to insert arbitrary HTML and script code into
pages or, when the PHP filter is enabled for the new format,
execute PHP code. This issue affects Drupal 6.x only.</p>
<p>When an anonymous user fails to login due to mistyping his
username or password, and the page he is on contains a sortable
table, the (incorrect) username and password are included in
links on the table. If the user visits these links the password
may then be leaked to external sites via the HTTP referer.</p>
<p>In addition, if the anonymous user is enticed to visit the site
via a specially crafted URL while the Drupal page cache is
enabled, a malicious user might be able to retrieve the
(incorrect) username and password from the page cache.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2372</cvename>
<cvename>CVE-2009-2374</cvename>
<cvename>CVE-2009-2373</cvename>
<url>http://drupal.org/node/507572</url>
<url>http://secunia.com/advisories/35681</url>
</references>
<dates>
<discovery>2009-07-01</discovery>
<entry>2009-07-13</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="70372cda-6771-11de-883a-00e0815b8da8">
<topic>nfsen -- remote command execution</topic>
<affects>
<package>
<name>nfsen</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nfsen reports:</p>
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=967583">
<p>Due to double input checking, a remote command execution security
bug exists in all NfSen versions 1.3 and 1.3.1. Users are
requested to update to nfsen-1.3.2.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/forum/forum.php?forum_id=967583</url>
</references>
<dates>
<discovery>2009-06-18</discovery>
<entry>2009-07-03</entry>
</dates>
</vuln>
<vuln vid="ba73f494-65a8-11de-aef5-001c2514716c">
<topic>phpmyadmin -- XSS vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin project reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php">
<p>It was possible to conduct an XSS attack via a crafted
SQL bookmark.</p>
<p>All 3.x releases on which the "bookmarks" feature is
active are affected, previous versions are not.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2284</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php</url>
</references>
<dates>
<discovery>2009-06-30</discovery>
<entry>2009-06-30</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="3ebd4cb5-657f-11de-883a-00e0815b8da8">
<topic>nagios -- Command Injection Vulnerability</topic>
<affects>
<package>
<name>nagios</name>
<range><le>3.0.6_1</le></range>
</package>
<package>
<name>nagios2</name>
<range><le>2.12_3</le></range>
</package>
<package>
<name>nagios-devel</name>
<range><le>3.1.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35543?">
<p>A vulnerability has been reported in Nagios, which can be
exploited by malicious users to potentially compromise a
vulnerable system.</p>
<p>Input passed to the "ping" parameter in statuswml.cgi is not
properly sanitised before being used to invoke the ping command.
This can be exploited to inject and execute arbitrary shell
commands.</p>
<p>Successful exploitation requires access to the ping feature
of the WAP interface.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2288</cvename>
<url>http://secunia.com/advisories/35543</url>
<url>http://tracker.nagios.org/view.php?id=15</url>
</references>
<dates>
<discovery>2009-05-29</discovery>
<entry>2009-06-30</entry>
<modified>2009-07-13</modified>
</dates>
</vuln>
<vuln vid="f59dda75-5ff4-11de-a13e-00e0815b8da8">
<topic>tor-devel -- DNS resolution vulnerability</topic>
<affects>
<package>
<name>tor-devel</name>
<range><lt>0.2.1.15-rc</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://git.torproject.org/checkout/tor/master/ChangeLog">
<p>A malicious exit relay could convince a controller that the
client's DNS question resolves to an internal IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.torproject.org/checkout/tor/master/ChangeLog</url>
</references>
<dates>
<discovery>2009-06-20</discovery>
<entry>2009-06-23</entry>
</dates>
</vuln>
<vuln vid="c14aa48c-5ab7-11de-bc9b-0030843d3802">
<topic>cscope -- multiple buffer overflows</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.7a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34978">
<p>Some vulnerabilities have been reported in Cscope, which
potentially can be exploited by malicious people to compromise a
user's system.</p>
<p>The vulnerabilities are caused due to various boundary errors,
which can be exploited to cause buffer overflows when parsing
specially crafted files or directories.</p>
</blockquote>
</body>
</description>
<references>
<bid>34805</bid>
<cvename>CVE-2009-0148</cvename>
<url>http://secunia.com/advisories/34978</url>
</references>
<dates>
<discovery>2009-05-31</discovery>
<entry>2009-06-16</entry>
</dates>
</vuln>
<vuln vid="91a2066b-5ab6-11de-bc9b-0030843d3802">
<topic>cscope -- buffer overflow</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34832">
<p>Attackers may leverage this issue to execute arbitrary code
in the context of the application. Failed attacks will cause
denial-of-service conditions.</p>
</blockquote>
</body>
</description>
<references>
<bid>34832</bid>
<cvename>CVE-2009-1577</cvename>
<url>http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19</url>
</references>
<dates>
<discovery>2009-05-31</discovery>
<entry>2009-06-16</entry>
</dates>
</vuln>
<vuln vid="bdccd14b-5aac-11de-a438-003048590f9e">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla15</name>
<range><lt>1.5.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35278/">
<p>Some vulnerabilities have been reported in Joomla!, which can be
exploited by malicious users to conduct script insertion attacks and
by malicious people to conduct cross-site scripting attacks.</p>
<p>Certain unspecified input is not properly sanitised before being
used. This can be exploited to insert arbitrary HTML and script code,
which will be executed in a user's browser session in the context of
an affected site when the malicious data is displayed.</p>
<p>Certain unspecified input passed to the user view of the com_users
core component is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected site.</p>
<p>Input passed via certain parameters to the "JA_Purity" template is
not properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1938</cvename>
<cvename>CVE-2009-1939</cvename>
<cvename>CVE-2009-1940</cvename>
<url>http://secunia.com/advisories/35278/</url>
<url>http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html</url>
</references>
<dates>
<discovery>2009-06-03</discovery>
<entry>2009-06-16</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="b1ca65e6-5aaf-11de-bc9b-0030843d3802">
<topic>pidgin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pidgin</name>
<name>libpurple</name>
<name>finch</name>
<range><lt>2.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35194/">
<p>Some vulnerabilities and weaknesses have been reported in Pidgin,
which can be exploited by malicious people to cause a DoS or to
potentially compromise a user's system.</p>
<p>A truncation error in the processing of MSN SLP messages can be
exploited to cause a buffer overflow.</p>
<p>A boundary error in the XMPP SOCKS5 "bytestream" server when
initiating an outgoing file transfer can be exploited to cause a
buffer overflow.</p>
<p>A boundary error exists in the implementation of the
"PurpleCircBuffer" structure. This can be exploited to corrupt memory
and cause a crash via specially crafted XMPP or Sametime
packets.</p>
<p>A boundary error in the "decrypt_out()" function can be exploited
to cause a stack-based buffer overflow with 8 bytes and crash the
application via a specially crafted QQ packet.</p>
</blockquote>
</body>
</description>
<references>
<bid>35067</bid>
<cvename>CVE-2009-1373</cvename>
<cvename>CVE-2009-1374</cvename>
<cvename>CVE-2009-1375</cvename>
<cvename>CVE-2009-1376</cvename>
<url>http://secunia.com/advisories/35194/</url>
<url>http://www.pidgin.im/news/security/?id=29</url>
<url>http://www.pidgin.im/news/security/?id=30</url>
<url>http://www.pidgin.im/news/security/?id=32</url>
</references>
<dates>
<discovery>2009-06-03</discovery>
<entry>2009-06-16</entry>
</dates>
</vuln>
<vuln vid="d9b01c08-59b3-11de-828e-00e0815b8da8">
<topic>git -- denial of service vulnerability</topic>
<affects>
<package>
<name>git</name>
<range><lt>1.6.3.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/35338/discuss">
<p>Git is prone to a denial-of-service vulnerability because it
fails to properly handle some client requests.</p>
<p>Attackers can exploit this issue to cause a daemon process to
enter an infinite loop. Repeated exploits may consume excessive
system resources, resulting in a denial of service condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>35338</bid>
<cvename>CVE-2009-2108</cvename>
<url>https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html</url>
<url>http://article.gmane.org/gmane.comp.version-control.git/120724</url>
</references>
<dates>
<discovery>2009-06-04</discovery>
<entry>2009-06-15</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="62e0fbe5-5798-11de-bb78-001cc0377035">
<topic>ruby -- BigDecimal denial of service vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.7.160_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/">
<p>A denial of service (DoS) vulnerability was found on the
BigDecimal standard library of Ruby. Conversion from BigDecimal
objects into Float numbers had a problem which enables attackers
to effectively cause segmentation faults.</p>
<p>An attacker can cause a denial of service by causing BigDecimal
to parse an insanely large number, such as:</p>
<p><code>BigDecimal("9E69999999").to_s("F")</code></p>
</blockquote>
</body>
</description>
<references>
<bid>35278</bid>
<cvename>CVE-2009-1904</cvename>
<url>http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/</url>
</references>
<dates>
<discovery>2009-06-09</discovery>
<entry>2009-06-13</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="da185955-5738-11de-b857-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.20_8,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.11,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>3.0.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.22</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
<p>MFSA 2009-32 JavaScript chrome privilege escalation</p>
<p>MFSA 2009-31 XUL scripts bypass content-policy checks</p>
<p>MFSA 2009-30 Incorrect principal set for file: resources
loaded via location bar</p>
<p>MFSA 2009-29 Arbitrary code execution using event listeners
attached to an element whose owner document is null</p>
<p>MFSA 2009-28 Race condition while accessing the private data
of a NPObject JS wrapper class object</p>
<p>MFSA 2009-27 SSL tampering via non-200 responses to proxy
CONNECT requests</p>
<p>MFSA 2009-26 Arbitrary domain cookie access by local file:
resources</p>
<p>MFSA 2009-25 URL spoofing with invalid unicode characters</p>
<p>MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1392</cvename>
<cvename>CVE-2009-1832</cvename>
<cvename>CVE-2009-1833</cvename>
<cvename>CVE-2009-1834</cvename>
<cvename>CVE-2009-1835</cvename>
<cvename>CVE-2009-1836</cvename>
<cvename>CVE-2009-1837</cvename>
<cvename>CVE-2009-1838</cvename>
<cvename>CVE-2009-1839</cvename>
<cvename>CVE-2009-1840</cvename>
<cvename>CVE-2009-1841</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-24.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-25.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-26.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-27.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-28.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-29.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-30.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-31.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-32.html</url>
<url>http://secunia.com/advisories/35331/</url>
</references>
<dates>
<discovery>2009-06-11</discovery>
<entry>2009-06-12</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="eb9212f7-526b-11de-bbf2-001b77d09812">
<topic>apr -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apr</name>
<range><lt>1.3.5.1.3.7</lt></range>
</package>
<package>
<name>apache</name>
<range><ge>2.2.0</ge><lt>2.2.11_5</lt></range>
<range><ge>2.0.0</ge><lt>2.0.63_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35284/">
<p>Some vulnerabilities have been reported in APR-util, which
can be exploited by malicious users and malicious people to
cause a DoS (Denial of Service).</p>
<p>A vulnerability is caused due to an error in the processing
of XML files and can be exploited to exhaust all available
memory via a specially crafted XML file containing a
predefined entity inside an entity definition.</p>
<p>A vulnerability is caused due to an error within the
"apr_strmatch_precompile()" function in
strmatch/apr_strmatch.c, which can be exploited to crash an
application using the library.</p>
</blockquote>
<p>RedHat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=3D504390">
<p>A single NULL byte buffer overflow flaw was found in
apr-util's apr_brigade_vprintf() function.</p>
</blockquote>
</body>
</description>
<references>
<bid>35221</bid>
<cvename>CVE-2009-1955</cvename>
<cvename>CVE-2009-1956</cvename>
<cvename>CVE-2009-0023</cvename>
<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
<url>http://secunia.com/advisories/35284/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=3D504390</url>
</references>
<dates>
<discovery>2009-06-05</discovery>
<entry>2009-06-08</entry>
</dates>
</vuln>
<vuln vid="4f838b74-50a1-11de-b01f-001c2514716c">
<topic>dokuwiki -- Local File Inclusion with register_globals on</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20090214_2</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DokuWiki reports:</p>
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1700">
<p>A security hole was discovered which allows an attacker
to include arbitrary files located on the attacked DokuWiki
installation. The included file is executed in the PHP context.
This can be escalated by introducing malicious code through
uploading file via the media manager or placing PHP code in
editable pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1960</cvename>
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1700</url>
</references>
<dates>
<discovery>2009-05-26</discovery>
<entry>2009-06-04</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="82b55df8-4d5a-11de-8811-0030843d3802">
<topic>openssl -- denial of service in DTLS implementation</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>0.9.8</ge><lt>0.9.8k_1</lt></range>
</package>
<package>
<name>linux-f10-openssl</name>
<range><ge>0.9.8f</ge><lt>0.9.8m</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35128/">
<p>Some vulnerabilities have been reported in OpenSSL, which can be
exploited by malicious people to cause a DoS.</p>
<p>The library does not limit the number of buffered DTLS records with
a future epoch. This can be exploited to exhaust all available memory
via specially crafted DTLS packets.</p>
<p>An error when processing DTLS messages can be exploited to exhaust
all available memory by sending a large number of out of sequence
handshake messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1377</cvename>
<cvename>CVE-2009-1378</cvename>
<url>http://secunia.com/advisories/35128/</url>
</references>
<dates>
<discovery>2009-05-18</discovery>
<entry>2009-05-30</entry>
<modified>2014-04-10</modified>
</dates>
</vuln>
<vuln vid="399f4cd7-4d59-11de-8811-0030843d3802">
<topic>eggdrop -- denial of service vulnerability</topic>
<affects>
<package>
<name>eggdrop</name>
<range><lt>1.6.19_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35104/">
<p>The vulnerability is caused due to an error in the processing of
private messages within the server module
(/mod/server.mod/servrmsg.c). This can be exploited to cause a
crash by sending a specially crafted message to the bot.</p>
</blockquote>
</body>
</description>
<references>
<bid>34985</bid>
<cvename>CVE-2009-1789</cvename>
<url>http://www.eggheads.org/news/2009/05/14/35</url>
<url>http://secunia.com/advisories/35104/</url>
</references>
<dates>
<discovery>2009-05-15</discovery>
<entry>2009-05-30</entry>
</dates>
</vuln>
<vuln vid="a2d4a330-4d54-11de-8811-0030843d3802">
<topic>wireshark -- PCNFSD Dissector Denial of Service Vulnerability</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<name>wireshark</name>
<name>wireshark-lite</name>
<range><lt>1.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35201/">
<p>A vulnerability has been reported in Wireshark, which can be
exploited by malicious people to cause a DoS.</p>
<p>The vulnerability is caused due to an error in the PCNFSD dissector
and can be exploited to cause a crash via a specially crafted PCNFSD
packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1829</cvename>
<url>http://secunia.com/advisories/35201/</url>
<url>http://www.wireshark.org/security/wnpa-sec-2009-03.html</url>
</references>
<dates>
<discovery>2009-05-21</discovery>
<entry>2009-05-30</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="6355efdb-4d4d-11de-8811-0030843d3802">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35076/">
<p>Two vulnerabilities have been reported in libsndfile, which can be
exploited by malicious people to compromise an application using the
library.</p>
<p>A boundary error exists within the "voc_read_header()" function in
src/voc.c. This can be exploited to cause a heap-based buffer overflow
via a specially crafted VOC file.</p>
<p>A boundary error exists within the "aiff_read_header()" function in
src/aiff.c. This can be exploited to cause a heap-based buffer overflow
via a specially crafted AIFF file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1788</cvename>
<cvename>CVE-2009-1791</cvename>
<url>http://secunia.com/advisories/35076/</url>
<url>http://www.trapkit.de/advisories/TKADV2009-006.txt</url>
</references>
<dates>
<discovery>2009-05-15</discovery>
<entry>2009-05-30</entry>
</dates>
</vuln>
<vuln vid="80f13884-4d4c-11de-8811-0030843d3802">
<topic>slim -- local disclosure of X authority magic cookie</topic>
<affects>
<package>
<name>slim</name>
<range><lt>1.3.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/35132/">
<p>A security issue has been reported in SLiM, which can be
exploited by malicious, local users to disclose sensitive
information.</p>
<p>The security issue is caused due to the application
generating the X authority file by passing the X authority
cookie via the command line to "xauth". This can be exploited
to disclose the X authority cookie by consulting the process
list and e.g. gain access the user's display.</p>
</blockquote>
</body>
</description>
<references>
<bid>35015</bid>
<cvename>CVE-2009-1756</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306</url>
</references>
<dates>
<discovery>2009-05-20</discovery>
<entry>2009-05-30</entry>
</dates>
</vuln>
<vuln vid="4175c811-f690-4898-87c5-755b3cf1bac6">
<topic>ntp -- stack-based buffer overflow</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.4p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/853097">
<p>ntpd contains a stack buffer overflow which may allow a remote
unauthenticated attacker to execute arbitrary code on a vulnerable
system or create a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>35017</bid>
<cvename>CVE-2009-0159</cvename>
<cvename>CVE-2009-1252</cvename>
<url>http://www.kb.cert.org/vuls/id/853097</url>
</references>
<dates>
<discovery>2009-05-06</discovery>
<entry>2009-05-20</entry>
</dates>
</vuln>
<vuln vid="5ed2f96b-33b7-4863-8c6b-540d22344424">
<topic>imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability</topic>
<affects>
<package>
<name>imap-uw</name>
<range><lt>2007e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33795">
<p>University of Washington IMAP c-client is prone to a remote
format-string vulnerability because the software fails to adequately
sanitize user-supplied input before passing it as the
format-specifier to a formatted-printing function.</p>
</blockquote>
</body>
</description>
<references>
<bid>33795</bid>
</references>
<dates>
<discovery>2009-02-17</discovery>
<entry>2009-05-21</entry>
<modified>2009-05-22</modified>
</dates>
</vuln>
<vuln vid="37a8603d-4494-11de-bea7-000c29a67389">
<topic>nsd -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>3.2.2</lt></range>
</package>
<package>
<name>nsd2</name>
<range><lt>2.3.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NLnet Labs:</p>
<blockquote cite="http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html">
<p>A one-byte buffer overflow has been reported in NSD. The
problem affects all versions 2.0.0 to 3.2.1. The bug allows
a carefully crafted exploit to bring down your DNS server. It
is highly unlikely that this one byte overflow can lead to
other (system) exploits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1755</cvename>
<url>http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html</url>
</references>
<dates>
<discovery>2009-05-19</discovery>
<entry>2009-05-19</entry>
<modified>2009-05-22</modified>
</dates>
</vuln>
<vuln vid="48e14d86-42f1-11de-ad22-000e35248ad7">
<topic>libxine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine developers report:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233">
<ul>
<li>Fix another possible int overflow in the 4XM demuxer.
(ref. TKADV2009-004, CVE-2009-0385)</li>
<li>Fix an integer overflow in the Quicktime demuxer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0385</cvename>
<cvename>CVE-2009-1274</cvename>
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
<url>http://trapkit.de/advisories/TKADV2009-005.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
</references>
<dates>
<discovery>2009-04-04</discovery>
<entry>2009-05-17</entry>
</dates>
</vuln>
<vuln vid="51d1d428-42f0-11de-ad22-000e35248ad7">
<topic>libxine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities were fixed in libxine 1.1.16.2.</p>
<p>Tobias Klein reports:</p>
<blockquote cite="http://trapkit.de/advisories/TKADV2009-004.txt">
<p>FFmpeg contains a type conversion vulnerability while
parsing malformed 4X movie files. The vulnerability may be
exploited by a (remote) attacker to execute arbitrary code in
the context of FFmpeg or an application using the FFmpeg
library.</p>
<p>Note: A similar issue also affects xine-lib < version
1.1.16.2.</p>
</blockquote>
<p>xine developers report:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=660071">
<ul>
<li>Fix broken size checks in various input plugins (ref.
CVE-2008-5239).</li>
<li>More malloc checking (ref. CVE-2008-5240).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0698</cvename>
<cvename>CVE-2008-5234</cvename>
<cvename>CVE-2008-5240</cvename>
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
</references>
<dates>
<discovery>2009-02-15</discovery>
<entry>2009-05-17</entry>
</dates>
</vuln>
<vuln vid="1e8031be-4258-11de-b67a-0030843d3802">
<topic>php -- ini database truncation inside dba_replace() function</topic>
<affects>
<package>
<name>php4-dba</name>
<range><lt>4.4.9_1</lt></range>
</package>
<package>
<name>php5-dba</name>
<range><lt>5.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>securityfocus research reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/498746/30/0/threaded">
<p>A bug that leads to the emptying of the INI file contents if
the database key was not found exists in PHP dba extension in
versions 5.2.6, 4.4.9 and earlier.</p>
<p>Function dba_replace() are not filtering strings key and value.
There is a possibility for the destruction of the file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-7068</cvename>
<url>http://www.securityfocus.com/archive/1/498746/30/0/threaded</url>
<url>http://securityreason.com/achievement_securityalert/58</url>
</references>
<dates>
<discovery>2008-11-28</discovery>
<entry>2009-05-16</entry>
<modified>2013-06-16</modified>
</dates>
</vuln>
<vuln vid="6a245f31-4254-11de-b67a-0030843d3802">
<topic>libwmf -- embedded GD library Use-After-Free vulnerability</topic>
<affects>
<package>
<name>libwmf</name>
<range><lt>0.2.8.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34901">
<p>A vulnerability has been reported in libwmf, which can be exploited
by malicious people to cause a DoS (Denial of Service) or compromise
an application using the library.</p>
<p>The vulnerability is caused due to a use-after-free error within the
embedded GD library, which can be exploited to cause a crash or
potentially to execute arbitrary code via a specially crafted WMF
file.</p>
</blockquote>
</body>
</description>
<references>
<bid>34792</bid>
<cvename>CVE-2009-1364</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=496864</url>
<url>https://rhn.redhat.com/errata/RHSA-2009-0457.html</url>
<url>http://secunia.com/advisories/34901/</url>
</references>
<dates>
<discovery>2009-05-05</discovery>
<entry>2009-05-16</entry>
</dates>
</vuln>
<vuln vid="48aab1d0-4252-11de-b67a-0030843d3802">
<topic>libwmf -- integer overflow vulnerability</topic>
<affects>
<package>
<name>libwmf</name>
<range><lt>0.2.8.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20921">
<p>infamous41md has reported a vulnerability in libwmf, which
potentially can be exploited by malicious people to compromise an
application using the vulnerable library.</p>
<p>The vulnerability is caused due to an integer overflow error when
allocating memory based on a value taken directly from a WMF file
without performing any checks. This can be exploited to cause a
heap-based buffer overflow when a specially crafted WMF file is
processed.</p>
</blockquote>
</body>
</description>
<references>
<bid>18751</bid>
<cvename>CVE-2006-3376</cvename>
<url>http://secunia.com/advisories/20921/</url>
</references>
<dates>
<discovery>2006-07-03</discovery>
<entry>2009-05-16</entry>
</dates>
</vuln>
<vuln vid="bfe218a5-4218-11de-b67a-0030843d3802">
<topic>moinmoin -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34821/">
<p>Input passed via multiple parameters to action/AttachFile.py is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in the context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1482</cvename>
<url>http://secunia.com/advisories/34821/</url>
<url>http://moinmo.in/SecurityFixes</url>
</references>
<dates>
<discovery>2009-04-21</discovery>
<entry>2009-05-16</entry>
</dates>
</vuln>
<vuln vid="4a638895-41b7-11de-b1cc-00219b0fc4d8">
<topic>mod_perl -- cross-site scripting</topic>
<affects>
<package>
<name>mod_perl</name>
<range><lt>1.31</lt></range>
</package>
<package>
<name>mod_perl2</name>
<range><lt>2.05</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/3459796">
<p>Certain input passed to the "Apache::Status" and "Apache2::Status"
modules is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0796</cvename>
<url>http://secunia.com/advisories/34597</url>
</references>
<dates>
<discovery>2009-02-28</discovery>
<entry>2009-05-16</entry>
<modified>2009-05-16</modified>
</dates>
</vuln>
<vuln vid="a6605f4b-4067-11de-b444-001372fd0af2">
<topic>drupal -- cross-site scripting</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.18</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Security Team reports:</p>
<blockquote cite="http://drupal.org/node/461886">
<p>When outputting user-supplied data Drupal strips potentially
dangerous HTML attributes and tags or escapes characters which
have a special meaning in HTML. This output filtering secures the
site against cross site scripting attacks via user input.</p>
<p>Certain byte sequences that are valid in the UTF-8 specification
are potentially dangerous when interpreted as UTF-7. Internet
Explorer 6 and 7 may decode these characters as UTF-7 if they
appear before the <meta http-equiv="Content-Type" /> tag that
specifies the page content as UTF-8, despite the fact that Drupal
also sends a real HTTP header specifying the content as UTF-8.
This enables attackers to execute cross site scripting attacks
with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting
contained an incomplete fix for the issue. HTML exports of books
are still vulnerable, which means that anyone with edit
permissions for pages in outlines is able to insert arbitrary HTML
and script code in these exports.</p>
<p>Additionally, the taxonomy module allows users with the
'administer taxonomy' permission to inject arbitrary HTML and
script code in the help text of any vocabulary.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/461886</url>
<url>http://secunia.com/advisories/35045</url>
</references>
<dates>
<discovery>2009-05-13</discovery>
<entry>2009-05-14</entry>
<modified>2009-05-16</modified>
</dates>
</vuln>
<vuln vid="14ab174c-40ef-11de-9fd5-001bd3385381">
<topic>cyrus-sasl -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><lt>2.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/238019">
<p>The sasl_encode64() function converts a string into
base64. The Cyrus SASL library contains buffer overflows
that occur because of unsafe use of the sasl_encode64()
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0688</cvename>
<url>http://www.kb.cert.org/vuls/id/238019</url>
</references>
<dates>
<discovery>2009-04-08</discovery>
<entry>2009-05-15</entry>
</dates>
</vuln>
<vuln vid="fc4d0ae8-3fa3-11de-a3fd-0030843d3802">
<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33593/">
<p>Some vulnerabilities have been reported in MoinMoin, which can be
exploited by malicious people to conduct cross-site scripting attacks.</p>
<p>Input passed to multiple parameters in action/AttachFile.py is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in the context of an affected site.</p>
<p>Certain input passed to security/antispam.py is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
the context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0260</cvename>
<cvename>CVE-2009-0312</cvename>
<url>http://moinmo.in/SecurityFixes</url>
<url>http://secunia.com/advisories/33593</url>
</references>
<dates>
<discovery>2009-01-21</discovery>
<entry>2009-05-13</entry>
</dates>
</vuln>
<vuln vid="f0f97b94-3f95-11de-a3fd-0030843d3802">
<topic>ghostscript -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>ghostscript8</name>
<name>ghostscript8-nox11</name>
<range><lt>8.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34340/discuss">
<p>Ghostscript is prone to a remote buffer-overflow vulnerability
because it fails to properly bounds-check user-supplied input before
copying it into a finite-sized buffer.</p>
<p>Exploiting this issue allows remote attackers to overwrite a
sensitive memory buffer with arbitrary data, potentially allowing them
to execute malicious machine code in the context of the affected
application. This vulnerability may facilitate the compromise of
affected computers.</p>
</blockquote>
</body>
</description>
<references>
<bid>34340</bid>
<cvename>CVE-2008-6679</cvename>
</references>
<dates>
<discovery>2009-02-03</discovery>
<entry>2009-05-13</entry>
</dates>
</vuln>
<vuln vid="4b172278-3f46-11de-becb-001cc0377035">
<topic>pango -- integer overflow</topic>
<affects>
<package>
<name>pango</name>
<name>linux-pango</name>
<name>linux-f8-pango</name>
<name>linux-f10-pango</name>
<range><lt>1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-001.html">
<p>Pango suffers from a multiplicative integer overflow which
may lead to a potentially exploitable, heap overflow depending
on the calling conditions.</p>
<p>For example, this vulnerability is remotely reachable in Firefox
by creating an overly large document.location value but only results
in a process-terminating, allocation error (denial of service).</p>
<p>The affected function is pango_glyph_string_set_size. An overflow
check when doubling the size neglects the overflow possible on the
subsequent allocation.</p>
</blockquote>
</body>
</description>
<references>
<bid>34870</bid>
<cvename>CVE-2009-1194</cvename>
<url>http://secunia.com/advisories/35021/</url>
</references>
<dates>
<discovery>2009-02-22</discovery>
<entry>2009-05-13</entry>
<modified>2009-10-01</modified>
</dates>
</vuln>
<vuln vid="defce068-39aa-11de-a493-001b77d09812">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<name>wireshark</name>
<name>wireshark-lite</name>
<range><lt>1.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark team reports:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-02.html">
<p>Wireshark 1.0.7 fixes the following vulnerabilities:</p>
<ul>
<li>The PROFINET dissector was vulnerable to a format
string overflow. (Bug 3382) Versions affected: 0.99.6 to
1.0.6, CVE-2009-1210.</li>
<li>The Check Point High-Availability Protocol (CPHAP)
dissector could crash. (Bug 3269) Versions affected: 0.9.6
to 1.0.6; CVE-2009-1268.</li>
<li>Wireshark could crash while loading a Tektronix .rf5
file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6,
CVE-2009-1269.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>34291</bid>
<bid>34457</bid>
<cvename>CVE-2009-1210</cvename>
<cvename>CVE-2009-1268</cvename>
<cvename>CVE-2009-1269</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2009-02.html</url>
<url>http://secunia.com/advisories/34542</url>
</references>
<dates>
<discovery>2009-04-06</discovery>
<entry>2009-05-09</entry>
<modified>2009-05-13</modified>
</dates>
</vuln>
<vuln vid="736e55bc-39bb-11de-a493-001b77d09812">
<topic>cups -- remote code execution and DNS rebinding</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo security team summarizes:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200904-20.xml">
<p>The following issues were reported in CUPS:</p>
<ul>
<li>iDefense reported an integer overflow in the
_cupsImageReadTIFF() function in the "imagetops" filter,
leading to a heap-based buffer overflow (CVE-2009-0163).</li>
<li>Aaron Siegel of Apple Product Security reported that the
CUPS web interface does not verify the content of the "Host"
HTTP header properly (CVE-2009-0164).</li>
<li>Braden Thomas and Drew Yao of Apple Product Security
reported that CUPS is vulnerable to CVE-2009-0146,
CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and
poppler.</li>
</ul>
<p>A remote attacker might send or entice a user to send a
specially crafted print job to CUPS, possibly resulting in the
execution of arbitrary code with the privileges of the
configured CUPS user -- by default this is "lp", or a Denial
of Service. Furthermore, the web interface could be used to
conduct DNS rebinding attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>34571</bid>
<bid>34665</bid>
<bid>34568</bid>
<cvename>CVE-2009-0163</cvename>
<cvename>CVE-2009-0164</cvename>
<cvename>CVE-2009-0146</cvename>
<cvename>CVE-2009-0147</cvename>
<cvename>CVE-2009-0166</cvename>
<url>http://www.cups.org/articles.php?L582</url>
</references>
<dates>
<discovery>2009-05-05</discovery>
<entry>2009-05-07</entry>
<modified>2009-05-13</modified>
</dates>
</vuln>
<vuln vid="fbc8413f-2f7a-11de-9a3f-001b77d09812">
<topic>FreeBSD -- remotely exploitable crash in OpenSSL</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_10</lt></range>
<range><ge>6.4</ge><lt>6.4_4</lt></range>
<range><ge>7.0</ge><lt>7.0_12</lt></range>
<range><ge>7.1</ge><lt>7.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The function ASN1_STRING_print_ex does not properly validate
the lengths of BMPString or UniversalString objects before
attempting to print them.</p>
<h1>Impact</h1>
<p>An application which attempts to print a BMPString or
UniversalString which has an invalid length will crash as a
result of OpenSSL accessing invalid memory locations. This
could be used by an attacker to crash a remote application.</p>
<h1>Workaround</h1>
<p>No workaround is available, but applications which do not use
the ASN1_STRING_print_ex function (either directly or indirectly)
are not affected.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:08.openssl</freebsdsa>
<cvename>CVE-2009-0590</cvename>
</references>
<dates>
<discovery>2009-03-25</discovery>
<entry>2009-05-07</entry>
<modified>2009-05-13</modified>
</dates>
</vuln>
<vuln vid="2748fdde-3a3c-11de-bbc5-00e0815b8da8">
<topic>quagga -- Denial of Service</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Team reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/503220">
<p>It was discovered that Quagga, an IP routing daemon, could
no longer process the Internet routing table due to broken
handling of multiple 4-byte AS numbers in an AS path. If such
a prefix is received, the BGP daemon crashes with an assert
failure leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>34656</bid>
<mlist msgid="Pine.LNX.4.64.0904301931590.24373@nacho.alt.net">http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html</mlist>
<cvename>CVE-2009-1572</cvename>
</references>
<dates>
<discovery>2009-05-04</discovery>
<entry>2009-05-06</entry>
<modified>2009-05-07</modified>
</dates>
</vuln>
<vuln vid="e3e30d99-58a8-4a3f-8059-a8b7cd59b881">
<topic>openfire -- Openfire No Password Changes Security Bypass</topic>
<affects>
<package>
<name>openfire</name>
<range><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34984/">
<p>A vulnerability has been reported in Openfire which can
be exploited by malicious users to bypass certain security
restrictions. The vulnerability is caused due to Openfire
not properly respecting the no password changes setting which
can be exploited to change passwords by sending jabber:iq:auth
passwd_change requests to the server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1596</cvename>
<url>http://secunia.com/advisories/34984/</url>
<url>http://www.igniterealtime.org/issues/browse/JM-1532</url>
<url>http://www.igniterealtime.org/community/message/190288#190288</url>
</references>
<dates>
<discovery>2009-05-04</discovery>
<entry>2009-05-04</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="7a1ab8d4-35c1-11de-9672-0030843d3802">
<topic>drupal -- cross site scripting</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.17</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="http://drupal.org/node/449078">
<p>When outputting user-supplied data Drupal strips potentially
dangerous HTML attributes and tags or escapes characters which have a
special meaning in HTML. This output filtering secures the site
against cross site scripting attacks via user input.</p>
<p>Certain byte sequences that are valid in the UTF-8 specification
are potentially dangerous when interpreted as UTF-7. Internet Explorer
6 and 7 may decode these characters as UTF-7 if they appear before the
meta http-equiv="Content-Type" tag that specifies the page content
as UTF-8, despite the fact that Drupal also sends a real HTTP header
specifying the content as UTF-8. This behaviour enables malicious
users to insert and execute Javascript in the context of the website
if site visitors are allowed to post content.</p>
<p>In addition, Drupal core also has a very limited information
disclosure vulnerability under very specific conditions. If a user is
tricked into visiting the site via a specially crafted URL and then
submits a form (such as the search box) from that page, the
information in their form submission may be directed to a third-party
site determined by the URL and thus disclosed to the third party. The
third party site may then execute a CSRF attack against the submitted
form.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1575</cvename>
<cvename>CVE-2009-1576</cvename>
<url>http://drupal.org/node/449078</url>
</references>
<dates>
<discovery>2009-04-30</discovery>
<entry>2009-04-30</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="3b18e237-2f15-11de-9672-0030843d3802">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.20_7,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.9,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>3.0.9</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.17</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2009-22: Firefox allows Refresh header to redirect to
javascript: URIs</p>
<p>MFSA 2009-21: POST data sent to wrong site when saving web page
with embedded frame</p>
<p>MFSA 2009-20: Malicious search plugins can inject code into
arbitrary sites</p>
<p>MFSA 2009-19: Same-origin violations in XMLHttpRequest and
XPCNativeWrapper.toString</p>
<p>MFSA 2009-18: XSS hazard using third-party stylesheets and XBL
bindings</p>
<p>MFSA 2009-17: Same-origin violations when Adobe Flash loaded via
view-source: scheme</p>
<p>MFSA 2009-16: jar: scheme ignores the content-disposition: header
on the inner URI</p>
<p>MFSA 2009-15: URL spoofing with box drawing character</p>
<p>MFSA 2009-14 Crashes with evidence of memory corruption
(rv:1.9.0.9)</p>
</blockquote>
</body>
</description>
<references>
<bid>34656</bid>
<cvename>CVE-2009-1303</cvename>
<cvename>CVE-2009-1306</cvename>
<cvename>CVE-2009-1307</cvename>
<cvename>CVE-2009-1308</cvename>
<cvename>CVE-2009-1309</cvename>
<cvename>CVE-2009-1312</cvename>
<cvename>CVE-2009-1311</cvename>
<cvename>CVE-2009-1302</cvename>
<cvename>CVE-2009-1304</cvename>
<cvename>CVE-2009-1305</cvename>
<cvename>CVE-2009-1310</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-22.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-21.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-20.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-19.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-18.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-17.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-16.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-15.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-14.html</url>
</references>
<dates>
<discovery>2009-04-21</discovery>
<entry>2009-04-22</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="50d233d9-374b-46ce-922d-4e6b3f777bef">
<topic>poppler -- Poppler Multiple Vulnerabilities</topic>
<affects>
<package>
<name>poppler</name>
<range><lt>0.10.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite=" http://secunia.com/advisories/34746/">
<p>Some vulnerabilities have been reported in Poppler which can be
exploited by malicious people to potentially compromise an
application using the library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/34746/</url>
</references>
<dates>
<discovery>2009-04-17</discovery>
<entry>2009-04-18</entry>
</dates>
</vuln>
<vuln vid="a21037d5-2c38-11de-ab3b-0017a4cccfc6">
<topic>xpdf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.02_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://www.vupen.com/english/advisories/2009/1065">
<p>Some vulnerabilities have been reported in Xpdf, which can be
exploited by malicious people to potentially compromise a user's
system.</p>
<p>A boundary error exists when decoding JBIG2 symbol dictionary
segments. This can be exploited to cause a heap-based buffer
overflow and potentially execute arbitrary code.</p>
<p>Multiple integer overflows in the JBIG2 decoder can be
exploited to potentially execute arbitrary code.</p>
<p>Multiple boundary errors in the JBIG2 decoder can be
exploited to cause buffer overflows and potentially execute
arbitrary code.</p>
<p>Multiple errors in the JBIG2 decoder can be exploited can be
exploited to free arbitrary memory and potentially execute arbitrary
code.</p>
<p>Multiple unspecified input validation errors in the JBIG2 decoder can
be exploited to potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0146</cvename>
<cvename>CVE-2009-0147</cvename>
<cvename>CVE-2009-0166</cvename>
<cvename>CVE-2009-0799</cvename>
<cvename>CVE-2009-0800</cvename>
<cvename>CVE-2009-1179</cvename>
<cvename>CVE-2009-1180</cvename>
<cvename>CVE-2009-1181</cvename>
<cvename>CVE-2009-1182</cvename>
<cvename>CVE-2009-1183</cvename>
<url>http://secunia.com/advisories/34291</url>
<url>http://www.vupen.com/english/advisories/2009/1065</url>
</references>
<dates>
<discovery>2009-04-16</discovery>
<entry>2009-04-18</entry>
<modified>2009-04-18</modified>
</dates>
</vuln>
<vuln vid="20b4f284-2bfc-11de-bdeb-0030843d3802">
<topic>freetype2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.3.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34723/">
<p>Some vulnerabilities have been reported in FreeType, which can be
exploited by malicious people to potentially compromise an application
using the library.</p>
<p>An integer overflow error within the "cff_charset_compute_cids()"
function in cff/cffload.c can be exploited to potentially cause a
heap-based buffer overflow via a specially crafted font.</p>
<p>Multiple integer overflow errors within validation functions in
sfnt/ttcmap.c can be exploited to bypass length validations and
potentially cause buffer overflows via specially crafted fonts.</p>
<p>An integer overflow error within the "ft_smooth_render_generic()"
function in smooth/ftsmooth.c can be exploited to potentially cause a
heap-based buffer overflow via a specially crafted font.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0946</cvename>
<url>http://secunia.com/advisories/34723/</url>
</references>
<dates>
<discovery>2009-04-16</discovery>
<entry>2009-04-18</entry>
</dates>
</vuln>
<vuln vid="cf91c1e4-2b6d-11de-931b-00e0815b8da8">
<topic>ejabberd -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34133">
<p>The ejabberd application is prone to a cross-site scripting
vulnerability.</p>
<p>An attacker may leverage this issue to execute arbitrary script code
in the browser of an unsuspecting user in the context of the affected
site and to steal cookie-based authentication credentials.</p>
</blockquote>
</body>
</description>
<references>
<bid>34133</bid>
<cvename>CVE-2009-0934</cvename>
</references>
<dates>
<discovery>2009-03-16</discovery>
<entry>2009-04-17</entry>
</dates>
</vuln>
<vuln vid="872ae5be-29c0-11de-bdeb-0030843d3802">
<topic>ziproxy -- multiple vulnerability</topic>
<affects>
<package>
<name>ziproxy</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ziproxy Developers reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/MAPG-7N9GN8">
<p>Multiple HTTP proxy implementations are prone to an
information-disclosure vulnerability related to the interpretation of
the 'Host' HTTP header. Specifically, this issue occurs when the proxy
makes a forwarding decision based on the 'Host' HTTP header instead of
the destination IP address.</p>
<p>Attackers may exploit this issue to obtain sensitive information
such as internal intranet webpages. Additional attacks may also be
possible.</p>
</blockquote>
</body>
</description>
<references>
<bid>33858</bid>
<cvename>CVE-2009-0804</cvename>
<url>http://www.kb.cert.org/vuls/id/MAPG-7N9GN8</url>
</references>
<dates>
<discovery>2009-02-23</discovery>
<entry>2009-04-15</entry>
</dates>
</vuln>
<vuln vid="1a0e4cc6-29bf-11de-bdeb-0030843d3802">
<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php">
<p>Setup script used to generate configuration can be fooled using a
crafted POST request to include arbitrary PHP code in generated
configuration file. Combined with ability to save files on server,
this can allow unauthenticated users to execute arbitrary PHP code.
This issue is on different parameters than PMASA-2009-3 and it was
missed out of our radar because it was not existing in 2.11.x
branch.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1285</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php</url>
</references>
<dates>
<discovery>2009-04-14</discovery>
<entry>2009-04-15</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="03d22656-2690-11de-8226-0030843d3802">
<topic>drupal6-cck -- cross-site scripting</topic>
<affects>
<package>
<name>drupal6-cck</name>
<range><lt>2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal CCK plugin developer reports:</p>
<blockquote cite="http://drupal.org/node/406520">
<p>The Node reference and User reference sub-modules, which
are part of the Content Construction Kit (CCK) project, lets
administrators define node fields that are references to other
nodes or to users. When displaying a node edit form, the
titles of candidate referenced nodes or names of candidate
referenced users are not properly filtered, allowing malicious
users to inject arbitrary code on those pages. Such a cross
site scripting (XSS) attack may lead to a malicious user
gaining full administrative access.</p>
</blockquote>
</body>
</description>
<references>
<bid>34172</bid>
<cvename>CVE-2009-1069</cvename>
<url>http://drupal.org/node/406520</url>
</references>
<dates>
<discovery>2009-03-23</discovery>
<entry>2009-04-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="0fe73a4a-1b18-11de-8226-0030843d3802">
<topic>pivot-weblog -- file deletion vulnerability</topic>
<affects>
<package>
<name>pivot-weblog</name>
<range><lt>1.40.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34302">
<p>A vulnerability has been discovered in Pivot, which can be
exploited by malicious people to delete certain files.</p>
<p>Input passed to the "refkey" parameter in
extensions/bbclone_tools/count.php is not properly sanitised
before being used to delete files. This can be exploited to
delete files with the permissions of the web server via directory
traversal sequences passed within the "refkey" parameter.</p>
<p>NOTE: Users with the "Advanced" user level are able to include and
execute uploaded PHP code via the "pivot_path" parameter in
extensions/bbclone_tools/getkey.php when
extensions/bbclone_tools/hr_conf.php can be deleted.</p>
</blockquote>
</body>
</description>
<references>
<bid>34160</bid>
<url>http://secunia.com/advisories/34302/</url>
</references>
<dates>
<discovery>2009-03-18</discovery>
<entry>2009-03-27</entry>
</dates>
</vuln>
<vuln vid="06f9174f-190f-11de-b2f0-001c2514716c">
<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
<affects>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.9.5</lt></range>
</package>
<package>
<name>phpMyAdmin</name>
<range><lt>3.1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php">
<p>Setup script used to generate configuration can be fooled
using a crafted POST request to include arbitrary PHP code
in generated configuration file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1151</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php</url>
</references>
<dates>
<discovery>2009-03-24</discovery>
<entry>2009-03-25</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="6bb6188c-17b2-11de-ae4d-0030843d3802">
<topic>amarok -- multiple vulnerabilities</topic>
<affects>
<package>
<name>amarok</name>
<range><lt>1.4.10_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33505">
<p>Tobias Klein has reported some vulnerabilities in Amarok, which
potentially can be exploited by malicious people to compromise a
user's system.</p>
<p>Two integer overflow errors exist within the
"Audible::Tag::readTag()" function in
src/metadata/audible/audibletag.cpp. These can be exploited to cause
heap-based buffer overflows via specially crafted Audible Audio
files.</p>
<p>Two errors within the "Audible::Tag::readTag()" function in
src/metadata/audible/audibletag.cpp can be exploited to corrupt
arbitrary memory via specially crafted Audible Audio files.</p>
</blockquote>
</body>
</description>
<references>
<bid>33210</bid>
<cvename>CVE-2009-0135</cvename>
<cvename>CVE-2009-0136</cvename>
<url>http://www.debian.org/security/2009/dsa-1706</url>
<url>http://secunia.com/advisories/33505</url>
</references>
<dates>
<discovery>2009-01-12</discovery>
<entry>2009-03-23</entry>
</dates>
</vuln>
<vuln vid="f6f19735-9245-4918-8a60-87948ebb4907">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<name>wireshark</name>
<name>wireshark-lite</name>
<range><lt>1.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vendor reports:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-01.html">
<p>On non-Windows systems Wireshark could crash if the HOME
environment variable contained sprintf-style string formatting
characters. Wireshark could crash while reading a malformed
NetScreen snoop file. Wireshark could crash while reading a
Tektronix K12 text capture file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0599</cvename>
<cvename>CVE-2009-0600</cvename>
<cvename>CVE-2009-0601</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2009-01.html</url>
</references>
<dates>
<discovery>2009-02-06</discovery>
<entry>2009-03-22</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="72cba7b0-13cd-11de-a964-0030843d3802">
<topic>netatalk -- arbitrary command execution in papd daemon</topic>
<affects>
<package>
<name>netatalk</name>
<range><lt>2.0.3_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33227/">
<p>A vulnerability has been reported in Netatalk, which potentially
can be exploited by malicious users to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to the papd daemon improperly
sanitising several received parameters before passing them in a call
to popen(). This can be exploited to execute arbitrary commands via
a specially crafted printing request.</p>
<p>Successful exploitation requires that a printer is configured to
pass arbitrary values as parameters to a piped command.</p>
</blockquote>
</body>
</description>
<references>
<bid>32925</bid>
<cvename>CVE-2008-5718</cvename>
<url>http://secunia.com/advisories/33227/</url>
<url>http://www.openwall.com/lists/oss-security/2009/01/13/3</url>
</references>
<dates>
<discovery>2008-12-19</discovery>
<entry>2009-03-18</entry>
<modified>2009-03-18</modified>
</dates>
</vuln>
<vuln vid="37a365ed-1269-11de-a964-0030843d3802">
<topic>gstreamer-plugins-good -- multiple memory overflows</topic>
<affects>
<package>
<name>gstreamer-plugins-good</name>
<range><ge>0.10.9,3</ge><lt>0.10.12,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33650/">
<p>Tobias Klein has reported some vulnerabilities in GStreamer Good
Plug-ins, which can potentially be exploited by malicious people to
compromise a vulnerable system.</p>
<p>A boundary error occurs within the "qtdemux_parse_samples()"
function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts"
Atom parsing. This can be exploited to cause a heap-based buffer
overflow via a specially crafted QuickTime media file.</p>
<p>An array indexing error exists in the "qtdemux_parse_samples()"
function in gst/gtdemux/qtdemux.c when performing QuickTime "stss"
Atom parsing. This can be exploited to corrupt memory via a specially
crafted QuickTime media file.</p>
<p>A boundary error occurs within the "qtdemux_parse_samples()"
function in gst/gtdemux/qtdemux.c when performing QuickTime "stts"
Atom parsing. This can be exploited to cause a heap-based buffer
overflow via a specially crafted QuickTime media file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0386</cvename>
<cvename>CVE-2009-0387</cvename>
<cvename>CVE-2009-0397</cvename>
<url>http://secunia.com/advisories/33650/</url>
<url>http://trapkit.de/advisories/TKADV2009-003.txt</url>
<url>http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html</url>
</references>
<dates>
<discovery>2009-01-22</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="c5af0747-1262-11de-a964-0030843d3802">
<topic>libsndfile -- CAF processing integer overflow vulnerability</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33980/">
<p>The vulnerability is caused due to an integer overflow error in the
processing of CAF description chunks. This can be exploited to cause a
heap-based buffer overflow by tricking the user into processing a
specially crafted CAF audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0186</cvename>
<url>http://secunia.com/advisories/33980/</url>
</references>
<dates>
<discovery>2009-03-03</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="6733e1bf-125f-11de-a964-0030843d3802">
<topic>ffmpeg -- 4xm processing memory corruption vulnerability</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>2008.07.27_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33711/">
<p>Tobias Klein has reported a vulnerability in FFmpeg, which
potentially can be exploited by malicious people to compromise an
application using the library.</p>
<p>The vulnerability is caused due to a signedness error within the
"fourxm_read_header()" function in libavformat/4xm.c. This can be
exploited to corrupt arbitrary memory via a specially crafted 4xm
file.</p>
</blockquote>
</body>
</description>
<references>
<bid>33502</bid>
<cvename>CVE-2009-0385</cvename>
<url>http://secunia.com/advisories/33711/</url>
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
</references>
<dates>
<discovery>2009-01-28</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="35c0b572-125a-11de-a964-0030843d3802">
<topic>roundcube -- webmail script insertion and php code injection</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33622/">
<p>Some vulnerabilities have been reported in RoundCube Webmail, which
can be exploited by malicious users to compromise a vulnerable system
and by malicious people to conduct script insertion attacks and
compromise a vulnerable system.</p>
<p>The HTML "background" attribute within e.g. HTML emails is not
properly sanitised before being used. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site if a malicious email is viewed.</p>
<p>Input passed via a vCard is not properly sanitised before being
used in a call to "preg_replace()" with the "e" modifier in
program/include/rcube_vcard.php. This can be exploited to inject and
execute arbitrary PHP code by e.g. tricking a user into importing a
malicious vCard file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0413</cvename>
<url>http://secunia.com/advisories/33622/</url>
<url>http://sourceforge.net/forum/forum.php?forum_id=927958</url>
<url>http://trac.roundcube.net/changeset/2245</url>
<url>http://trac.roundcube.net/ticket/1485689</url>
</references>
<dates>
<discovery>2009-01-21</discovery>
<entry>2009-03-16</entry>
<modified>2009-03-26</modified>
</dates>
</vuln>
<vuln vid="ca0841ff-1254-11de-a964-0030843d3802">
<topic>proftpd -- multiple sql injection vulnerabilities</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.2</lt></range>
</package>
<package>
<name>proftpd-devel</name>
<range><le>1.3.20080922</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33842/">
<p>Some vulnerabilities have been reported in ProFTPD, which can be
exploited by malicious people to conduct SQL injection attacks.</p>
<p>The application improperly sets the character encoding prior to
performing SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code in an environment using a
multi-byte character encoding.</p>
<p>An error exists in the "mod_sql" module when processing e.g. user
names containing '%' characters. This can be exploited to bypass input
sanitation routines and manipulate SQL queries by injecting arbitrary
SQL code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0542</cvename>
<cvename>CVE-2009-0543</cvename>
<url>http://secunia.com/advisories/33842/</url>
<url>http://bugs.proftpd.org/show_bug.cgi?id=3173</url>
<url>http://bugs.proftpd.org/show_bug.cgi?id=3124</url>
<url>http://milw0rm.com/exploits/8037</url>
</references>
<dates>
<discovery>2009-02-06</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="03140526-1250-11de-a964-0030843d3802">
<topic>zabbix -- php frontend multiple vulnerabilities</topic>
<affects>
<package>
<name>zabbix</name>
<range><lt>1.6.2_1,1</lt></range>
</package>
<package>
<name>zabbix-agent</name>
<range><lt>1.6.2_1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34091/">
<p>Some vulnerabilities have been reported in the ZABBIX PHP frontend,
which can be exploited by malicious people to conduct cross-site
request forgery attacks and malicious users to disclose sensitive
information and compromise a vulnerable system.</p>
<p>Input appended to and passed via the "extlang" parameter to the
"calc_exp2()" function in include/validate.inc.php is not properly
sanitised before being used. This can be exploited to inject and
execute arbitrary PHP code.</p>
<p>The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the
requests. This can be exploited to e.g. create users by enticing a
logged in administrator to visit a malicious web page.</p>
<p>Input passed to the "srclang" parameter in locales.php (when "next"
is set to a non-NULL value) is not properly verified before being used
to include files. This can be exploited to include arbitrary files
from local resources via directory traversal attacks and URL-encoded
NULL bytes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/34091/</url>
<url>http://www.ush.it/team/ush/hack-zabbix_162/adv.txt</url>
</references>
<dates>
<discovery>2009-03-04</discovery>
<entry>2009-03-16</entry>
<modified>2009-03-23</modified>
</dates>
</vuln>
<vuln vid="a2074ac6-124c-11de-a964-0030843d3802">
<topic>php-mbstring -- php mbstring buffer overflow vulnerability</topic>
<affects>
<package>
<name>php4-mbstring</name>
<range><lt>4.4.9</lt></range>
</package>
<package>
<name>php5-mbstring</name>
<range><lt>5.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/32948">
<p>PHP is prone to a buffer-overflow vulnerability because it fails to
perform boundary checks before copying user-supplied data to
insufficiently sized memory buffers. The issue affects the 'mbstring'
extension included in the standard distribution.</p>
<p>An attacker can exploit this issue to execute arbitrary machine
code in the context of the affected webserver. Failed exploit attempts
will likely crash the webserver, denying service to legitimate
users.</p>
</blockquote>
</body>
</description>
<references>
<bid>32948</bid>
<cvename>CVE-2008-5557</cvename>
</references>
<dates>
<discovery>2008-12-21</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="4ce3c20b-124b-11de-a964-0030843d3802">
<topic>phppgadmin -- directory traversal with register_globals enabled</topic>
<affects>
<package>
<name>phppgadmin</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33014">
<p>Dun has discovered a vulnerability in phpPgAdmin, which can be
exploited by malicious people to disclose sensitive information.</p>
<p>Input passed via the "_language" parameter to libraries/lib.inc.php
is not properly sanitised before being used to include files. This can
be exploited to include arbitrary files from local resources via
directory traversal attacks and URL-encoded NULL bytes.</p>
</blockquote>
</body>
</description>
<references>
<bid>32670</bid>
<cvename>CVE-2008-5587</cvename>
<url>http://secunia.com/advisories/33014</url>
</references>
<dates>
<discovery>2008-12-08</discovery>
<entry>2009-03-16</entry>
</dates>
</vuln>
<vuln vid="8c5205b4-11a0-11de-a964-0030843d3802">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/964/">
<p>An unspecified error in the processing of JPEG images can be
exploited to trigger a memory corruption.</p>
<p>An error can be exploited to execute arbitrary script code in a
different domain via unspecified plugins.</p>
<p>An unspecified error has a "moderately severe" impact. No further
information is available.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0914</cvename>
<cvename>CVE-2009-0915</cvename>
<url>http://www.opera.com/docs/changelogs/freebsd/964/</url>
<url>http://secunia.com/advisories/34135/</url>
</references>
<dates>
<discovery>2009-03-15</discovery>
<entry>2009-03-15</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="e848a92f-0e7d-11de-92de-000bcdc1757a">
<topic>epiphany -- untrusted search path vulnerability</topic>
<affects>
<package>
<name>epiphany</name>
<range><lt>2.24.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5985">
<p>Untrusted search path vulnerability in the Python interface in
Epiphany 2.22.3, and possibly other versions, allows local users to
execute arbitrary code via a Trojan horse Python file in the current
working directory, related to a vulnerability in the PySys_SetArgv
function (CVE-2008-5983).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5985</cvename>
<cvename>CVE-2008-5983</cvename>
</references>
<dates>
<discovery>2009-01-26</discovery>
<entry>2009-03-11</entry>
</dates>
</vuln>
<vuln vid="f1892066-0e74-11de-92de-000bcdc1757a">
<topic>apache -- Cross-site scripting vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.2.0</gt><lt>2.2.9_2</lt></range>
<range><gt>2.0.0</gt><lt>2.0.63_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939">
<p>Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the
mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c
in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions,
allows remote attackers to inject arbitrary web script or HTML via a
wildcard in the last directory component in the pathname in an FTP
URI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2939</cvename>
<url>http://www.rapid7.com/advisories/R7-0033.jsp</url>
</references>
<dates>
<discovery>2008-07-25</discovery>
<entry>2009-03-11</entry>
</dates>
</vuln>
<vuln vid="ea2411a4-08e8-11de-b88a-0022157515b2">
<topic>pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability</topic>
<affects>
<package>
<name>pngcrush</name>
<range><lt>1.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33976/">
<p>A vulnerability has been reported in Pngcrush, which
can be exploited by malicious people to potentially
compromise a user's system.</p>
<p>The vulnerability is caused due to the use of vulnerable
libpng code.</p>
</blockquote>
</body>
</description>
<references>
<bid>33827</bid>
<cvename>CVE-2009-0040</cvename>
<url>http://secunia.com/advisories/33976</url>
<url>http://xforce.iss.net/xforce/xfdb/48819</url>
</references>
<dates>
<discovery>2009-02-19</discovery>
<entry>2009-03-04</entry>
</dates>
</vuln>
<vuln vid="5d433534-f41c-402e-ade5-e0a2259a7cb6">
<topic>curl -- cURL/libcURL Location: Redirect URLs Security Bypass</topic>
<affects>
<package>
<name>curl</name>
<range><ge>5.11</ge><lt>7.19.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/34138/">
<p>The security issue is caused due to cURL following HTTP Location:
redirects to e.g. scp:// or file:// URLs which can be exploited
by a malicious HTTP server to overwrite or disclose the content of
arbitrary local files and potentially execute arbitrary commands via
specially crafted redirect URLs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0037</cvename>
<url>http://secunia.com/advisories/34138/</url>
</references>
<dates>
<discovery>2009-03-03</discovery>
<entry>2009-03-04</entry>
</dates>
</vuln>
<vuln vid="cf495fd4-fdcd-11dd-9a86-0050568452ac">
<topic>Zend Framework -- Local File Inclusion vulnerability in Zend_View::render()</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthew Weier O'Phinney reports:</p>
<blockquote cite="http://weierophinney.net/matthew/archives/206-Zend-Framework-1.7.5-Released-Important-Note-Regarding-Zend_View.html">
<p>A potential Local File Inclusion (LFI) vulnerability exists in
the Zend_View::render() method. If user input is used to
specify the script path, then it is possible to trigger the
LFI.</p>
<p>Note that Zend Framework applications that never call the
Zend_View::render() method with a user-supplied parameter are
not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://framework.zend.com/issues/browse/ZF-5748</url>
</references>
<dates>
<discovery>2009-02-11</discovery>
<entry>2009-02-18</entry>
</dates>
</vuln>
<vuln vid="25eb365c-fd11-11dd-8424-c213de35965d">
<topic>dia -- remote command execution vulnerability</topic>
<affects>
<package>
<name>dia</name>
<range><lt>0.96.1_6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Security Focus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33448/">
<p>An attacker could exploit this issue by enticing an
unsuspecting victim to execute the vulnerable
application in a directory containing a malicious
Python file. A successful exploit will allow arbitrary
Python commands to run within the privileges of the currently
logged-in user.</p>
</blockquote>
</body>
</description>
<references>
<bid>33448</bid>
<cvename>CVE-2008-5984</cvename>
<url>http://secunia.com/advisories/33672</url>
</references>
<dates>
<discovery>2009-01-26</discovery>
<entry>2009-02-17</entry>
</dates>
</vuln>
<vuln vid="5a021595-fba9-11dd-86f3-0030843d3802">
<topic>pycrypto -- ARC2 module buffer overflow</topic>
<affects>
<package>
<name>py-pycrypto</name>
<range><lt>2.0.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dwayne C. Litzenberger reports:</p>
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html">
<p>pycrypto is exposed to a buffer overflow issue because it fails to
adequately verify user-supplied input. This issue resides in the ARC2
module. This issue can be triggered with specially crafted ARC2 keys
in excess of 128 bytes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html</url>
</references>
<dates>
<discovery>2009-02-06</discovery>
<entry>2009-02-15</entry>
</dates>
</vuln>
<vuln vid="bcee3989-d106-4f60-948f-835375634710">
<topic>varnish -- Varnish HTTP Request Parsing Denial of Service</topic>
<affects>
<package>
<name>varnish</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33712">
<p>Varnish is prone to a remote denial-of-service
vulnerability because the application fails to handle
certain HTTP requests.</p>
<p>Successfully exploiting this issue allows remote
attackers to crash the affected application denying further
service to legitimate users.</p>
</blockquote>
</body>
</description>
<references>
<bid>33712</bid>
<url>http://secunia.com/advisories/33852/</url>
<url>http://varnish.projects.linpro.no/wiki/WikiStart</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2009-02-14</entry>
<modified>2009-02-15</modified>
</dates>
</vuln>
<vuln vid="78f5606b-f9d1-11dd-b79c-0030843d3802">
<topic>tor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.0.34</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.12-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33880/">
<p>Some vulnerabilities have been reported in Tor, where one has an
unknown impact and others can be exploited by malicious people to
cause a DoS.</p>
<p>An error when running Tor as a directory authority can be exploited
to trigger the execution of an infinite loop.</p>
<p>An unspecified error exists when running on Windows systems prior
to Windows XP. No further information is currently available.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0936</cvename>
<cvename>CVE-2009-0937</cvename>
<cvename>CVE-2009-0938</cvename>
<url>http://secunia.com/advisories/33880/</url>
<url>http://archives.seul.org/or/announce/Feb-2009/msg00000.html</url>
</references>
<dates>
<discovery>2009-02-10</discovery>
<entry>2009-02-13</entry>
<modified>2009-03-20</modified>
</dates>
</vuln>
<vuln vid="8b491182-f842-11dd-94d9-0030843d3802">
<topic>firefox -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.20_3,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.6,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>3.0.6</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.15</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
<p>MFSA 2009-06: Directives to not cache pages ignored</p>
<p>MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies</p>
<p>MFSA 2009-04: Chrome privilege escalation via local .desktop
files</p>
<p>MFSA 2009-03: Local file stealing with SessionStore</p>
<p>MFSA 2009-02: XSS using a chrome XBL method and window.eval</p>
<p>MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0352</cvename>
<cvename>CVE-2009-0353</cvename>
<cvename>CVE-2009-0354</cvename>
<cvename>CVE-2009-0355</cvename>
<cvename>CVE-2009-0356</cvename>
<cvename>CVE-2009-0357</cvename>
<cvename>CVE-2009-0358</cvename>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-01.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-02.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-03.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-04.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-05.html</url>
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-06.html</url>
<url>http://secunia.com/advisories/33799/</url>
</references>
<dates>
<discovery>2009-02-04</discovery>
<entry>2009-02-11</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="83574d5a-f828-11dd-9fdf-0050568452ac">
<topic>codeigniter -- arbitrary script execution in the new Form Validation class</topic>
<affects>
<package>
<name>codeigniter</name>
<range><ge>1.7.0</ge><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>znirkel reports:</p>
<blockquote cite="http://secunia.com/advisories/33829/">
<p>The eval() function in _reset_post_array crashes when posting
certain data. By passing in carefully-crafted input data, the eval()
function could also execute malicious PHP code.</p>
<p>Note that CodeIgniter applications that either do not use the
new Form Validation class or use the old Validation class are not
affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://codeigniter.com/bug_tracker/bug/6068/</url>
</references>
<dates>
<discovery>2008-11-28</discovery>
<entry>2009-02-11</entry>
</dates>
</vuln>
<vuln vid="b07f3254-f83a-11dd-85a4-ea653f0746ab">
<topic>pyblosxom -- atom flavor multiple XML injection vulnerabilities</topic>
<affects>
<package>
<name>pyblosxom</name>
<range><lt>1.5.r3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Security Focus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33676/">
<p>PyBlosxom is prone to multiple XML-injection
vulnerabilities because the application fails to
properly sanitize user-supplied input before using it
in dynamically generated content.</p>
<p>Attacker-supplied XML and script code would run in the
context of the affected browser, potentially allowing
the attacker to steal cookie-based authentication credentials
or to control how the site is rendered to the user. Other attacks
are also possible.</p>
</blockquote>
</body>
</description>
<references>
<bid>33676</bid>
</references>
<dates>
<discovery>2009-02-09</discovery>
<entry>2009-02-11</entry>
</dates>
</vuln>
<vuln vid="cc47fafe-f823-11dd-94d9-0030843d3802">
<topic>typo3 -- cross-site scripting and information disclosure</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>4.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33829/">
<p>Some vulnerabilities have been reported in Typo3, which can be
exploited by malicious people to conduct cross-site scripting attacks
and disclose sensitive information.</p>
<p>Input passed via unspecified fields to the backend user interface
is not properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.</p>
<p>An error in the "jumpUrl" mechanism can be exploited to read
arbitrary files from local resources by disclosing a hash secret used
to restrict file access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0815</cvename>
<cvename>CVE-2009-0816</cvename>
<url>http://secunia.com/advisories/33829/</url>
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/</url>
</references>
<dates>
<discovery>2009-02-10</discovery>
<entry>2009-02-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="a89b76a7-f6bd-11dd-94d9-0030843d3802">
<topic>amaya -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>amaya</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32848/">
<p>A boundary error when processing "div" HTML tags can be exploited
to cause a stack-based buffer overflow via an overly long "id"
parameter.</p>
<p>A boundary error exists when processing overly long links. This can
be exploited to cause a stack-based buffer overflow by tricking the
user into e.g. editing a malicious link.</p>
<p>A boundary error when processing e.g. a "bdo" HTML tag having an
overly long "dir" attribute can be exploited to cause a stack-based
buffer overflow.</p>
<p>A boundary error when processing "input" HTML tags can be
exploited to cause a stack-based buffer overflow via an overly long
e.g. "type" attribute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5282</cvename>
<cvename>CVE-2009-0323</cvename>
<url>http://secunia.com/advisories/32848/</url>
<url>http://www.bmgsec.com.au/advisory/41/</url>
<url>http://www.bmgsec.com.au/advisory/40/</url>
<url>http://milw0rm.com/exploits/7467</url>
<url>http://www.coresecurity.com/content/amaya-buffer-overflows</url>
</references>
<dates>
<discovery>2008-11-25</discovery>
<entry>2009-02-09</entry>
</dates>
</vuln>
<vuln vid="71597e3e-f6b8-11dd-94d9-0030843d3802">
<topic>websvn -- multiple vulnerabilities</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32338/">
<p>Some vulnerabilities have been reported in WebSVN, which can be
exploited by malicious users to disclose sensitive information, and by
malicious people to conduct cross-site scripting attacks and
manipulate data.</p>
<p>Input passed in the URL to index.php is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.</p>
<p>Input passed to the "rev" parameter in rss.php is not properly
sanitised before being used. This can be exploited to overwrite
arbitrary files via directory traversal attacks.</p>
<p>Access to restricted repositories is not properly enforced, which
can be exploited to disclose potentially sensitive information by
accessing the repository via "listing.php" and using the "compare with
previous" and "show changed files" links.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5918</cvename>
<cvename>CVE-2008-5919</cvename>
<cvename>CVE-2009-0240</cvename>
<url>http://secunia.com/advisories/32338/</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191</url>
<url>http://www.gulftech.org/?node=research&article_id=00132-10202008</url>
</references>
<dates>
<discovery>2008-10-23</discovery>
<entry>2009-02-09</entry>
</dates>
</vuln>
<vuln vid="40774927-f6b4-11dd-94d9-0030843d3802">
<topic>phplist -- local file inclusion vulnerability</topic>
<affects>
<package>
<name>phplist</name>
<range><lt>2.10.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33533/">
<p>Input passed to the "_SERVER[ConfigFile]" parameter in
admin/index.php is not properly verified before being used to include
files. This can be exploited to include arbitrary files from local
resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0422</cvename>
<url>http://secunia.com/advisories/33533/</url>
</references>
<dates>
<discovery>2009-01-15</discovery>
<entry>2009-02-09</entry>
</dates>
</vuln>
<vuln vid="9c2460a4-f6b1-11dd-94d9-0030843d3802">
<topic>squid -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.7.1</ge><lt>2.7.6</lt></range>
<range><ge>3.0.1</ge><lt>3.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2009:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_1.txt">
<p>Due to an internal error Squid is vulnerable to a denial
of service attack when processing specially crafted requests.</p>
<p>This problem allows any client to perform a denial of service
attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0478</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2009_1.txt</url>
<url>http://secunia.com/advisories/33731/</url>
</references>
<dates>
<discovery>2009-02-04</discovery>
<entry>2009-02-09</entry>
<modified>2009-02-10</modified>
</dates>
</vuln>
<vuln vid="653606e9-f6ac-11dd-94d9-0030843d3802">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33617/">
<p>Some vulnerabilities have been reported in Typo3, which can be
exploited by malicious people to bypass certain security restrictions,
conduct cross-site scripting and session fixation attacks, and
compromise a vulnerable system.</p>
<p>The "Install tool" system extension uses insufficiently random
entropy sources to generate an encryption key, resulting in weak
security.</p>
<p>The authentication library does not properly invalidate supplied
session tokens, which can be exploited to hijack a user's
session.</p>
<p>Certain unspecified input passed to the "Indexed Search Engine"
system extension is not properly sanitised before being used to invoke
commands. This can be exploited to inject and execute arbitrary shell
commands.</p>
<p>Input passed via the name and content of files to the "Indexed Search
Engine" system extension is not properly sanitised before being returned
to the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.</p>
<p>Certain unspecified input passed to the Workspace module is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.</p>
<p>Note: It is also reported that certain unspecified input passed to
test scripts of the "ADOdb" system extension is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0255</cvename>
<cvename>CVE-2009-0256</cvename>
<cvename>CVE-2009-0257</cvename>
<cvename>CVE-2009-0258</cvename>
<url>http://secunia.com/advisories/33617/</url>
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/</url>
</references>
<dates>
<discovery>2009-02-07</discovery>
<entry>2009-02-09</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="13d6d997-f455-11dd-8516-001b77d09812">
<topic>sudo -- certain authorized users could run commands as any user</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.6.9</ge><lt>1.6.9.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html">
<p>A bug was introduced in Sudo's group matching code in version
1.6.9 when support for matching based on the supplemental group
vector was added. This bug may allow certain users listed in
the sudoers file to run a command as a different user than their
access rule specifies.</p>
</blockquote>
</body>
</description>
<references>
<bid>33517</bid>
<cvename>CVE-2009-0034</cvename>
<mlist msgid="200902041802.n14I2llS024155@core.courtesan.com">http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html</mlist>
</references>
<dates>
<discovery>2009-02-04</discovery>
<entry>2009-02-06</entry>
</dates>
</vuln>
<vuln vid="6d85dc62-f2bd-11dd-9f55-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.15</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/358957">
<p>The Content Translation module for Drupal 6.x enables users to make
a translation of an existing item of content (a node). In that proces
the existing node's content is copied into the new node's submission
form.</p>
<p>The module contains a flaw that allows a user with the 'translate
content' permission to potentially bypass normal viewing access
restrictions, for example allowing the user to see the content of
unpublished nodes even if they do not have permission to view
unpublished nodes.</p>
<p>When user profile pictures are enabled, the default user profile
validation function will be bypassed, possibly allowing invalid user
names or e-mail addresses to be submitted.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/358957</url>
<url>http://secunia.com/advisories/33550/</url>
<url>http://secunia.com/advisories/33500/</url>
<url>http://secunia.com/advisories/33542/</url>
</references>
<dates>
<discovery>2009-01-14</discovery>
<entry>2009-02-04</entry>
</dates>
</vuln>
<vuln vid="4a99d61c-f23a-11dd-9f55-0030843d3802">
<topic>perl -- Directory Permissions Race Condition</topic>
<affects>
<package>
<name>perl</name>
<range><ge>5.8.0</ge><lt>5.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/14531/">
<p>Paul Szabo has reported a vulnerability in Perl File::Path::rmtree,
which potentially can be exploited by malicious, local users to
gain escalated privileges.</p>
<p>The vulnerability is caused due to a race condition in the way
File::Path::rmtree handles directory permissions when cleaning up
directories. This can be exploited by replacing an existing sub
directory in the directory tree with a symbolic link to an arbitrary
file.</p>
<p>Successful exploitation may allow changing permissions of arbitrary
files, if root uses an application using the vulnerable code to delete
files in a directory having a world-writable sub directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0448</cvename>
<url>http://www.ubuntulinux.org/usn/usn-94-1</url>
<url>http://secunia.com/advisories/14531/</url>
</references>
<dates>
<discovery>2005-03-09</discovery>
<entry>2009-02-03</entry>
</dates>
</vuln>
<vuln vid="6a523dba-eeab-11dd-ab4f-0030843d3802">
<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33593/">
<p>Input passed to multiple parameters in action/AttachFile.py is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in the context of an affected site.</p>
<p>Certain input passed to security/antispam.py is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
the context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0260</cvename>
<cvename>CVE-2009-0312</cvename>
<url>http://secunia.com/advisories/33593/</url>
<url>http://hg.moinmo.in/moin/1.8/file/c76d50dac855</url>
<url>http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad</url>
<url>http://moinmo.in/SecurityFixes#moin1.8.1</url>
</references>
<dates>
<discovery>2009-01-21</discovery>
<entry>2009-01-30</entry>
</dates>
</vuln>
<vuln vid="b9077cc4-6d04-4bcb-a37a-9ceaebfdcc9e">
<topic>ganglia -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>ganglia-monitor-core</name>
<name>ganglia-monitor-webfrontend</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33506">
<p>Spike Spiegel has discovered a vulnerability in Ganglia which
can be exploited by malicious people to compromise a
vulnerable system. The vulnerability is caused due to a
boundary error within the process_path function in
gmetad/server.c. This can be exploited to cause a stack-based
buffer overflow by e.g. sending a specially crafted message to
the gmetad service.</p>
<p>The vulnerability is confirmed in version 3.1.1. Other
versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0241</cvename>
<url>http://secunia.com/advisories/33506</url>
</references>
<dates>
<discovery>2009-01-26</discovery>
<entry>2009-01-30</entry>
<modified>2009-01-30</modified>
</dates>
</vuln>
<vuln vid="100a9ed2-ee56-11dd-ab4f-0030843d3802">
<topic>tor -- unspecified memory corruption vulnerability</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.0.33</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.1.11-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33635/">
<p>A vulnerability with an unknown impact has been reported in Tor.</p>
<p>The vulnerability is caused due to an unspecified error and can be
exploited to trigger a heap corruption. No further information is
currently available.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-0414</cvename>
<url>http://secunia.com/advisories/33635/</url>
<url>http://archives.seul.org/or/announce/Jan-2009/msg00000.html</url>
</references>
<dates>
<discovery>2009-01-22</discovery>
<entry>2009-01-29</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="2ffb1b0d-ecf5-11dd-abae-00219b0fc4d8">
<topic>glpi -- SQL Injection</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>0.71.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GLPI project reports:</p>
<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en">
<p>Input passed via unspecified parameters is not properly sanitised
before being used in SQL queries. This can be exploited to
manipulateSQL queries by injecting arbitrary SQL code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en</url>
<url>https://mail.gna.org/public/glpi-news/2009-01/msg00002.html</url>
<url>https://dev.indepnet.net/glpi/ticket/1224</url>
<url>http://secunia.com/advisories/33680/</url>
</references>
<dates>
<discovery>2009-01-25</discovery>
<entry>2009-01-28</entry>
</dates>
</vuln>
<vuln vid="c3aba586-ea77-11dd-9d1e-000bcdc1757a">
<topic>openfire -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openfire</name>
<range><lt>3.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Core Security Technologies reports:</p>
<blockquote cite="http://www.coresecurity.com/content/openfire-multiple-vulnerabilities">
<p>Multiple cross-site scripting vulnerabilities have been found
which may lead to arbitrary remote code execution on the server
running the application due to unauthorized upload of Java plugin
code.</p>
</blockquote>
</body>
</description>
<references>
<bid>32935</bid>
<bid>32937</bid>
<bid>32938</bid>
<bid>32939</bid>
<bid>32940</bid>
<bid>32943</bid>
<bid>32944</bid>
<bid>32945</bid>
<cvename>CVE-2009-0496</cvename>
<cvename>CVE-2009-0497</cvename>
<url>http://www.coresecurity.com/content/openfire-multiple-vulnerabilities</url>
</references>
<dates>
<discovery>2009-01-08</discovery>
<entry>2009-01-25</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="abcacb5a-e7f1-11dd-afcd-00e0815b8da8">
<topic>ipset-tools -- Denial of Service Vulnerabilities</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/30657/discuss">
<p>IPsec-Tools is affected by multiple remote denial-of-service
vulnerabilities because the software fails to properly handle
certain network packets.</p>
<p>A successful attack allows a remote attacker to crash the
software, denying further service to legitimate users.</p>
</blockquote>
</body>
</description>
<references>
<bid>30657</bid>
<cvename>CVE-2008-3651</cvename>
<cvename>CVE-2008-3652</cvename>
<mlist msgid="20080724084529.GA3768@zen.inc">http://marc.info/?l=ipsec-tools-devel&m=121688914101709&w=2</mlist>
</references>
<dates>
<discovery>2008-07-28</discovery>
<entry>2009-01-21</entry>
</dates>
</vuln>
<vuln vid="4b68d917-e705-11dd-afcd-00e0815b8da8">
<topic>Teamspeak Server -- Directory Traversal Vulnerability</topic>
<affects>
<package>
<name>teamspeak_server</name>
<range><le>2.0.23.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33256">
<p>TeamSpeak is prone to a directory-traversal vulnerability because
it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive
information that could aid in further attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>33256</bid>
<url>http://www.securityfocus.com/bid/33256</url>
</references>
<dates>
<discovery>2009-01-14</discovery>
<entry>2009-01-20</entry>
</dates>
</vuln>
<vuln vid="2bc960c4-e665-11dd-afcd-00e0815b8da8">
<topic>optipng -- arbitrary code execution via crafted BMP image</topic>
<affects>
<package>
<name>optipng</name>
<range><lt>0.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32651">
<p>A vulnerability has been reported in OptiPNG, which
potentially can be exploited by malicious people to compromise
a user's system.</p>
<p>The vulnerability is caused due to a boundary error in
the BMP reader and can be exploited to cause a buffer
overflow by tricking a user into processing a specially
crafted file.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5101</cvename>
<url>http://secunia.com/advisories/32651</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399</url>
<url>http://optipng.sourceforge.net/</url>
</references>
<dates>
<discovery>2008-11-11</discovery>
<entry>2009-01-19</entry>
</dates>
</vuln>
<vuln vid="ecad44b9-e663-11dd-afcd-00e0815b8da8">
<topic>git -- gitweb privilege escalation</topic>
<affects>
<package>
<name>git</name>
<range><lt>1.6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git maintainers report:</p>
<blockquote cite="http://marc.info/?l=git&m=122975564100860&w=2">
<p>gitweb has a possible local privilege escalation
bug that allows a malicious repository owner to run a command
of his choice by specifying diff.external configuration
variable in his repository and running a crafted gitweb
query.</p>
</blockquote>
</body>
</description>
<references>
<bid>32967</bid>
<mlist msgid="7vhc4z1gys.fsf@gitster.siamese.dyndns.org">http://marc.info/?l=git&m=122975564100860&w=2</mlist>
<url>http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt</url>
</references>
<dates>
<discovery>2008-12-20</discovery>
<entry>2009-01-19</entry>
</dates>
</vuln>
<vuln vid="0809ce7d-f672-4924-9b3b-7c74bc279b83">
<topic>gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26445/">
<p>GNUs tar and cpio utilities are prone to a denial-of-service
vulnerability because of insecure use of the alloca()
function.</p>
<p>Successfully exploiting this issue allows attackers
to crash the affected utilities and possibly to execute
code but this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<bid>26445</bid>
<cvename>CVE-2007-4476</cvename>
<url>http://www.securityfocus.com/bid/26445/</url>
</references>
<dates>
<discovery>2007-11-14</discovery>
<entry>2009-01-15</entry>
</dates>
</vuln>
<vuln vid="5ccb1c14-e357-11dd-a765-0030843d3802">
<topic>mplayer -- vulnerability in STR files processor</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.11_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30994">
<p>The vulnerability is caused due to a boundary error within the
"str_read_packet()" function in libavformat/psxstr.c. This can be
exploited to cause a heap-based buffer overflow via a specially
crafted STR file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3162</cvename>
<bid>30157</bid>
<url>http://secunia.com/advisories/30994</url>
<url>https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311</url>
</references>
<dates>
<discovery>2008-07-09</discovery>
<entry>2009-01-15</entry>
</dates>
</vuln>
<vuln vid="bc6a7e79-e111-11dd-afcd-00e0815b8da8">
<topic>cgiwrap -- XSS Vulnerability</topic>
<affects>
<package>
<name>cgiwrap</name>
<range><lt>4.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30765">
<p>A vulnerability has been reported in CGIWrap, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>The vulnerability is caused due to the application generating
error messages without specifying a charset. This can be exploited
to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
<p>Successful exploitation may require that the victim uses Internet
Explorer or a browser based on Internet Explorer components.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2852</cvename>
<url>http://secunia.com/advisories/30765</url>
<url>http://cgiwrap.sourceforge.net/changes.html</url>
</references>
<dates>
<discovery>2008-06-19</discovery>
<entry>2009-01-13</entry>
</dates>
</vuln>
<vuln vid="d4a358d3-e09a-11dd-a765-0030843d3802">
<topic>nagios -- web interface privilege escalation vulnerability</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>3.0.5</lt></range>
</package>
<package>
<name>nagios2</name>
<range><lt>2.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/32156/discuss">
<p>An attacker with low-level privileges may exploit this issue to
bypass authorization and cause arbitrary commands to run within the
context of the Nagios server. This may aid in further attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5027</cvename>
<bid>32156</bid>
<url>http://secunia.com/advisories/33320</url>
<url>http://www.ubuntu.com/usn/USN-698-1</url>
<url>http://www.nagios.org/development/history/nagios-3x.php</url>
</references>
<dates>
<discovery>2008-11-06</discovery>
<entry>2009-01-12</entry>
<modified>2009-01-15</modified>
</dates>
</vuln>
<vuln vid="a02c9595-e018-11dd-a765-0030843d3802">
<topic>pdfjam -- insecure temporary files</topic>
<affects>
<package>
<name>pdfjam</name>
<range><lt>1.20_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/33278">
<p>Some security issues have been reported in PDFjam, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges.</p>
<p>The security issues are caused due to the "pdf90", "pdfjoin", and
"pdfnup" scripts using temporary files in an insecure manner. This can
be exploited to overwrite arbitrary files via symlink attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5743</cvename>
<url>https://bugzilla.novell.com/show_bug.cgi?id=459031</url>
<url>http://secunia.com/advisories/33278</url>
</references>
<dates>
<discovery>2008-12-05</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="58997463-e012-11dd-a765-0030843d3802">
<topic>verlihub -- insecure temporary file usage and arbitrary command execution</topic>
<affects>
<package>
<name>verlihub</name>
<range><lt>0.9.8.d.r2_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/32889/discuss">
<p>An attacker with local access could potentially exploit this issue
to perform symbolic-link attacks, overwriting arbitrary files in the
context of the affected application.</p>
<p>Successfully mounting a symlink attack may allow the attacker to
delete or corrupt sensitive files, which may result in a denial of
service. Other attacks may also be possible.</p>
</blockquote>
<blockquote cite="http://www.securityfocus.com/bid/32420/discuss">
<p>Verlihub is prone to a remote command-execution vulnerability
because it fails to sufficiently validate user input.</p>
<p>Successfully exploiting this issue would allow an attacker to
execute arbitrary commands on an affected computer in the context of
the affected application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5705</cvename>
<cvename>CVE-2008-5706</cvename>
<bid>32889</bid>
<bid>32420</bid>
<url>http://milw0rm.com/exploits/7183</url>
</references>
<dates>
<discovery>2008-11-22</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="66a770b4-e008-11dd-a765-0030843d3802">
<topic>mysql -- empty bit-string literal denial of service</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.0</ge><lt>5.0.66</lt></range>
<range><ge>5.1</ge><lt>5.1.26</lt></range>
<range><ge>6.0</ge><lt>6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://bugs.mysql.com/bug.php?id=35658">
<p>The vulnerability is caused due to an error when processing an
empty bit-string literal and can be exploited to crash the server via
a specially crafted SQL statement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3963</cvename>
<url>http://bugs.mysql.com/bug.php?id=35658</url>
<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html</url>
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html</url>
<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
<url>http://secunia.com/advisories/31769</url>
</references>
<dates>
<discovery>2008-09-11</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="8c451386-dff3-11dd-a765-0030843d3802">
<topic>mysql -- privilege escalation and overwrite of the system table information</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.1</ge><lt>4.1.24</lt></range>
<range><ge>5.0</ge><lt>5.0.51</lt></range>
<range><ge>5.1</ge><lt>5.1.23</lt></range>
<range><ge>6.0</ge><lt>6.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
<p>Using RENAME TABLE against a table with explicit DATA
DIRECTORY and INDEX DIRECTORY options can be used to overwrite
system table information by replacing the symbolic link
points. the file to which the symlink points.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5969</cvename>
<bid>26765</bid>
<url>http://bugs.mysql.com/bug.php?id=32111</url>
</references>
<dates>
<discovery>2007-11-14</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="240ac24c-dff3-11dd-a765-0030843d3802">
<topic>mysql -- remote dos via malformed password packet</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.1</ge><lt>4.1.24</lt></range>
<range><ge>5.0</ge><lt>5.0.44</lt></range>
<range><ge>5.1</ge><lt>5.1.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
<p>A malformed password packet in the connection protocol
could cause the server to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3780</cvename>
<bid>25017</bid>
<url>http://bugs.mysql.com/bug.php?id=28984</url>
</references>
<dates>
<discovery>2007-07-15</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="bb4e9a44-dff2-11dd-a765-0030843d3802">
<topic>mysql -- renaming of arbitrary tables by authenticated users</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.1</ge><lt>4.1.23</lt></range>
<range><ge>5.0</ge><lt>5.0.42</lt></range>
<range><ge>5.1</ge><lt>5.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-23.html">
<p>The requirement of the DROP privilege for RENAME TABLE was not
enforced.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2691</cvename>
<bid>24016</bid>
<url>http://bugs.mysql.com/bug.php?id=27515</url>
</references>
<dates>
<discovery>2007-05-14</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="69a20ce4-dfee-11dd-a765-0030843d3802">
<topic>imap-uw -- imap c-client buffer overflow</topic>
<affects>
<package>
<name>imap-uw</name>
<range><lt>2007e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SANS reports:</p>
<blockquote cite="http://www.washington.edu/imap/documentation/RELNOTES.html">
<p>The University of Washington IMAP library is a library implementing
the IMAP mail protocol. University of Washington IMAP is exposed to a
buffer overflow issue that occurs due to a boundary error within the
rfc822_output_char function in the c-client library. The University of
Washington IMAP library versions prior to 2007e are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5514</cvename>
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
</references>
<dates>
<discovery>2008-12-16</discovery>
<entry>2009-01-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="a6713190-dfea-11dd-a765-0030843d3802">
<topic>imap-uw -- local buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>imap-uw</name>
<range><lt>2007d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SANS reports:</p>
<blockquote cite="http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22">
<p>University of Washington "tmail" and "dmail" are mail deliver
agents. "tmail" and "dmail" are exposed to local buffer overflow
issues because they fail to perform adequate boundary checks on
user-supplied data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5514</cvename>
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
<url>http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22</url>
</references>
<dates>
<discovery>2008-10-29</discovery>
<entry>2009-01-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="bd730827-dfe0-11dd-a765-0030843d3802">
<topic>libcdaudio -- remote buffer overflow and code execution</topic>
<affects>
<package>
<name>libcdaudio</name>
<range><lt>0.99.12p2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/32122/discuss">
<p>The 'libcdaudio' library is prone to a remote heap code in the
context of an application that uses the library. Failed attacks will
cause denial-of-service conditions.</p>
</blockquote>
<blockquote cite="http://www.securityfocus.com/bid/12770/discuss">
<p>A buffer-overflow in Grip occurs when the software processes a
response to a CDDB query that has more than 16 matches.</p>
<p>To exploit this issue, an attacker must be able to influence the
response to a CDDB query, either by controlling a malicious CDDB
server or through some other means. Successful exploits will allow
arbitrary code to run.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5030</cvename>
<cvename>CVE-2005-0706</cvename>
<bid>32122</bid>
<bid>12770</bid>
</references>
<dates>
<discovery>2008-11-05</discovery>
<entry>2009-01-11</entry>
</dates>
</vuln>
<vuln vid="c702944a-db0f-11dd-aa56-000bcdf0a03b">
<topic>FreeBSD -- netgraph / bluetooth privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_7</lt></range>
<range><ge>6.4</ge><lt>6.4_1</lt></range>
<range><ge>7.0</ge><lt>7.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Some function pointers for netgraph and bluetooth sockets are
not properly initialized.</p>
<h1>Impact:</h1>
<p>A local user can cause the FreeBSD kernel to execute
arbitrary code. This could be used by an attacker directly;
or it could be used to gain root privilege or to escape from
a jail.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems without local
untrusted users are not vulnerable. Furthermore, systems are
not vulnerable if they have neither the ng_socket nor
ng_bluetooth kernel modules loaded or compiled into the
kernel.</p>
<p>Systems with the security.jail.socket_unixiproute_only
sysctl set to 1 (the default) are only vulnerable if they have
local untrusted users outside of jails.</p>
<p>If the command</p>
<p><code># kldstat -v | grep ng_</code></p>
<p>produces no output, the system is not vulnerable.</p>
</body>
</description>
<references>
<freebsdsa>SA-08:13.protosw</freebsdsa>
</references>
<dates>
<discovery>2008-12-23</discovery>
<entry>2009-01-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="e9ecaceb-db0d-11dd-aa56-000bcdf0a03b">
<topic>FreeBSD -- Cross-site request forgery in ftpd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_7</lt></range>
<range><ge>6.4</ge><lt>6.4_1</lt></range>
<range><ge>7.0</ge><lt>7.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ftpd(8) server splits long commands into several
requests. This may result in the server executing a command
which is hidden inside another very long command.</p>
<h1>Impact:</h1>
<p>This could, with a specifically crafted command, be used in a
cross-site request forgery attack.</p>
<p>FreeBSD systems running ftpd(8) server could act as a point
of privilege escalation in an attack against users using web
browser to access trusted FTP sites.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems not running FTP
servers are not vulnerable. Systems not running the FreeBSD
ftp(8) server are not affected, but users of other ftp
daemons are advised to take care since several other ftp
daemons are known to have related bugs.</p>
</body>
</description>
<references>
<cvename>CVE-2008-4247</cvename>
<freebsdsa>SA-08:12.ftpd</freebsdsa>
</references>
<dates>
<discovery>2008-12-23</discovery>
<entry>2009-01-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6b8cadce-db0b-11dd-aa56-000bcdf0a03b">
<topic>FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_5</lt></range>
<range><ge>7.0</ge><lt>7.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>IPv6 routers may allow "on-link" IPv6 nodes to create and
update the router's neighbor cache and forwarding
information. A malicious IPv6 node sharing a common router
but on a different physical segment from another node may be
able to spoof Neighbor Discovery messages, allowing it to
update router information for the victim node.</p>
<h1>Impact:</h1>
<p>An attacker on a different physical network connected to the
same IPv6 router as another node could redirect IPv6 traffic
intended for that node. This could lead to denial of service
or improper access to private network traffic.</p>
<h1>Workaround:</h1>
<p>Firewall packet filters can be used to filter incoming
Neighbor Solicitation messages but may interfere with normal
IPv6 operation if not configured carefully.</p>
<p>Reverse path forwarding checks could be used to make
gateways, such as routers or firewalls, drop Neighbor
Solicitation messages from nodes with unexpected source
addresses on a particular interface.</p>
<p>IPv6 router administrators are encouraged to read RFC 3756
for further discussion of Neighbor Discovery security
implications.</p>
</body>
</description>
<references>
<cvename>CVE-2008-2476</cvename>
<freebsdsa>SA-08:10.nd6</freebsdsa>
</references>
<dates>
<discovery>2008-10-01</discovery>
<entry>2009-01-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5796858d-db0b-11dd-aa56-000bcdf0a03b">
<topic>FreeBSD -- arc4random(9) predictable sequence vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_6</lt></range>
<range><ge>7.0</ge><lt>7.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When the arc4random(9) random number generator is
initialized, there may be inadequate entropy to meet the
needs of kernel systems which rely on arc4random(9); and it
may take up to 5 minutes before arc4random(9) is reseeded
with secure entropy from the Yarrow random number generator.</p>
<h1>Impact:</h1>
<p>All security-related kernel subsystems that rely on a
quality random number generator are subject to a wide range of
possible attacks for the 300 seconds after boot or until 64k
of random data is consumed. The list includes:</p>
<p>* GEOM ELI providers with onetime keys. When a provider is
configured in a way so that it gets attached at the same time
during boot (e.g. it uses the rc subsystem to initialize) it
might be possible for an attacker to recover the encrypted
data.</p>
<p>* GEOM shsec providers. The GEOM shsec subsytem is used to
split a shared secret between two providers so that it can be
recovered when both of them are present. This is done by
writing the random sequence to one of providers while
appending the result of the random sequence on the other host
to the original data. If the provider was created within the
first 300 seconds after booting, it might be possible for an
attacker to extract the original data with access to only one
of the two providers between which the secret data is split.</p>
<p>* System processes started early after boot may receive
predictable IDs.</p>
<p>* The 802.11 network stack uses arc4random(9) to generate
initial vectors (IV) for WEP encryption when operating in
client mode and WEP authentication challenges when operating
in hostap mode, which may be insecure.</p>
<p>* The IPv4, IPv6 and TCP/UDP protocol implementations rely
on a quality random number generator to produce unpredictable
IP packet identifiers, initial TCP sequence numbers and
outgoing port numbers. During the first 300 seconds after
booting, it may be easier for an attacker to execute IP
session hijacking, OS fingerprinting, idle scanning, or in
some cases DNS cache poisoning and blind TCP data injection
attacks.</p>
<p>* The kernel RPC code uses arc4random(9) to retrieve
transaction identifiers, which might make RPC clients
vulnerable to hijacking attacks.</p>
<h1>Workaround:</h1>
<p>No workaround is available for affected systems.</p>
</body>
</description>
<references>
<cvename>CVE-2008-5162</cvename>
<freebsdsa>SA-08.11.arc4random</freebsdsa>
</references>
<dates>
<discovery>2008-11-24</discovery>
<entry>2009-01-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="d5e1aac8-db0b-11dd-ae30-001cc0377035">
<topic>xterm -- DECRQSS remote command execution vulnerability</topic>
<affects>
<package>
<name>xterm</name>
<range><lt>238</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/33060/discuss">
<p>The xterm program is prone to a remote command-execution
vulnerability because it fails to sufficiently validate user
input.</p>
<p>Successfully exploiting this issue would allow an attacker
to execute arbitrary commands on an affected computer in the
context of the affected application.</p>
</blockquote>
</body>
</description>
<references>
<bid>33060</bid>
<cvename>CVE-2008-2383</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030</url>
</references>
<dates>
<discovery>2008-12-28</discovery>
<entry>2009-01-05</entry>
<modified>2009-01-06</modified>
</dates>
</vuln>
<vuln vid="58a3c266-db01-11dd-ae30-001cc0377035">
<topic>php5-gd -- uninitialized memory information disclosure vulnerability</topic>
<affects>
<package>
<name>php5-gd</name>
<range><le>5.2.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to CVE-2008-5498 entry:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498">
<p>Array index error in the "imageRotate" function in PHP 5.2.8 and
earlier allows context-dependent attackers to read the contents
of arbitrary memory locations via a crafted value of the third
argument (aka the "bgd_color" or "clrBack" argument) for an indexed
image.</p>
</blockquote>
</body>
</description>
<references>
<bid>33002</bid>
<cvename>CVE-2008-5498</cvename>
<url>http://www.securiteam.com/unixfocus/6G00Y0ANFU.html</url>
</references>
<dates>
<discovery>2008-12-24</discovery>
<entry>2009-01-05</entry>
<modified>2009-02-04</modified>
</dates>
</vuln>
<vuln vid="27d78386-d35f-11dd-b800-001b77d09812">
<topic>awstats -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.9,1</lt></range>
</package>
<package>
<name>awstats-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31519">
<p>Morgan Todd has discovered a vulnerability in AWStats,
which can be exploited by malicious people to conduct
cross-site scripting attacks.</p>
<p>Input passed in the URL to awstats.pl is not properly
sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.</p>
<p>Successful exploitation requires that the application is
running as a CGI script.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3714</cvename>
<cvename>CVE-2008-5080</cvename>
<url>http://secunia.com/advisories/31519</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432</url>
</references>
<dates>
<discovery>2008-03-12</discovery>
<entry>2009-01-04</entry>
</dates>
</vuln>
<vuln vid="13b0c8c8-bee0-11dd-a708-001fc66e7203">
<topic>p5-File-Path -- rmtree allows creation of setuid files</topic>
<affects>
<package>
<name>p5-File-Path</name>
<range><lt>2.07_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2008/11/28/1">
<p>perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to
address this)</p>
<p>This vulnerability was fixed in 5.8.4-7 but re-introduced
in 5.8.8-1. It's also present in File::Path 2.xx, up to and
including 2.07 which has only a partial fix.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0448</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2008/11/28/1</mlist>
<mlist>http://www.gossamer-threads.com/lists/perl/porters/233699#233699</mlist>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905</url>
</references>
<dates>
<discovery>2008-11-28</discovery>
<entry>2009-01-03</entry>
</dates>
</vuln>
<vuln vid="0e1e3789-d87f-11dd-8ecd-00163e000016">
<topic>vim -- multiple vulnerabilities in the netrw module</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim-gtk2</name>
<name>vim-gnome</name>
<range><ge>7.0</ge><lt>7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Minar reports:</p>
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v2.html">
<p>Applying the ``D'' to a file with a crafted file name,
or inside a directory with a crafted directory name, can
lead to arbitrary code execution.</p>
</blockquote>
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v5.html">
<p>Lack of sanitization throughout Netrw can lead to arbitrary
code execution upon opening a directory with a crafted
name.</p>
</blockquote>
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html">
<p>The Vim Netrw Plugin shares the FTP user name and password
across all FTP sessions. Every time Vim makes a new FTP
connection, it sends the user name and password of the
previous FTP session to the FTP server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3076</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2008/10/16/2</mlist>
<url>http://www.rdancer.org/vulnerablevim-netrw.html</url>
<url>http://www.rdancer.org/vulnerablevim-netrw.v2.html</url>
<url>http://www.rdancer.org/vulnerablevim-netrw.v5.html</url>
<url>http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html</url>
</references>
<dates>
<discovery>2008-10-16</discovery>
<entry>2009-01-02</entry>
</dates>
</vuln>
<vuln vid="214e8e07-d369-11dd-b800-001b77d09812">
<topic>vinagre -- format string vulnerability</topic>
<affects>
<package>
<name>vinagre</name>
<range><lt>0.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CORE Security Technologies reports:</p>
<blockquote cite="http://www.coresecurity.com/content/vinagre-format-string">
<p>A format string error has been found on the
vinagre_utils_show_error() function that can be exploited via
commands issued from a malicious server containing format
string specifiers on the VNC name.</p>
<p>In a web based attack scenario, the user would be required
to connect to a malicious server. Successful exploitation
would then allow the attacker to execute arbitrary code with
the privileges of the Vinagre user.</p>
</blockquote>
</body>
</description>
<references>
<bid>32682</bid>
<cvename>CVE-2008-5660</cvename>
<url>http://www.coresecurity.com/content/vinagre-format-string</url>
<url>http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news</url>
</references>
<dates>
<discovery>2008-12-09</discovery>
<entry>2008-12-31</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="f98dea27-d687-11dd-abd1-0050568452ac">
<topic>twiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>4.2.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:</p>
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlerts#Security_Alerts_of_TWiki_4_2_x_P">
<p>XSS vulnerability with URLPARAM variable</p>
<p>SEARCH variable allows arbitrary shell command execution</p>
</blockquote>
</body>
</description>
<references>
<bid>32668</bid>
<bid>32669</bid>
<cvename>CVE-2008-5304</cvename>
<cvename>CVE-2008-5305</cvename>
<url>http://secunia.com/advisories/33040</url>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304</url>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305</url>
<url>http://www.securitytracker.com/alerts/2008/Dec/1021351.html</url>
<url>http://www.securitytracker.com/alerts/2008/Dec/1021352.html</url>
<url>https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513</url>
<url>http://xforce.iss.net/xforce/xfdb/45293</url>
</references>
<dates>
<discovery>2008-12-05</discovery>
<entry>2008-12-30</entry>
</dates>
</vuln>
<vuln vid="8f483746-d45d-11dd-84ec-001fc66e7203">
<topic>roundcube -- remote execution of arbitrary code</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.2.b2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Entry for CVE-2008-5619 says:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619">
<p>html2text.php in RoundCube Webmail (roundcubemail)
0.2-1.alpha and 0.2-3.beta allows remote attackers to execute
arbitrary code via crafted input that is processed by the
preg_replace function with the eval switch.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5619</cvename>
<url>http://trac.roundcube.net/ticket/1485618</url>
</references>
<dates>
<discovery>2008-12-12</discovery>
<entry>2008-12-30</entry>
</dates>
</vuln>
<vuln vid="738f8f9e-d661-11dd-a765-0030843d3802">
<topic>mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.1</ge><lt>4.1.25</lt></range>
<range><ge>5.0</ge><lt>5.0.75</lt></range>
<range><ge>5.1</ge><lt>5.1.28</lt></range>
<range><ge>6.0</ge><lt>6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL Team reports:</p>
<blockquote cite="http://bugs.mysql.com/bug.php?id=32167">
<p>Additional corrections were made for the symlink-related privilege
problem originally addressed. The original fix did not correctly
handle the data directory pathname if it contained symlinked
directories in its path, and the check was made only at
table-creation time, not at table-opening time later.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2079</cvename>
<cvename>CVE-2008-4097</cvename>
<cvename>CVE-2008-4098</cvename>
<url>http://bugs.mysql.com/bug.php?id=32167</url>
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html</url>
<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html</url>
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html</url>
<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25</url>
</references>
<dates>
<discovery>2008-07-03</discovery>
<entry>2008-12-30</entry>
</dates>
</vuln>
<vuln vid="7c5bd5b8-d652-11dd-a765-0030843d3802">
<topic>mplayer -- twinvq processing buffer overflow vulnerability</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.11_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A trapkit reports:</p>
<blockquote cite="http://trapkit.de/advisories/TKADV2008-014.txt">
<p>MPlayer contains a stack buffer overflow vulnerability while
parsing malformed TwinVQ media files. The vulnerability may be
exploited by a (remote) attacker to execute arbitrary code in
the context of MPlayer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5616</cvename>
<url>http://secunia.com/advisories/33136/</url>
<url>http://trapkit.de/advisories/TKADV2008-014.txt</url>
</references>
<dates>
<discovery>2008-12-14</discovery>
<entry>2008-12-30</entry>
</dates>
</vuln>
<vuln vid="0ac68e68-d32b-11dd-b540-d1288664c17e">
<topic>ampache -- insecure temporary file usage</topic>
<affects>
<package>
<name>ampache</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31657">
<p>A security issue has been reported in Ampache, which can be
exploited by malicious, local users to perform certain actions
with escalated privileges.</p>
<p>The security issue is caused due to the "gather-messages.sh"
script handling temporary files in an insecure manner.
This can be exploited via symlink attacks to overwrite arbitrary
files with the privileges of the user running the script.</p>
</blockquote>
</body>
</description>
<references>
<bid>30875</bid>
<cvename>CVE-2008-3929</cvename>
<url>http://secunia.com/advisories/31657</url>
</references>
<dates>
<discovery>2008-12-24</discovery>
<entry>2008-12-26</entry>
</dates>
</vuln>
<vuln vid="225bc349-ce10-11dd-a721-0030843d3802">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/963/">
<p>Manipulating certain text-area contents can cause a buffer
overflow, which may be exploited to execute arbitrary code.</p>
<p>Certain HTML constructs can cause the resulting DOM to change
unexpectedly, which triggers a crash. To inject code, additional
techniques will have to be employed.</p>
<p>Exceptionally long host names in file: URLs can cause a buffer
overflow, which may be exploited to execute arbitrary code. Remote Web
pages cannot refer to file: URLs, so successful exploitation involves
tricking users into manually opening the exploit URL, or a local file
that refers to it.</p>
<p>When Opera is previewing a news feed, some scripted URLs are not
correctly blocked. These can execute scripts which are able to
subscribe the user to any feed URL that the attacker chooses, and can
also view the contents of any feeds that the user is subscribed to.
These may contain sensitive information.</p>
<p>Built-in XSLT templates incorrectly handle escaped content and can
cause it to be treated as markup. If a site accepts content from
untrusted users, which it then displays using XSLT as escaped strings,
this can allow scripted markup to be injected. The scripts will then
be executed in the security context of that site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5178</cvename>
<url>http://www.opera.com/support/kb/view/920/</url>
<url>http://www.opera.com/support/kb/view/921/</url>
<url>http://www.opera.com/support/kb/view/922/</url>
<url>http://www.opera.com/support/kb/view/923/</url>
<url>http://www.opera.com/support/kb/view/924/</url>
<url>http://secunia.com/advisories/32752/</url>
</references>
<dates>
<discovery>2008-11-18</discovery>
<entry>2008-12-19</entry>
</dates>
</vuln>
<vuln vid="61b07d71-ce0e-11dd-a721-0030843d3802">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><gt>1.6.0</gt><lt>1.6.11</lt></range>
<range><gt>1.12.0</gt><lt>1.12.3</lt></range>
<range><gt>1.13.0</gt><lt>1.13.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MediaWiki development team reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html">
<p>Certain unspecified input is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.</p>
<p>Certain unspecified input related to uploads is not properly
sanitised before being used. This can be exploited to inject arbitrary
HTML and script code, which will be executed in a user's browser
session in context of an affected site when a malicious data is
opened. Successful exploitation may require that uploads are enabled
and the victim uses an Internet Explorer based browser.</p>
<p>Certain SVG scripts are not properly sanitised before being used.
This can be exploited to inject arbitrary HTML and script code, which
will be executed in a user's browser session in context of an affected
site when a malicious data is opened. Successful exploitation may require
that SVG uploads are enabled and the victim uses a browser supporting SVG
scripting.</p>
<p>The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the
requests. This can be exploited to perform certain operations when a
logged in user visits a malicious site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5249</cvename>
<cvename>CVE-2008-5250</cvename>
<cvename>CVE-2008-5252</cvename>
<url>http://secunia.com/advisories/33133/</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html</url>
</references>
<dates>
<discovery>2008-12-15</discovery>
<entry>2008-12-19</entry>
</dates>
</vuln>
<vuln vid="609c790e-ce0a-11dd-a721-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.14</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/345441">
<p>The update system is vulnerable to Cross site request forgeries.
Malicious users may cause the superuser (user 1) to execute old
updates that may damage the database.</p>
<p>When an input format is deleted, not all existing content on a site
is updated to reflect this deletion. Such content is then displayed
unfiltered. This may lead to cross site scripting attacks when harmful
tags are no longer stripped from 'malicious' content that was posted
earlier.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-6533</cvename>
<url>http://drupal.org/node/345441</url>
<url>http://secunia.com/advisories/33112/</url>
</references>
<dates>
<discovery>2008-12-11</discovery>
<entry>2008-12-19</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="29f5bfc5-ce04-11dd-a721-0030843d3802">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.20,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.20</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.14</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<p>MFSA 2008-69 XSS vulnerabilities in SessionStore</p>
<p>MFSA 2008-68 XSS and JavaScript privilege escalation</p>
<p>MFSA 2008-67 Escaped null characters ignored by CSS parser</p>
<p>MFSA 2008-66 Errors parsing URLs with leading whitespace and
control characters</p>
<p>MFSA 2008-65 Cross-domain data theft via script redirect error
message</p>
<p>MFSA 2008-64 XMLHttpRequest 302 response disclosure</p>
<p>MFSA 2008-62 Additional XSS attack vectors in feed preview</p>
<p>MFSA 2008-61 Information stealing via loadBindingDocument</p>
<p>MFSA 2008-60 Crashes with evidence of memory corruption
(rv:1.9.0.5/1.8.1.19)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5500</cvename>
<cvename>CVE-2008-5501</cvename>
<cvename>CVE-2008-5502</cvename>
<cvename>CVE-2008-5503</cvename>
<cvename>CVE-2008-5504</cvename>
<cvename>CVE-2008-5505</cvename>
<cvename>CVE-2008-5506</cvename>
<cvename>CVE-2008-5507</cvename>
<cvename>CVE-2008-5508</cvename>
<cvename>CVE-2008-5510</cvename>
<cvename>CVE-2008-5511</cvename>
<cvename>CVE-2008-5512</cvename>
<cvename>CVE-2008-5513</cvename>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-60.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-61.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-62.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-63.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-64.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-65.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-66.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-67.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-68.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-69.html</url>
</references>
<dates>
<discovery>2008-12-17</discovery>
<entry>2008-12-19</entry>
</dates>
</vuln>
<vuln vid="54f72962-c7ba-11dd-a721-0030843d3802">
<topic>phpmyadmin -- cross-site request forgery vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.9.4</lt></range>
</package>
<package>
<name>phpMyAdmin</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin Team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php">
<p>A logged-in user can be subject of SQL injection through cross
site request forgery. Several scripts in phpMyAdmin are
vulnerable and the attack can be made through table parameter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5621</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php</url>
<url>http://www.milw0rm.com/exploits/7382</url>
<url>http://secunia.com/advisories/33076/</url>
</references>
<dates>
<discovery>2008-12-09</discovery>
<entry>2008-12-11</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="1f9e2376-c52f-11dd-8cbc-00163e000016">
<topic>php5 -- potential magic_quotes_gpc vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP Developers reports:</p>
<blockquote cite="http://www.php.net/archive/2008.php#id2008-12-07-1">
<p>Due to a security bug found in the PHP 5.2.7 release, it has been
removed from distribution. The bug affects configurations where
magic_quotes_gpc is enabled, because it remains off even when set to
on.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5844</cvename>
<url>http://www.php.net/archive/2008.php#id2008-12-07-1</url>
</references>
<dates>
<discovery>2008-12-07</discovery>
<entry>2008-12-08</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="baece347-c489-11dd-a721-0030843d3802">
<topic>wireshark -- SMTP Processing Denial of Service Vulnerability</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><lt>1.0.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32840/">
<p>A vulnerability has been reported in Wireshark, which can be
exploited by malicious people to cause a DoS.</p>
<p>The vulnerability is caused due to an error in the SMTP dissector
and can be exploited to trigger the execution of an infinite loop via
a large SMTP packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5285</cvename>
<url>http://secunia.com/advisories/32840/</url>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html</url>
</references>
<dates>
<discovery>2008-11-24</discovery>
<entry>2008-12-07</entry>
</dates>
</vuln>
<vuln vid="27d01223-c457-11dd-a721-0030843d3802">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32964/">
<p>Some vulnerabilities have been reported in PHP, where some have an
unknown impact and others can potentially be exploited by malicious
people to cause a DoS (Denial of Service) or compromise a vulnerable
system.</p>
<p>An input validation error exists within the
"ZipArchive::extractTo()" function when extracting ZIP archives.
This can be exploited to extract files to arbitrary locations
outside the specified directory via directory traversal sequences in
a specially crafted ZIP archive.</p>
<p>An error in the included PCRE library can be exploited to cause a
buffer overflow.</p>
<p>The problem is that the "BG(page_uid)" and "BG(page_gid)" variables
are not initialized. No further information is currently
available.</p>
<p>The problem is that the "php_value" order is incorrect for Apache
configurations. No further information is currently available.</p>
<p>An error in the GD library can be exploited to cause a crash via a
specially crafted font file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2371</cvename>
<cvename>CVE-2008-2829</cvename>
<cvename>CVE-2008-3658</cvename>
<cvename>CVE-2008-3659</cvename>
<cvename>CVE-2008-3660</cvename>
<url>http://www.php.net/ChangeLog-5.php#5.2.7</url>
<url>http://www.sektioneins.de/advisories/SE-2008-06.txt</url>
<url>http://secunia.com/advisories/30916/</url>
<url>http://secunia.com/advisories/31409/</url>
<url>http://secunia.com/advisories/32964/</url>
</references>
<dates>
<discovery>2008-12-04</discovery>
<entry>2008-12-07</entry>
</dates>
</vuln>
<vuln vid="44ee8160-c453-11dd-a721-0030843d3802">
<topic>mgetty+sendfax -- symlink attack via insecure temporary files</topic>
<affects>
<package>
<name>mgetty+sendfax</name>
<range><lt>1.1.35_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403">
<p>Faxspool in mgetty 1.1.36 allows local users to overwrite
arbitrary files via a symlink attack on a /tmp/faxsp.####
temporary file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4936</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403</url>
<url>https://bugs.gentoo.org/show_bug.cgi?id=235806</url>
</references>
<dates>
<discovery>2008-08-24</discovery>
<entry>2008-12-07</entry>
</dates>
</vuln>
<vuln vid="3efc106e-c451-11dd-a721-0030843d3802">
<topic>dovecot-managesieve -- Script Name Directory Traversal Vulnerability</topic>
<affects>
<package>
<name>dovecot-managesieve</name>
<range><lt>0.10.4</lt></range>
<range><ge>0.11.0</ge><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/Advisories/32768/">
<p>The security issue is caused due to an input validation error when
processing script names. This can be exploited to read or modify
arbitrary files having ".sieve" extensions via directory traversal
attacks, with the privileges of the attacker's user id.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5301</cvename>
<url>http://www.vupen.com/english/advisories/2008/3190</url>
<url>http://secunia.com/Advisories/32768/</url>
<url>http://dovecot.org/list/dovecot/2008-November/035259.html</url>
</references>
<dates>
<discovery>2008-11-18</discovery>
<entry>2008-12-07</entry>
</dates>
</vuln>
<vuln vid="578f6322-c450-11dd-a721-0030843d3802">
<topic>habari -- Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
<name>habari</name>
<range><lt>0.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32311/">
<p>Input passed via the "habari_username" parameter when logging in is
not properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4601</cvename>
<url>http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt</url>
<url>http://secunia.com/advisories/32311/</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2008-12-07</entry>
</dates>
</vuln>
<vuln vid="acf80afa-c3ef-11dd-a721-0030843d3802">
<topic>vlc -- arbitrary code execution in the RealMedia processor</topic>
<affects>
<package>
<name>vlc-devel</name>
<range><lt>0.9.8a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Klein from TrapKit reports:</p>
<blockquote cite="http://www.trapkit.de/advisories/TKADV2008-013.txt">
<p>The VLC media player contains an integer overflow vulnerability
while parsing malformed RealMedia (.rm) files. The vulnerability
leads to a heap overflow that can be exploited by a (remote)
attacker to execute arbitrary code in the context of VLC media
player.</p>
</blockquote>
</body>
</description>
<references>
<bid>32545</bid>
<cvename>CVE-2008-5276</cvename>
<url>http://www.trapkit.de/advisories/TKADV2008-013.txt</url>
<url>http://www.videolan.org/security/sa0811.html</url>
</references>
<dates>
<discovery>2008-11-30</discovery>
<entry>2008-12-06</entry>
<modified>2008-12-07</modified>
</dates>
</vuln>
<vuln vid="af2745c0-c3e0-11dd-a721-0030843d3802">
<topic>mantis -- php code execution vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32314/">
<p>EgiX has discovered a vulnerability in Mantis, which can be
exploited by malicious users to compromise a vulnerable system.</p>
<p>Input passed to the "sort" parameter in manage_proj_page.php is not
properly sanitised before being used in a "create_function()" call.
This can be exploited to execute arbitrary PHP code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4687</cvename>
<url>http://secunia.com/advisories/32314/</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2008-12-06</entry>
</dates>
</vuln>
<vuln vid="29255141-c3df-11dd-a721-0030843d3802">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30270/">
<p>Some vulnerabilities have been reported in Mantis, which can be
exploited by malicious users to compromise a vulnerable system and
malicious people to conduct cross-site scripting and request forgery
attacks.</p>
<p>Input passed to the "filter_target" parameter in
return_dynamic_filters.php is not properly sanitised before being
returned to a user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.</p>
<p>A vulnerability is caused due to the application allowing users to
perform certain actions via HTTP requests without performing any
validity checks to verify the request. This can be exploited to e.g.
add a new user with administrative privileges by enticing a logged-in
administrator to visit a malicious site.</p>
<p>Input passed to the "value" parameter in adm_config_set.php is not
properly sanitised before being used in an "eval()" statement. This
can be exploited to e.g. execute arbitrary PHP commands via a
specially crafted request.</p>
<p>Input passed to the "language" parameter in account_prefs_update.php
is not properly verified before being used to include files. This
can be exploited to include arbitrary files from local
resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2276</cvename>
<cvename>CVE-2008-3331</cvename>
<cvename>CVE-2008-3332</cvename>
<cvename>CVE-2008-3333</cvename>
<url>http://secunia.com/advisories/30270/</url>
</references>
<dates>
<discovery>2008-05-15</discovery>
<entry>2008-12-06</entry>
</dates>
</vuln>
<vuln vid="d1ce8a4f-c235-11dd-8cbc-00163e000016">
<topic>squirrelmail -- Cross site scripting vulnerability</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>1.4.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squirrelmail team reports:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311">
<p>An issue was fixed that allowed an attacker to send specially-
crafted hyperlinks in a message that could execute cross-site
scripting (XSS) when the user viewed the message in SquirrelMail.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2379</cvename>
<url>http://secunia.com/Advisories/32143/</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311</url>
</references>
<dates>
<discovery>2008-12-03</discovery>
<entry>2008-12-04</entry>
</dates>
</vuln>
<vuln vid="842bafdd-be2f-11dd-a578-0030843d3802">
<topic>openoffice -- arbitrary code execution vulnerabilities</topic>
<affects>
<package>
<name>openoffice.org-2</name>
<name>openoffice.org-2-RC</name>
<name>openoffice.org-2-devel</name>
<range><ge>2.4</ge><lt>2.4.2</lt></range>
<range><ge>2.4.20040402</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenOffice Team reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2237.html">
<p>A security vulnerability with the way OpenOffice 2.x process WMF
files may allow a remote unprivileged user who provides a
StarOffice/StarSuite document that is opened by a local user to
execute arbitrary commands on the system with the privileges of the
user running StarOffice/StarSuite. No working exploit is known right
now.</p>
</blockquote>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2238.html">
<p>A security vulnerability with the way OpenOffice 2.x process EMF
files may allow a remote unprivileged user who provides a
StarOffice/StarSuite document that is opened by a local user to
execute arbitrary commands on the system with the privileges of the
user running StarOffice/StarSuite. No working exploit is known right
now.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2237</cvename>
<cvename>CVE-2008-2238</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2008-2237.html</url>
<url>http://www.openoffice.org/security/cves/CVE-2008-2238.html</url>
</references>
<dates>
<discovery>2008-10-29</discovery>
<entry>2008-11-29</entry>
</dates>
</vuln>
<vuln vid="622bc638-be27-11dd-a578-0030843d3802">
<topic>wordpress -- header rss feed script insertion vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>wordpress-mu</name>
<range><lt>2.6.5</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32882/">
<p>Input passed via the HTTP "Host" header is not properly sanitised
before being used. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected site
if malicious data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5278</cvename>
<url>http://secunia.com/advisories/32882/</url>
<url>http://wordpress.org/development/2008/11/wordpress-265/</url>
</references>
<dates>
<discovery>2008-11-26</discovery>
<entry>2008-11-29</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="1583640d-be20-11dd-a578-0030843d3802">
<topic>samba -- potential leakage of arbitrary memory contents</topic>
<affects>
<package>
<name>samba</name>
<name>samba3</name>
<name>ja-samba</name>
<range><ge>3.0.29,1</ge><lt>3.0.32_2,1</lt></range>
</package>
<package>
<name>samba32-devel</name>
<range><lt>3.2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2008-4314.html">
<p>Samba 3.0.29 and beyond contain a change to deal with gcc 4
optimizations. Part of the change modified range checking for
client-generated offsets of secondary trans, trans2 and nttrans
requests. These requests are used to transfer arbitrary amounts
of memory from clients to servers and back using small SMB
requests and contain two offsets: One offset (A) pointing into
the PDU sent by the client and one (B) to direct the transferred
contents into the buffer built on the server side. While the range
checking for offset (B) is correct, a cut and paste error lets offset
(A) pass completely unchecked against overflow.</p>
<p>The buffers passed into trans, trans2 and nttrans undergo higher-level
processing like DCE/RPC requests or listing directories. The missing
bounds check means that a malicious client can make the server do this
higher-level processing on arbitrary memory contents of the smbd process
handling the request. It is unknown if that can be abused to pass arbitrary
memory contents back to the client, but an important barrier is missing from
the affected Samba versions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4314</cvename>
<url>http://www.samba.org/samba/security/CVE-2008-4314.html</url>
<url>http://secunia.com/advisories/32813/</url>
</references>
<dates>
<discovery>2008-11-27</discovery>
<entry>2008-11-29</entry>
</dates>
</vuln>
<vuln vid="37940643-be1b-11dd-a578-0030843d3802">
<topic>hplip -- hpssd Denial of Service</topic>
<affects>
<package>
<name>hplip</name>
<range><lt>2.8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31470">
<p>A security issue has been reported in hplip, which can be
exploited by malicious, local users to cause a DoS.</p>
<p>The security issue is caused due to an error within hpssd.py when
parsing certain requests. This can be exploited to crash the service
by sending specially crafted requests to the default port 2207/TCP.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2940</cvename>
<cvename>CVE-2008-2941</cvename>
<bid>30683</bid>
<url>https://rhn.redhat.com/errata/RHSA-2008-0818.html</url>
<url>http://secunia.com/advisories/31470</url>
</references>
<dates>
<discovery>2008-08-14</discovery>
<entry>2008-11-29</entry>
</dates>
</vuln>
<vuln vid="87106b67-be13-11dd-a578-0030843d3802">
<topic>cups -- potential buffer overflow in PNG reading code</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CUPS reports:</p>
<blockquote cite="http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt">
<p>The PNG image reading code did not validate the
image size properly, leading to a potential buffer overflow
(STR #2974)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5286</cvename>
<url>http://www.cups.org/str.php?L2974</url>
<url>http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt</url>
<url>http://www.openwall.com/lists/oss-security/2008/11/25/2</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2008-11-29</entry>
<modified>2008-12-25</modified>
</dates>
</vuln>
<vuln vid="910486d5-ba4d-11dd-8f23-0019666436c2">
<topic>imlib2 -- XPM processing buffer overflow vulnerability</topic>
<affects>
<package>
<name>imlib2</name>
<name>imlib2-nox11</name>
<range><lt>1.4.1.000_1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/Advisories/32796/">
<p>A vulnerability has been discovered in imlib2, which can
be exploited by malicious people to potentially compromise
an application using the library.</p>
<p>The vulnerability is caused due to a pointer arithmetic
error within the "load()" function provided by the XPM
loader. This can be exploited to cause a heap-based buffer
overflow via a specially crafted XPM file.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<bid>32371</bid>
<cvename>CVE-2008-5187</cvename>
<url>http://secunia.com/Advisories/32796/</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15</url>
<url>http://bugzilla.enlightenment.org/show_bug.cgi?id=547</url>
</references>
<dates>
<discovery>2008-11-20</discovery>
<entry>2008-11-24</entry>
</dates>
</vuln>
<vuln vid="4d4caee0-b939-11dd-a578-0030843d3802">
<topic>streamripper -- multiple buffer overflows</topic>
<affects>
<package>
<name>streamripper</name>
<range><lt>1.64.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2008-50/">
<p>A boundary error exists within http_parse_sc_header() in lib/http.c
when parsing an overly long HTTP header starting with "Zwitterion v".</p>
<p>A boundary error exists within http_get_pls() in lib/http.c when
parsing a specially crafted pls playlist containing an overly long
entry.</p>
<p>A boundary error exists within http_get_m3u() in lib/http.c when
parsing a specially crafted m3u playlist containing an overly long
"File" entry.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4829</cvename>
<url>http://secunia.com/secunia_research/2008-50/</url>
<url>http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196</url>
</references>
<dates>
<discovery>2008-11-05</discovery>
<entry>2008-11-23</entry>
</dates>
</vuln>
<vuln vid="00d6040a-b8e0-11dd-a578-0030843d3802">
<topic>mantis -- session hijacking vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mantis Team reports:</p>
<blockquote cite="http://www.mantisbt.org/bugs/changelog_page.php?version_id=97">
<p>When configuring a web application to use only ssl (e. g. by
forwarding all http-requests to https), a user would expect that
sniffing and hijacking the session is impossible.
Though, for this to be secure, one needs to set the session cookie to
have the secure flag. Else the cookie will be transferred through http
if the victim's browser does a single http-request on the same domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3102</cvename>
<url>http://www.mantisbt.org/bugs/view.php?id=9524</url>
<url>http://www.mantisbt.org/bugs/view.php?id=9533</url>
<url>http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/</url>
<url>http://int21.de/cve/CVE-2008-3102-mantis.html</url>
</references>
<dates>
<discovery>2008-10-14</discovery>
<entry>2008-11-22</entry>
</dates>
</vuln>
<vuln vid="75c24c1d-b688-11dd-88fd-001c2514716c">
<topic>dovecot -- ACL plugin bypass vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports in dovecot 1.1.4 release notes:</p>
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2008-October/000085.html">
<p>ACL plugin fixes: Negative rights were actually treated
as positive rights. 'k' right didn't prevent creating
parent/child/child mailbox. ACL groups weren't working.</p>
</blockquote>
</body>
</description>
<references>
<bid>31587</bid>
<cvename>CVE-2008-4577</cvename>
<cvename>CVE-2008-4578</cvename>
</references>
<dates>
<discovery>2008-10-05</discovery>
<entry>2008-11-19</entry>
</dates>
</vuln>
<vuln vid="f1e0164e-b67b-11dd-a55e-00163e000016">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.6.32_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/Advisories/32773/">
<p>Two vulnerabilities have been reported in Libxml2, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
to potentially compromise an application using the library.</p>
<p>1) An integer overflow error in the "xmlSAX2Characters()" function
can be exploited to trigger a memory corruption via a specially</p>
<p>Successful exploitation may allow execution of arbitrary code, but
requires e.g. that the user is tricked into processing an overly
large XML file (2GB or more).</p>
<p>2) An integer overflow error in the "xmlBufferResize()" function
can be exploited to trigger the execution of an infinite loop.
The vulnerabilities are reported in version 2.7.2.</p>
<p>Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4225</cvename>
<cvename>CVE-2008-4226</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=470466</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=470480</url>
<url>http://secunia.com/Advisories/32773/</url>
</references>
<dates>
<discovery>2008-11-18</discovery>
<entry>2008-11-19</entry>
</dates>
</vuln>
<vuln vid="937adf01-b64a-11dd-a55e-00163e000016">
<topic>openfire -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openfire</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Kurtz reports:</p>
<blockquote cite="http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt">
<p>The jabber server Openfire (<= version 3.6.0a) contains several
serious vulnerabilities. Depending on the particular runtime
environment these issues can potentially even be used by an
attacker to execute code on operating system level.</p>
<ol>
<li>Authentication bypass - This vulnerability provides an attacker
full access to all functions in the admin webinterface without
providing any user credentials. The Tomcat filter which is
responsible for authentication could be completely
circumvented.</li>
<li>SQL injection - It is possible to pass SQL statements to the
backend database through a SQL injection vulnerability. Depending
on the particular runtime environment and database permissions it
is even possible to write files to disk and execute code on
operating system level.</li>
<li>Multiple Cross-Site Scripting - Permits arbitrary insertion
of HTML- and JavaScript code in login.jsp. An attacker could
also manipulate a parameter to specify a destination to which a
user will be forwarded to after successful authentication.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-6510</cvename>
<cvename>CVE-2008-6511</cvename>
<cvename>CVE-2008-6508</cvename>
<cvename>CVE-2009-1595</cvename>
<cvename>CVE-2008-1728</cvename>
<cvename>CVE-2008-6509</cvename>
<url>http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt</url>
<url>http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html</url>
<url>http://secunia.com/Advisories/32478/</url>
</references>
<dates>
<discovery>2008-11-07</discovery>
<entry>2008-11-19</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="75f2382e-b586-11dd-95f9-00e0815b8da8">
<topic>syslog-ng2 -- startup directory leakage in the chroot environment</topic>
<affects>
<package>
<name>syslog-ng2</name>
<range><lt>2.0.9_2</lt></range>
</package>
<package>
<name>syslog-ng</name>
<range><le>1.6.12_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Grandel reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791">
<p>I have not had the time to analyze all of syslog-ng code.
But by reading the code section near the chroot call and looking
at strace results I believe that syslog-ng does not chdir to the
chroot jail's location before chrooting into it.</p>
<p>This opens up ways to work around the chroot jail.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5110</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791</url>
<url>http://www.openwall.com/lists/oss-security/2008/11/17/3</url>
</references>
<dates>
<discovery>2008-11-15</discovery>
<entry>2008-11-18</entry>
<modified>2009-07-01</modified>
</dates>
</vuln>
<vuln vid="a1126054-b57c-11dd-8892-0017319806e7">
<topic>enscript -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>enscript-a4</name>
<name>enscript-letter</name>
<name>enscript-letterdj</name>
<range><lt>1.6.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Harnhammar of Secunia Research reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863">
<p>Stack-based buffer overflow in the read_special_escape function
in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e
(aka special escapes processing) option is enabled, allows
user-assisted remote attackers to execute arbitrary code via a
crafted ASCII file, related to the setfilename command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3863</cvename>
<cvename>CVE-2008-4306</cvename>
<url>http://secunia.com/secunia_research/2008-41/</url>
</references>
<dates>
<discovery>2008-10-22</discovery>
<entry>2008-11-18</entry>
</dates>
</vuln>
<vuln vid="45298931-b3bf-11dd-80f8-001cc0377035">
<topic>gnutls -- X.509 certificate chain validation vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/32232/discuss">
<p>GnuTLS is prone to a security-bypass vulnerability because the
application fails to properly validate chained X.509 certificates.
Successfully exploiting this issue allows attackers to perform
man-in-the-middle attacks by impersonating trusted servers.
Unsuspecting users may be under a false sense of security that can
aid attackers in launching further attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>32232</bid>
<cvename>CVE-2008-4989</cvename>
<url>http://www.gnu.org/software/gnutls/security.html</url>
<mlist msgid="4918143A.3050103@gmx.net">http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html</mlist>
</references>
<dates>
<discovery>2008-11-10</discovery>
<entry>2008-11-16</entry>
</dates>
</vuln>
<vuln vid="daf045d7-b211-11dd-a987-000c29ca8953">
<topic>net-snmp -- DoS for SNMP agent via crafted GETBULK request</topic>
<affects>
<package>
<name>net-snmp</name>
<range><gt>5.4</gt><lt>5.4.2.1</lt></range>
<range><gt>5.3</gt><lt>5.3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wes Hardaker reports through sourceforge.net forum:</p>
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=882903">
<p>SECURITY ISSUE: A bug in the getbulk handling code could
let anyone with even minimal access crash the agent. If you
have open access to your snmp agents (bad bad bad; stop doing
that!) or if you don't trust everyone that does have access to
your agents you should updated immediately to prevent
potential denial of service attacks.</p>
</blockquote>
<p>Description at cve.mitre.org additionally clarifies:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309">
<p>Integer overflow in the netsnmp_create_subtree_cache
function in agent/snmp_agent.c in net-snmp 5.4 before
5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows
remote attackers to cause a denial of service (crash) via
a crafted SNMP GETBULK request, which triggers a heap-based
buffer overflow, related to the number of responses or
repeats.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4309</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=882903</url>
<url>http://www.openwall.com/lists/oss-security/2008/10/31/1</url>
<url>http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272</url>
</references>
<dates>
<discovery>2008-10-12</discovery>
<entry>2008-11-14</entry>
<modified>2009-03-23</modified>
</dates>
</vuln>
<vuln vid="f29fea8f-b19f-11dd-a55e-00163e000016">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.18,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.18</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.13</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<p>MFSA 2008-58 Parsing error in E4X default namespace</p>
<p>MFSA 2008-57 -moz-binding property bypasses security checks on
codebase principals</p>
<p>MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin
violation</p>
<p>MFSA 2008-55 Crash and remote code execution in
nsFrameManager</p>
<p>MFSA 2008-54 Buffer overflow in http-index-format parser</p>
<p>MFSA 2008-53 XSS and JavaScript privilege escalation via session
restore</p>
<p>MFSA 2008-52 Crashes with evidence of memory corruption
(rv:1.9.0.4/1.8.1.18)</p>
<p>MFSA 2008-51 file: URIs inherit chrome privileges when opened
from chrome</p>
<p>MFSA 2008-50 Crash and remote code execution via __proto__
tampering</p>
<p>MFSA 2008-49 Arbitrary code execution via Flash Player dynamic
module unloading</p>
<p>MFSA 2008-48 Image stealing via canvas and HTTP redirect</p>
<p>MFSA 2008-47 Information stealing via local shortcut files</p>
<p>MFSA 2008-46 Heap overflow when canceling newsgroup message</p>
<p>MFSA 2008-44 resource: traversal vulnerabilities</p>
<p>MFSA 2008-43 BOM characters stripped from JavaScript before
execution</p>
<p>MFSA 2008-42 Crashes with evidence of memory corruption
(rv:1.9.0.2/1.8.1.17)</p>
<p>MFSA 2008-41 Privilege escalation via XPCnativeWrapper
pollution</p>
<p>MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin
violation</p>
<p>MFSA 2008-37 UTF-8 URL stack buffer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0017</cvename>
<cvename>CVE-2008-4582</cvename>
<cvename>CVE-2008-5012</cvename>
<cvename>CVE-2008-5013</cvename>
<cvename>CVE-2008-5014</cvename>
<cvename>CVE-2008-5015</cvename>
<cvename>CVE-2008-5016</cvename>
<cvename>CVE-2008-5017</cvename>
<cvename>CVE-2008-5018</cvename>
<cvename>CVE-2008-5019</cvename>
<cvename>CVE-2008-5021</cvename>
<cvename>CVE-2008-5022</cvename>
<cvename>CVE-2008-5023</cvename>
<cvename>CVE-2008-5024</cvename>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-47.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-48.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-49.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-50.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-51.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-52.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-53.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-54.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-55.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-56.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-57.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-58.html</url>
</references>
<dates>
<discovery>2008-11-13</discovery>
<entry>2008-11-13</entry>
<modified>2008-11-23</modified>
</dates>
</vuln>
<vuln vid="445ed958-b0d9-11dd-a55e-00163e000016">
<topic>faad2 -- heap overflow vulnerability</topic>
<affects>
<package>
<name>faad2</name>
<range><lt>2.6.1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4201">
<p>Heap-based buffer overflow in the decodeMP4file function
(frontend/main.c) in FAAD2 2.6.1 and earlier allows remote
attackers to cause a denial of service (crash) and possibly
execute arbitrary code via a crafted MPEG-4 (MP4) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4201</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml</url>
</references>
<dates>
<discovery>2008-09-16</discovery>
<entry>2008-11-12</entry>
<modified>2008-11-13</modified>
</dates>
</vuln>
<vuln vid="66657bd5-ac92-11dd-b541-001f3b19d541">
<topic>emacs -- run-python vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<range><ge>22</ge><le>22.2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Emacs developers report:</p>
<blockquote cite="http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html">
<p>The Emacs command `run-python' launches an interactive
Python interpreter. After the Python process starts up,
Emacs automatically sends it the line:</p>
<p>import emacs</p>
<p>which normally imports a script named emacs.py which is
distributed with Emacs. This script, which is typically
located in a write-protected installation directory with
other Emacs program files, defines various functions to help
the Python process communicate with Emacs.</p>
<p>The vulnerability arises because Python, by default,
prepends '' to the module search path, so modules are looked
for in the current directory. If the current directory is
world-writable, an attacker may insert malicious code by
adding a fake Python module named emacs.py into that
directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3949</cvename>
<url>http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html</url>
</references>
<dates>
<discovery>2008-09-05</discovery>
<entry>2008-11-07</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="24b64fb0-af1d-11dd-8a16-001b1116b350">
<topic>clamav -- off-by-one heap overflow in VBA project parser</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.94.1</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20081105</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Advisory from Moritz Jodeit, November 8th, 2008:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/498169/30/0/threaded">
<p>ClamAV contains an off-by-one heap overflow vulnerability
in the code responsible for parsing VBA project files.
Successful exploitation could allow an attacker to execute
arbitrary code with the privileges of the `clamd' process by
sending an email with a prepared attachment.</p>
<p>A VBA project file embedded inside an OLE2 office document
send as an attachment can trigger the off-by-one.</p>
</blockquote>
<p>Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:</p>
<blockquote cite="http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog">
<p>libclamav/vba_extract.c: get_unicode_name off-by-one,
bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/498169/30/0/threaded</url>
<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
<cvename>CVE-2008-5050</cvename>
</references>
<dates>
<discovery>2008-11-08</discovery>
<entry>2008-11-10</entry>
</dates>
</vuln>
<vuln vid="c89a3ebb-ae07-11dd-b4b2-001f3c8eabeb">
<topic>trac -- potential DOS vulnerability</topic>
<affects>
<package>
<name>trac</name>
<range><lt>0.11.2</lt></range>
</package>
<package>
<name>ja-trac</name>
<range><lt>0.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Trac development team reports:</p>
<blockquote cite="http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d">
<p>0.11.2 is a new stable maintenance release. It contains
several security fixes and everyone is recommended to
upgrade their installations.</p>
<p>Bug fixes:</p>
<p>Fixes potential DOS vulnerability with certain wiki markup.</p>
</blockquote>
</body>
</description>
<references>
<url>http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d</url>
</references>
<dates>
<discovery>2008-11-08</discovery>
<entry>2008-11-09</entry>
</dates>
</vuln>
<vuln vid="4b09378e-addb-11dd-a578-0030843d3802">
<topic>vlc -- cue processing stack overflow</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>0.8.6.i_2,2</lt></range>
</package>
<package>
<name>vlc-devel</name>
<range><lt>0.9.6,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC Team reports:</p>
<blockquote cite="http://www.videolan.org/security/sa0810.html">
<p>The VLC media player contains a stack overflow vulnerability
while parsing malformed cue files. The vulnerability may be
exploited by a (remote) attacker to execute arbitrary code in
the context of VLC media player.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5032</cvename>
<cvename>CVE-2008-5036</cvename>
<url>http://www.videolan.org/security/sa0810.html</url>
<url>http://www.trapkit.de/advisories/TKADV2008-012.txt</url>
</references>
<dates>
<discovery>2008-11-05</discovery>
<entry>2008-11-08</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="0e30e802-a9db-11dd-93a2-000bcdf0a03b">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/906/">
<p>When certain parameters are passed to Opera's History
Search, they can cause content not to be correctly
sanitized. This can allow scripts to be injected into the
History Search results page. Such scripts can then run with
elevated privileges and interact with Opera's configuration,
allowing them to execute arbitrary code.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/907/">
<p>The links panel shows links in all frames on the current
page, including links with JavaScript URLs. When a page is
held in a frame, the script is incorrectly executed on the
outermost page, not the page where the URL was located.
This can be used to execute scripts in the context of an
unrelated frame, which allows cross-site scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4794</cvename>
<url>http://www.opera.com/support/search/view/906/</url>
<url>http://www.opera.com/support/search/view/907/</url>
</references>
<dates>
<discovery>2008-11-03</discovery>
<entry>2008-11-03</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="07bb3bd2-a920-11dd-8503-0211060005df">
<topic>qemu -- Heap overflow in Cirrus emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.1_10</lt></range>
<range><ge>0.9.1s.20080101*</ge><lt>0.9.1s.20080620_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aurelien Jarno reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html">
<p>CVE-2008-4539: fix a heap overflow in Cirrus emulation</p>
<p>The code in hw/cirrus_vga.c has changed a lot between
CVE-2007-1320 has been announced and the patch has been applied.
As a consequence it has wrongly applied and QEMU is still
vulnerable to this bug if using VNC.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4539</cvename>
<mlist msgid="E1Kw4kF-0001Mx-KA@cvs.savannah.gnu.org">http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html</mlist>
</references>
<dates>
<discovery>2008-11-01</discovery>
<entry>2008-11-02</entry>
</dates>
</vuln>
<vuln vid="85b0bbc8-a7a5-11dd-8283-001c2514716c">
<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.0</gt><lt>3.0.1.1</lt></range>
<range><lt>2.11.9.3</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/31928">
<p>phpMyAdmin is prone to a cross-site scripting vulnerability
because it fails to sufficiently sanitize user-supplied data.</p>
<p>An attacker may leverage this issue to execute arbitrary
script code in the browser of an unsuspecting user in the
context of the affected site. This may allow the attacker
to steal cookie-based authentication credentials and to
launch other attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>31928</bid>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9</url>
</references>
<dates>
<discovery>2008-10-30</discovery>
<entry>2008-10-31</entry>
<modified>2008-10-31</modified>
</dates>
</vuln>
<vuln vid="f5c4d7f7-9f4b-11dd-bab1-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/903/">
<p>Certain constructs are not escaped correctly by Opera's
History Search results. These can be used to inject scripts
into the page, which can then be used to look through the user's
browsing history, including the contents of the pages they have
visited. These may contain sensitive information.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/904/">
<p>If a link that uses a JavaScript URL triggers Opera's Fast
Forward feature, when the user activates Fast Forward, the
script should run on the current page. When a page is held in a
frame, the script is incorrectly executed on the outermost page,
not the page where the URL was located. This can be used to
execute scripts in the context of an unrelated frame, which
allows cross-site scripting.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/905/">
<p>When Opera is previewing a news feed, some scripts are not
correctly blocked. These scripts are able to subscribe the user
to any feed URL that the attacker chooses, and can also view
the contents of any feeds that the user is subscribed to.
These may contain sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4697</cvename>
<cvename>CVE-2008-4698</cvename>
<cvename>CVE-2008-4725</cvename>
<url>http://www.opera.com/support/search/view/903/</url>
<url>http://www.opera.com/support/search/view/904/</url>
<url>http://www.opera.com/support/search/view/905/</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2008-10-28</entry>
<modified>2010-05-02</modified>
</dates>
</vuln>
<vuln vid="2ddbfd29-a455-11dd-a55e-00163e000016">
<topic>libspf2 -- Buffer overflow</topic>
<affects>
<package>
<name>libspf2</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2469">
<p>Heap-based buffer overflow in the SPF_dns_resolv_lookup function
in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers
to execute arbitrary code via a long DNS TXT record with a modified
length field.</p>
</blockquote>
</body>
</description>
<references>
<bid>31881</bid>
<cvename>CVE-2008-2469</cvename>
</references>
<dates>
<discovery>2008-10-21</discovery>
<entry>2008-10-27</entry>
</dates>
</vuln>
<vuln vid="55616fda-a2d0-11dd-a9f9-0030843d3802">
<topic>openx -- sql injection vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32114/">
<p>OpenX can be exploited by malicious people to conduct SQL injection
attacks.</p>
<p>Input passed to the "bannerid" parameter in www/delivery/ac.php is
not properly sanitised before being used in SQL queries. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL
code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/32114/</url>
<url>http://blog.openx.org/10/openx-security-update/</url>
</references>
<dates>
<discovery>2008-10-03</discovery>
<entry>2008-10-25</entry>
</dates>
</vuln>
<vuln vid="9d3020e4-a2c4-11dd-a9f9-0030843d3802">
<topic>flyspray -- multiple vulnerabilities</topic>
<affects>
<package>
<name>flyspray</name>
<range><lt>0.9.9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Flyspray Project reports:</p>
<blockquote cite="http://www.flyspray.org/fsa:2">
<p>Flyspray is affected by a Cross Site scripting Vulnerability
due to an error escaping PHP's $_SERVER['QUERY_STRING']
superglobal, that can be maliciously used to inject
arbitrary code into the savesearch() javascript function.</p>
<p>There is an XSS problem in the history tab, the application
fails to sanitize the "details" parameter correctly, leading
to the possibility of arbitrary code injection into the
getHistory() javascript function.</p>
</blockquote>
<blockquote cite="http://www.flyspray.org/fsa:3">
<p>Flyspray is affected by a Cross Site scripting Vulnerability
due missing escaping of SQL error messages. By including HTML
code in a query and at the same time causing it to fail by
submitting invalid data, an XSS hole can be exploited.</p>
<p>There is an XSS problem in the task history attached to
comments, since the application fails to sanitize the
old_value and new_value database fields for changed task
summaries.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/29215">
<p>Input passed via the "item_summary" parameter to
"index.php?do=details" is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of
an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6461</cvename>
<cvename>CVE-2008-1165</cvename>
<cvename>CVE-2008-1166</cvename>
<url>http://secunia.com/advisories/29215</url>
</references>
<dates>
<discovery>2008-02-24</discovery>
<entry>2008-10-25</entry>
</dates>
</vuln>
<vuln vid="3a4a3e9c-a1fe-11dd-81be-001c2514716c">
<topic>wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>wordpress-mu</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Wordpress development team reports:</p>
<blockquote cite="http://wordpress.org/development/2008/10/wordpress-263/">
<p>A <a href="http://secunia.com/Advisories/32361/">vulnerability</a>
in the <a href="http://sourceforge.net/projects/snoopy/">Snoopy</a>
library was announced today. WordPress uses Snoopy to fetch the feeds
shown in the Dashboard. Although this seems to be a low risk
vulnerability for WordPress users, we wanted to get an update out
immediately.</p>
</blockquote>
</body>
</description>
<references>
<bid>31887</bid>
<url>http://secunia.com/Advisories/32361/</url>
<url>http://wordpress.org/development/2008/10/wordpress-263/</url>
</references>
<dates>
<discovery>2008-10-23</discovery>
<entry>2008-10-24</entry>
</dates>
</vuln>
<vuln vid="706c9eef-a077-11dd-b413-001372fd0af2">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.12</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/324824">
<p>On a server configured for IP-based virtual hosts, Drupal may be
caused to include and execute specifically named files outside
of its root directory. This bug affects both Drupal 5 and
Drupal 6.</p>
<p>The title of book pages is not always properly escaped, enabling
users with the "create book content" permission or the
permission to edit any node in the book hierarchy to insert
arbitrary HTML and script code into pages. Such a Cross site
scripting attack may lead to the attacker gaining administrator
access. This bug affects Drupal 6.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-6170</cvename>
<url>http://drupal.org/node/324824</url>
</references>
<dates>
<discovery>2008-10-22</discovery>
<entry>2008-10-22</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="06eac338-9ddf-11dd-813f-000e35248ad7">
<topic>libxine -- denial of service vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine team reports:</p>
<blockquote cite="http://www.xinehq.de/index.php/news">
<p>A new xine-lib version is now available. This release contains
some security fixes, notably a DoS via corrupted Ogg files
(CVE-2008-3231), some related fixes, and fixes for a few possible
buffer overflows.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3231</cvename>
<url>http://www.xinehq.de/index.php/news</url>
<url>http://xforce.iss.net/xforce/xfdb/44040</url>
</references>
<dates>
<discovery>2008-07-13</discovery>
<entry>2008-10-19</entry>
</dates>
</vuln>
<vuln vid="78f456fd-9c87-11dd-a55e-00163e000016">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r124_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb08-18.html">
<p>Potential vulnerabilities have been identified in Adobe Flash
Player 9.0.124.0 and earlier that could allow an attacker who
successfully exploits these potential vulnerabilities to bypass
Flash Player security controls. Adobe recommends users update
to the most current version of Flash Player available for their
platform.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6243</cvename>
<cvename>CVE-2008-3873</cvename>
<cvename>CVE-2007-4324</cvename>
<cvename>CVE-2008-4401</cvename>
<cvename>CVE-2008-4503</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb08-18.html</url>
</references>
<dates>
<discovery>2008-10-15</discovery>
<entry>2008-10-17</entry>
</dates>
</vuln>
<vuln vid="d71da236-9a94-11dd-8f42-001c2514716c">
<topic>libxml2 -- two vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.6.32_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31558/">
<p>Two vulnerabilities have been reported in Libxml2, which can be
exploited by malicious people to cause a DoS (Denial of Service)
or potentially compromise an application using the library.</p>
<p>1) A recursion error exists when processing certain XML content.
This can be exploited to e.g. exhaust all available memory and CPU
resources by tricking an application using Libxml2 into processing
specially crafted XML documents.</p>
<p>2) A boundary error in the processing of long XML entity names
in parser.c can be exploited to cause a heap-based buffer overflow
when specially crafted XML content is parsed.</p>
<p>Successful exploitation may allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3281</cvename>
<cvename>CVE-2008-3529</cvename>
</references>
<dates>
<discovery>2008-08-22</discovery>
<entry>2008-10-15</entry>
<modified>2008-10-20</modified>
</dates>
</vuln>
<vuln vid="12efc567-9879-11dd-a5e7-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.11</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/318706">
<p>A logic error in the core upload module validation allowed
unprivileged users to attach files to content. Users can view files
attached to content which they do not otherwise have access to.
If the core upload module is not enabled, your site will not be
affected.</p>
<p>A deficiency in the user module allowed users who had been blocked
by access rules to continue logging into the site under certain
conditions. If you do not use the 'access rules' functionality in core,
your site will not be affected.</p>
<p>The BlogAPI module does not implement correct validation for
certain content fields, allowing for values to be set for fields which
would otherwise be inaccessible on an internal Drupal form. We have
hardened these checks in BlogAPI module for this release, but the
security team would like to re-iterate that the 'Administer content
with BlogAPI' permission should only be given to trusted users.
If the core BlogAPI module is not enabled, your site will not be
affected.</p>
<p>A weakness in the node module API allowed for node validation to be
bypassed in certain circumstances for contributed modules implementing
the API. Additional checks have been added to ensure that validation
is performed in all cases. This vulnerability only affects sites using
one of a very small number of contributed modules, all of which will
continue to work correctly with the improved API. None of them were
found vulnerable, so our correction is a preventative measure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4791</cvename>
<cvename>CVE-2008-4792</cvename>
<cvename>CVE-2008-4793</cvename>
<url>http://drupal.org/node/318706</url>
<url>http://secunia.com/advisories/32200/</url>
<url>http://secunia.com/advisories/32201/</url>
<url>http://secunia.com/advisories/32198/</url>
</references>
<dates>
<discovery>2008-10-08</discovery>
<entry>2008-10-12</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="ce29ce1d-971a-11dd-ab7e-001c2514716c">
<topic>cups -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The release note of cups 1.3.9 reports:</p>
<blockquote cite="http://cups.org/articles.php?L575">
<p>It contains the following fixes:</p>
<ul>
<li>SECURITY: The HP-GL/2 filter did not range check
pen numbers (STR #2911)</li>
<li>SECURITY: The SGI image file reader did not range
check 16-bit run lengths (STR #2918)</li>
<li>SECURITY: The text filter did not range check cpi,
lpi, or column values (STR #2919)</li>
</ul>
</blockquote>
<p>Exploitation of this vulnerability results in the execution
of arbitrary code with the privileges of the affected service.</p>
</body>
</description>
<references>
<cvename>CVE-2008-3639</cvename>
<cvename>CVE-2008-3640</cvename>
<cvename>CVE-2008-3641</cvename>
</references>
<dates>
<discovery>2008-10-09</discovery>
<entry>2008-10-10</entry>
</dates>
</vuln>
<vuln vid="fb84d5dd-9528-11dd-9a00-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/901/">
<p>If a malicious page redirects Opera to a specially crafted
address (URL), it can cause Opera to crash. Given sufficient
address content, the crash could cause execution of code
controlled by the attacking page.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/902/">
<p>Once a Java applet has been cached, if a page can predict the
cache path for that applet, it can load the applet from the
cache, causing it to run in the context of the local machine.
This allows it to read other cache files on the computer or
perform other normally more restrictive actions. These files
could contain sensitive information, which could then be sent
to the attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4695</cvename>
<cvename>CVE-2008-4694</cvename>
<url>http://www.opera.com/support/search/view/901/</url>
<url>http://www.opera.com/support/search/view/902/</url>
</references>
<dates>
<discovery>2008-10-04</discovery>
<entry>2008-10-10</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="4775c807-8f30-11dd-821f-001cc0377035">
<topic>mysql -- command line client input validation vulnerability</topic>
<affects>
<package>
<name>mysql-client</name>
<range><gt>5.1</gt><lt>5.1.28_1</lt></range>
<range><gt>5.0</gt><lt>5.0.67_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Henlich reports:</p>
<blockquote cite="http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/">
<p>The mysql command-line client does not quote HTML special
characters like < in its output. This allows an attacker who
is able to write data into a table to hide or modify records in
the output, and to inject potentially dangerous code, e. g.
Javascript to perform cross-site scripting or cross-site request
forgery attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>31486</bid>
<url>http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/</url>
</references>
<dates>
<discovery>2007-04-17</discovery>
<entry>2008-10-01</entry>
<modified>2008-10-10</modified>
</dates>
</vuln>
<vuln vid="724e6f93-8f2a-11dd-821f-001cc0377035">
<topic>mplayer -- multiple integer overflows</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.11_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The oCERT team reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2008-013.html">
<p>The MPlayer multimedia player suffers from a vulnerability which
could result in arbitrary code execution and at the least, in
unexpected process termination. Three integer underflows located
in the Real demuxer code can be used to exploit a heap overflow,
a specific video file can be crafted in order to make the
stream_read function reading or writing arbitrary amounts of
memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3827</cvename>
<url>http://www.ocert.org/advisories/ocert-2008-013.html</url>
</references>
<dates>
<discovery>2008-09-30</discovery>
<entry>2008-10-01</entry>
<modified>2008-10-02</modified>
</dates>
</vuln>
<vuln vid="fb911e31-8ceb-11dd-bb29-000c6e274733">
<topic>lighttpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.19_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd seurity annoucement:</p>
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt">
<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
not decode the url before matching against rewrite and redirect
patterns, which allows attackers to bypass rewrites rules. this
can be a security problem in certain configurations if these rules
are used to hide certain urls.</p>
</blockquote>
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt">
<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
not lowercase the filename after generating it from the url in
mod_userdir on case insensitive (file)systems.</p>
<p>As other modules are case sensitive, this may lead to information
disclosure; for example if one configured php to handle files
ending on ".php", an attacker will get the php source with
http://example.com/~user/file.PHP</p>
</blockquote>
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt">
<p>lighttpd 1.4.19 does not always release a header if it triggered
a 400 (Bad Request) due to a duplicate header.</p>
</blockquote>
</body>
</description>
<references>
<bid>31434</bid>
<cvename>CVE-2008-4298</cvename>
<cvename>CVE-2008-4359</cvename>
<cvename>CVE-2008-4360</cvename>
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt</url>
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt</url>
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt</url>
</references>
<dates>
<discovery>2008-09-26</discovery>
<entry>2008-09-27</entry>
<modified>2009-02-22</modified>
</dates>
</vuln>
<vuln vid="24ec781b-8c11-11dd-9923-0016d325a0ed">
<topic>bitlbee -- account recreation security issues</topic>
<affects>
<package>
<name>bitlbee</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31633/">
<p>Some security issues have been reported in BitlBee, which can
be exploited by malicious people to bypass certain security
restrictions and hijack accounts.</p>
<p>The security issues are caused due to unspecified errors, which
can be exploited to overwrite existing accounts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3920</cvename>
<cvename>CVE-2008-3969</cvename>
<url>http://secunia.com/advisories/31633/</url>
</references>
<dates>
<discovery>2008-08-27</discovery>
<entry>2008-09-26</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="2273879e-8a2f-11dd-a6fe-0030843d3802">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.17,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>2.0.0.17</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.17</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>2.0</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2008-37<br/>UTF-8 URL stack buffer overflow</p>
<p>MFSA 2008-38<br/>nsXMLDocument::OnChannelRedirect() same-origin
violation</p>
<p>MFSA 2008-39<br/>Privilege escalation using feed preview page and
XSS flaw</p>
<p>MFSA 2008-40<br/>Forced mouse drag</p>
<p>MFSA 2008-41<br/>Privilege escalation via XPCnativeWrapper
pollution</p>
<p>MFSA 2008-42<br/>Crashes with evidence of memory corruption
(rv:1.9.0.2/1.8.1.17)</p>
<p>MFSA 2008-43<br/>BOM characters stripped from JavaScript before
execution</p>
<p>MFSA 2008-44<br/>resource: traversal vulnerabilities</p>
<p>MFSA 2008-45<br/>XBM image uninitialized memory reading</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0016</cvename>
<cvename>CVE-2008-3835</cvename>
<cvename>CVE-2008-3836</cvename>
<cvename>CVE-2008-3837</cvename>
<cvename>CVE-2008-4058</cvename>
<cvename>CVE-2008-4059</cvename>
<cvename>CVE-2008-4060</cvename>
<cvename>CVE-2008-4061</cvename>
<cvename>CVE-2008-4062</cvename>
<cvename>CVE-2008-4063</cvename>
<cvename>CVE-2008-4064</cvename>
<cvename>CVE-2008-4065</cvename>
<cvename>CVE-2008-4067</cvename>
<cvename>CVE-2008-4068</cvename>
<cvename>CVE-2008-4069</cvename>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-37.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-38.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-39.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-40.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-41.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-42.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-43.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-44.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-45.html</url>
</references>
<dates>
<discovery>2008-09-24</discovery>
<entry>2008-09-24</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="a0afb4b9-89a1-11dd-a65b-00163e000016">
<topic>squirrelmail -- Session hijacking vulnerability</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><le>1.4.15_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Boeck reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2008/Sep/0239.html">
<p>When configuring a web application to use only ssl (e.g. by
forwarding all http-requests to https), a user would expect that
sniffing and hijacking the session is impossible.</p>
<p>Though, for this to be secure, one needs to set the session
cookie to have the secure flag. Otherwise the cookie will be
transferred through HTTP if the victim's browser does a single
HTTP request on the same domain.</p>
<p>Squirrelmail does not set that flag. It is fixed in the 1.5
test versions, but current 1.4.15 is vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<bid>31321</bid>
<cvename>CVE-2008-3663</cvename>
<mlist>http://seclists.org/bugtraq/2008/Sep/0239.html</mlist>
</references>
<dates>
<discovery>2008-08-12</discovery>
<entry>2008-09-23</entry>
</dates>
</vuln>
<vuln vid="0f51f2c9-8956-11dd-a6fe-0030843d3802">
<topic>proftpd -- Long Command Processing Vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.2rc2</lt></range>
</package>
<package>
<name>proftpd-devel</name>
<range><lt>1.3.20080922</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31930/">
<p>The vulnerability is caused due to the application truncating an
overly long FTP command, and improperly interpreting the remainder
string as a new FTP command. This can be exploited to execute
arbitrary FTP commands with the privileges of another user by e.g.
tricking the user into following malicious link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4242</cvename>
<cvename>CVE-2008-4247</cvename>
<url>http://secunia.com/advisories/31930/</url>
<url>http://bugs.proftpd.org/show_bug.cgi?id=3115</url>
</references>
<dates>
<discovery>2008-09-22</discovery>
<entry>2008-09-23</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="150e4548-8950-11dd-a6fe-0030843d3802">
<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/Advisories/31974/">
<p>An error exists in the "PMA_escapeJsString()" function in
libraries/js_escape.lib.php, which can be exploited to bypass
certain filters and execute arbitrary HTML and script code in a
user's browser session in context of an affected site when e.g.
Microsoft Internet Explorer is used.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/Advisories/31974/</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8</url>
</references>
<dates>
<discovery>2008-09-23</discovery>
<entry>2008-09-23</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="fc9e73b2-8685-11dd-bb64-0030843d3802">
<topic>gallery -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery</name>
<range><lt>1.5.9</lt></range>
</package>
<package>
<name>gallery2</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31912/">
<p>An error in the handing of ZIP archives with symbolic links can be
exploited to disclose the contents of arbitrary files.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/31858/">
<p>Input from uploaded Flash animations is not properly sanitised
before being used. This can be exploited to insert arbitrary HTML and
script code, which is executed in a user's browser session in context
of an affected site when the malicious data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/31912/</url>
<url>http://secunia.com/advisories/31858/</url>
</references>
<dates>
<discovery>2008-09-18</discovery>
<entry>2008-09-19</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="74bf1594-8493-11dd-bb64-0030843d3802">
<topic>phpmyadmin -- Code execution vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7">
<p>The server_databases.php script was vulnerable to an attack coming
from a user who is already logged-on to phpMyAdmin, where he can
execute shell code (if the PHP configuration permits commands like
exec).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4096</cvename>
<url>http://secunia.com/Advisories/31884/</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7</url>
</references>
<dates>
<discovery>2008-09-15</discovery>
<entry>2008-09-17</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9227dcaf-827f-11dd-9cd7-0050568452ac">
<topic>twiki -- Arbitrary code execution in session files</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Th1nk3r reports:</p>
<blockquote cite="http://www.milw0rm.com/exploits/6269">
<p>The version of TWiki installed on the remote host allows access to
the 'configure' script and fails to sanitize the 'image' parameter
of that script of directory traversal sequences before returning the
file contents when the 'action' parameter is set to 'image'. An
unauthenticated attacker can leverage this issue to view arbitrary
files on the remote host subject to the privileges of the web server
user id. .</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3195</cvename>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195</url>
<url>http://www.kb.cert.org/vuls/id/362012</url>
<url>https://inspectit.accessitgroup.com/threats/details.cgi?id=34031</url>
<url>http://www.nessus.org/plugins/index.php?view=single&id=34031</url>
</references>
<dates>
<discovery>2008-08-05</discovery>
<entry>2008-09-14</entry>
</dates>
</vuln>
<vuln vid="755fa519-80a9-11dd-8de5-0030843d3802">
<topic>neon -- NULL pointer dereference in Digest domain support</topic>
<affects>
<package>
<name>neon28</name>
<range><lt>0.28.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joe Orton reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2008/08/15/4">
<p>A NULL pointer deference in the Digest authentication support in
neon versions 0.28.0 through 0.28.2 inclusive allows a malicious
server to crash a client application, resulting in possible denial
of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>30710</bid>
<cvename>CVE-2008-3746</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571</url>
<url>http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html</url>
</references>
<dates>
<discovery>2008-08-15</discovery>
<entry>2008-09-12</entry>
</dates>
</vuln>
<vuln vid="da5c4072-8082-11dd-9c8c-001c2514716c">
<topic>clamav -- CHM Processing Denial of Service</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.94</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20080902</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Boeck reports:</p>
<blockquote cite="http://int21.de/cve/CVE-2008-1389-clamav-chd.html">
<p>A fuzzing test showed weakness in the chm parser of
clamav, which can possibly be exploited. The clamav
team has disabled the chm module in older versions
though freshclam updates and has released 0.94 with
a fixed parser.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1389</cvename>
<url>https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089</url>
</references>
<dates>
<discovery>2008-07-09</discovery>
<entry>2008-09-12</entry>
</dates>
</vuln>
<vuln vid="7d239578-7ff2-11dd-8de5-0030843d3802">
<topic>horde -- multiple vulnerabilities</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31842/">
<p>Some vulnerabilities have been reported in various Horde products,
which can be exploited by malicious people to conduct script insertion
attacks</p>
<p>Input via MIME attachment linking is not properly sanitised in the
MIME library before being used. This can be exploited to execute
arbitrary HTML and script code in a user's browser session if e.g. a
malicious email is viewed.</p>
<p>Certain unspecified input in HTML messages is not properly
sanitised before being used. This can be exploited to execute
arbitrary HTML and script in a user's browser session if e.g. a
malicious HTML email is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3823</cvename>
<cvename>CVE-2008-3824</cvename>
<mlist>http://lists.horde.org/archives/announce/2008/000429.html</mlist>
<url>http://secunia.com/advisories/31842/</url>
</references>
<dates>
<discovery>2008-09-10</discovery>
<entry>2008-09-11</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="0dccaa28-7f3c-11dd-8de5-0030843d3802">
<topic>python -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python24</name>
<range><lt>2.4.5_2</lt></range>
</package>
<package>
<name>python25</name>
<range><lt>2.5.2_3</lt></range>
</package>
<package>
<name>python23</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31305">
<p>Some vulnerabilities have been reported in Python, where some have
unknown impact and others can potentially be exploited by malicious
people to cause a DoS (Denial of Service) or to compromise a
vulnerable system.</p>
<p>Various integer overflow errors exist in core modules e.g.
stringobject, unicodeobject, bufferobject, longobject, tupleobject,
stropmodule, gcmodule, mmapmodule.</p>
<p>An integer overflow in the hashlib module can lead to an unreliable
cryptographic digest results.</p>
<p>Integer overflow errors in the processing of unicode strings can be
exploited to cause buffer overflows on 32-bit systems.</p>
<p>An integer overflow exists in the PyOS_vsnprintf() function on
architectures that do not have a "vsnprintf()" function.</p>
<p>An integer underflow error in the PyOS_vsnprintf() function when
passing zero-length strings can lead to memory corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2315</cvename>
<cvename>CVE-2008-2316</cvename>
<cvename>CVE-2008-3142</cvename>
<cvename>CVE-2008-3144</cvename>
<url>http://bugs.python.org/issue2620</url>
<url>http://bugs.python.org/issue2588</url>
<url>http://bugs.python.org/issue2589</url>
<url>http://secunia.com/advisories/31305</url>
<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072276.html</mlist>
<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072174.html</mlist>
<mlist>http://mail.python.org/pipermail/python-checkins/2008-June/070481.html</mlist>
</references>
<dates>
<discovery>2008-08-04</discovery>
<entry>2008-09-10</entry>
</dates>
</vuln>
<vuln vid="388d9ee4-7f22-11dd-a66a-0019666436c2">
<topic>mysql -- MyISAM table privileges security bypass vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>6.0</ge><lt>6.0.5</lt></range>
<range><ge>5.1</ge><lt>5.1.24</lt></range>
<range><ge>5.0</ge><lt>5.0.67</lt></range>
<range><ge>4.1</ge><lt>4.1.22_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/29106/discuss">
<p>MySQL is prone to a security-bypass vulnerability.
An attacker can exploit this issue to overwrite existing
table files in the MySQL data directory, bypassing certain
security restrictions.</p>
</blockquote>
</body>
</description>
<references>
<bid>29106</bid>
<cvename>CVE-2008-2079</cvename>
</references>
<dates>
<discovery>2008-05-05</discovery>
<entry>2008-09-10</entry>
<modified>2008-10-10</modified>
</dates>
</vuln>
<vuln vid="8e8b8b94-7f1d-11dd-a66a-0019666436c2">
<topic>rubygem-rails -- SQL injection vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Weiss reports, that it is possible
to perform an SQL injection in Rails applications
via not correctly sanitized :limit and :offset
parameters. It is possible to change arbitrary
values in affected tables or gain access to the
sensitive data.</p>
</body>
</description>
<references>
<cvename>CVE-2008-4094</cvename>
<url>http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1</url>
</references>
<dates>
<discovery>2008-09-08</discovery>
<entry>2008-09-10</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="884fced7-7f1c-11dd-a66a-0019666436c2">
<topic>wordpress -- remote privilege escalation</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>wordpress-mu</name>
<range><lt>2.6.2</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Wordpress development team reports:</p>
<blockquote cite="http://wordpress.org/development/2008/09/wordpress-262/">
<p>With open registration enabled, it is possible in WordPress
versions 2.6.1 and earlier to craft a username such that it
will allow resetting another users password to a randomly
generated password. The randomly generated password is not
disclosed to the attacker, so this problem by itself is annoying
but not a security exploit. However, this attack coupled with a
weakness in the random number seeding in mt_rand() could be used
to predict the randomly generated password.</p>
</blockquote>
</body>
</description>
<references>
<bid>31068</bid>
<cvename>CVE-2008-4107</cvename>
<url>http://wordpress.org/development/2008/09/wordpress-262/</url>
</references>
<dates>
<discovery>2008-09-08</discovery>
<entry>2008-10-22</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="2f794295-7b69-11dd-80ba-000bcdf0a03b">
<topic>FreeBSD -- Remote kernel panics on IPv6 connections</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_4</lt></range>
<range><ge>7.0</ge><lt>7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In case of an incoming ICMPv6 'Packet Too Big Message', there
is an insufficient check on the proposed new MTU for a path to
the destination.</p>
<h1>Impact:</h1>
<p>When the kernel is configured to process IPv6 packets and has
active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet
Too Big Message' could cause the TCP stack of the kernel to
panic.</p>
<h1>Workaround:</h1>
<p>Systems without INET6 / IPv6 support are not vulnerable and
neither are systems which do not listen on any IPv6 TCP sockets
and have no active IPv6 connections.</p>
<p>Filter ICMPv6 'Packet Too Big Messages' using a firewall, but
this will at the same time break PMTU support for IPv6
connections.</p>
</body>
</description>
<references>
<cvename>CVE-2008-3530</cvename>
<freebsdsa>SA-08:09.icmp6</freebsdsa>
</references>
<dates>
<discovery>2008-09-03</discovery>
<entry>2008-09-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="7dbb7197-7b68-11dd-80ba-000bcdf0a03b">
<topic>FreeBSD -- nmount(2) local arbitrary code execution</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_4</lt></range>
<range><ge>7.0</ge><lt>7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Various user defined input such as mount points, devices, and
mount options are prepared and passed as arguments to
nmount(2) into the kernel. Under certain error conditions,
user defined data will be copied into a stack allocated buffer
stored in the kernel without sufficient bounds checking.</p>
<h1>Impact:</h1>
<p>If the system is configured to allow unprivileged users to
mount file systems, it is possible for a local adversary to
exploit this vulnerability and execute code in the context of
the kernel.</p>
<h1>Workaround:</h1>
<p>It is possible to work around this issue by allowing only
privileged users to mount file systems by running the
following sysctl(8) command:</p>
<pre># sysctl vfs.usermount=0</pre>
</body>
</description>
<references>
<cvename>CVE-2008-3531</cvename>
<freebsdsa>SA-08:08.nmount</freebsdsa>
</references>
<dates>
<discovery>2008-09-03</discovery>
<entry>2008-09-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6d4e4759-7b67-11dd-80ba-000bcdf0a03b">
<topic>FreeBSD -- amd64 swapgs local privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_4</lt></range>
<range><ge>7.0</ge><lt>7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If a General Protection Fault happens on a FreeBSD/amd64
system while it is returning from an interrupt, trap or
system call, the swapgs CPU instruction may be called one
extra time when it should not resulting in userland and
kernel state being mixed.</p>
<h1>Impact:</h1>
<p>A local attacker can by causing a General Protection Fault
while the kernel is returning from an interrupt, trap or
system call while manipulating stack frames and, run
arbitrary code with kernel privileges.</p>
<p>The vulnerability can be used to gain kernel / supervisor
privilege. This can for example be used by normal users to
gain root privileges, to break out of jails, or bypass
Mandatory Access Control (MAC) restrictions.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but only systems running the 64
bit FreeBSD/amd64 kernels are vulnerable.</p>
<p>Systems with 64 bit capable CPUs, but running the 32 bit
FreeBSD/i386 kernel are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2008-3890</cvename>
<freebsdsa>SA-08:07.amd64</freebsdsa>
</references>
<dates>
<discovery>2008-09-03</discovery>
<entry>2008-09-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="73ec1008-72f0-11dd-874b-0030843d3802">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>9.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Team reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/893/">
<p>Scripts are able to change the addresses of framed pages that
come from the same site. Due to a flaw in the way that Opera checks
what frames can be changed, a site can change the address of frames
on other sites inside any window that it has opened. This allows
sites to open pages from other sites, and display misleading
information on them.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/894/">
<p>Custom shortcut and menu commands can be used to activate external
applications. In some cases, the parameters passed to these
applications are not prepared correctly, and may be created from
uninitialized memory. These may be misinterpreted as additional
parameters, and depending on the application, this could allow
execution of arbitrary code.</p>
<p>Successful exploitation requires convincing the user to modify
their shortcuts or menu files appropriately, pointing to an
appropriate target application, then to activate that shortcut at
an appropriate time. To inject code, additional means will have to
be employed.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/895/">
<p>When insecure pages load content from secure sites into a frame,
they can cause Opera to incorrectly report the insecure site as
being secure. The padlock icon will incorrectly be shown, and the
security information dialog will state that the connection is
secure, but without any certificate information.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/896/">
<p>As a security precaution, Opera does not allow Web pages to
link to files on the user's local disk. However, a flaw exists
that allows Web pages to link to feed source files on the
user's computer. Suitable detection of JavaScript events and
appropriate manipulation can unreliably allow a script to
detect the difference between successful and unsuccessful
subscriptions to these files, to allow it to discover if the
file exists or not. In most cases the attempt will fail.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/897/">
<p>It has been reported that when a user subscribes to a news
feed using the feed subscription button, the page address
can be changed. This causes the address field not to update
correctly. Although this can mean that misleading
information can be displayed in the address field, it can
only leave the attacking page's address in the address bar,
not a trusted third party address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4195</cvename>
<cvename>CVE-2008-4197</cvename>
<cvename>CVE-2008-4198</cvename>
<cvename>CVE-2008-4200</cvename>
<url>http://www.opera.com/support/search/view/893/</url>
<url>http://www.opera.com/support/search/view/894/</url>
<url>http://www.opera.com/support/search/view/895/</url>
<url>http://www.opera.com/support/search/view/896/</url>
<url>http://www.opera.com/support/search/view/897/</url>
</references>
<dates>
<discovery>2008-08-20</discovery>
<entry>2008-08-25</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="d864a0a7-6f27-11dd-acfe-00104b9e1a4a">
<topic>gnutls -- "gnutls_handshake()" Denial of Service</topic>
<affects>
<package>
<name>gnutls</name>
<range><ge>2.3.5</ge><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/31505/">
<p>A vulnerability has been reported in GnuTLS, which can
potentially be exploited by malicious people to cause a DoS
(Denial of Service).</p>
<p>The vulnerability is caused due to a use-after-free error when an
application calls "gnutls_handshake()" for an already valid session
and can potentially be exploited, e.g. during re-handshakes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2377</cvename>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947</url>
<url>http://secunia.com/advisories/31505/</url>
</references>
<dates>
<discovery>2008-08-15</discovery>
<entry>2008-08-21</entry>
</dates>
</vuln>
<vuln vid="8514b6e7-6f0f-11dd-b3db-001c2514716c">
<topic>joomla -- flaw in the reset token validation</topic>
<affects>
<package>
<name>joomla15</name>
<range><lt>1.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla project reports:</p>
<blockquote cite="http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html">
<p>A flaw in the reset token validation mechanism allows
for non-validating tokens to be forged. This will allow
an unauthenticated, unauthorized user to reset the password
of the first enabled user (lowest id). Typically, this is
an administrator user. Note, that changing the first users
username may lessen the impact of this exploit (since the
person who changed the password does not know the login
associated with the new password). However, the only way
to completely rectify the issue is to upgrade to 1.5.6
(or patch the /components/com_user/models/reset.php file).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3681</cvename>
</references>
<dates>
<discovery>2008-08-14</discovery>
<entry>2008-08-20</entry>
<modified>2008-08-20</modified>
</dates>
</vuln>
<vuln vid="c4f31e16-6e33-11dd-8eb7-0011098ad87f">
<topic>cdf3 -- Buffer overflow vulnerability</topic>
<affects>
<package>
<name>cdf3</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NASA Goddard Space Flight Center reports:</p>
<blockquote cite="http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html">
<p>The libraries for the scientific data file format, Common Data
Format (CDF) version 3.2 and earlier, have the potential for a
buffer overflow vulnerability when reading specially-crafted
(invalid) CDF files. If successful, this could trigger execution
of arbitrary code within the context of the CDF-reading program
that could be exploited to compromise a system, or otherwise
crash the program. While it's unlikely that you would open CDFs
from untrusted sources, we recommend everyone upgrade to the
latest CDF libraries on their systems, including the IDL and
Matlab plugins. Most worrisome is any service that enables the
general public to submit CDF files for processing.</p>
<p>The vulnerability is in the CDF library routines not properly
checking the length tags on a CDF file before copying data to a
stack buffer. Exploitation requires the user to explicitly open
a specially-crafted file. CDF users should not open files from
untrusted third parties until the patch is applied (and continue
then to exercise normal caution for files from untrusted third
parties).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2080</cvename>
<url>http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html</url>
</references>
<dates>
<discovery>2008-05-15</discovery>
<entry>2008-08-19</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="070b5b22-6d74-11dd-aa18-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.10</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/295053">
<p>A bug in the output filter employed by Drupal makes it possible
for malicious users to insert script code into pages (cross site
scripting or XSS). A bug in the private filesystem trusts the MIME
type sent by the browser, enabling malicious users with the ability
to upload files to execute cross site scripting attacks.</p>
<p>The BlogAPI module does not validate the extension of uploaded
files, enabling users with the "administer content with blog api"
permission to upload harmful files. This bug affects both Drupal
5.x and 6.x.</p>
<p>Drupal forms contain a token to protect against cross site
request forgeries (CSRF). The token may not be validated properly
for cached forms and forms containing AHAH elements. This bug
affects Drupal 6.x.</p>
<p>User access rules can be added or deleted upon accessing a
properly formatted URL, making such modifications vulnerable to
cross site request forgeries (CSRF). This may lead to unintended
addition or deletion of an access rule when a sufficiently
privileged user visits a page or site created by a malicious
person. This bug affects both Drupal 5.x and 6.x.</p>
<p>The Upload module in Drupal 6 contains privilege escalation
vulnerabilities for users with the "upload files" permission. This
can lead to users being able to edit nodes which they are normally
not allowed to, delete any file to which the webserver has
sufficient rights, and download attachments of nodes to which they
have no access. Harmful files may also be uploaded via cross site
request forgeries (CSRF). These bugs affect Drupal 6.x.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3740</cvename>
<cvename>CVE-2008-3741</cvename>
<cvename>CVE-2008-3742</cvename>
<cvename>CVE-2008-3743</cvename>
<cvename>CVE-2008-3744</cvename>
<cvename>CVE-2008-3745</cvename>
<url>http://secunia.com/advisories/31462/</url>
</references>
<dates>
<discovery>2008-08-13</discovery>
<entry>2008-08-18</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55">
<topic>ruby -- multiple vulnerabilities in safe level</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range>
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
<p>Several vulnerabilities in safe level have been discovereds:.</p>
<ul>
<li>untrace_var is permitted at safe level 4;</li>
<li>$PROGRAM_NAME may be modified at safe level 4;</li>
<li>insecure methods may be called at safe level 1-3;</li>
<li>syslog operations are permitted at safe level 4;</li>
<li>dl doesn't check taintness, so it could allow attackers
to call dangerous functions.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3655</cvename>
<cvename>CVE-2008-3656</cvename>
<cvename>CVE-2008-3905</cvename>
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
</references>
<dates>
<discovery>2008-08-08</discovery>
<entry>2008-08-16</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55">
<topic>ruby -- DoS vulnerability in WEBrick</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
<p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time
taking requests due to a backtracking regular expression in
WEBrick::HTTPUtils.split_header_value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3655</cvename>
<cvename>CVE-2008-3656</cvename>
<cvename>CVE-2008-3905</cvename>
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
</references>
<dates>
<discovery>2008-08-08</discovery>
<entry>2008-08-16</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55">
<topic>ruby -- DNS spoofing vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
<p>resolv.rb allow remote attackers to spoof DNS answers. This risk
can be reduced by randomness of DNS transaction IDs and source
ports.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1447</cvename>
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
</references>
<dates>
<discovery>2008-08-08</discovery>
<entry>2008-08-16</entry>
<modified>2009-02-09</modified>
</dates>
</vuln>
<vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7">
<topic>Bugzilla -- Directory Traversal in importxml.pl</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.22.1</ge><lt>2.22.4</lt></range>
<range><ge>3.*</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.22.4/">
<p>When importing bugs using importxml.pl, the --attach_path
option can be specified, pointing to the directory where
attachments to import are stored. If the XML file being
read by importxml.pl contains a malicious</p>
<pre>../relative_path/to/local_file</pre>
<p>node, the script follows this relative path and attaches the
local file pointed by it to the bug, making the file public.
The security fix makes sure the relative path is always
ignored.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4437</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=437169</url>
</references>
<dates>
<discovery>2008-06-03</discovery>
<entry>2008-08-15</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="c61ca9cb-64c3-11dd-954d-006097bcc5f4">
<topic>openvpn-devel -- arbitrary code execution</topic>
<affects>
<package>
<name>openvpn-devel</name>
<range><ge>2.1.b14</ge><lt>2.1.r9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/index.php/documentation/change-log/changelog-21.html">
<p>Security Fix - affects non-Windows OpenVPN clients running
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
vulnerable nor are any versions of the OpenVPN server
vulnerable).</p>
<p>An OpenVPN client connecting to a malicious or compromised server
could potentially receive an "lladdr" or "iproute" configuration
directive from the server which could cause arbitrary code execution
on the client. A successful attack requires that (a) the client has
agreed to allow the server to push configuration directives to it by
including "pull" or the macro "client" in its configuration file,
(b) the client succesfully authenticates the server, (c) the server
is malicious or has been compromised and is under the control of the
attacker, and (d) the client is running a non-Windows OS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3459</cvename>
<url>http://openvpn.net/index.php/documentation/change-log/changelog-21.html</url>
</references>
<dates>
<discovery>2008-07-31</discovery>
<entry>2008-08-07</entry>
</dates>
</vuln>
<vuln vid="35e54755-54e4-11dd-ad8b-0030843d3802">
<topic>phpmyadmin -- cross site request forgery vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5">
<p>A logged-in user, if abused into clicking a crafted link or loading
an attack page, would create a database he did not intend to, or would
change his connection character set.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5</url>
<url>http://secunia.com/advisories/31115/</url>
</references>
<dates>
<discovery>2008-07-15</discovery>
<entry>2008-07-18</entry>
<modified>2008-09-17</modified>
</dates>
</vuln>
<vuln vid="ecedde1c-5128-11dd-a4e1-0030843d3802">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.8</lt></range>
</package>
<package>
<name>drupal6</name>
<range><lt>6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/280571">
<p>Free tagging taxonomy terms can be used to insert arbitrary script
and HTML code (cross site scripting or XSS) on node preview pages. A
successful exploit requires that the victim selects a term containing
script code and chooses to preview the node. This issue affects Drupal
6.x only. Some values from OpenID providers are output without being
properly escaped, allowing malicious providers to insert arbitrary script
and HTML code (XSS) into user pages. This issue affects Drupal 6.x only.
filter_xss_admin() has been hardened to prevent use of the object HTML
tag in administrator input.</p>
<p>Translated strings (5.x, 6.x) and OpenID identities (6.x) are
immediately deleted upon accessing a properly formatted URL, making
such deletion vulnerable to cross site request forgeries (CSRF). This
may lead to unintended deletion of translated strings or OpenID
identities when a sufficiently privileged user visits a page or site
created by a malicious person.</p>
<p>When contributed modules such as Workflow NG terminate the current
request during a login event, user module is not able to regenerate
the user's session. This may lead to a session fixation attack, when a
malicious user is able to control another users' initial session ID.
As the session is not regenerated, the malicious user may use the
'fixed' session ID after the victim authenticates and will have the
same access. This issue affects both Drupal 5 and Drupal 6.</p>
<p>Schema API uses an inappropriate placeholder for 'numeric' fields
enabling SQL injection when user-supplied data is used for such
fields.This issue affects Drupal 6 only.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3218</cvename>
<cvename>CVE-2008-3221</cvename>
<url>http://drupal.org/node/280571</url>
<url>http://secunia.com/advisories/31028/</url>
</references>
<dates>
<discovery>2008-07-09</discovery>
<entry>2008-07-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="655ee1ec-511b-11dd-80ba-000bcdf0a03b">
<topic>FreeBSD -- DNS cache poisoning</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.3</ge><lt>6.3_3</lt></range>
<range><ge>7.0</ge><lt>7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The BIND DNS implementation does not randomize the UDP source
port when doing remote queries, and the query id alone does
not provide adequate randomization.</p>
<h1>Impact:</h1>
<p>The lack of source port randomization reduces the amount of
data the attacker needs to guess in order to successfully
execute a DNS cache poisoning attack. This allows the
attacker to influence or control the results of DNS queries
being returned to users from target systems.</p>
<h1>Workaround:</h1>
<p>Limiting the group of machines that can do recursive queries
on the DNS server will make it more difficult, but not
impossible, for this vulnerability to be exploited.</p>
<p>To limit the machines able to perform recursive queries, add an ACL in
named.conf and limit recursion like the following:</p>
<pre>acl example-acl {</pre>
<pre> 192.0.2.0/24;</pre>
<pre>};</pre>
<pre>options {</pre>
<pre> recursion yes;</pre>
<pre> allow-recursion { example-acl; };</pre>
<pre>};</pre>
</body>
</description>
<references>
<certvu>800113</certvu>
<cvename>CVE-2008-1447</cvename>
<freebsdsa>SA-08:06.bind</freebsdsa>
</references>
<dates>
<discovery>2008-07-08</discovery>
<entry>2008-07-13</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="bc20510f-4dd4-11dd-93e7-0211d880e350">
<topic>poppler -- uninitialized pointer</topic>
<affects>
<package>
<name>poppler</name>
<range><lt>0.8.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felipe Andres Manzano reports:</p>
<blockquote cite="http://milw0rm.com/exploits/6032">
<p>The libpoppler pdf rendering library, can free
uninitialized pointers, leading to arbitrary code
execution. This vulnerability results from memory
management bugs in the Page class constructor/destructor.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2950</cvename>
<url>http://milw0rm.com/exploits/6032</url>
</references>
<dates>
<discovery>2008-07-07</discovery>
<entry>2008-07-09</entry>
</dates>
</vuln>
<vuln vid="f5c58fc1-49c0-11dd-b0ba-00163e000016">
<topic>py-pylons -- Path traversal bug</topic>
<affects>
<package>
<name>py24-pylons</name>
<range><lt>0.9.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pylons team reports:</p>
<blockquote cite="http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2">
<p>The error.py controller uses paste.fileapp to serve the static
resources to the browser. The default error.py controller uses
os.path.join to combine the id from Routes with the media path.
Routes prior to 1.8 double unquoted the PATH_INFO, resulting in
FileApp returning files from the filesystem that can be outside
of the intended media path directory.</p>
<p>An attacker can craft URL's which utilize the double escaping
to pass in a name to the error.py controller which contains a
leading slash thus escaping the intended media path and serving
files from any location on the filesystem that the Pylons
application has access to.</p>
</blockquote>
</body>
</description>
<references>
<url>http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2</url>
</references>
<dates>
<discovery>2008-05-28</discovery>
<entry>2008-07-04</entry>
</dates>
</vuln>
<vuln vid="4fb43b2f-46a9-11dd-9d38-00163e000016">
<topic>FreeType 2 -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30600">
<ul>
<li>An integer overflow error exists in the processing of PFB font
files. This can be exploited to cause a heap-based buffer overflow
via a PFB file containing a specially crafted "Private" dictionary
table.</li>
<li>An error in the processing of PFB font files can be exploited
to trigger the "free()" of memory areas that are not allocated on
the heap.</li>
<li>An off-by-one error exists in the processing of PFB font files.
This can be exploited to cause a one-byte heap-based buffer
overflow via a specially crafted PFB file.</li>
<li>An off-by-one error exists in the implementation of the "SHC"
instruction while processing TTF files. This can be exploited to
cause a one-byte heap-based buffer overflow via a specially crafted
TTF file.</li>
</ul>
<p>Successful exploitation of the vulnerabilities may allow execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>29637</bid>
<bid>29639</bid>
<bid>29640</bid>
<bid>29641</bid>
<cvename>CVE-2008-1806</cvename>
<cvename>CVE-2008-1807</cvename>
<cvename>CVE-2008-1808</cvename>
<url>http://secunia.com/advisories/30600</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=605780</url>
</references>
<dates>
<discovery>2008-06-10</discovery>
<entry>2008-07-03</entry>
</dates>
</vuln>
<vuln vid="1e8e63c0-478a-11dd-a88d-000ea69a5213">
<topic>fetchmail -- potential crash in -v -v verbose mode (revised patch)</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.8_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
<p>2008-06-24 1.2 also fixed issue in report_complete (reported by
Petr Uzel)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2711</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
</references>
<dates>
<discovery>2008-06-24</discovery>
<entry>2008-07-01</entry>
</dates>
</vuln>
<vuln vid="e285a1f4-4568-11dd-ae96-0030843d3802">
<topic>phpmyadmin -- Cross Site Scripting Vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia report:</p>
<blockquote cite="http://secunia.com/advisories/30813/">
<p>Some vulnerabilities have been reported in phpMyAdmin, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed via unspecified parameters to files in /libraries is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.</p>
<p>Successful exploitation requires that "register_globals" is enabled
and support for ".htaccess" files is disabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2960</cvename>
<url>http://secunia.com/advisories/30813/</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4</url>
</references>
<dates>
<discovery>2008-06-23</discovery>
<entry>2008-06-28</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="c84dc9ad-41f7-11dd-a4f9-00163e000016">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.2.0</gt><lt>2.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>The following potential security flaws are addressed:</p>
<ul>
<li>CVE-2008-2364: mod_proxy_http: Better handling of excessive
interim responses from origin server to prevent potential denial of
service and high memory usage. Reported by Ryujiro Shibuya.</li>
<li>CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against
the balancer-manager interface</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6420</cvename>
<cvename>CVE-2008-2364</cvename>
<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
</references>
<dates>
<discovery>2008-06-14</discovery>
<entry>2008-06-24</entry>
</dates>
</vuln>
<vuln vid="ee6fa2bd-406a-11dd-936a-0015af872849">
<topic>php -- input validation error in safe_mode</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.6_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to Maksymilian Arciemowicz research,
it is possible to bypass security restrictions
of <code>safe_mode</code> in various
functions via directory traversal vulnerability. The attacker
can use this attack to gain access to sensitive
information. Functions utilizing
<code>expand_filepath()</code> may be affected.</p>
<p>It should be noted that this vulnerability is not
considered to be serious by the FreeBSD Security Team,
since <code>safe_mode</code> and <code>open_basedir</code>
are insecure by design and should not be relied upon.</p>
</body>
</description>
<references>
<cvename>CVE-2008-2665</cvename>
<cvename>CVE-2008-2666</cvename>
<bid>29797</bid>
<url>http://securityreason.com/achievement_securityalert/54</url>
</references>
<dates>
<discovery>2008-06-17</discovery>
<entry>2008-06-22</entry>
<modified>2008-09-04</modified>
</dates>
</vuln>
<vuln vid="30866e6c-3c6d-11dd-98c9-00163e000016">
<topic>vim -- Vim Shell Command Injection Vulnerabilities</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim-ruby</name>
<name>vim6</name>
<name>vim6-ruby</name>
<range><gt>6</gt><le>6.4.10</le></range>
<range><gt>7</gt><lt>7.1.315</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rdancer.org reports:</p>
<blockquote cite="http://www.rdancer.org/vulnerablevim.html">
<p>Improper quoting in some parts of Vim written in the Vim Script
can lead to arbitrary code execution upon opening a crafted
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2712</cvename>
<url>http://www.rdancer.org/vulnerablevim.html</url>
</references>
<dates>
<discovery>2008-06-16</discovery>
<entry>2008-06-21</entry>
</dates>
</vuln>
<vuln vid="53802164-3f7e-11dd-90ea-0019666436c2">
<topic>ruby -- multiple integer and buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.6.111_3,1</lt></range>
</package>
<package>
<name>ruby_static</name>
<range><ge>1.8.*,1</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/">
<p>Multiple vulnerabilities in Ruby may lead to a denial of service
(DoS) condition or allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2726</cvename>
<url>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</url>
</references>
<dates>
<discovery>2008-06-19</discovery>
<entry>2008-06-21</entry>
</dates>
</vuln>
<vuln vid="168190df-3e9a-11dd-87bc-000ea69a5213">
<topic>fetchmail -- potential crash in -v -v verbose mode</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.8_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
<p>Gunter Nau reported fetchmail crashing on some messages; further
debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
dug up that this happened when fetchmail was trying to print, in
-v -v verbose level, headers exceeding 2048 bytes. In this
situation, fetchmail would resize the buffer and fill in further
parts of the message, but forget to reinitialize its va_list
typed source pointer, thus reading data from a garbage address found
on the stack at addresses above the function arguments the caller
passed in; usually that would be the caller's stack frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2711</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
</references>
<dates>
<discovery>2008-06-13</discovery>
<entry>2008-06-20</entry>
</dates>
</vuln>
<vuln vid="800e8bd5-3acb-11dd-8842-001302a18722">
<topic>xorg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.4.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb of X.Org reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-June/036026.html">
<p>Several vulnerabilities have been found in the server-side code
of some extensions in the X Window System. Improper validation of
client-provided data can cause data corruption.</p>
<p>Exploiting these overflows will crash the X server or,
under certain circumstances allow the execution of arbitray machine
code.</p>
<p>When the X server is running with root privileges (which is the case
for the Xorg server and for most kdrive based servers), these
vulnerabilities can thus also be used to raise privileges.</p>
<p>All these vulnerabilities, to be exploited successfully, require either
an already established connection to a running X server (and normally
running X servers are only accepting authenticated connections), or a
shell access with a valid user on the machine where the vulnerable
server is installed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1377</cvename>
<cvename>CVE-2008-1379</cvename>
<cvename>CVE-2008-2360</cvename>
<cvename>CVE-2008-2361</cvename>
<cvename>CVE-2008-2362</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2008-June/036026.html</url>
<url>http://secunia.com/advisories/30627/</url>
</references>
<dates>
<discovery>2008-06-11</discovery>
<entry>2008-06-15</entry>
</dates>
</vuln>
<vuln vid="c4ba95b2-39ce-11dd-98c9-00163e000016">
<topic>moinmoin -- superuser privilege escalation</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin team reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.6/rev/f405012e67af">
<p>A check in the userform processing was not working as expected and
could be abused for ACL and superuser privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1937</cvename>
<url>http://hg.moinmo.in/moin/1.6/rev/f405012e67af</url>
</references>
<dates>
<discovery>2008-04-20</discovery>
<entry>2008-06-14</entry>
<modified>2008-06-15</modified>
</dates>
</vuln>
<vuln vid="022baf71-38e6-11dd-8d34-00e0815b8da8">
<topic>Courier Authentication Library -- SQL Injection</topic>
<affects>
<package>
<name>courier-authlib</name>
<range><lt>0.60.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30591/">
<p>A vulnerability has been reported in the Courier Authentication
Library, which can be exploited by malicious people to conduct SQL
injection attacks.</p>
<p>Input passed via e.g. the username to the library is not properly
sanitised before being used in SQL queries. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code and e.g.
potentially bypass authentication.</p>
<p>Successful exploitation requires that a MySQL database is used for
authentication and that a Non-Latin character set is selected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/30591/</url>
</references>
<dates>
<discovery>2008-06-10</discovery>
<entry>2008-06-13</entry>
</dates>
</vuln>
<vuln vid="90db9983-2f53-11dd-a0d8-0016d325a0ed">
<topic>ikiwiki -- cleartext passwords</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>2.48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index32h2">
<p>Until version 2.48, ikiwiki stored passwords in cleartext in
the userdb. That risks exposing all users' passwords if the file
is somehow exposed. To pre-emtively guard against that, current
versions of ikiwiki store password hashes (using Eksblowfish).</p>
</blockquote>
</body>
</description>
<references>
<url>http://ikiwiki.info/security/#index32h2</url>
</references>
<dates>
<discovery>2008-05-30</discovery>
<entry>2008-06-01</entry>
</dates>
</vuln>
<vuln vid="09066828-2ef1-11dd-a0d8-0016d325a0ed">
<topic>ikiwiki -- empty password security hole</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><ge>1.34</ge><lt>2.47_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index33h2">
<p>This hole allowed ikiwiki to accept logins using empty
passwords to openid accounts that didn't use a password.</p>
<p>Upgrading to a non-vulnerable ikiwiki version immediatly is
recommended if your wiki allows both password and openid
logins.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0169</cvename>
<url>http://ikiwiki.info/security/#index33h2</url>
</references>
<dates>
<discovery>2008-05-30</discovery>
<entry>2008-05-31</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="04c6187d-2d8f-11dd-98c9-00163e000016">
<topic>linux-flashplugin -- unspecified remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://blogs.adobe.com/psirt/">
<p>An exploit appears to be taking advantage of a known
vulnerability, reported by Mark Dowd of the ISS X-Force and wushi
of team509, that was resolved in Flash Player 9.0.124.0
(CVE-2007-0071). This exploit does NOT appear to include a new,
unpatched vulnerability as has been reported elsewhere - customers
with Flash Player 9.0.124.0 should not be vulnerable to this
exploit.</p>
</blockquote>
</body>
</description>
<references>
<bid>29386</bid>
<cvename>CVE-2007-0071</cvename>
<url>http://blogs.adobe.com/psirt/</url>
</references>
<dates>
<discovery>2008-05-27</discovery>
<entry>2008-05-30</entry>
</dates>
</vuln>
<vuln vid="fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8">
<topic>Nagios -- Cross Site Scripting Vulnerability</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>2.12</lt></range>
<range><gt>3.*</gt><lt>3.0.2</lt></range>
</package>
<package>
<name>nagios-devel</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30283">
<p>A vulnerability has been reported in Nagios, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>29140</bid>
<cvename>CVE-2007-5803</cvename>
<url>http://secunia.com/advisories/30283</url>
</references>
<dates>
<discovery>2008-05-20</discovery>
<entry>2008-05-28</entry>
<modified>2008-09-08</modified>
</dates>
</vuln>
<vuln vid="555ac165-2bee-11dd-bbdc-00e0815b8da8">
<topic>spamdyke -- open relay</topic>
<affects>
<package>
<name>spamdyke</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Spamdyke Team reports:</p>
<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
<p>Fixed smtp_filter() to reject the DATA command if no valid
recipients have been specified. Otherwise, a specific scenario could
result in every spamdyke installation being used as an open relay.
If the remote server connects and gives one or more recipients that
are rejected (for relaying or blacklisting), then gives the DATA
command, spamdyke will ignore all other commands, assuming that
message data is being transmitted. However, because all of the
recipients were rejected, qmail will reject the DATA command. From
that point on, the remote server can give as many recipients as it
likes and spamdyke will ignore them all -- they will not be filtered
at all. After that, the remote server can give the DATA command and
send the actual message data. Because spamdyke is controlling
relaying, the RELAYCLIENT environment variable is set and qmail won't
check for relaying either. Thanks to Mirko Buffoni for reporting
this one.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2784</cvename>
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
</references>
<dates>
<discovery>2008-05-21</discovery>
<entry>2008-05-27</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="402ae710-26a2-11dd-ae05-825f4c35000a">
<topic>peercast -- arbitrary code execution</topic>
<affects>
<package>
<name>peercast</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde discovered that PeerCast, a P2P audio and
video streaming server, is vulnerable to a buffer overflow
in the HTTP Basic Authentication code, allowing a remote
attacker to crash PeerCast or execure arbitrary code.</p>
</body>
</description>
<references>
<bid>28986</bid>
<cvename>CVE-2008-2040</cvename>
<url>http://secunia.com/advisories/30020</url>
</references>
<dates>
<discovery>2008-05-20</discovery>
<entry>2008-05-21</entry>
</dates>
</vuln>
<vuln vid="f5a76faf-244c-11dd-b143-0211d880e350">
<topic>libvorbis -- various security issues</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.2.0_2,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2008-0270.html">
<p>Will Drewry of the Google Security Team reported several
flaws in the way libvorbis processed audio data. An
attacker could create a carefully crafted [Vorbis] audio file
in such a way that it could cause an application linked
with libvorbis to crash, or execute arbitrary code when
it was opened.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1419</cvename>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2008-1423</cvename>
<url>https://rhn.redhat.com/errata/RHSA-2008-0270.html</url>
</references>
<dates>
<discovery>2008-05-14</discovery>
<entry>2008-05-17</entry>
</dates>
</vuln>
<vuln vid="f49ba347-2190-11dd-907c-001c2514716c">
<topic>django -- XSS vulnerability</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<range><lt>0.96.2</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<range><lt>20080511</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2008/may/14/security/">
<p>The Django administration application will, when accessed by
a user who is not sufficiently authenticated, display a login
form and ask the user to provide the necessary credentials
before displaying the requested page. This form will be submitted
to the URL the user attempted to access, by supplying the current
request path as the value of the form's "action" attribute.</p>
<p>The value of the request path was not being escaped, creating an
opportunity for a cross-site scripting (XSS) attack by leading a
user to a URL which contained URL-encoded HTML and/or JavaScript
in the request path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2302</cvename>
<url>http://www.djangoproject.com/weblog/2008/may/14/security/</url>
</references>
<dates>
<discovery>2008-05-10</discovery>
<entry>2008-05-14</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="633716fa-1f8f-11dd-b143-0211d880e350">
<topic>vorbis-tools -- Speex header processing vulnerability</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.2.0_2,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29882/">
<p>A vulnerability has been reported in vorbis-tools,
which can potentially be exploited by malicious people
to compromise a user's system.</p>
<p>The vulnerability is caused due to an input validation
error when processing Speex headers, which can be
exploited via a specially crafted Speex stream containing
a negative "modeID" field in the header.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1686</cvename>
<url>http://secunia.com/advisories/29882/</url>
</references>
<dates>
<discovery>2008-04-18</discovery>
<entry>2008-05-11</entry>
</dates>
</vuln>
<vuln vid="8950ac62-1d30-11dd-9388-0211060005df">
<topic>qemu -- "drive_init()" Disk Format Security Bypass</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.1_6</lt></range>
<range><ge>0.9.1s.20070101*</ge><lt>0.9.1s.20080302_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/30111/">
<p>A vulnerability has been reported in QEMU, which can be exploited
by malicious, local users to bypass certain security
restrictions.</p>
<p>The vulnerability is caused due to the "drive_init()" function
in vl.c determining the format of a disk from data contained in
the disk's header. This can be exploited by a malicious user in
a guest system to e.g. read arbitrary files on the host by
writing a fake header to a raw formatted disk image.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-2004</cvename>
<url>http://secunia.com/advisories/30111/</url>
<mlist>http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html</mlist>
</references>
<dates>
<discovery>2008-04-28</discovery>
<entry>2008-05-08</entry>
</dates>
</vuln>
<vuln vid="5ef12755-1c6c-11dd-851d-0016d325a0ed">
<topic>swfdec -- exposure of sensitive information</topic>
<affects>
<package>
<name>swfdec</name>
<range><lt>0.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29915">
<p>A vulnerability has been reported in swfdec, which can be
exploited by malicious people to disclose sensitive
information.</p>
<p>The vulnerability is caused due to swfdec not properly
restricting untrusted sandboxes from reading local files,
which can be exploited to disclose the content of arbitrary
local files by e.g. tricking a user into visiting a malicious
website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1834</cvename>
<url>http://secunia.com/advisories/29915</url>
</references>
<dates>
<discovery>2008-04-09</discovery>
<entry>2008-05-07</entry>
</dates>
</vuln>
<vuln vid="86a4d810-1884-11dd-a914-0016179b2dd5">
<topic>mt-daapd -- integer overflow</topic>
<affects>
<package>
<name>mt-daapd</name>
<range><lt>0.2.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2008/1303">
<p>A vulnerability has been identified in mt-daapd which could be exploited
by remote attackers to cause a denial of service or compromise an
affected system. This issue is caused by a buffer overflow error in the
ws_getpostvars() function when processing a negative Content-Length:
header value, which could be exploited by remote unauthenticated
attackers to crash an affected application or execute arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1771</cvename>
<url>http://secunia.com/advisories/29917</url>
<url>http://www.frsirt.com/english/advisories/2008/1303</url>
</references>
<dates>
<discovery>2008-04-21</discovery>
<entry>2008-05-02</entry>
</dates>
</vuln>
<vuln vid="b1bcab7d-1880-11dd-a914-0016179b2dd5">
<topic>sdl_image -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>sdl_image</name>
<range><lt>1.2.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/28640">
<p>Two vulnerabilities have been reported in SDL_image, which can be
exploited by malicious people to cause a Denial of Service or potentially
compromise an application using the library.</p>
<p>A boundary error within the LWZReadByte() function in IMG_gif.c can
be exploited to trigger the overflow of a static buffer via a
specially crafted GIF file.</p>
<p>A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c
can be exploited to cause a heap-based buffer overflow via a specially
crafted IFF ILBM file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6697</cvename>
<cvename>CVE-2008-0544</cvename>
<url>http://secunia.com/advisories/28640</url>
</references>
<dates>
<discovery>2008-01-24</discovery>
<entry>2008-05-02</entry>
</dates>
</vuln>
<vuln vid="30394651-13e1-11dd-bab7-0016179b2dd5">
<topic>gnupg -- memory corruption vulnerability</topic>
<affects>
<package>
<name>gnupg</name>
<range><ge>1.0.0</ge><lt>1.4.9</lt></range>
<range><ge>2.0.0</ge><lt>2.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29568">
<p>A vulnerability has been reported in GnuPG, which can potentially
be exploited to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an error when importing keys
with duplicated IDs. This can be exploited to cause a memory
corruption when importing keys via --refresh-keys or --import.</p>
<p>Successful exploitation potentially allows execution of arbitrary
code, but has not been proven yet.</p>
</blockquote>
</body>
</description>
<references>
<bid>28487</bid>
<cvename>CVE-2008-1530</cvename>
<url>http://www.ocert.org/advisories/ocert-2008-1.html</url>
<url>http://secunia.com/advisories/29568</url>
<url>https://bugs.g10code.com/gnupg/issue894</url>
</references>
<dates>
<discovery>2008-03-19</discovery>
<entry>2008-04-26</entry>
<modified>2008-04-29</modified>
</dates>
</vuln>
<vuln vid="44c8694a-12f9-11dd-9b26-001c2514716c">
<topic>extman -- password bypass vulnerability</topic>
<affects>
<package>
<name>extman</name>
<range><ge>0.2.4</ge><lt>0.2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Extmail team reports:</p>
<blockquote cite="http://www.extmail.org/forum/thread-7260-1-1.html">
<p>Emergency update #4 fixes a serious security vulnerability.</p>
</blockquote>
<p>Successful exploit of this vulnerability would allow attacker to
change user's password without knowing it by using specifically
crafted HTTP request.</p>
</body>
</description>
<references>
<url>http://www.extmail.org/forum/thread-7260-1-1.html</url>
</references>
<dates>
<discovery>2008-04-01</discovery>
<entry>2008-04-25</entry>
</dates>
</vuln>
<vuln vid="f47f2746-12c5-11dd-bab7-0016179b2dd5">
<topic>mailman -- script insertion vulnerability</topic>
<affects>
<package>
<name>ja-mailman</name>
<name>mailman</name>
<name>mailman-with-htdig</name>
<range><lt>2.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/28794">
<p>A vulnerability has been reported in Mailman, which can be
exploited by malicious users to conduct script insertion
attacks.</p>
<p>Certain input when editing the list templates and the list info
attribute is not properly sanitised before being stored. This can be
exploited to insert arbitrary HTML and script code, which is
executed in a user's browser session in context of an affected site
when the malicious website is accessed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0564</cvename>
<bid>27630</bid>
<url>http://www.ubuntu.com/usn/usn-586-1</url>
<url>http://secunia.com/advisories/28794</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=593924</url>
</references>
<dates>
<discovery>2008-02-05</discovery>
<entry>2008-04-25</entry>
</dates>
</vuln>
<vuln vid="86c05550-12c1-11dd-bab7-0016179b2dd5">
<topic>mksh -- TTY attachment privilege escalation</topic>
<affects>
<package>
<name>mksh</name>
<range><lt>R33d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29803/">
<p>The vulnerability is caused due to an error when attaching to a TTY
via the -T command line switch. This can be exploited to execute
arbitrary commands with the privileges of the user running mksh via
characters previously written to the attached virtual console.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1845</cvename>
<url>http://secunia.com/advisories/29803/</url>
<url>http://www.mirbsd.org/mksh.htm#clog</url>
</references>
<dates>
<discovery>2008-04-14</discovery>
<entry>2008-04-25</entry>
</dates>
</vuln>
<vuln vid="9c133aa0-12bd-11dd-bab7-0016179b2dd5">
<topic>serendipity -- multiple cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>1.3.1</lt></range>
</package>
<package>
<name>serendipity-devel</name>
<range><lt>200804242342</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Boeck reports:</p>
<blockquote cite="http://int21.de/cve/CVE-2008-1386-s9y.html">
<p>The installer of serendipity 1.3 has various Cross Site Scripting
issues. This is considered low priority, as attack scenarios are
very unlikely.</p>
<p>Various path fields are not escaped properly, thus filling them
with javascript code will lead to XSS. MySQL error messages are not
escaped, thus the database host field can also be filled with
javascript.</p>
</blockquote>
<blockquote cite="http://int21.de/cve/CVE-2008-1385-s9y.html">
<p>In the referrer plugin of the blog application serendipity,
the referrer string is not escaped, thus leading to a permanent
XSS.</p>
</blockquote>
</body>
</description>
<references>
<bid>28885</bid>
<cvename>CVE-2008-1385</cvename>
<cvename>CVE-2008-1386</cvename>
<url>http://int21.de/cve/CVE-2008-1385-s9y.html</url>
<url>http://int21.de/cve/CVE-2008-1386-s9y.html</url>
<url>http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html</url>
</references>
<dates>
<discovery>2008-04-22</discovery>
<entry>2008-04-25</entry>
</dates>
</vuln>
<vuln vid="67bd39ba-12b5-11dd-bab7-0016179b2dd5">
<topic>firefox -- javascript garbage collector vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.14,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>2.0.0.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.10</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>1.1.2</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/2008/mfsa2008-20.html">
<p>Fixes for security problems in the JavaScript engine described in
MFSA 2008-15 introduced a stability problem, where some users
experienced crashes during JavaScript garbage collection. This is
being fixed primarily to address stability concerns. We have no
demonstration that this particular crash is exploitable but are
issuing this advisory because some crashes of this type have been
shown to be exploitable in the past.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1237</cvename>
<cvename>CVE-2008-1380</cvename>
<bid>28818</bid>
<url>http://secunia.com/advisories/29787</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-20.html</url>
</references>
<dates>
<discovery>2008-04-16</discovery>
<entry>2008-04-25</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="57c705d6-12ae-11dd-bab7-0016179b2dd5">
<topic>png -- unknown chunk processing uninitialized memory access</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.2.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://.com/advisories/29792">
<p>Tavis Ormandy has reported a vulnerability in libpng, which can be
exploited by malicious people to cause a Denial of Service, disclose
potentially sensitive information, or potentially compromise an
application using the library.</p>
<p>The vulnerability is caused due to the improper handling of PNG
chunks unknown to the library. This can be exploited to trigger the
use of uninitialized memory in e.g. a free() call via unknown PNG
chunks having a length of zero.</p>
<p>Successful exploitation may allow execution of arbitrary code, but
requires that the application calls the png_set_read_user_chunk_fn()
function or the png_set_keep_unknown_chunks() function under
specific conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1382</cvename>
<bid>28770</bid>
<url>http://secunia.com/advisories/29792</url>
<url>http://libpng.sourceforge.net/Advisory-1.2.26.txt</url>
</references>
<dates>
<discovery>2008-04-12</discovery>
<entry>2008-04-25</entry>
<modified>2008-04-29</modified>
</dates>
</vuln>
<vuln vid="b84a992a-12ab-11dd-bab7-0016179b2dd5">
<topic>openfire -- unspecified denial of service</topic>
<affects>
<package>
<name>openfire</name>
<range><lt>3.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29751">
<p>A vulnerability has been reported in Openfire, which can be
exploited by malicious people to cause a Denial of Service.</p>
<p>The vulnerability is caused due to an unspecified error and can be
exploited to cause a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1728</cvename>
<bid>28722</bid>
<url>http://secunia.com/advisories/29751</url>
<url>http://www.igniterealtime.org/issues/browse/JM-1289</url>
</references>
<dates>
<discovery>2008-04-10</discovery>
<entry>2008-04-25</entry>
</dates>
</vuln>
<vuln vid="f6377f08-12a7-11dd-bab7-0016179b2dd5">
<topic>php -- integer overflow vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/28392/discuss">
<p>Integer overflow in PHP 5.2.5 and earlier allows context-dependent
attackers to cause a denial of service and possibly have unspecified
other impact via a printf format parameter with a large width
specifier, related to the php_sprintf_appendstring function in
formatted_print.c and probably other functions for formatted strings
(aka *printf functions).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1384</cvename>
<bid>28392</bid>
<url>http://securityreason.com/achievement_securityalert/52</url>
</references>
<dates>
<discovery>2008-03-21</discovery>
<entry>2008-04-25</entry>
<modified>2008-05-02</modified>
</dates>
</vuln>
<vuln vid="ec41c3e2-129c-11dd-bab7-0016179b2dd5">
<topic>python -- Integer Signedness Error in zlib Module</topic>
<affects>
<package>
<name>python23</name>
<range><lt>2.3.6_1</lt></range>
</package>
<package>
<name>python24</name>
<range><lt>2.4.5_1</lt></range>
</package>
<package>
<name>python25</name>
<range><lt>2.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Justin Ferguson reports:</p>
<blockquote cite="http://bugs.python.org/issue2586">
<p>Integer signedness error in the zlib extension module in Python
2.5.2 and earlier allows remote attackers to execute arbitrary code
via a negative signed integer, which triggers insufficient memory
allocation and a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1721</cvename>
<bid>28715</bid>
<url>http://securityreason.com/securityalert/3802</url>
<url>http://bugs.python.org/issue2586</url>
</references>
<dates>
<discovery>2008-04-10</discovery>
<entry>2008-04-25</entry>
<modified>2008-04-28</modified>
</dates>
</vuln>
<vuln vid="51436b4c-1250-11dd-bab7-0016179b2dd5">
<topic>postgresql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<range><ge>7.3</ge><lt>7.3.21</lt></range>
<range><ge>7.4</ge><lt>7.4.19</lt></range>
<range><ge>8.0</ge><lt>8.0.15</lt></range>
<range><ge>8.1</ge><lt>8.1.11</lt></range>
<range><ge>8.2</ge><lt>8.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL developers report:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6600">
<p>PostgreSQL allows users to create indexes on the results of
user-defined functions, known as "expression indexes". This provided
two vulnerabilities to privilege escalation: (1) index functions
were executed as the superuser and not the table owner during VACUUM
and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION
were permitted within index functions. Both of these holes have now
been closed.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4772">
<p>PostgreSQL allowed malicious users to initiate a denial-of-service
by passing certain regular expressions in SQL queries. First, users
could create infinite loops using some specific regular expressions.
Second, certain complex regular expressions could consume excessive
amounts of memory. Third, out-of-range backref numbers could be used
to crash the backend.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=">
<p>DBLink functions combined with local trust or ident authentication
could be used by a malicious user to gain superuser privileges. This
issue has been fixed, and does not affect users who have not
installed DBLink (an optional module), or who are using password
authentication for local access. This same problem was addressed in
the previous release cycle, but that patch failed to close all forms
of the loophole.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6600</cvename>
<cvename>CVE-2007-4772</cvename>
<cvename>CVE-2007-6067</cvename>
<cvename>CVE-2007-4769</cvename>
<cvename>CVE-2007-6601</cvename>
<bid>27163</bid>
<url>http://www.postgresql.org/about/news.905</url>
</references>
<dates>
<discovery>2008-01-06</discovery>
<entry>2008-04-24</entry>
</dates>
</vuln>
<vuln vid="fe971a0f-1246-11dd-bab7-0016179b2dd5">
<topic>phpmyadmin -- Shared Host Information Disclosure</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement report:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3">
<p>It is possible to read the contents of any file that the web
server's user can access. The exact mechanism to achieve this won't
be disclosed. If a user can upload on the same host where
phpMyAdmin is running a PHP script that can read files with the
rights of the web server's user, the current advisory does not
describe an additional threat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1924</cvename>
<url>http://secunia.com/advisories/29944/</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
</references>
<dates>
<discovery>2008-04-23</discovery>
<entry>2008-04-24</entry>
<modified>2008-09-17</modified>
</dates>
</vuln>
<vuln vid="6eb1dc51-1244-11dd-bab7-0016179b2dd5">
<topic>phpmyadmin -- Username/Password Session File Information Disclosure</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement report:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2">
<p>phpMyAdmin saves sensitive information like the MySQL username and
password and the Blowfish secret key in session data, which might be
unprotected on a shared host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1567</cvename>
<url>http://secunia.com/advisories/29613/</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
</references>
<dates>
<discovery>2008-03-31</discovery>
<entry>2008-04-24</entry>
<modified>2008-09-17</modified>
</dates>
</vuln>
<vuln vid="7a7c5853-10a3-11dd-8eb8-00163e000016">
<topic>libxine -- array index vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine Team reports:</p>
<blockquote cite="http://www.xinehq.de/index.php/news">
<p>A new xine-lib version is now available. This release contains a
security fix (an unchecked array index that could allows remote
attackers to execute arbitrary code via a header structure
containing a negative offset, which is used to dereference a
function pointer.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1686</cvename>
<url>http://www.xinehq.de/index.php/news</url>
</references>
<dates>
<discovery>2008-04-06</discovery>
<entry>2008-04-24</entry>
</dates>
</vuln>
<vuln vid="589d8053-0b03-11dd-b4ef-00e07dc4ec84">
<topic>clamav -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.93</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20080415</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29000">
<p>Some vulnerabilities have been reported in ClamAV, which can be
exploited by malicious people to cause a DoS (Denial of Service)
or to compromise a vulnerable system.</p>
<p>1) A boundary error exists within the "cli_scanpe()" function in
libclamav/pe.c. This can be exploited to cause a heap-based buffer
overflow via a specially crafted "Upack" executable.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
<p>2) A boundary error within the processing of PeSpin packed
executables in libclamav/spin.c can be exploited to cause a
heap-based buffer overflow.</p>
<p>Successful exploitation may allow execution of arbitrary code.</p>
<p>3) An unspecified error in the processing of ARJ files can be
exploited to hang ClamAV.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1100</cvename>
<cvename>CVE-2008-1387</cvename>
<url>http://secunia.com/advisories/29000</url>
</references>
<dates>
<discovery>2008-04-15</discovery>
<entry>2008-04-15</entry>
</dates>
</vuln>
<vuln vid="1ac77649-0908-11dd-974d-000fea2763ce">
<topic>lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.19_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/29649">
<p>A vulnerability has been reported in lighttpd, which can be
exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to lighttpd not properly clearing
the OpenSSL error queue. This can be exploited to close concurrent
SSL connections of lighttpd by terminating one SSL connection.</p>
</blockquote>
</body>
</description>
<references>
<bid>28489</bid>
<cvename>CVE-2008-1531</cvename>
<url>http://secunia.com/advisories/29649</url>
<url>http://trac.lighttpd.net/trac/ticket/285</url>
</references>
<dates>
<discovery>2008-04-02</discovery>
<entry>2008-04-13</entry>
</dates>
</vuln>
<vuln vid="8d2c0ce1-08b6-11dd-94b4-0016d325a0ed">
<topic>ikiwiki -- cross site request forging</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index31h2">
<p>Cross Site Request Forging could be used to construct a link
that would change a logged-in user's password or other preferences
if they clicked on the link. It could also be used to construct a
link that would cause a wiki page to be modified by a logged-in
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0165</cvename>
<url>http://ikiwiki.info/security/#index31h2</url>
</references>
<dates>
<discovery>2008-04-10</discovery>
<entry>2008-04-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="072a53e0-0397-11dd-bd06-0017319806e7">
<topic>postfix-policyd-weight -- working directory symlink vulnerability</topic>
<affects>
<package>
<name>postfix-policyd-weight</name>
<range><lt>0.1.14.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>postfix-policyd-weight does not check for symlink for its working
directory. If the working directory is not already setup by the
super root, an unprivileged user can link it to another directories
in the system. This results in ownership/permission changes on the
target directory.</p>
</body>
</description>
<references>
<bid>28480</bid>
<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/815</mlist>
<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/823</mlist>
</references>
<dates>
<discovery>2008-03-24</discovery>
<entry>2008-04-06</entry>
</dates>
</vuln>
<vuln vid="b21790a5-02fb-11dd-bd06-0017319806e7">
<topic>powerdns-recursor -- DNS cache poisoning</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If the system random number generator can be predicted by its
past output, then an attacker may spoof Recursor to accept mallicious
data. This leads to DNS cache poisoning and client redirection.</p>
</body>
</description>
<references>
<url>http://doc.powerdns.com/security-policy.html</url>
</references>
<dates>
<discovery>2008-03-31</discovery>
<entry>2008-04-05</entry>
</dates>
</vuln>
<vuln vid="fb672330-02db-11dd-bd06-0017319806e7">
<topic>suphp -- multiple local privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>suphp</name>
<range><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple local privilege escalation are found in the symlink
verification code. An attacker may use it to run a PHP script with
the victim's privilege. This attack is a little harder when suphp
operates in paranoid mode. For suphp that runs in owner mode
which is the default in ports, immediate upgrade to latest
version is advised.</p>
</body>
</description>
<references>
<cvename>CVE-2008-1614</cvename>
<bid>28568</bid>
<url>http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html</url>
</references>
<dates>
<discovery>2008-03-30</discovery>
<entry>2008-04-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="ad4a00fa-0157-11dd-8bd3-001372ae3ab9">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>9.27.20080331</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>9.27.20080331</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software reports of multiple security issues in Opera.
All of them can lead to arbitrary code execution. Details are
as the following:</p>
<ul>
<li><a href="http://www.opera.com/support/search/view/881/">Newsfeed
prompt can cause Opera to execute arbitrary code</a></li>
<li><a href="http://www.opera.com/support/search/view/882/">Resized
canvas patterns can cause Opera to execute arbitrary code</a></li>
</ul>
</body>
</description>
<references>
<bid>28585</bid>
<cvename>CVE-2008-1761</cvename>
<cvename>CVE-2008-1762</cvename>
<url>http://www.opera.com/support/search/view/881/</url>
<url>http://www.opera.com/support/search/view/882/</url>
</references>
<dates>
<discovery>2008-04-03</discovery>
<entry>2008-04-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="12b336c6-fe36-11dc-b09c-001c2514716c">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.13,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>2.0.0.13</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.9</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>1.1.1</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>2.0.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<ul>
<li><a href="/security/announce/2008/mfsa2008-19.html">MFSA 2008-19</a>
XUL popup spoofing variant (cross-tab popups)</li>
<li><a href="/security/announce/2008/mfsa2008-18.html">MFSA 2008-18</a>
Java socket connection to any local port via LiveConnect</li>
<li><a href="/security/announce/2008/mfsa2008-17.html">MFSA 2008-17</a>
Privacy issue with SSL Client Authentication</li>
<li><a href="/security/announce/2008/mfsa2008-16.html">MFSA 2008-16</a>
HTTP Referrer spoofing with malformed URLs</li>
<li><a href="/security/announce/2008/mfsa2008-15.html">MFSA 2008-15</a>
Crashes with evidence of memory corruption (rv:1.8.1.13)</li>
<li><a href="/security/announce/2008/mfsa2008-14.html">MFSA 2008-14</a>
JavaScript privilege escalation and arbitrary code execution</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>28448</bid>
<cvename>CVE-2008-1241</cvename>
<cvename>CVE-2008-1240</cvename>
<cvename>CVE-2007-4879</cvename>
<cvename>CVE-2008-1238</cvename>
<cvename>CVE-2008-1236</cvename>
<cvename>CVE-2008-1237</cvename>
<cvename>CVE-2008-1233</cvename>
<cvename>CVE-2008-1234</cvename>
<cvename>CVE-2008-1235</cvename>
</references>
<dates>
<discovery>2008-03-26</discovery>
<entry>2008-03-30</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="ff304c35-fb5b-11dc-91c1-00e0815b8da8">
<topic>silc -- pkcs_decode buffer overflow</topic>
<affects>
<package>
<name>silc-irssi-client</name>
<name>silc-client</name>
<range><lt>1.1.4</lt></range>
</package>
<package>
<name>silc-server</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Core Security Technologies reports:</p>
<blockquote cite="http://www.coresecurity.com/?action=item&id=2206">
<p>A remote buffer overflow vulnerability found in a library
used by both the SILC server and client to process
packets containing cryptographic material may allow an
un-authenticated client to executearbitrary code on the
server with the privileges of the user account running the
server, or a malicious SILC server to compromise client
systems and execute arbitrary code with the privileges of
the user account running the SILC client program.</p>
</blockquote>
</body>
</description>
<references>
<bid>28373</bid>
<url>http://www.coresecurity.com/?action=item&id=2206</url>
</references>
<dates>
<discovery>2008-03-25</discovery>
<entry>2008-03-26</entry>
</dates>
</vuln>
<vuln vid="063399fc-f6d6-11dc-bcee-001c2514716c">
<topic>bzip2 -- crash with certain malformed archive files</topic>
<affects>
<package>
<name>bzip2</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/28286/">
<p>The 'bzip2' application is prone to a remote file-handling
vulnerability because the application fails to properly
handle malformed files.</p>
<p>Exploit attempts likely result in application crashes.</p>
</blockquote>
</body>
</description>
<references>
<bid>28286</bid>
<cvename>CVE-2008-1372</cvename>
<url>https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html</url>
<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/</url>
</references>
<dates>
<discovery>2008-03-18</discovery>
<entry>2008-03-20</entry>
</dates>
</vuln>
<vuln vid="9cfbca7f-efb7-11dc-be01-0211060005df">
<topic>qemu -- unchecked block read/write vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ian Jackson reports on the debian-security mailinglist:</p>
<blockquote cite="http://lists.debian.org/debian-security/2008/02/msg00064.html">
<p>When a block device read or write request is made by the guest,
nothing checks that the request is within the range supported by
the backend, but the code in the backend typically assumes that
the request is sensible.</p>
<p>Depending on the backend, this can allow the guest to read
and write arbitrary memory locations in qemu, and possibly gain
control over the qemu process, escaping from the
emulation/virtualisation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0928</cvename>
<url>http://secunia.com/advisories/29172</url>
<url>http://secunia.com/advisories/29081</url>
<mlist msgid="18362.62578.44273.779731@mariner.uk.xensource.com">http://lists.debian.org/debian-security/2008/02/msg00064.html</mlist>
</references>
<dates>
<discovery>2008-02-19</discovery>
<entry>2008-03-11</entry>
</dates>
</vuln>
<vuln vid="b39bdc06-ee42-11dc-8678-00a0cce0781e">
<topic>dovecot -- security hole in blocking passdbs</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot reports:</p>
<blockquote cite="http://dovecot.org/list/dovecot-news/2008-March/000065.html">
<p>Security hole in blocking passdbs (MySQL always. PAM, passwd
and shadow if blocking=yes) where user could specify extra
fields in the password. The main problem here is when specifying
"skip_password_check" introduced in v1.0.11 for fixing master user
logins, allowing the user to log in as anyone without a valid
password.</p>
</blockquote>
</body>
</description>
<references>
<url>http://dovecot.org/list/dovecot-news/2008-March/000065.html</url>
<url>http://secunia.com/advisories/29295/</url>
</references>
<dates>
<discovery>2008-03-09</discovery>
<entry>2008-03-10</entry>
</dates>
</vuln>
<vuln vid="de4d4110-ebce-11dc-ae14-0016179b2dd5">
<topic>mplayer -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.11_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mplayer team reports:</p>
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
<p>A buffer overflow was found in the code used to extract album
titles from CDDB server answers. When parsing answers from the
CDDB server, the album title is copied into a fixed-size buffer
with insufficient size checks, which may cause a buffer overflow.
A malicious database entry could trigger a buffer overflow in the
program. That can lead to arbitrary code execution with the UID of
the user running MPlayer.</p>
<p>A buffer overflow was found in the code used to escape URL
strings. The code used to skip over IPv6 addresses can be tricked
into leaving a pointer to a temporary buffer with a non-NULL value;
this causes the unescape code to reuse the buffer, and may lead to
a buffer overflow if the old buffer is smaller than required.
A malicious URL string may be used to trigger a buffer overflow in
the program, that can lead to arbitrary code execution with the UID
of the user running MPlayer.</p>
<p>A buffer overflow was found in the code used to parse MOV file
headers. The code read some values from the file and used them as
indexes into as array allocated on the heap without performing any
boundary check. A malicious file may be used to trigger a buffer
overflow in the program. That can lead to arbitrary code execution
with the UID of the user running MPlayer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0485</cvename>
<cvename>CVE-2008-0486</cvename>
<cvename>CVE-2008-0629</cvename>
<cvename>CVE-2008-0630</cvename>
<url>http://secunia.com/advisories/28779</url>
</references>
<dates>
<discovery>2008-02-05</discovery>
<entry>2008-03-06</entry>
</dates>
</vuln>
<vuln vid="ca8e56d5-e856-11dc-b5af-0017319806e7">
<topic>ghostscript -- zseticcspace() function buffer overflow vulnerability</topic>
<affects>
<package>
<name>ghostscript-gpl</name>
<name>ghostscript-gpl-nox11</name>
<range><lt>8.61_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans from the Google Security Team reports:</p>
<blockquote cite="http://scary.beasts.org/security/CESA-2008-001.html">
<p>Severity: parsing of evil PostScript file will result in
arbitrary code execution.</p>
<p>A stack-based buffer overflow in the zseticcspace() function
in zicc.c allows remote arbitrary code execution via a
malicious PostScript file (.ps) that contains a long Range
array.</p>
</blockquote>
</body>
</description>
<references>
<bid>28017</bid>
<cvename>CVE-2008-0411</cvename>
<url>http://scary.beasts.org/security/CESA-2008-001.html</url>
</references>
<dates>
<discovery>2008-02-28</discovery>
<entry>2008-03-05</entry>
</dates>
</vuln>
<vuln vid="ce2f2ade-e7df-11dc-a701-000bcdc1757a">
<topic>phpmyadmin -- SQL injection vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement report:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1">
<p>phpMyAdmin used the $_REQUEST superglobal as a source for
its parameters, instead of $_GET and $_POST. This means that
on most servers, a cookie with the same name as one of
phpMyAdmin's parameters can interfere.</p>
<p>Another application could set a cookie for the root path
"/" with a "sql_query" name, therefore overriding the
user-submitted sql_query because by default, the $_REQUEST
superglobal imports first GET, then POST then COOKIE data.</p>
<h3>Mitigation factor</h3>
<p>An attacker must trick the victim into visiting a page on
the same web server where he has placed code that creates
a malicious cookie.</p>
</blockquote>
</body>
</description>
<references>
<bid>28068</bid>
<cvename>CVE-2008-1149</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1</url>
</references>
<dates>
<discovery>2008-03-01</discovery>
<entry>2008-03-04</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f9e96930-e6df-11dc-8c6a-00304881ac9a">
<topic>pcre -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PCRE developers report:</p>
<blockquote cite="http://pcre.org/changelog.txt">
<p>A character class containing a very large number of characters with
codepoints greater than 255 (in UTF-8 mode, of course) caused a
buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<bid>27786</bid>
<cvename>CVE-2008-0674</cvename>
<url>http://pcre.org/changelog.txt</url>
</references>
<dates>
<discovery>2008-01-28</discovery>
<entry>2008-02-29</entry>
</dates>
</vuln>
<vuln vid="e8a6a16d-e498-11dc-bb89-000bcdc1757a">
<topic>libxine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine Team reports:</p>
<blockquote cite="http://www.xinehq.de/index.php/news">
<p>A new xine-lib version is now available. This release
contains a security fix (array index vulnerability which
may lead to a stack buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0486</cvename>
<url>http://www.xinehq.de/index.php/news</url>
</references>
<dates>
<discovery>2007-02-08</discovery>
<entry>2008-02-26</entry>
</dates>
</vuln>
<vuln vid="9f581778-e3d4-11dc-bb89-000bcdc1757a">
<topic>coppermine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Coppermine Security advisory</p>
<blockquote cite="http://coppermine-gallery.net/forum/index.php?topic=48106.0">
<p>The development team is releasing a security update for
Coppermine in order to counter a recently discovered
cross-site-scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0504</cvename>
<cvename>CVE-2008-0505</cvename>
<cvename>CVE-2008-0506</cvename>
<url>http://coppermine-gallery.net/forum/index.php?topic=48106.0</url>
<url>http://coppermine-gallery.net/forum/index.php?topic=50103.0</url>
<url>http://secunia.com/advisories/28682/</url>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2008-02-25</entry>
</dates>
</vuln>
<vuln vid="f113bbeb-e3ac-11dc-bb89-000bcdc1757a">
<topic>moinmoin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin Security advisory</p>
<blockquote cite="http://moinmo.in/SecurityFixes">
<p>XSS issue in login action</p>
<p>XSS issue in AttachFile action</p>
<p>XSS issue in RenamePage/DeletePage action</p>
<p>XSS issue in gui editor</p>
</blockquote>
</body>
</description>
<references>
<bid>27404</bid>
<cvename>CVE-2007-0857</cvename>
<cvename>CVE-2007-0901</cvename>
<cvename>CVE-2007-0902</cvename>
<cvename>CVE-2007-2423</cvename>
<cvename>CVE-2007-2673</cvename>
<cvename>CVE-2008-0780</cvename>
<cvename>CVE-2008-0781</cvename>
<cvename>CVE-2008-0782</cvename>
<url>http://moinmo.in/SecurityFixes</url>
<url>http://secunia.com/advisories/29010/</url>
</references>
<dates>
<discovery>2007-02-08</discovery>
<entry>2008-02-25</entry>
<modified>2008-02-26</modified>
</dates>
</vuln>
<vuln vid="30c560ff-e0df-11dc-891a-02061b08fc24">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports about multiple security
fixes:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
<ul>
<li>Fixed an issue where simulated text inputs could trick
users into uploading arbitrary files, as reported by
Mozilla.</li>
<li>Image properties can no longer be used to execute
scripts, as reported by Max Leonov.</li>
<li>Fixed an issue where the representation of DOM
attribute values could allow cross site scripting, as
reported by Arnaud.lb.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1080</cvename>
<cvename>CVE-2008-1081</cvename>
<url>http://www.opera.com/docs/changelogs/freebsd/926/</url>
<url>http://www.opera.com/support/search/view/877/</url>
<url>http://www.opera.com/support/search/view/879/</url>
<url>http://www.opera.com/support/search/view/880/</url>
</references>
<dates>
<discovery>2008-02-20</discovery>
<entry>2008-02-22</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="810a5197-e0d9-11dc-891a-02061b08fc24">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.12,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-firefox-devel</name>
<range><lt>2.0.0.12</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.8</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>1.0.9</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<ul>
<li>Web forgery overwrite with div overlay</li>
<li>URL token stealing via stylesheet redirect</li>
<li>Mishandling of locally-saved plain text files</li>
<li>File action dialog tampering</li>
<li>Possible information disclosure in BMP decoder</li>
<li>Web browsing history and forward navigation stealing</li>
<li>Directory traversal via chrome: URI</li>
<li>Stored password corruption</li>
<li>Privilege escalation, XSS, Remote Code Execution</li>
<li>Multiple file input focus stealing vulnerabilities</li>
<li>Crashes with evidence of memory corruption (rv:1.8.1.12)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0412</cvename>
<cvename>CVE-2008-0413</cvename>
<cvename>CVE-2008-0414</cvename>
<cvename>CVE-2008-0415</cvename>
<cvename>CVE-2008-0417</cvename>
<cvename>CVE-2008-0418</cvename>
<cvename>CVE-2008-0419</cvename>
<cvename>CVE-2008-0420</cvename>
<cvename>CVE-2008-0591</cvename>
<cvename>CVE-2008-0592</cvename>
<cvename>CVE-2008-0593</cvename>
<cvename>CVE-2008-0594</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-01.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-02.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-03.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-04.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-05.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-06.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-07.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-08.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-09.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-10.html</url>
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-11.html</url>
</references>
<dates>
<discovery>2008-02-07</discovery>
<entry>2008-02-22</entry>
<modified>2009-12-12</modified>
</dates>
</vuln>
<vuln vid="e5d29309-e0db-11dc-97b2-001c2514716c">
<topic>openldap -- modrdn Denial of Service vulnerability</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.3.41</lt></range>
<range><gt>2.4.0</gt><lt>2.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/28926/">
<p>A vulnerability has been reported in OpenLDAP, which can
be exploited by malicious users to cause a DoS (Denial of
Service).</p>
</blockquote>
</body>
</description>
<references>
<bid>27778</bid>
<cvename>CVE-2008-0658</cvename>
</references>
<dates>
<discovery>2008-02-13</discovery>
<entry>2008-02-22</entry>
</dates>
</vuln>
<vuln vid="be4b0529-dbaf-11dc-9791-000ea6702141">
<topic>clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>0.92</ge><lt>0.92.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Security Advisory 02.12.08:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658">
<p>Remote exploitation of an integer overflow vulnerability
in Clam AntiVirus' ClamAV, as included in various vendors'
operating system distributions, allows attackers to execute
arbitrary code with the privileges of the affected process.</p>
<p>The vulnerability exists within the code responsible
for parsing and scanning PE files. While iterating through
all sections contained in the PE file, several attacker
controlled values are extracted from the file. On each iteration,
arithmetic operations are performed without taking into
consideration 32-bit integer wrap.</p>
<p>Since insufficient integer overflow checks are present,
an attacker can cause a heap overflow by causing a specially
crafted Petite packed PE binary to be scanned. This results
in an exploitable memory corruption condition.</p>
<p>Exploitation of this vulnerability results in the
execution of arbitrary code with the privileges of the process
using libclamav. In the case of the clamd program, this will
result in code execution with the privileges of the clamav user.
Unsuccessful exploitation results in the clamd process crashing.</p>
</blockquote>
<h1>Workaround</h1>
<p>Disabling the scanning of PE files will prevent exploitation.</p>
<p>If using clamscan, this can be done by running clamscan with the
'--no-pe' option.</p>
<p>If using clamdscan, set the 'ScanPE' option in the clamd.conf
file to 'no'.</p>
</body>
</description>
<references>
<cvename>CVE-2008-0318</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658</url>
<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
</references>
<dates>
<discovery>2008-01-07</discovery>
<entry>2008-02-15</entry>
</dates>
</vuln>
<vuln vid="dea7df85-d96c-11dc-9bfc-000e0c092e7a">
<topic>cacti -- Multiple security vulnerabilities have been discovered</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti development team reports:</p>
<blockquote cite="http://forums.cacti.net/about25749.html">
<p>Multiple security vulnerabilities have been discovered in
Cacti's web interface:</p>
<ul>
<li>XSS vulnerabilities</li>
<li>Path disclosure vulnerabilities</li>
<li>SQL injection vulnerabilities</li>
<li>HTTP response splitting vulnerabilities</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://forums.cacti.net/about25749.html</url>
</references>
<dates>
<discovery>2008-02-12</discovery>
<entry>2008-02-12</entry>
</dates>
</vuln>
<vuln vid="739329c8-d8f0-11dc-ac2f-0016d325a0ed">
<topic>ikiwiki -- javascript insertion via uris</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>2.32.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index30h2">
<p>The htmlscrubber did not block javascript in uris. This was
fixed by adding a whitelist of valid uri types, which does not
include javascript. Some urls specifyable by the meta plugin
could also theoretically have been used to inject javascript; this
was also blocked.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0808</cvename>
<url>http://ikiwiki.info/security/#index30h2</url>
</references>
<dates>
<discovery>2008-02-10</discovery>
<entry>2008-02-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="1a818749-d646-11dc-8959-000bcdc1757a">
<topic>zenphoto -- XSS vulnerability</topic>
<affects>
<package>
<name>zenphoto</name>
<range><lt>1.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zenphoto project reports:</p>
<blockquote cite="http://www.zenphoto.org/2008/02/">
<p>A new zenphoto version is now available. This release contains
security fixes for HTML, XSS, and SQL injection vulnerabilities.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6666</cvename>
<url>http://www.securityfocus.com/bid/27084</url>
<url>http://secunia.com/advisories/28281</url>
</references>
<dates>
<discovery>2008-01-03</discovery>
<entry>2008-02-09</entry>
</dates>
</vuln>
<vuln vid="0832ee18-cf77-11dc-8c6a-00304881ac9a">
<topic>jetty -- multiple vulnerability</topic>
<affects>
<package>
<name>jetty</name>
<range><lt>6.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Greg Wilkins reports:</p>
<blockquote cite="http://jira.codehaus.org/browse/JETTY-386#action_117699">
<p>jetty allows remote attackers to bypass protection mechanisms and
read the source of files via multiple '/' characters in the URI.</p>
</blockquote>
</body>
</description>
<references>
<bid>27117</bid>
<cvename>CVE-2007-6672</cvename>
<url>http://jira.codehaus.org/browse/JETTY-386#action_117699</url>
</references>
<dates>
<discovery>2007-12-22</discovery>
<entry>2008-02-04</entry>
</dates>
</vuln>
<vuln vid="6ecd0b42-ce77-11dc-89b1-000e35248ad7">
<topic>libxine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine project reports:</p>
<blockquote cite="http://xinehq.de/index.php/news">
<p>A new xine-lib version is now available. This release contains
a security fix (remotely-expoitable buffer overflow, CVE-2006-1664).
(This is not the first time that that bug has been fixed...)
It also fixes a few more recent bugs, such as the audio output
problems in 1.1.9.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1664</cvename>
<url>http://secunia.com/advisories/19853/</url>
</references>
<dates>
<discovery>2008-01-23</discovery>
<entry>2008-01-29</entry>
</dates>
</vuln>
<vuln vid="fe2b6597-c9a4-11dc-8da8-0008a18a9961">
<topic>xorg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.4_4,1</lt></range>
</package>
<package>
<name>libXfont</name>
<range><lt>1.3.1_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb of X.Org reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-January/031918.html">
<p>Several vulnerabilities have been identified in server code
of the X window system caused by lack of proper input validation
on user controlled data in various parts of the software,
causing various kinds of overflows.</p>
<p>Exploiting these overflows will crash the X server or,
under certain circumstances allow the execution of arbitray
machine code.</p>
<p>When the X server is running with root privileges (which is the
case for the Xorg server and for most kdrive based servers),
these vulnerabilities can thus also be used to raise
privileges.</p>
<p>All these vulnerabilities, to be exploited succesfully, require
either an already established connection to a running X server
(and normally running X servers are only accepting authenticated
connections), or a shell access with a valid user on the machine
where the vulnerable server is installed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5760</cvename>
<cvename>CVE-2007-5958</cvename>
<cvename>CVE-2007-6427</cvename>
<cvename>CVE-2007-6428</cvename>
<cvename>CVE-2007-6429</cvename>
<cvename>CVE-2008-0006</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2008-January/031918.html</url>
<url>http://lists.freedesktop.org/archives/xorg/2008-January/032099.html</url>
<url>http://secunia.com/advisories/28532/</url>
</references>
<dates>
<discovery>2008-01-18</discovery>
<entry>2008-01-23</entry>
</dates>
</vuln>
<vuln vid="024edd06-c933-11dc-810c-0016179b2dd5">
<topic>xfce -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xfce4-panel</name>
<name>libxfce4gui</name>
<range><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml">
<p>A remote attacker could entice a user to install a specially
crafted "rc" file to execute arbitrary code via long strings
in the "Name" and "Comment" fields or via unspecified vectors
involving the second vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6531</cvename>
<cvename>CVE-2007-6532</cvename>
<url>http://www.xfce.org/documentation/changelogs/4.4.2</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml</url>
</references>
<dates>
<discovery>2008-01-09</discovery>
<entry>2008-01-22</entry>
<modified>2008-02-13</modified>
</dates>
</vuln>
<vuln vid="a59afa47-c930-11dc-810c-0016179b2dd5">
<topic>claws-mail -- insecure temporary file creation</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089">
<p>A local attacker could exploit this vulnerability to conduct
symlink attacks to overwrite files with the privileges of the user
running Claws Mail.</p>
</blockquote>
</body>
</description>
<references>
<bid>26676</bid>
<cvename>CVE-2007-6208</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml</url>
<url>http://security.gentoo.org/glsa/glsa-200801-03.xml</url>
<url>http://secunia.com/advisories/27897</url>
</references>
<dates>
<discovery>2007-12-03</discovery>
<entry>2008-01-22</entry>
<modified>2008-02-12</modified>
</dates>
</vuln>
<vuln vid="e5a9de5f-c6bc-11dc-b9f1-00a0cce0781e">
<topic>IRC Services-- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>ircservices</name>
<range><lt>5.0.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27761">
<p>A vulnerability has been reported in IRC Services,
which can be exploited by malicious people to cause
a Denial of Service. The vulnerability is caused due
to the improper handling of overly long passwords within
the "default_encrypt()" function in encrypt.c and can be
exploited to crash an affected server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6122</cvename>
<url>http://secunia.com/advisories/27761</url>
<url>http://ircservices.za.net/Changes.txt</url>
</references>
<dates>
<discovery>2007-11-21</discovery>
<entry>2008-01-19</entry>
</dates>
</vuln>
<vuln vid="02eedd3c-c6b5-11dc-93b6-000e35248ad7">
<topic>libxine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xine project reports:</p>
<blockquote cite="http://xinehq.de/index.php/news">
<p>A new xine-lib version is now available. This release contains
a security fix (remotely-expoitable buffer overflow, CVE-2008-0225).
It also contains a read-past-end fix for an internal library
function which is only used if the OS does not supply it and a
rendering fix for Darwin/PPC.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0225</cvename>
<url>http://aluigi.altervista.org/adv/xinermffhof-adv.txt</url>
<url>http://secunia.com/advisories/28384</url>
</references>
<dates>
<discovery>2008-01-08</discovery>
<entry>2008-01-19</entry>
</dates>
</vuln>
<vuln vid="60e1792b-c380-11dc-821a-000bcdc1757a">
<topic>geeklog xss vulnerability</topic>
<affects>
<package>
<name>geeklog</name>
<range><lt>1.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Geeklog reports:</p>
<blockquote cite="http://www.geeklog.net/article.php/geeklog-1.4.0sr6">
<p>MustLive pointed out a possible XSS in the form to email an
article to a friend that we're fixing with this release.</p>
<p>Please note that this problem only exists in Geeklog 1.4.0
- neither Geeklog 1.4.1 nor any older versions (1.3.x series)
have that problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3756</cvename>
<url>http://www.geeklog.net/article.php/geeklog-1.4.0sr6</url>
</references>
<dates>
<discovery>2008-01-08</discovery>
<entry>2008-01-15</entry>
</dates>
</vuln>
<vuln vid="4451a4c9-c05e-11dc-982e-001372fd0af2">
<topic>drupal -- cross site request forgery</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.6</lt></range>
</package>
<package>
<name>drupal4</name>
<range><lt>4.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/208562">
<p>The aggregator module fetches items from RSS feeds and makes
them available on the site. The module provides an option to
remove items from a particular feed. This has been implemented
as a simple GET request and is therefore vulnerable to cross
site request forgeries. For example: Should a privileged user
view a page containing an <img> tag with a specially
constructed src pointing to a remove items URL, the items would
be removed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0272</cvename>
<url>http://drupal.org/node/208562</url>
<url>http://secunia.com/advisories/28422/</url>
</references>
<dates>
<discovery>2008-01-10</discovery>
<entry>2008-01-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="6f736456-c060-11dc-982e-001372fd0af2">
<topic>drupal -- cross site scripting (utf8)</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.6</lt></range>
</package>
<package>
<name>drupal4</name>
<range><lt>4.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/208564">
<p>When outputting plaintext Drupal strips potentially dangerous
HTML tags and attributes from HTML, and escapes characters which
have a special meaning in HTML. This output filtering secures
the site against cross site scripting attacks via user input.</p>
<p>Certain byte sequences that are invalid in the UTF8
specification are not handled properly by Internet Explorer 6
and may lead it to see a multibyte start character where none is
present. Internet Explorer 6 then consumes a number of
subsequent UTF-8 characters. This may lead to unsafe attributes
that were outside a tag for the filter to appear inside a tag
for Internet Explorer 6. This behaviour can then be used to
insert and execute javascript in the context of the website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0273</cvename>
<url>http://drupal.org/node/208564</url>
<url>http://secunia.com/advisories/28422/</url>
</references>
<dates>
<discovery>2008-01-10</discovery>
<entry>2008-01-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f0fa19dd-c060-11dc-982e-001372fd0af2">
<topic>drupal -- cross site scripting (register_globals)</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.6</lt></range>
</package>
<package>
<name>drupal4</name>
<range><lt>4.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/208565">
<p>When theme .tpl.php files are accessible via the web and the PHP
setting register_globals is set to enabled, anonymous users are
able to execute cross site scripting attacks via specially
crafted links.</p>
<p>Drupal's .htaccess attempts to set register_globals to disabled
and also prevents access to .tpl.php files. Only when both these
measures are not effective and your PHP interpreter is
configured with register_globals set to enabled, will this issue
affect you.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0274</cvename>
<url>http://drupal.org/node/208565</url>
<url>http://secunia.com/advisories/28422/</url>
</references>
<dates>
<discovery>2008-01-10</discovery>
<entry>2008-01-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f358de71-bf64-11dc-928b-0016179b2dd5">
<topic>maradns -- CNAME record resource rotation denial of service</topic>
<affects>
<package>
<name>maradns</name>
<range><lt>1.2.12.08</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/28329">
<p>A vulnerability has been reported in MaraDNS, which can be
exploited by malicious people to cause a Denial of Service.</p>
<p>The vulnerability is caused due to an error within the handling of
certain DNS packets. This can be exploited to cause a resource
rotation by sending specially crafted DNS packets, which cause an
authoritative CNAME record to not resolve, resulting in a Denial of
Sevices.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-0061</cvename>
<url>http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html</url>
<url>http://secunia.com/advisories/28329</url>
</references>
<dates>
<discovery>2008-01-04</discovery>
<entry>2008-01-10</entry>
</dates>
</vuln>
<vuln vid="f762ccbb-baed-11dc-a302-000102cc8983">
<topic>linux-realplayer -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><ge>10.0.5</ge><lt>10.0.9.809.20070726</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27361">
<p>Multiple vulnerabilities have been reported in
RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious
people to compromise a user's system.</p>
<p>An input validation error when processing .RA/.RAM files can be
exploited to cause a heap corruption via a specially crafted
.RA/.RAM file with an overly large size field in the header.</p>
<p>An error in the processing of .PLS files can be exploited to cause
a memory corruption and execute arbitrary code via a specially
crafted .PLS file.</p>
<p>An input validation error when parsing .SWF files can be exploited
to cause a buffer overflow via a specially crafted .SWF file with
malformed record headers.</p>
<p>A boundary error when processing rm files can be exploited to
cause a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5081</cvename>
<cvename>CVE-2007-3410</cvename>
<cvename>CVE-2007-2263</cvename>
<cvename>CVE-2007-2264</cvename>
<url>http://secunia.com/advisories/27361</url>
<url>http://service.real.com/realplayer/security/10252007_player/en/</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-063.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-062.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-061.html</url>
<url>http://secunia.com/advisories/25819/</url>
<certvu>759385</certvu>
</references>
<dates>
<discovery>2007-10-25</discovery>
<entry>2008-01-04</entry>
</dates>
</vuln>
<vuln vid="562cf6c4-b9f1-11dc-a302-000102cc8983">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><ge>9.0</ge><lt>9.0r115</lt></range>
<range><ge>7.0</ge><lt>7.0r73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Security bulletin:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-20.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player that could allow an attacker who successfully exploits these
potential vulnerabilities to take control of the affected system. A
malicious SWF must be loaded in Flash Player by the user for an
attacker to exploit these potential vulnerabilities. Users are
recommended to update to the most current version of Flash Player
available for their platform.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6242</cvename>
<cvename>CVE-2007-4768</cvename>
<cvename>CVE-2007-5275</cvename>
<cvename>CVE-2007-6243</cvename>
<cvename>CVE-2007-6244</cvename>
<cvename>CVE-2007-6245</cvename>
<cvename>CVE-2007-4324</cvename>
<cvename>CVE-2007-6246</cvename>
<cvename>CVE-2007-5476</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb07-20.html</url>
<url>http://secunia.com/advisories/28161/</url>
</references>
<dates>
<discovery>2007-12-18</discovery>
<entry>2008-01-03</entry>
</dates>
</vuln>
<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
<topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot reports:</p>
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
<p>If two users with the same password and same pass_filter
variables log in within auth_cache_ttl seconds (1h by default),
the second user may get logged in with the first user's cached
pass_attrs. For example if pass_attrs contained the user's
home/mail directory, this would mean that the second user will
be accessing the first user's mails.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
</references>
<dates>
<discovery>2007-12-21</discovery>
<entry>2007-12-29</entry>
</dates>
</vuln>
<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
<topic>gallery2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery2</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gallery team reports:</p>
<blockquote cite="http://gallery.menalto.com/gallery_2.2.4_released">
<p>Gallery 2.2.4 addresses the following security
vulnerabilities:</p>
<ul>
<li>Publish XP module - Fixed unauthorized album creation
and file uploads.</li>
<li>URL rewrite module - Fixed local file inclusion
vulnerability in unsecured admin controller and
information disclosure in hotlink protection.</li>
<li>Core / add-item modules - Fixed Cross Site Scripting
(XSS) vulnerabilities through malicious file names.</li>
<li>Installation (Gallery application) - Update
web-accessibility protection of the storage folder for
Apache 2.2.</li>
<li>Core (Gallery application) / MIME module - Fixed
vulnerability in checks for disallowed file extensions
in file uploads.</li>
<li>Gallery Remote module - Added missing permissions
checks for some GR commands.</li>
<li>WebDAV module - Fixed Cross Site Scripting (XSS)
vulnerability through HTTP PROPPATCH.</li>
<li>WebDAV module - Fixed information (item data)
disclosure in a WebDAV view.</li>
<li>Comment module - Fixed information (item data)
disclosure in comment views.</li>
<li>Core module (Gallery application) - Improved
resilience against item information disclosure
attacks.</li>
<li>Slideshow module - Fixed information (item data)
disclosure in the slideshow.</li>
<li>Print modules - Fixed information (item data)
disclosure in several print modules.</li>
<li>Core / print modules - Fixed arbitrary URL redirection
(phishing attacks) in the core module and several print
modules.</li>
<li>WebCam module - Fixed proxied request weakness.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6685</cvename>
<cvename>CVE-2007-6686</cvename>
<cvename>CVE-2007-6687</cvename>
<cvename>CVE-2007-6689</cvename>
<cvename>CVE-2007-6690</cvename>
<cvename>CVE-2007-6692</cvename>
<url>http://gallery.menalto.com/gallery_2.2.4_released</url>
</references>
<dates>
<discovery>2007-12-24</discovery>
<entry>2007-12-25</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="299e3f81-aee7-11dc-b781-0016179b2dd5">
<topic>e2fsprogs -- heap buffer overflow</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.40.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230">
<p>Fix a potential security vulnerability where an untrusted
filesystem can be corrupted in such a way that a program using
libext2fs will allocate a buffer which is far too small. This
can lead to either a crash or potentially a heap-based buffer
overflow crash. No known exploits exist, but main concern is
where an untrusted user who possesses privileged access in a
guest Xen environment could corrupt a filesystem which is then
accessed by thus allowing the untrusted user to gain privileged
access in the host OS. Thanks to the McAfee AVERT Research group
for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<bid>26772</bid>
<cvename>CVE-2007-5497</cvename>
<url>http://secunia.com/advisories/27889/</url>
<url>http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230</url>
</references>
<dates>
<discovery>2007-12-07</discovery>
<entry>2007-12-20</entry>
</dates>
</vuln>
<vuln vid="8a835235-ae84-11dc-a5f9-001a4d49522b">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.16</ge><lt>0.99.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Wireshark team reports of multiple vulnerabilities:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-03.html">
<ul>
<li>Wireshark could crash when reading an MP3 file.</li>
<li>Beyond Security discovered that Wireshark could loop
excessively while reading a malformed DNP packet.</li>
<li>Stefan Esser discovered a buffer overflow in the SSL
dissector.</li>
<li>The ANSI MAP dissector could be susceptible to a
buffer overflow on some platforms.</li>
<li>The Firebird/Interbase dissector could go into an
infinite loop or crash.</li>
<li>The NCP dissector could cause a crash.</li>
<li>The HTTP dissector could crash on some systems while
decoding chunked messages.</li>
<li>The MEGACO dissector could enter a large loop and
consume system resources.</li>
<li>The DCP ETSI dissector could enter a large loop and
consume system resources.</li>
<li>Fabiodds discovered a buffer overflow in the iSeries
(OS/400) Communication trace file parser.</li>
<li>The PPP dissector could overflow a buffer.</li>
<li>The Bluetooth SDP dissector could go into an infinite
loop.</li>
<li>A malformed RPC Portmap packet could cause a
crash.</li>
<li>The IPv6 dissector could loop excessively.</li>
<li>The USB dissector could loop excessively or crash.</li>
<li>The SMB dissector could crash.</li>
<li>The RPL dissector could go into an infinite loop.</li>
<li>The WiMAX dissector could crash due to unaligned
access on some platforms.</li>
<li>The CIP dissector could attempt to allocate a huge
amount of memory and crash.</li>
</ul>
<h2>Impact</h2>
<p>It may be possible to make Wireshark or Ethereal crash or
use up available memory by injecting a purposefully
malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6112</cvename>
<cvename>CVE-2007-6113</cvename>
<cvename>CVE-2007-6114</cvename>
<cvename>CVE-2007-6115</cvename>
<cvename>CVE-2007-6117</cvename>
<cvename>CVE-2007-6118</cvename>
<cvename>CVE-2007-6120</cvename>
<cvename>CVE-2007-6121</cvename>
<cvename>CVE-2007-6438</cvename>
<cvename>CVE-2007-6439</cvename>
<cvename>CVE-2007-6441</cvename>
<cvename>CVE-2007-6450</cvename>
<cvename>CVE-2007-6451</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2007-03.html</url>
</references>
<dates>
<discovery>2007-12-19</discovery>
<entry>2007-12-19</entry>
<modified>2007-12-22</modified>
</dates>
</vuln>
<vuln vid="31b045e7-ae75-11dc-a5f9-001a4d49522b">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports about multiple security
fixes:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
<ul>
<li>Fixed an issue where plug-ins could be used to allow
cross domain scripting, as reported by David
Bloom. Details will be disclosed at a later date.</li>
<li>Fixed an issue with TLS certificates that could be
used to execute arbitrary code, as reported by Alexander
Klink (Cynops GmbH). Details will be disclosed at a
later date.</li>
<li>Rich text editing can no longer be used to allow cross
domain scripting, as reported by David Bloom. See our
advisory.</li>
<li>Prevented bitmaps from revealing random data from
memory, as reported by Gynvael Coldwind. Details will be
disclosed at a later date.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6520</cvename>
<cvename>CVE-2007-6521</cvename>
<cvename>CVE-2007-6522</cvename>
<cvename>CVE-2007-6524</cvename>
<url>http://www.opera.com/docs/changelogs/freebsd/925/</url>
<url>http://www.opera.com/support/search/view/875/</url>
</references>
<dates>
<discovery>2007-12-19</discovery>
<entry>2007-12-19</entry>
<modified>2007-12-29</modified>
</dates>
</vuln>
<vuln vid="31435fbc-ae73-11dc-a5f9-001a4d49522b">
<topic>peercast -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>peercast</name>
<range><lt>0.1218</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luigi Auriemma reports that peercast is vulnerable to a
buffer overflow which could lead to a DoS or potentially
remote code execution:</p>
<blockquote cite="http://aluigi.altervista.org/adv/peercasthof-adv.txt">
<p>The handshakeHTTP function which handles all the requests
received by the other clients is vulnerable to a heap
overflow which allows an attacker to fill the
loginPassword and loginMount buffers located in the
Servent class with how much data he wants.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6454</cvename>
<url>http://aluigi.altervista.org/adv/peercasthof-adv.txt</url>
<url>http://secunia.com/advisories/28120/</url>
</references>
<dates>
<discovery>2007-12-17</discovery>
<entry>2007-12-19</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="fee7e059-acec-11dc-807f-001b246e4fdf">
<topic>ganglia-webfrontend -- XSS vulnerabilities</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ganglia project reports:</p>
<blockquote cite="http://ganglia.info/?p=60">
<p>The Ganglia development team is pleased to release Ganglia
3.0.6 (Foss) which is available[...]. This release includes a
security fix for web frontend cross-scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers</url>
</references>
<dates>
<discovery>2007-12-10</discovery>
<entry>2007-12-17</entry>
<modified>2007-12-18</modified>
</dates>
</vuln>
<vuln vid="30f5ca1d-a90b-11dc-bf13-0211060005df">
<topic>qemu -- Translation Block Local Denial of Service Vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.0_4</lt></range>
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070802_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26666/discuss">
<p>QEMU is prone to a local denial-of-service vulnerability
because it fails to perform adequate boundary checks when
handling user-supplied input.</p>
<p>Attackers can exploit this issue to cause denial-of-service
conditions. Given the nature of the issue, attackers may also be
able to execute arbitrary code, but this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<bid>26666</bid>
<cvename>CVE-2007-6227</cvename>
<url>http://www.securityfocus.com/archive/1/484429</url>
</references>
<dates>
<discovery>2007-11-30</discovery>
<entry>2007-12-12</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="fa708908-a8c7-11dc-b41d-000fb5066b20">
<topic>drupal -- SQL injection vulnerability</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.4</lt></range>
</package>
<package>
<name>drupal4</name>
<range><lt>4.7.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/198162">
<p>The function taxonomy_select_nodes() directly injects variables
into SQL queries instead of using placeholders. While taxonomy
module itself validates the input passed to
taxonomy_select_nodes(), this is a weakness in Drupal core.
Several contributed modules, such as taxonomy_menu, ajaxLoader,
and ubrowser, directly pass user input to taxonomy_select_nodes(),
enabling SQL injection attacks by anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6299</cvename>
<url>http://drupal.org/node/198162</url>
<url>http://secunia.com/advisories/27932/</url>
</references>
<dates>
<discovery>2007-12-05</discovery>
<entry>2007-12-12</entry>
</dates>
</vuln>
<vuln vid="ffcbd42d-a8c5-11dc-bec2-02e0185f8d72">
<topic>samba -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>samba</name>
<name>samba3</name>
<name>ja-samba</name>
<range><lt>3.0.28</lt></range>
<range><gt>*,1</gt><lt>3.0.28,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secuna Research reports:</p>
<blockquote cite="http://secunia.com/advisories/27760/">
<p>Secunia Research has discovered a vulnerability in Samba, which
can be exploited by malicious people to compromise a vulnerable
system. The vulnerability is caused due to a boundary error within
the "send_mailslot()" function. This can be exploited to cause a
stack-based buffer overflow with zero bytes via a specially crafted
"SAMLOGON" domain logon packet containing a username string placed
at an odd offset followed by an overly long GETDC string.
Successful exploitation allows execution of arbitrary code, but
requires that the "domain logons" option is enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6015</cvename>
<url>http://secunia.com/advisories/27760/</url>
</references>
<dates>
<discovery>2007-12-10</discovery>
<entry>2007-12-12</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="b2571f88-a867-11dc-a6f0-00a0cce0781e">
<topic>smbftpd -- format string vulnerability</topic>
<affects>
<package>
<name>smbftpd</name>
<range><lt>0.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27014/">
<p>Format string vulnerability in the SMBDirList function in dirlist.c
in SmbFTPD 0.96 allows remote attackers to execute arbitrary code
via format string specifiers in a directory name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5184</cvename>
<url>http://secunia.com/advisories/27014/</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=543077</url>
</references>
<dates>
<discovery>2007-10-01</discovery>
<entry>2007-12-12</entry>
</dates>
</vuln>
<vuln vid="6ae7cef2-a6ae-11dc-95e6-000c29c5647f">
<topic>jetty -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jetty</name>
<range><lt>6.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5613">
<p>Cross-site scripting (XSS) vulnerability in Dump Servlet in
Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject
arbitrary web script or HTML via unspecified parameters and
cookies.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5614">
<p>Mortbay Jetty before 6.1.6rc1 does not properly handle "certain
quote sequences" in HTML cookie parameters, which allows remote
attackers to hijack browser sessions via unspecified vectors.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5615">
<p>CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0
allows remote attackers to inject arbitrary HTTP headers and
conduct HTTP response splitting attacks via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<certvu>237888</certvu>
<certvu>212984</certvu>
<certvu>438616</certvu>
<cvename>CVE-2007-5613</cvename>
<cvename>CVE-2007-5614</cvename>
<cvename>CVE-2007-5615</cvename>
<url>http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt</url>
</references>
<dates>
<discovery>2007-12-05</discovery>
<entry>2007-12-10</entry>
</dates>
</vuln>
<vuln vid="821afaa2-9e9a-11dc-a7e3-0016360406fa">
<topic>liveMedia -- DoS vulnerability</topic>
<affects>
<package>
<name>liveMedia</name>
<range><lt>2007.11.18,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The live555 development team reports:</p>
<blockquote cite="http://www.live555.com/liveMedia/public/changelog.txt">
<p>Fixed a bounds-checking error in "parseRTSPRequestString()"
caused by an int vs. unsigned problem.</p>
</blockquote>
<blockquote cite="http://aluigi.altervista.org/adv/live555x-adv.txt">
<p>The function which handles the incoming queries from the
clients is affected by a vulnerability which allows an attacker
to crash the server remotely using the smallest RTSP query
possible to use.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6036</cvename>
<url>http://aluigi.altervista.org/adv/live555x-adv.txt</url>
<url>http://www.live555.com/liveMedia/public/changelog.txt</url>
</references>
<dates>
<discovery>2007-11-20</discovery>
<entry>2007-12-08</entry>
<modified>2007-12-09</modified>
</dates>
</vuln>
<vuln vid="610bc692-a2ad-11dc-900c-000bcdc1757a">
<topic>GNU finger vulnerability</topic>
<affects>
<package>
<name>gnu-finger</name>
<range><le>1.37_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU security announcement:</p>
<blockquote cite="http://www.gnu.org/software/finger/">
<p>GNU Finger unfortunately has not been updated in
many years, and has known security vulnerabilities.
Please do not use it in production environments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-1999-1165</cvename>
<url>http://www.gnu.org/software/finger/</url>
</references>
<dates>
<discovery>1999-07-21</discovery>
<entry>2007-12-05</entry>
</dates>
</vuln>
<vuln vid="6eb580d7-a29c-11dc-8919-001c2514716c">
<topic>Squid -- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.0</ge><lt>2.6.16_1</lt></range>
<range><ge>3.*</ge><lt>3.0.r1.20071001_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid secuirty advisory reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable
to a denial of service check during some cache update
reply processing.</p>
<p>This problem allows any client trusted to use the
service to perform a denial of service attack on the
Squid service.</p>
</blockquote>
</body>
</description>
<references>
<bid>26687</bid>
<cvename>CVE-2007-6239</cvename>
</references>
<dates>
<discovery>2007-11-28</discovery>
<entry>2007-12-04</entry>
<modified>2007-12-07</modified>
</dates>
</vuln>
<vuln vid="30acb8ae-9d46-11dc-9114-001c2514716c">
<topic>rubygem-rails -- session-fixation vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.com/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release">
<p>The rails core team has released ruby on rails 1.2.6 to
address a bug in the fix for session fixation attacks
(CVE-2007-5380). The CVE Identifier for this new issue
is CVE-2007-6077.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6077</cvename>
</references>
<dates>
<discovery>2007-11-24</discovery>
<entry>2007-11-27</entry>
</dates>
</vuln>
<vuln vid="44fb0302-9d38-11dc-9114-001c2514716c">
<topic>rubygem-rails -- JSON XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>1.2.5</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release">
<p>All users of Rails 1.2.4 or earlier are advised to upgrade
to 1.2.5, though it isn't strictly necessary if you
aren't working with JSON. For more information the JSON
vulnerability, see CVE-2007-3227.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3227</cvename>
</references>
<dates>
<discovery>2007-10-12</discovery>
<entry>2007-11-28</entry>
<modified>2007-12-01</modified>
</dates>
</vuln>
<vuln vid="31d9fbb4-9d09-11dc-a29d-0016d325a0ed">
<topic>ikiwiki -- improper symlink verification vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index29h2">
<p>Ikiwiki did not check if path to the srcdir to contained a
symlink. If an attacker had commit access to the directories in
the path, they could change it to a symlink, causing ikiwiki to
read and publish files that were not intended to be
published. (But not write to them due to other checks.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://ikiwiki.info/security/#index29h2</url>
</references>
<dates>
<discovery>2007-11-26</discovery>
<entry>2007-11-27</entry>
</dates>
</vuln>
<vuln vid="f1f6f6da-9d2f-11dc-9114-001c2514716c">
<topic>firefox -- multiple remote unspecified memory corruption vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.10,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.7</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/2007/mfsa2007-38.html">
<p>The Firefox 2.0.0.10 update contains fixes for three bugs that
improve the stability of the product. These crashes showed some
evidence of memory corruption under certain circumstances and we
presume that with enough effort at least some of these could be
exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>26593</bid>
<cvename>CVE-2007-5959</cvename>
</references>
<dates>
<discovery>2007-11-26</discovery>
<entry>2007-11-27</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="15485ae8-9848-11dc-9e48-0016179b2dd5">
<topic>phpmyadmin -- Cross Site Scripting</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>2.11.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8">
<p>The login page auth_type cookie was vulnerable to XSS via
the convcharset parameter. An attacker could use this to
execute malicious code on the visitors computer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6100</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8</url>
<url>http://www.nth-dimension.org.uk/downloads.php?id=38</url>
</references>
<dates>
<discovery>2007-11-20</discovery>
<entry>2007-11-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="a63b15f9-97ff-11dc-9e48-0016179b2dd5">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba</name>
<name>samba3</name>
<name>ja-samba</name>
<range><lt>3.0.26a</lt></range>
<range><gt>*,1</gt><lt>3.0.26a_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-5398.html">
<p>Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd. This defect may
only be exploited when the "wins support" parameter has
been enabled in smb.conf.</p>
</blockquote>
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-4572.html">
<p>Samba developers have discovered what is believed to be
a non-exploitable buffer over in nmbd during the processing
of GETDC logon server requests. This code is only used
when the Samba server is configured as a Primary or Backup
Domain Controller.</p>
</blockquote>
</body>
</description>
<references>
<bid>26454</bid>
<cvename>CVE-2007-4572</cvename>
<cvename>CVE-2007-5398</cvename>
<url>http://secunia.com/advisories/27450/</url>
<url>http://us1.samba.org/samba/security/CVE-2007-4572.html</url>
<url>http://us1.samba.org/samba/security/CVE-2007-5398.html</url>
</references>
<dates>
<discovery>2007-11-15</discovery>
<entry>2007-11-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="392b5b1d-9471-11dc-9db7-001c2514716c">
<topic>php -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP project reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_5.php">
<p>Security Enhancements and Fixes in PHP 5.2.5:</p>
<ul>
<li>Fixed dl() to only accept filenames. Reported by Laurent
Gaffie.</li>
<li>Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
Reported by Laurent Gaffie.</li>
<li>Fixed htmlentities/htmlspecialchars not to accept partial
multibyte sequences. Reported by Rasmus Lerdorf</li>
<li>Fixed possible triggering of buffer overflows inside glibc
implementations of the fnmatch(), setlocale() and glob()
functions. Reported by Laurent Gaffie.</li>
<li>Fixed "mail.force_extra_parameters" php.ini directive not to be
modifiable in .htaccess due to the security implications. Reported
by SecurityReason.</li>
<li>Fixed bug #42869 (automatic session id insertion adds sessions
id to non-local forms).</li>
<li>Fixed bug #41561 (Values set with php_admin_* in httpd.conf can
be overwritten with ini_set()).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>26403</bid>
<cvename>CVE-2007-4887</cvename>
</references>
<dates>
<discovery>2007-11-08</discovery>
<entry>2007-11-16</entry>
</dates>
</vuln>
<vuln vid="a7080c30-91a2-11dc-b2eb-00b0d07e6c7e">
<topic>mt-daapd -- denial of service vulnerability</topic>
<affects>
<package>
<name>mt-daapd</name>
<range><lt>0.2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.us-cert.gov/cas/bulletins/SB07-316.html">
<p>webserver.c in mt-dappd in Firefly Media Server 0.2.4 and
earlier allows remote attackers to cause a denial of service
(NULL dereference and daemon crash) via a stats method action
to /xml-rpc with (1) an empty Authorization header line, which
triggers a crash in the ws_decodepassword function; or (2) a
header line without a ':' character, which triggers a crash
in the ws_getheaders function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5824</cvename>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-12</entry>
</dates>
</vuln>
<vuln vid="92f86b93-923f-11dc-a2bf-02e081235dab">
<topic>net-snmp -- denial of service via GETBULK request</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.3.1_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">
<p>The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1
allows remote attackers to cause a denial of service (CPU
and memory consumption) via a GETBULK request with a large
max-repeaters value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5846</cvename>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-13</entry>
<modified>2007-11-14</modified>
</dates>
</vuln>
<vuln vid="ff65eecb-91e4-11dc-bd6c-0016179b2dd5">
<topic>flac -- media file processing integer overflow vulnerabilities</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.1.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Laps reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608">
<p>Remote exploitation of multiple integer overflow vulnerabilities
in libFLAC, as included with various vendor's software
distributions, allows attackers to execute arbitrary code
in the context of the currently logged in user.</p>
<p>These vulnerabilities specifically exist in the handling of
malformed FLAC media files. In each case, an integer overflow can
occur while calculating the amount of memory to allocate. As such,
insufficient memory is allocated for the data that is subsequently
read in from the file, and a heap based buffer overflow occurs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4619</cvename>
<url>http://secunia.com/advisories/27210/</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608</url>
</references>
<dates>
<discovery>2007-10-11</discovery>
<entry>2007-11-13</entry>
</dates>
</vuln>
<vuln vid="2747fc39-915b-11dc-9239-001c2514716c">
<topic>xpdf -- multiple remote Stream.CC vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.3_2</lt></range>
</package>
<package>
<name>gpdf</name>
<range><gt>0</gt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.5.8_1</lt></range>
</package>
<package>
<name>koffice</name>
<range><lt>1.6.3_3,2</lt></range>
</package>
<package>
<name>poppler</name>
<range><lt>0.6</lt></range>
</package>
<package>
<name>xpdf</name>
<range><lt>3.02_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/483372">
<p>Secunia Research has discovered some vulnerabilities in Xpdf,
which can be exploited by malicious people to compromise a user's
system.</p>
<ul>
<li>An array indexing error within the
"DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc
can be exploited to corrupt memory via a specially crafted PDF
file.</li>
<li>An integer overflow error within the "DCTStream::reset()"
method in xpdf/Stream.cc can be exploited to cause a heap-based
buffer overflow via a specially crafted PDF file.</li>
<li>A boundary error within the "CCITTFaxStream::lookChar()" method
in xpdf/Stream.cc can be exploited to cause a heap-based buffer
overflow by tricking a user into opening a PDF file containing a
specially crafted "CCITTFaxDecode" filter.</li>
</ul>
<p>Successful exploitation may allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>26367</bid>
<cvename>CVE-2007-4352</cvename>
<cvename>CVE-2007-5392</cvename>
<cvename>CVE-2007-5393</cvename>
</references>
<dates>
<discovery>2007-11-07</discovery>
<entry>2007-11-12</entry>
<modified>2007-11-14</modified>
</dates>
</vuln>
<vuln vid="ffba6ab0-90b5-11dc-9835-003048705d5a">
<topic>plone -- unsafe data interpreted as pickles</topic>
<affects>
<package>
<name>plone</name>
<range><ge>2.5</ge><lt>2.5.5</lt></range>
<range><ge>3.0</ge><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone projectreports:</p>
<blockquote cite="http://plone.org/about/security/advisories/cve-2007-5741">
<p>This hotfix corrects a vulnerability in the statusmessages
and linkintegrity modules, where unsafe network data was
interpreted as python pickles. This allows an attacker to
run arbitrary python code within the Zope/Plone process.</p>
</blockquote>
</body>
</description>
<references>
<bid>26354</bid>
<cvename>CVE-2007-5741</cvename>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-12</entry>
</dates>
</vuln>
<vuln vid="2d2dcbb4-906c-11dc-a951-0016179b2dd5">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The DigiTrust Group reports:</p>
<blockquote cite="http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html">
<p>When creating a new database, a malicious user can use a
client-side Web proxy to place malicious code in the db parameter of
the POST request. Since db_create.php does not properly sanitize
user-supplied input, an administrator could face a persistent XSS
attack when the database names are displayed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5976</cvename>
<cvename>CVE-2007-5977</cvename>
<url>http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7</url>
</references>
<dates>
<discovery>2007-11-11</discovery>
<entry>2007-11-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9b718b82-8ef5-11dc-8e42-001c2514716c">
<topic>gallery2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery2</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gallery project reports:</p>
<blockquote cite="http://gallery.menalto.com/gallery_2.2.3_released">
<p>Gallery 2.2.3 addresses the following security vulnerabilities:</p>
<ul>
<li>Unauthorized renaming of items possible with WebDAV (reported
by Merrick Manalastas)</li>
<li>Unauthorized modification and retrieval of item properties
possible with WebDAV</li>
<li>Unauthorized locking and replacing of items possible with
WebDAV</li>
<li>Unauthorized editing of data file possible via linked items with
Reupload and WebDAV (reported by Nicklous Roberts)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4650</cvename>
<bid>25580</bid>
</references>
<dates>
<discovery>2007-08-29</discovery>
<entry>2007-11-09</entry>
</dates>
</vuln>
<vuln vid="20a4eb11-8ea3-11dc-a396-0016179b2dd5">
<topic>tikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tikiwik</name>
<range><lt>1.9.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/26618/">
<p>Some vulnerabilities have been reported in TikiWiki, which
can be exploited by malicious people to conduct cross-site
scripting and script insertion attacks and disclose potentially
sensitive information.</p>
<p>Input passed to the username parameter in tiki-remind_password.php
(when remind is set to send me my password) is not properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code (for example with meta
refreshes to a javascript: URL) in a user's browser session in
context of an affected site.</p>
<p>Input passed to the local_php and error_handler parameters in
tiki-index.php is not properly verified before being used to include
files. This can be exploited to include arbitrary files from local
resources.</p>
<p>Input passed to the imp_language parameter in
tiki-imexport_languages.php is not properly verified before being
used to include files. This can be exploited to include arbitrary
files from local resources.</p>
<p>Certain img src elements are not properly santised before being
used. This can be exploited to insert arbitrary HTML and script
code, which is executed in a user's browser session in context of an
affected site when the malicious data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4554</cvename>
<cvename>CVE-2007-5683</cvename>
<cvename>CVE-2007-5684</cvename>
<url>http://secunia.com/advisories/26618/</url>
<url>http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2</url>
</references>
<dates>
<discovery>2007-08-27</discovery>
<entry>2007-11-09</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="8dd9722c-8e97-11dc-b8f6-001c2514716c">
<topic>cups -- off-by-one buffer overflow</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27233">
<p>Secunia Research has discovered a vulnerability in CUPS, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to a boundary error within the
"ippReadIO()" function in cups/ipp.c when processing IPP (Internet
Printing Protocol) tags. This can be exploited to overwrite one
byte on the stack with a zero by sending an IPP request containing
specially crafted "textWithLanguage" or "nameWithLanguage" tags.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4351</cvename>
<url>http://secunia.com/secunia_research/2007-76/</url>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-09</entry>
<modified>2007-11-12</modified>
</dates>
</vuln>
<vuln vid="5b47c279-8cb5-11dc-8878-0016179b2dd5">
<topic>perl -- regular expressions unicode data buffer overflow</topic>
<affects>
<package>
<name>perl</name>
<name>perl-threaded</name>
<range><gt>5.8.*</gt><lt>5.8.8_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0966.html">
<p>A flaw was found in Perl's regular expression engine. Specially
crafted input to a regular expression can cause Perl to improperly
allocate memory, possibly resulting in arbitrary code running with
the permissions of the user running Perl.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5116</cvename>
<url>http://secunia.com/advisories/27546/</url>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-06</entry>
<modified>2007-11-07</modified>
</dates>
</vuln>
<vuln vid="bfd6eef4-8c94-11dc-8c55-001c2514716c">
<topic>pcre -- arbitrary code execution</topic>
<affects>
<package>
<name>pcre</name>
<name>pcre-utf8</name>
<range><lt>7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian project reports:</p>
<blockquote cite="http://www.debian.org/security/2007/dsa-1399">
<p>Tavis Ormandy of the Google Security Team has discovered
several security issues in PCRE, the Perl-Compatible Regular
Expression library, which potentially allow attackers to
execute arbitrary code by compiling specially crafted regular
expressions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1659</cvename>
<cvename>CVE-2007-1660</cvename>
<cvename>CVE-2007-1661</cvename>
<cvename>CVE-2007-1662</cvename>
<cvename>CVE-2007-4766</cvename>
<cvename>CVE-2007-4767</cvename>
<cvename>CVE-2007-4768</cvename>
<url>http://www.pcre.org/changelog.txt</url>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-06</entry>
</dates>
</vuln>
<vuln vid="617a4021-8bf0-11dc-bffa-0016179b2dd5">
<topic>perdition -- str_vwrite format string vulnerability</topic>
<affects>
<package>
<name>perdition</name>
<range><lt>1.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SEC-Consult reports:</p>
<blockquote cite="http://www.sec-consult.com/300.html">
<p>Perdition IMAP is affected by a format string bug in one of its
IMAP output-string formatting functions. The bug allows the
execution of arbitrary code on the affected server.
A successful exploit does not require prior authentication.</p>
</blockquote>
</body>
</description>
<references>
<bid>26270</bid>
<cvename>CVE-2007-5740</cvename>
<url>http://www.sec-consult.com/300.html</url>
<url>http://secunia.com/advisories/27458</url>
</references>
<dates>
<discovery>2007-10-31</discovery>
<entry>2007-11-05</entry>
</dates>
</vuln>
<vuln vid="f8b0f83c-8bb3-11dc-bffa-0016179b2dd5">
<topic>gftp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gftp</name>
<range><lt>2.0.18_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml">
<p>Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
included in gFTP when processing overly long directory or file
names.</p>
<p>A remote attacker could trigger these vulnerabilities by enticing
a user to download a file with a specially crafted directory or file
name, possibly resulting in the execution of arbitrary code or a
Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3961</cvename>
<cvename>CVE-2007-3962</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml</url>
</references>
<dates>
<discovery>2007-11-01</discovery>
<entry>2007-11-05</entry>
<modified>2007-11-11</modified>
</dates>
</vuln>
<vuln vid="a1ef3fc0-8ad0-11dc-9490-0016179b2dd5">
<topic>dircproxy -- remote denial of service</topic>
<affects>
<package>
<name>dircproxy</name>
<range><lt>1.0.5_1</lt></range>
</package>
<package>
<name>dircproxy-devel</name>
<range><lt>1.2.0.b2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Securiweb reports:</p>
<blockquote cite="http://dircproxy.securiweb.net/ticket/89">
<p>dircproxy allows remote attackers to cause a denial of
service (segmentation fault) via an ACTION command without a
parameter, which triggers a NULL pointer dereference, as
demonstrated using a blank /me message from irssi.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5226</cvename>
<url>http://dircproxy.securiweb.net/ticket/89</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=319301</url>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2007-11-04</entry>
<modified>2008-01-31</modified>
</dates>
</vuln>
<vuln vid="a467d0f9-8875-11dc-b3ba-0016179b2dd5">
<topic>wordpress -- cross-site scripting</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<range><lt>2.3.1</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory report:</p>
<blockquote cite="http://secunia.com/advisories/27407">
<p>Input passed to the "posts_columns" parameter in
wp-admin/edit-post-rows.php is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in
context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5710</cvename>
<url>http://secunia.com/advisories/27407</url>
<url>http://wordpress.org/development/2007/10/wordpress-231/</url>
</references>
<dates>
<discovery>2007-10-29</discovery>
<entry>2007-11-01</entry>
</dates>
</vuln>
<vuln vid="db449245-870d-11dc-a3ec-001921ab2fa4">
<topic>openldap -- multiple remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.3.39</lt></range>
<range><gt>2.4.0</gt><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26245/">
<p>OpenLDAP is prone to multiple remote denial-of-service
vulnerabilities because of an incorrect NULL-termination
issue and a double-free issue.</p>
</blockquote>
</body>
</description>
<references>
<bid>26245</bid>
<cvename>CVE-2007-5707</cvename>
<cvename>CVE-2007-5708</cvename>
</references>
<dates>
<discovery>2007-10-29</discovery>
<entry>2007-10-30</entry>
<modified>2007-10-31</modified>
</dates>
</vuln>
<vuln vid="d2c2952d-85a1-11dc-bfff-003048705d5a">
<topic>py-django -- denial of service vulnerability</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<range><lt>0.96.1</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<range><lt>20071026</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2007/oct/26/security-fix/">
<p>A per-process cache used by Django's internationalization
("i18n") system to store the results of translation lookups
for particular values of the HTTP Accept-Language header
used the full value of that header as a key. An attacker
could take advantage of this by sending repeated requests
with extremely large strings in the Accept-Language header,
potentially causing a denial of service by filling available
memory.</p>
<p>Due to limitations imposed by Web server software on the
size of HTTP header fields, combined with reasonable limits
on the number of requests which may be handled by a single
server process over its lifetime, this vulnerability may be
difficult to exploit. Additionally, it is only present when
the "USE_I18N" setting in Django is "True" and the i18n
middleware component is enabled*. Nonetheless, all users of
affected versions of Django are encouraged to update.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.djangoproject.com/weblog/2007/oct/26/security-fix/</url>
</references>
<dates>
<discovery>2007-10-26</discovery>
<entry>2007-10-27</entry>
</dates>
</vuln>
<vuln vid="44224e08-8306-11dc-9283-0016179b2dd5">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory from Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/866/">
<p>If a user has configured Opera to use an external newsgroup
client or e-mail application, specially crafted Web pages can
cause Opera to run that application incorrectly. In some cases
this can lead to execution of arbitrary code.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/867/">
<p>When accesing frames from different Web sites, specially crafted
scripts can bypass the same-origin policy, and overwrite functions
from those frames. If scripts on the page then run those functions,
this can cause the script of the attacker's choice to run in the
context of the target Web site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5540</cvename>
<cvename>CVE-2007-5541</cvename>
<url>http://www.opera.com/support/search/view/866/</url>
<url>http://www.opera.com/support/search/view/867/</url>
<url>http://secunia.com/advisories/27277/</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-25</entry>
</dates>
</vuln>
<vuln vid="9c00d446-8208-11dc-9283-0016179b2dd5">
<topic>drupal --- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal4</name>
<range><lt>4.7.8</lt></range>
</package>
<package>
<name>drupal5</name>
<range><lt>5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/184315">
<p>In some circumstances Drupal allows user-supplied data to
become part of response headers. As this user-supplied data
is not always properly escaped, this can be exploited by
malicious users to execute HTTP response splitting attacks
which may lead to a variety of issues, among them cache
poisoning, cross-user defacement and injection of arbitrary
code.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184316">
<p>The Drupal installer allows any visitor to provide credentials
for a database when the site's own database is not reachable. This
allows attackers to run arbitrary code on the site's server.
An immediate workaround is the removal of the file install.php
in the Drupal root directory.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184320">
<p>The allowed extension list of the core Upload module contains
the extension HTML by default. Such files can be used to execute
arbitrary script code in the context of the affected site when a
user views the file. Revoking upload permissions or removing the
.html extension from the allowed extension list will stop uploads
of malicious files. but will do nothing to protect your site
againstfiles that are already present. Carefully inspect the file
system path for any HTML files. We recommend you remove any HTML
file you did not update yourself. You should look for , CSS
includes, Javascript includes, and onerror="" attributes if
you need to review files individually.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184348">
<p>The Drupal Forms API protects against cross site request
forgeries (CSRF), where a malicious site can cause a user
to unintentionally submit a form to a site where he is
authenticated. The user deletion form does not follow the
standard Forms API submission model and is therefore not
protected against this type of attack. A CSRF attack may
result in the deletion of users.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184354">
<p>The publication status of comments is not passed during the
hook_comments API operation, causing various modules that rely
on the publication status (such as Organic groups, or Subscriptions)
to mail out unpublished comments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5597</cvename>
<cvename>CVE-2007-5596</cvename>
<cvename>CVE-2007-5595</cvename>
<cvename>CVE-2007-5594</cvename>
<cvename>CVE-2007-5593</cvename>
<url>http://drupal.org/node/184315</url>
<url>http://drupal.org/node/184316</url>
<url>http://drupal.org/node/184348</url>
<url>http://drupal.org/node/184354</url>
<url>http://drupal.org/node/184320</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27290</url>
<url>http://secunia.com/advisories/27290</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-24</entry>
</dates>
</vuln>
<vuln vid="3a81017a-8154-11dc-9283-0016179b2dd5">
<topic>ldapscripts -- Command Line User Credentials Disclosure</topic>
<affects>
<package>
<name>ldapscripts</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ganael Laplanche reports:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600">
<p>Up to now, each ldap* command was called with the -w parameter,
which allows to specify the bind password on the command line.
Unfortunately, this could make the password appear to anybody
performing a `ps` during the call. This is now avoided by using
the -y parameter and a password file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600</url>
<url>http://secunia.com/advisories/27111</url>
<cvename>CVE-2007-5373</cvename>
</references>
<dates>
<discovery>2007-10-09</discovery>
<entry>2007-10-23</entry>
</dates>
</vuln>
<vuln vid="e24797af-803d-11dc-b787-003048705d5a">
<topic>firefox -- OnUnload Javascript browser entrapment vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0979.html">
<p>Several flaws were found in the way in which Firefox
displayed malformed web content. A web page containing
specially-crafted content could potentially trick a user
into surrendering sensitive information. (CVE-2007-1095,
CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1095</cvename>
</references>
<dates>
<discovery>2007-10-19</discovery>
<entry>2007-10-22</entry>
<modified>2007-10-23</modified>
</dates>
</vuln>
<vuln vid="498a8731-7cfc-11dc-96e6-0012f06707f0">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The DigiTrust Group discovered serious XSS vulnerability in
the phpMyAdmin server_status.php script. According to their
report</p>
<blockquote cite="http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html">
<p>vulnerability can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5589</cvename>
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-17</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="51b51d4a-7c0f-11dc-9e47-0011d861d5e2">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26020/discuss">
<p>phpMyAdmin is prone to a cross-site scripting vulnerability
because it fails to properly sanitize user-supplied input.</p>
<p>An attacker may leverage this issue to execute arbitrary script
code in the browser of an unsuspecting user in the context of the
affected site. This may help the attacker steal potentially
sensitive information and launch other attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5386</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5</url>
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071009a</url>
<url>http://secunia.com/advisories/27173</url>
<bid>26020</bid>
</references>
<dates>
<discovery>2007-10-12</discovery>
<entry>2007-10-16</entry>
<modified>2007-10-20</modified>
</dates>
</vuln>
<vuln vid="7453c85d-7830-11dc-b4c8-0016179b2dd5">
<topic>nagios-plugins -- Long Location Header Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>nagios-plugins</name>
<range><lt>1.4.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/27124/">
<p>The vulnerability is caused due to a boundary error within the
redir() function in check_http.c when processing HTTP Location:
header information. This can be exploited to cause a buffer overflow
by returning an overly long string in the "Location:" header to a
vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/forum/forum.php?forum_id=740172</url>
<url>http://secunia.com/advisories/27124/</url>
<cvename>CVE-2007-5198</cvename>
</references>
<dates>
<discovery>2007-09-28</discovery>
<entry>2007-10-11</entry>
</dates>
</vuln>
<vuln vid="172acf78-780c-11dc-b3f4-0016179b2dd5">
<topic>png -- multiple vulnerabilities</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/27093/">
<p>Some vulnerabilities have been reported in libpng, which can be
exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>Certain errors within libpng, including a logical NOT instead of a
bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency
extension, and an incorrect use of sizeof() may be exploited to
crash an application using the library.</p>
<p>Various out-of-bounds read errors exist within the functions
png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(),
png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by
exploited to crash an application using the library.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/27130/">
<p>The vulnerability is caused due to an off-by-one error within
the ICC profile chunk handling, which potentially can be
exploited to crash an application using the library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/27093/</url>
<url>http://secunia.com/advisories/27130/</url>
<cvename>CVE-2007-5267</cvename>
<cvename>CVE-2007-5266</cvename>
<cvename>CVE-2007-5268</cvename>
<cvename>CVE-2007-5269</cvename>
</references>
<dates>
<discovery>2007-10-08</discovery>
<entry>2007-10-11</entry>
</dates>
</vuln>
<vuln vid="f5b29ec0-71f9-11dc-8c6a-00304881ac9a">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been discovered in ImageMagick.</p>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4985">
<p>ImageMagick before 6.3.5-9 allows context-dependent attackers
to cause a denial of service via a crafted image file that
triggers (1) an infinite loop in the ReadDCMImage function,
related to ReadBlobByte function calls; or (2) an infinite
loop in the ReadXCFImage function, related to ReadBlobMSBLong
function calls.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4986">
<p>Multiple integer overflows in ImageMagick before 6.3.5-9
allow context-dependent attackers to execute arbitrary code
via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)
.xwd image file, which triggers a heap-based buffer overflow.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4987">
<p>Off-by-one error in the ReadBlobString function in blob.c in
ImageMagick before 6.3.5-9 allows context-dependent attackers
to execute arbitrary code via a crafted image file, which
triggers the writing of a '\0' character to an out-of-bounds
address.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4988">
<p>Sign extension error in the ReadDIBImage function in
ImageMagick before 6.3.5-9 allows context-dependent attackers
to execute arbitrary code via a crafted width value in an
image file, which triggers an integer overflow and a
heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4985</cvename>
<cvename>CVE-2007-4986</cvename>
<cvename>CVE-2007-4987</cvename>
<cvename>CVE-2007-4988</cvename>
<url>http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-10-10</entry>
</dates>
</vuln>
<vuln vid="c93e4d41-75c5-11dc-b903-0016179b2dd5">
<topic>jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented</topic>
<affects>
<package>
<name>jdk</name>
<range><ge>1.3.0</ge><lt>1.6.0.3p3</lt></range>
<range><ge>1.5.0,1</ge><lt>1.5.0.13p7,1</lt></range>
</package>
<package>
<name>linux-blackdown-jdk</name>
<range><ge>1.3.0</ge></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>1.3.0</ge><lt>1.3.1.20</lt></range>
<range><ge>1.4.0</ge><lt>1.4.2.16</lt></range>
<range><eq>1.5.0.b1</eq></range>
<range><eq>1.5.0.b1,1</eq></range>
<range><ge>1.5.0,2</ge><lt>1.5.0.13,2</lt></range>
<range><ge>1.6.0</ge><lt>1.6.0.03</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUN reports:</p>
<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1">
<p>A vulnerability in the Java Runtime Environment (JRE) with applet
caching may allow an untrusted applet that is downloaded from a
malicious website to make network connections to network services
on machines other than the one that the applet was downloaded from.
This may allow network resources (such as web pages) and
vulnerabilities (that exist on these network services) which are not
otherwise normally accessible to be accessed or exploited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1</url>
<cvename>CVE-2007-5232</cvename>
</references>
<dates>
<discovery>2007-10-03</discovery>
<entry>2007-10-08</entry>
<modified>2007-11-16</modified>
</dates>
</vuln>
<vuln vid="a5f667db-7596-11dc-8b7a-0019b944b34e">
<topic>xfs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xfs</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2007-October/028899.html">
<h1>Problem Description:</h1>
<p>Several vulnerabilities have been identified in xfs, the X font
server. The QueryXBitmaps and QueryXExtents protocol requests
suffer from lack of validation of their 'length' parameters.</p>
<h1>Impact:</h1>
<p>On most modern systems, the font server is accessible only for
local clients and runs with reduced privileges, but on some
systems it may still be accessible from remote clients and
possibly running with root privileges, creating an opportunity
for remote privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4568</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2007-October/028899.html</url>
</references>
<dates>
<discovery>2007-10-02</discovery>
<entry>2007-10-08</entry>
</dates>
</vuln>
<vuln vid="a058d6fa-7325-11dc-ae10-0016179b2dd5">
<topic>tcl/tk -- buffer overflow in ReadImage function</topic>
<affects>
<package>
<name>tk</name>
<name>tk-threads</name>
<range><gt>8.2.*</gt><lt>8.2.3_11</lt></range>
<range><gt>8.3.*</gt><lt>8.3.5_10</lt></range>
<range><gt>8.4.*,2</gt><lt>8.4.16,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Buffer overflow in the ReadImage function in generic/tkImgGIF.c
in Tcl/Tk, allows remote attackers to execute arbitrary code via
multi-frame interlaced GIF files in which later frames are smaller
than the first.</p>
</body>
</description>
<references>
<url>http://secunia.com/advisories/26942</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=541207</url>
<cvename>CVE-2007-5137</cvename>
</references>
<dates>
<discovery>2007-09-27</discovery>
<entry>2007-10-05</entry>
<modified>2011-09-04</modified>
</dates>
</vuln>
<vuln vid="91ed69f9-72c7-11dc-981a-001921ab2fa4">
<topic>firebird -- multiple remote buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>firebird-server</name>
<range><ge>1.*</ge><lt>1.5.5</lt></range>
<range><ge>2.0.*</ge><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RISE Security reports:</p>
<blockquote cite="http://risesecurity.org/advisory/RISE-2007003/">
<p>There exists multiple vulnerabilities within functions
of Firebird Relational Database, which when properly
exploited can lead to remote compromise of the vulnerable
system.</p>
</blockquote>
</body>
</description>
<references>
<bid>25925</bid>
</references>
<dates>
<discovery>2007-10-03</discovery>
<entry>2007-10-04</entry>
</dates>
</vuln>
<vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4">
<topic>id3lib -- insecure temporary file creation</topic>
<affects>
<package>
<name>id3lib</name>
<range><lt>3.8.3_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Bug report log reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540">
<p>When tagging file $foo, a temporary copy of the file is
created, and for some reason, libid3 doesn't use mkstemp
but just creates $foo.XXXXXX literally, without any checking.</p>
<p>This would silently truncate and overwrite an existing
$foo.XXXXXX.</p>
</blockquote>
</body>
</description>
<references>
<bid>25372</bid>
<cvename>CVE-2007-4460</cvename>
</references>
<dates>
<discovery>2007-08-20</discovery>
<entry>2007-10-01</entry>
<modified>2007-10-01</modified>
</dates>
</vuln>
<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
<topic>mediawiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><gt>1.10.0</gt><lt>1.10.2</lt></range>
<range><gt>1.9.0</gt><lt>1.9.4</lt></range>
<range><gt>1.8.0</gt><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MediaWiki development team reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
<p>A possible HTML/XSS injection vector in the API
pretty-printing mode has been found and fixed.</p>
<p>The vulnerability may be worked around in an unfixed version
by simply disabling the API interface if it is not in use, by
adding this to LocalSettings.php:</p>
<p>$wgEnableAPI = false;</p>
<p>(This is the default setting in 1.8.x.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4828</cvename>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
</references>
<dates>
<discovery>2007-09-10</discovery>
<entry>2007-09-21</entry>
<modified>2007-10-10</modified>
</dates>
</vuln>
<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
<topic>wordpress -- remote sql injection vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>2.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.3</lt></range>
</package>
<package>
<name>wordpress-mu</name>
<range><lt>1.2.4,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Concha reports:</p>
<blockquote cite="http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html">
<p>While testing WordPress, it has been discovered a SQL
Injection vulnerability that allows an attacker to retrieve
remotely any user credentials from a vulnerable site, this
bug is caused because of early database escaping and the
lack of validation in query string like parameters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4894</cvename>
<url>http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html</url>
</references>
<dates>
<discovery>2007-09-10</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="2bc96f18-683f-11dc-82b6-02e0185f8d72">
<topic>samba -- nss_info plugin privilege escalation vulnerability</topic>
<affects>
<package>
<name>samba</name>
<range><lt>3.0.26a</lt></range>
<range><gt>*,1</gt><lt>3.0.26a,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba development team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-4138.html">
<p>The idmap_ad.so library provides an nss_info extension to
Winbind for retrieving a user's home directory path, login
shell and primary group id from an Active Directory domain
controller. This functionality is enabled by defining the
"winbind nss info" smb.conf option to either "sfu" or
"rfc2307".</p>
<p>Both the Windows "Identity Management for Unix" and
"Services for Unix" MMC plug-ins allow a user to be assigned
a primary group for Unix clients that differs from the user's
Windows primary group. When the rfc2307 or sfu nss_info plugin
has been enabled, in the absence of either the RFC2307 or SFU
primary group attribute, Winbind will assign a primary group ID
of 0 to the domain user queried using the getpwnam() C library
call.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4138</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-4138.html</url>
</references>
<dates>
<discovery>2007-09-11</discovery>
<entry>2007-09-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="75231c63-f6a2-499d-8e27-787773bda284">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.20.*</ge><lt>2.22.3</lt></range>
<range><ge>3.*</ge><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.20.4/">
<p>This advisory covers three security issues that have recently been
fixed in the Bugzilla code:</p>
<ul>
<li>A possible cross-site scripting (XSS) vulnerability when filing
bugs using the guided form.</li>
<li>When using email_in.pl, insufficiently escaped data may be
passed to sendmail.</li>
<li>Users using the WebService interface may access Bugzilla's
time-tracking fields even if they normally cannot see them.</li>
</ul>
<p>We strongly advise that 2.20.x and 2.22.x users should upgrade to
2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or
below, should upgrade to 3.0.1.</p>
</blockquote>
</body>
</description>
<references>
<bid>25425</bid>
<cvename>CVE-2007-4538</cvename>
<cvename>CVE-2007-4539</cvename>
<cvename>CVE-2007-4543</cvename>
<url>http://www.bugzilla.org/security/2.20.4/</url>
</references>
<dates>
<discovery>2007-08-23</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="b6f6da57-680a-11dc-b350-001921ab2fa4">
<topic>clamav -- multiple remote Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.91.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/25398">
<p>ClamAV is prone to multiple denial-of-service vulnerabilities.</p>
<p>A successful attack may allow an attacker to crash the
application and deny service to users.</p>
</blockquote>
</body>
</description>
<references>
<bid>25398</bid>
<cvename>CVE-2007-4510</cvename>
</references>
<dates>
<discovery>2007-08-21</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="12488805-6773-11dc-8be8-02e0185f8d72">
<topic>coppermine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The coppermine development team reports two vulnerabilities
with the coppermine application. These vulnerabilities are
caused by improper checking of the log variable in "viewlog.php"
and improper checking of the referer variable in "mode.php".
This could allow local file inclusion, potentially disclosing
valuable information and could lead to an attacker conducting
a cross site scripting attack against the targeted site.</p>
</body>
</description>
<references>
<cvename>CVE-2007-4976</cvename>
<cvename>CVE-2007-4977</cvename>
<url>http://coppermine-gallery.net/forum/index.php?topic=46847.0</url>
</references>
<dates>
<discovery>2007-09-14</discovery>
<entry>2007-09-20</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e595e170-6771-11dc-8be8-02e0185f8d72">
<topic>openoffice -- arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>openoffice</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593">
<p>Remote exploitation of multiple integer overflow
vulnerabilities within OpenOffice, as included in various
vendors' operating system distributions, allows attackers to
execute arbitrary code.</p>
<p>These vulnerabilities exist within the TIFF parsing code of
the OpenOffice suite. When parsing the TIFF directory entries
for certain tags, the parser uses untrusted values from the
file to calculate the amount of memory to allocate. By
providing specially crafted values, an integer overflow occurs
in this calculation. This results in the allocation of a
buffer of insufficient size, which in turn leads to a heap
overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2834</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-09-20</entry>
</dates>
</vuln>
<vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72">
<topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.*</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Bugzilla development team reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.0.1/">
<p>Bugzilla::WebService::User::offer_account_by_email does
not check the "createemailregexp" parameter, and thus
allows users to create accounts who would normally be
denied account creation. The "emailregexp" parameter is
still checked. If you do not have the SOAP::Lite Perl
module installed on your Bugzilla system, your system is
not vulnerable (because the Bugzilla WebService will not
be enabled).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5038</cvename>
<url>http://www.bugzilla.org/security/3.0.1/</url>
</references>
<dates>
<discovery>2007-09-18</discovery>
<entry>2007-09-20</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72">
<topic>konquerer -- address bar spoofing</topic>
<affects>
<package>
<name>kdebase</name>
<range><lt>3.5.7_3</lt></range>
</package>
<package>
<name>kdelibs</name>
<range><lt>3.5.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE development team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070914-1.txt">
<p>The Konqueror address bar is vulnerable to spoofing attacks
that are based on embedding white spaces in the url. In addition
the address bar could be tricked to show an URL which it is
intending to visit for a short amount of time instead of the
current URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3820</cvename>
<cvename>CVE-2007-4224</cvename>
<cvename>CVE-2007-4225</cvename>
<url>http://www.kde.org/info/security/advisory-20070914-1.txt</url>
</references>
<dates>
<discovery>2007-09-14</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="79b616d0-66d1-11dc-b25f-02e0185f8d72">
<topic>kdm -- passwordless login vulnerability</topic>
<affects>
<package>
<name>kdebase3</name>
<range><lt>3.5.7_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE development team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070919-1.txt">
<p>KDM can be tricked into performing a password-less login
even for accounts with a password set under certain
circumstances, namely autologin to be configured and
"shutdown with password" enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4569</cvename>
<url>http://www.kde.org/info/security/advisory-20070919-1.txt</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="209f0d75-4b5c-11dc-a6cd-000fb5066b20">
<topic>flyspray -- authentication bypass</topic>
<affects>
<package>
<name>flyspray</name>
<range><lt>0.9.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Flyspray Project reports:</p>
<blockquote cite="http://www.flyspray.org/fsa:1">
<p>Flyspray authentication system can be bypassed by sending a
carefully crafted post request.</p>
<p>To be vulnerable, PHP configuration directive output_buffering
has to be disabled or set to a low value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1788</cvename>
<url>http://www.flyspray.org/fsa:1</url>
</references>
<dates>
<discovery>2007-03-13</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="3ce8c7e2-66cf-11dc-b25f-02e0185f8d72">
<topic>mozilla -- code execution via Quicktime media-link files</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.7</lt></range>
</package>
<!-- Packages which probably will be upgraded -->
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.5</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
<!-- Deprecated/old names -->
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports a vulnerability within the
mozilla browser. This vulnerability also affects various
other browsers like firefox and seamonkey. The vulnerability
is caused by QuickTime Media-Link files that contain a qtnext
attribute. This could allow an attacker to start the browser
with arbitrary command-line options. This could allow the
attacker to install malware, steal local data and possibly
execute and/or do other arbitrary things within the users
context.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4965</cvename>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-28.html</url>
</references>
<dates>
<discovery>2007-09-18</discovery>
<entry>2007-09-19</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="71d903fc-602d-11dc-898c-001921ab2fa4">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.4</lt></range>
</package>
<package>
<name>php4</name>
<range><lt>4.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_4.php">
<p>Security Enhancements and Fixes in PHP 5.2.4:</p>
<ul>
<li>Fixed a floating point exception inside wordwrap() (Reported
by Mattias Bengtsson)</li>
<li>Fixed several integer overflows inside the GD extension
(Reported by Mattias Bengtsson)</li>
<li>Fixed size calculation in chunk_split() (Reported by Gerhard
Wagner)</li>
<li>Fixed integer overflow in str[c]spn(). (Reported by Mattias
Bengtsson)</li>
<li>Fixed money_format() not to accept multiple %i or %n tokens.
(Reported by Stanislav Malyshev)</li>
<li>Fixed zend_alter_ini_entry() memory_limit interruption
vulnerability. (Reported by Stefan Esser)</li>
<li>Fixed INFILE LOCAL option handling with MySQL extensions not
to be allowed when open_basedir or safe_mode is active. (Reported
by Mattias Bengtsson)</li>
<li>Fixed session.save_path and error_log values to be checked
against open_basedir and safe_mode (CVE-2007-3378) (Reported by
Maksymilian Arciemowicz)</li>
<li>Fixed a possible invalid read in glob() win32 implementation
(CVE-2007-3806) (Reported by shinnai)</li>
<li>Fixed a possible buffer overflow in php_openssl_make_REQ
(Reported by zatanzlatan at hotbrev dot com)</li>
<li>Fixed an open_basedir bypass inside glob() function (Reported
by dr at peytz dot dk)</li>
<li>Fixed a possible open_basedir bypass inside session extension
when the session file is a symlink (Reported by c dot i dot morris
at durham dot ac dot uk)</li>
<li>Improved fix for MOPB-03-2007.</li>
<li>Corrected fix for CVE-2007-2872.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2872</cvename>
<cvename>CVE-2007-3378</cvename>
<cvename>CVE-2007-3806</cvename>
<cvename>CVE-2007-3996</cvename>
<cvename>CVE-2007-3997</cvename>
<cvename>CVE-2007-3998</cvename>
<cvename>CVE-2007-4652</cvename>
<cvename>CVE-2007-4657</cvename>
<cvename>CVE-2007-4658</cvename>
<cvename>CVE-2007-4659</cvename>
<cvename>CVE-2007-4660</cvename>
<cvename>CVE-2007-4661</cvename>
<cvename>CVE-2007-4662</cvename>
<cvename>CVE-2007-4663</cvename>
<cvename>CVE-2007-4670</cvename>
<url>http://www.php.net/releases/4_4_8.php</url>
<url>http://www.php.net/releases/5_2_4.php</url>
<url>http://secunia.com/advisories/26642</url>
</references>
<dates>
<discovery>2007-08-30</discovery>
<entry>2007-09-11</entry>
<modified>2008-01-14</modified>
</dates>
</vuln>
<vuln vid="c115271d-602b-11dc-898c-001921ab2fa4">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.2.0</gt><lt>2.2.6</lt></range>
<range><gt>2.0.0</gt><lt>2.0.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>The following potential security flaws are addressed:</p>
<ul>
<li>CVE-2007-3847: mod_proxy: Prevent reading past the end of a
buffer when parsing date-related headers.</li>
<li>CVE-2007-1863: mod_cache: Prevent a segmentation fault if
attributes are listed in a Cache-Control header without any
value.</li>
<li>CVE-2007-3304: prefork, worker, event MPMs: Ensure that the
parent process cannot be forced to kill processes outside its
process group.</li>
<li>CVE-2006-5752: mod_status: Fix a possible XSS attack against
a site with a public server-status page and ExtendedStatus
enabled, for browsers which perform charset "detection".
Reported by Stefan Esser.</li>
<li>CVE-2006-1862: mod_mem_cache: Copy headers into longer lived
storage; header names and values could previously point to
cleaned up storage.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3847</cvename>
<cvename>CVE-2007-1863</cvename>
<cvename>CVE-2006-5752</cvename>
<cvename>CVE-2007-3304</cvename>
</references>
<dates>
<discovery>2007-09-07</discovery>
<entry>2007-09-11</entry>
</dates>
</vuln>
<vuln vid="4b673ae7-5f9a-11dc-84dd-000102cc8983">
<topic>lighttpd -- FastCGI header overrun in mod_fastcgi</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lighttpd maintainer reports:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt">
<p>Lighttpd is prone to a header overflow when using the mod_fastcgi
extension, this can lead to arbitrary code execution in the fastcgi
application. For a detailed description of the bug see the external
reference.</p>
<p>This bug was found by Mattias Bengtsson and Philip Olausson</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt</url>
<url>http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/</url>
<cvename>CVE-2007-4727</cvename>
</references>
<dates>
<discovery>2007-09-09</discovery>
<entry>2007-09-10</entry>
</dates>
</vuln>
<vuln vid="f14ad681-5b88-11dc-812d-0011098b2f36">
<topic>rkhunter -- insecure temporary file creation</topic>
<affects>
<package>
<name>rkhunter</name>
<range><lt>1.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml">
<p>Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
Security Team have reported that the check_update.sh script and
the main rkhunter script insecurely creates several temporary
files with predictable filenames.</p>
<p>A local attacker could create symbolic links in the temporary
files directory, pointing to a valid file somewhere on the
filesystem. When rkhunter or the check_update.sh script runs,
this would result in the file being overwritten with the rights of
the user running the utility, which could be the root user.</p>
</blockquote>
</body>
</description>
<references>
<bid>13399</bid>
<cvename>CVE-2005-1270</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml</url>
</references>
<dates>
<discovery>2005-04-26</discovery>
<entry>2007-09-05</entry>
</dates>
</vuln>
<vuln vid="72cdf2ab-5b87-11dc-812d-0011098b2f36">
<topic>lsh -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lsh</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/14609">
<p>A vulnerability has been reported in LSH, which potentially
can be exploited by malicious people to cause a DoS (Denial
of Service).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0826</cvename>
<cvename>CVE-2005-0814</cvename>
<url>http://secunia.com/advisories/14609</url>
</references>
<dates>
<discovery>2005-03-17</discovery>
<entry>2007-09-05</entry>
<modified>2008-01-07</modified>
</dates>
</vuln>
<vuln vid="45500f74-5947-11dc-87c1-000e2e5785ad">
<topic>fetchmail -- denial of service on reject of local warning message</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>4.6.8</ge><lt>6.3.8_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-02.txt">
<p>fetchmail will generate warning messages in certain
circumstances (for instance, when leaving oversized messages
on the server or login to the upstream fails) and send them
to the local postmaster or the user running it.</p>
<p>If this warning message is then refused by the SMTP listener
that fetchmail is forwarding the message to, fetchmail
crashes and does not collect further messages until it is
restarted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4565</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2007-02.txt</url>
</references>
<dates>
<discovery>2007-07-29</discovery>
<entry>2007-09-02</entry>
</dates>
</vuln>
<vuln vid="d944719e-42f4-4864-89ed-f045b541919f">
<topic>gtar -- Directory traversal vulnerability</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.18_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2007-0860.html">
<p>A path traversal flaw was discovered in the way GNU
tar extracted archives. A malicious user could create a
tar archive that could write to arbitrary files to which
the user running GNU tar had write access.</p>
</blockquote>
<p>Red Hat credits Dmitry V. Levin for reporting the issue.</p>
</body>
</description>
<references>
<bid>25417</bid>
<cvename>CVE-2007-4131</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2007-0860.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=251921</url>
</references>
<dates>
<discovery>2007-08-23</discovery>
<entry>2007-09-01</entry>
</dates>
</vuln>
<vuln vid="d9867f50-54d0-11dc-b80b-0016179b2dd5">
<topic>claws-mail -- POP3 Format String Vulnerability</topic>
<affects>
<package>
<name>claws-mail</name>
<name>sylpheed-claws</name>
<range><lt>2.10.0_3</lt></range>
</package>
<package>
<name>sylpheed2</name>
<range><lt>2.4.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26550/">
<p>A format string error in the "inc_put_error()" function in
src/inc.c when displaying a POP3 server's error response can
be exploited via specially crafted POP3 server replies containing
format specifiers.</p>
<p>Successful exploitation may allow execution of arbitrary code,
but requires that the user is tricked into connecting to a malicious
POP3 server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2958</cvename>
<url>http://secunia.com/advisories/26550/</url>
<url>http://secunia.com/secunia_research/2007-70/advisory/</url>
</references>
<dates>
<discovery>2007-08-24</discovery>
<entry>2007-08-27</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="af8e3a0c-5009-11dc-8a43-003048705d5a">
<topic>rsync -- off by one stack overflow</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>2.6.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/25336/discuss">
<p>The rsync utility is prone to an off-by-one buffer-overflow
vulnerability. This issue is due to a failure of the application
to properly bounds-check user-supplied input.</p>
<p>Successfully exploiting this issue may allow arbitrary
code-execution in the context of the affected utility.</p>
</blockquote>
</body>
</description>
<references>
<bid>25336</bid>
<cvename>CVE-2007-4091</cvename>
</references>
<dates>
<discovery>2007-08-15</discovery>
<entry>2007-08-21</entry>
<modified>2007-08-23</modified>
</dates>
</vuln>
<vuln vid="df4a7d21-4b17-11dc-9fc2-001372ae3ab9">
<topic>opera -- Vulnerability in javascript handling</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.23.20070809</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory from Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/865/">
<p>A specially crafted JavaScript can make Opera execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/search/view/865/</url>
</references>
<dates>
<discovery>2007-08-03</discovery>
<entry>2007-08-15</entry>
<modified>2007-08-25</modified>
</dates>
</vuln>
<vuln vid="4a338d17-412d-11dc-bdb0-0016179b2dd5">
<topic>fsplib -- multiple vulnerabilities</topic>
<affects>
<package>
<name>fsplib</name>
<range><lt>0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26184/">
<p>fsplib can be exploited to compromise an application using
the library.</p>
<p>A boundary error exists in the processing of file names in
fsp_readdir_native, which can be exploited to cause a stack-based
buffer overflow if the defined MAXNAMLEN is bigger than 256.</p>
<p>A boundary error exists in the processing of directory entries in
fsp_readdir, which can be exploited to cause a stack-based buffer
overflow on systems with an insufficient size allocated for the
d_name field of directory entries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3961</cvename>
<cvename>CVE-2007-3962</cvename>
<url>http://secunia.com/advisories/26184/</url>
</references>
<dates>
<discovery>2007-07-24</discovery>
<entry>2007-08-02</entry>
</dates>
</vuln>
<vuln vid="4872d9a7-4128-11dc-bdb0-0016179b2dd5">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<p>joomla can be exploited to conduct session fixation
attacks, cross-site scripting attacks or HTTP response
splitting attacks.</p>
<p>Certain unspecified input passed in com_search, com_content and
mod_login is not properly sanitised before being returned to a
user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
<p>Input passed to the url parameter is not properly sanitised
before being returned to the user. This can be exploited to insert
arbitrary HTTP headers, which will be included in a response sent
to the user, allowing for execution of arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
<p>An error exists in the handling of sessions and can be exploited
to hijack another user's session by tricking the user into logging
in after following a specially crafted link.</p>
</body>
</description>
<references>
<cvename>CVE-2007-4188</cvename>
<cvename>CVE-2007-4189</cvename>
<cvename>CVE-2007-4190</cvename>
<cvename>CVE-2007-5577</cvename>
<url>http://www.joomla.org/content/view/3677/1/</url>
<url>http://secunia.com/advisories/26239/</url>
</references>
<dates>
<discovery>2007-07-30</discovery>
<entry>2007-08-02</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="2dc764fa-40c0-11dc-aeac-02e0185f8d72">
<topic>FreeBSD -- Buffer overflow in tcpdump(1)</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>3.9.6</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_7</lt></range>
<range><ge>6.1</ge><lt>6.1_19</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An un-checked return value in the BGP dissector code can
result in an integer overflow. This value is used in
subsequent buffer management operations, resulting in a stack
based buffer overflow under certain circumstances.</p>
<h1>Impact:</h1>
<p>By crafting malicious BGP packets, an attacker could exploit
this vulnerability to execute code or crash the tcpdump
process on the target system. This code would be executed in
the context of the user running tcpdump(1). It should be
noted that tcpdump(1) requires privileges in order to open live
network interfaces.</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-3798</cvename>
<freebsdsa>SA-07:06.tcpdump</freebsdsa>
</references>
<dates>
<discovery>2007-08-01</discovery>
<entry>2007-08-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="3de342fb-40be-11dc-aeac-02e0185f8d72">
<topic>FreeBSD -- Predictable query ids in named(8)</topic>
<affects>
<package>
<name>named</name>
<range><ge>9.4</ge><lt>9.4.1.1</lt></range>
<range><ge>9.3</ge><lt>9.3.4.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_7</lt></range>
<range><ge>6.1</ge><lt>6.1_19</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When named(8) is operating as a recursive DNS server or
sending NOTIFY requests to slave DNS servers, named(8)
uses a predictable query id.</p>
<h1>Impact:</h1>
<p>An attacker who can see the query id for some request(s)
sent by named(8) is likely to be able to perform DNS cache
poisoning by predicting the query id for other request(s).</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-2926</cvename>
<freebsdsa>SA-07:07.bind</freebsdsa>
</references>
<dates>
<discovery>2007-07-24</discovery>
<entry>2007-08-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0e43a14d-3f3f-11dc-a79a-0016179b2dd5">
<topic>xpdf -- stack based buffer overflow</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.02_2</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.5.7_1</lt></range>
</package>
<package>
<name>cups-base</name>
<range><lt>1.2.11_3</lt></range>
</package>
<package>
<name>gpdf</name>
<range><gt>0</gt></range>
</package>
<package>
<name>pdftohtml</name>
<range><lt>0.39_3</lt></range>
</package>
<package>
<name>poppler</name>
<range><lt>0.5.9_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070730-1.txt">
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
a vulnerability that can cause a stack based buffer overflow
via a PDF file that exploits an integer overflow in
StreamPredictor::StreamPredictor(). Remotely supplied
pdf files can be used to disrupt the kpdf viewer on
the client machine and possibly execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>25124</bid>
<cvename>CVE-2007-3387</cvename>
<url>http://www.kde.org/info/security/advisory-20070730-1.txt</url>
</references>
<dates>
<discovery>2007-07-30</discovery>
<entry>2007-07-31</entry>
<modified>2009-04-29</modified>
</dates>
</vuln>
<vuln vid="ff284bf0-3f32-11dc-a79a-0016179b2dd5">
<cancelled superseded="2dc764fa-40c0-11dc-aeac-02e0185f8d72"/>
</vuln>
<vuln vid="863f95d3-3df1-11dc-b3d3-0016179b2dd5">
<topic>mutt -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<name>mutt-lite</name>
<name>ja-mutt</name>
<name>zh-mutt</name>
<range><lt>1.4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/24192/">
<p>Mutt is prone to a local buffer-overflow vulnerability
because it fails to properly bounds-check user-supplied
input before using it in a memory copy operation.
An attacker can exploit this issue to execute arbitrary
code with the with the privileges of the victim. Failed
exploit attempts will result in a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>24192</bid>
<cvename>CVE-2007-2683</cvename>
<url>http://www.redhat.com/support/errata/RHSA-2007-0386.html</url>
</references>
<dates>
<discovery>2007-05-28</discovery>
<entry>2007-07-29</entry>
</dates>
</vuln>
<vuln vid="d2b8a963-3d59-11dc-b3d3-0016179b2dd5">
<topic>p5-Net-DNS -- multiple Vulnerabilities</topic>
<affects>
<package>
<name>p5-Net-DNS</name>
<range><lt>0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/25829/">
<p>An error exists in the handling of DNS queries where IDs are
incremented with a fixed value and are additionally used for
child processes in a forking server. This can be exploited to
poison the DNS cache of an application using the module if a
valid ID is guessed.</p>
<p>An error in the PP implementation within the "dn_expand()"
function can be exploited to cause a stack overflow due to an
endless loop via a specially crafted DNS packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3377</cvename>
<cvename>CVE-2007-3409</cvename>
<url>http://secunia.com/advisories/25829/</url>
</references>
<dates>
<discovery>2007-06-27</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="88260dfe-3d21-11dc-b3d3-0016179b2dd5">
<topic>phpsysinfo -- url Cross-Site Scripting</topic>
<affects>
<package>
<name>phpSysInfo</name>
<range><lt>2.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Doz reports:</p>
<blockquote cite="http://secunia.com/advisories/26248/">
<p>A Input passed in the URL to index.php is not properly
sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/26248/</url>
</references>
<dates>
<discovery>2007-07-27</discovery>
<entry>2007-07-28</entry>
<modified>2007-08-01</modified>
</dates>
</vuln>
<vuln vid="98dd7788-3d13-11dc-b3d3-0016179b2dd5">
<topic>drupal -- Cross site request forgeries</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/162360">
<p>Several parts in Drupal core are not protected against cross
site request forgeries due to inproper use of the Forms API,
or by taking action solely on GET requests. Malicious users are
able to delete comments and content revisions and disable menu
items by enticing a privileged users to visit certain URLs while
the victim is logged-in to the targeted site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/162360</url>
<url>http://secunia.com/advisories/26224/</url>
</references>
<dates>
<discovery>2007-07-26</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="1f5b711b-3d0e-11dc-b3d3-0016179b2dd5">
<topic>drupal -- Multiple cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>drupal4</name>
<range><lt>4.7.7</lt></range>
</package>
<package>
<name>drupal5</name>
<range><lt>5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/162361">
<p>Some server variables are not escaped consistently. When
a malicious user is able to entice a victim to visit a specially
crafted link or webpage, arbitrary HTML and script code can be
injected and executed in the context of the victim's session on
the targeted website.</p>
<p>Custom content type names are not escaped consistently. A
malicious user with the 'administer content types' permission
would be able to inject and execute arbitrary HTML and script
code on the website. Revoking the 'administer content types'
permission provides an immediate workaround.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/162361</url>
<url>http://secunia.com/advisories/26224/</url>
</references>
<dates>
<discovery>2007-07-26</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="1ed03222-3c65-11dc-b3d3-0016179b2dd5">
<topic>vim -- Command Format String Vulnerability</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim-ruby</name>
<name>vim6</name>
<name>vim6-ruby</name>
<range><lt>7.1.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/25941/">
<p>A format string error in the "helptags_one()" function in
src/ex_cmds.c when running the "helptags" command can be exploited
to execute arbitrary code via specially crafted help files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2953</cvename>
<url>http://secunia.com/advisories/25941/</url>
</references>
<dates>
<discovery>2007-07-27</discovery>
<entry>2007-07-27</entry>
</dates>
</vuln>
<vuln vid="b73335a5-3bbe-11dc-8e83-0016179b2dd5">
<topic>libvorbis -- Multiple memory corruption flaws</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.2.0,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-003-libvorbis.txt">
<p>libvorbis contains several vulnerabilities
allowing heap overwrite, read violations and a function
pointer overwrite. These bugs cause a at least a denial
of service, and potentially code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.isecpartners.com/advisories/2007-003-libvorbis.txt</url>
<cvename>CVE-2007-3106</cvename>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-07-26</entry>
</dates>
</vuln>
<vuln vid="ab2575d6-39f0-11dc-b8cc-000fea449b8a">
<topic>tomcat -- XSS vulnerability in sample applications</topic>
<affects>
<package>
<name>apache-tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
</package>
<package>
<name>jakarta-tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Project reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html">
<p>The JSP and Servlet included in the sample application within
the Tomcat documentation webapp did not escape user provided
data before including it in the output. This enabled a XSS
attack. These pages have been simplified not to use any user
provided data in the output.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1355</cvename>
<bid>24058</bid>
</references>
<dates>
<discovery>2007-05-19</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="872623af-39ec-11dc-b8cc-000fea449b8a">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-tomcat</name>
<range><ge>4.1.0</ge><lt>4.1.36</lt></range>
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
</package>
<package>
<name>jakarta-tomcat</name>
<range><ge>4.0.0</ge><lt>4.1.0</lt></range>
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Project reports:</p>
<blockquote cite="http://www.mail-archive.com/dev@tomcat.apache.org/msg16385.html">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat 4.1.36 stable. This build contains
numerous library updates, A small number of bug fixes and
two important security fixes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2090</cvename>
<cvename>CVE-2007-0450</cvename>
<cvename>CVE-2007-1358</cvename>
</references>
<dates>
<discovery>2007-04-27</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="cddde37a-39b5-11dc-b3da-001921ab2fa4">
<topic>dokuwiki -- XSS vulnerability in spellchecker backend</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20070626_1</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20070524_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DokuWiki reports:</p>
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1195">
<p>The spellchecker tests the UTF-8 capabilities of the used browser
by sending an UTF-8 string to the backend, which will send it back
unfiltered. By comparing string length the spellchecker can work
around broken implementations. An attacker could construct a form to
let users send JavaScript to the spellchecker backend, resulting in
malicious JavaScript being executed in their browser.</p>
<p>Affected are all versions up to and including 2007-06-26 even when
the spell checker is disabled.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/xfdb/35501</url>
<cvename>CVE-2007-3930</cvename>
</references>
<dates>
<discovery>2007-06-26</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="fc9c217e-3791-11dc-bb1a-000fea449b8a">
<topic>lighttpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.15_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26130/">
<p>Some vulnerabilities have been reported in lighttpd,
which can be exploited by malicious people to bypass
certain security restrictions or cause a DoS (Denial
of Service).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3947</cvename>
<cvename>CVE-2007-3948</cvename>
<cvename>CVE-2007-3949</cvename>
<cvename>CVE-2007-3950</cvename>
<url>http://trac.lighttpd.net/trac/ticket/1216</url>
<url>http://trac.lighttpd.net/trac/ticket/1232</url>
<url>http://trac.lighttpd.net/trac/ticket/1230</url>
<url>http://trac.lighttpd.net/trac/ticket/1263</url>
</references>
<dates>
<discovery>2007-07-20</discovery>
<entry>2007-07-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="12d266b6-363f-11dc-b6c9-000c6ec775d9">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports of multiple security fixes in
Opera, including an arbitrary code execute
vulnerability:</p>
<blockquote cite="http://www.opera.com/support/search/view/861/">
<p>Opera for Linux, FreeBSD, and Solaris has a flaw in the
createPattern function that leaves old data that was in
the memory before Opera allocated it in the new
pattern. The pattern can be read and analyzed by
JavaScript, so an attacker can get random samples of the
user's memory, which may contain data.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/862/">
<p>Removing a specially crafted torrent from the download
manager can crash Opera. The crash is caused by an
erroneous memory access.</p>
<p>An attacker needs to entice the user to accept the
malicious BitTorrent download, and later remove it from
Opera's download manager. To inject code, additional means
will have to be employed.</p>
<p>Users clicking a BitTorrent link and rejecting the
download are not affected.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/863/">
<p>data: URLs embed data inside them, instead of linking to
an external resource. Opera can mistakenly display the end
of a data URL instead of the beginning. This allows an
attacker to spoof the URL of a trusted site.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/864/">
<p>Opera's HTTP authentication dialog is displayed when the
user enters a Web page that requires a login name and a
password. To inform the user which server it was that
asked for login credentials, the dialog displays the
server name.</p>
<p>The user has to see the entire server name. A truncated
name can be misleading. Opera's authentication dialog cuts
off the long server names at the right hand side, adding
an ellipsis (...) to indicate that it has been cut off.</p>
<p>The dialog has a predictable size, allowing an attacker
to create a server name which will look almost like a
trusted site, because the real domain name has been cut
off. The three dots at the end will not be obvious to all
users.</p>
<p>This flaw can be exploited by phishers who can set up
custom sub-domains, for example by hosting their own
public DNS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3929</cvename>
<cvename>CVE-2007-4944</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564</url>
<url>http://www.opera.com/support/search/view/861/</url>
<url>http://www.opera.com/support/search/view/862/</url>
<url>http://www.opera.com/support/search/view/863/</url>
<url>http://www.opera.com/support/search/view/864/</url>
<url>http://www.opera.com/docs/changelogs/freebsd/922/</url>
</references>
<dates>
<discovery>2007-07-19</discovery>
<entry>2007-07-19</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e190ca65-3636-11dc-a697-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.5,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.a2_3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<name>thunderbird</name>
<range><lt>2.0.0.5</lt></range>
</package>
<!-- Packages which probably will be upgraded -->
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
<!-- Deprecated/old names -->
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5">
<ul>
<li>MFSA 2007-25 XPCNativeWrapper pollution</li>
<li>MFSA 2007-24 Unauthorized access to wyciwyg:// documents</li>
<li>MFSA 2007-21 Privilege escalation using an event
handler attached to an element not in the document</li>
<li>MFSA 2007-20 Frame spoofing while window is loading</li>
<li>MFSA 2007-19 XSS using addEventListener and setTimeout</li>
<li>MFSA 2007-18 Crashes with evidence of memory corruption</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3089</cvename>
<cvename>CVE-2007-3734</cvename>
<cvename>CVE-2007-3735</cvename>
<cvename>CVE-2007-3737</cvename>
<cvename>CVE-2007-3738</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-18.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-19.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-20.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-21.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-24.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-25.html</url>
<uscertta>TA07-199A</uscertta>
</references>
<dates>
<discovery>2007-07-17</discovery>
<entry>2007-07-19</entry>
<modified>2008-06-21</modified>
</dates>
</vuln>
<vuln vid="b42e8c32-34f6-11dc-9bc9-001921ab2fa4">
<topic>linux-flashplugin -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><gt>9.0</gt><le>9.0r45</le></range>
<range><gt>8.0</gt><le>8.0r34</le></range>
<range><le>7.0r69</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-12.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player that could allow an attacker who
successfully exploits these potential vulnerabilities
to take control of the affected system. A malicious
SWF must be loaded in Flash Player by the user for
an attacker to exploit these potential vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2022</cvename>
<cvename>CVE-2007-3456</cvename>
<cvename>CVE-2007-3457</cvename>
</references>
<dates>
<discovery>2007-07-10</discovery>
<entry>2007-07-18</entry>
</dates>
</vuln>
<vuln vid="7fadc049-2ba0-11dc-9377-0016179b2dd5">
<topic>wireshark -- Multiple problems</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.20</ge><lt>0.99.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark Team reports:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-02.html">
<p>It may be possible to make Wireshark or Ethereal crash or use up
available memory by injecting a purposefully malformed packet onto
the wire or by convincing someone to read a malformed packet trace
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3389</cvename>
<cvename>CVE-2007-3390</cvename>
<cvename>CVE-2007-3391</cvename>
<cvename>CVE-2007-3392</cvename>
<cvename>CVE-2007-3393</cvename>
<url>http://secunia.com/advisories/25833/</url>
<url>http://www.wireshark.org/security/wnpa-sec-2007-02.html</url>
</references>
<dates>
<discovery>2007-06-29</discovery>
<entry>2007-07-06</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="2c4f4688-298b-11dc-a197-0011098b2f36">
<topic>typespeed -- arbitrary code execution</topic>
<affects>
<package>
<name>typespeed</name>
<range><le>0.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-684">
<p>Ulf Härnhammar from the Debian Security Audit Project
discovered a problem in typespeed, a touch-typist trainer
disguised as game. This could lead to a local attacker
executing arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0105</cvename>
<url>http://www.debian.org/security/2005/dsa-684</url>
</references>
<dates>
<discovery>2005-02-16</discovery>
<entry>2007-07-03</entry>
<modified>2007-07-09</modified>
</dates>
</vuln>
<vuln vid="7128fb45-2633-11dc-94da-0016179b2dd5">
<topic>vlc -- format string vulnerability and integer overflow</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>0.8.6c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-001-vlc.txt">
<p>VLC is vulnerable to a format string attack in the parsing
of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
data or SAP/SDP service discovery messages. Additionally,
there are two errors in the handling of wav files, one a
denial of service due to an uninitialized variable, and one
integer overflow in sampling frequency calculations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3316</cvename>
<cvename>CVE-2007-3468</cvename>
<cvename>CVE-2007-3467</cvename>
<url>http://www.isecpartners.com/advisories/2007-001-vlc.txt</url>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-06-18</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="32d38cbb-2632-11dc-94da-0016179b2dd5">
<topic>flac123 -- stack overflow in comment parsing</topic>
<affects>
<package>
<name>flac123</name>
<range><lt>0.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-002-flactools.txt">
<p>flac123, also known as flac-tools, is vulnerable
to a buffer overflow in vorbis comment parsing.
This allows for the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3507</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=710314</url>
<url>http://www.isecpartners.com/advisories/2007-002-flactools.txt</url>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-06-28</entry>
<modified>2007-08-10</modified>
</dates>
</vuln>
<vuln vid="6e099997-25d8-11dc-878b-000c29c5647f">
<topic>gd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.0.35,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gd had been reported vulnerable to several
vulnerabilities:</p>
<ul>
<li>CVE-2007-3472: Integer overflow in gdImageCreateTrueColor
function in the GD Graphics Library (libgd) before 2.0.35
allows user-assisted remote attackers has unspecified attack
vectors and impact.</li>
<li>CVE-2007-3473: The gdImageCreateXbm function in the GD
Graphics Library (libgd) before 2.0.35 allows user-assisted
remote attackers to cause a denial of service (crash) via
unspecified vectors involving a gdImageCreate failure.</li>
<li>CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
reader in the GD Graphics Library (libgd) before 2.0.35 allow
user-assisted remote attackers to have unspecified attack vectors
and impact.</li>
<li>CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35
allows user-assisted remote attackers to cause a denial of service
(crash) via a GIF image that has no global color map.</li>
<li>CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
Library (libgd) before 2.0.35 allows user-assisted remote attackers
to cause a denial of service (crash and heap corruption) via large
color index values in crafted image data, which results in a
segmentation fault.</li>
<li>CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions
in GD Graphics Library (libgd) before 2.0.35 allows attackers to
cause a denial of service (CPU consumption) via a large (1) start or
(2) end angle degree value.</li>
<li>CVE-2007-3478: Race condition in gdImageStringFTEx
(gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd)
before 2.0.35 allows user-assisted remote attackers to cause a
denial of service (crash) via unspecified vectors, possibly
involving truetype font (TTF) support.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-3472</cvename>
<cvename>CVE-2007-3473</cvename>
<cvename>CVE-2007-3474</cvename>
<cvename>CVE-2007-3475</cvename>
<cvename>CVE-2007-3476</cvename>
<cvename>CVE-2007-3477</cvename>
<cvename>CVE-2007-3478</cvename>
<url>http://www.libgd.org/ReleaseNote020035</url>
<url>http://www.frsirt.com/english/advisories/2007/2336</url>
<url>http://bugs.libgd.org/?do=details&task_id=89</url>
<url>http://bugs.libgd.org/?do=details&task_id=94</url>
<url>http://bugs.libgd.org/?do=details&task_id=70</url>
<url>http://bugs.libgd.org/?do=details&task_id=87</url>
<url>http://bugs.libgd.org/?do=details&task_id=92</url>
<url>http://bugs.libgd.org/?do=details&task_id=74</url>
<url>http://bugs.libgd.org/?do=details&task_id=48</url>
<url>http://bugs.php.net/bug.php?id=40578</url>
</references>
<dates>
<discovery>2007-06-21</discovery>
<entry>2007-06-29</entry>
</dates>
</vuln>
<vuln vid="b1b5c125-2308-11dc-b91a-001921ab2fa4">
<topic>evolution-data-server -- remote execution of arbitrary code vulnerability</topic>
<affects>
<package>
<name>evolution-data-server</name>
<range><lt>1.10.2_1</lt></range>
<range><gt>1.11.*</gt><lt>1.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian project reports:</p>
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00082.html">
<p>It was discovered that the IMAP code in the Evolution
Data Server performs insufficient sanitising of a value
later used an array index, which can lead to the execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3257</cvename>
<url>http://secunia.com/advisories/25766/</url>
<url>http://bugzilla.gnome.org/show_bug.cgi?id=447414</url>
</references>
<dates>
<discovery>2007-06-23</discovery>
<entry>2007-06-25</entry>
<modified>2007-06-28</modified>
</dates>
</vuln>
<vuln vid="d337b206-200f-11dc-a197-0011098b2f36">
<topic>xpcd -- buffer overflow</topic>
<affects>
<package>
<name>xpcd</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Project reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-676">
<p>Erik Sjolund discovered a buffer overflow in pcdsvgaview,
an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses
svgalib to display graphics on the Linux console for which
root permissions are required. A malicious user could
overflow a fixed-size buffer and may cause the program to
execute arbitrary code with elevated privileges.</p>
</blockquote>
</body>
</description>
<references>
<bid>12523</bid>
<cvename>CVE-2005-0074</cvename>
<url>http://www.debian.org/security/2005/dsa-676</url>
</references>
<dates>
<discovery>2005-02-11</discovery>
<entry>2007-06-21</entry>
</dates>
</vuln>
<vuln vid="903654bd-1927-11dc-b8a0-02e0185f8d72">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.90.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav had been found vulnerable to multiple vulnerabilities:</p>
<ul>
<li>Improper checking for the end of an buffer causing an
unspecified attack vector.</li>
<li>Insecure temporary file handling, which could be exploited
to read sensitive information.</li>
<li>A flaw in the parser engine which could allow a remote
attacker to bypass the scanning of RAR files.</li>
<li>A flaw in libclamav/unrar.c which could cause a remote
Denial of Service (DoS) by sending a specially crafted
RAR file with a modified vm_codesize.</li>
<li>A flaw in the OLE2 parser which could cause a remote
Denial of Service (DoS).</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-2650</cvename>
<cvename>CVE-2007-3023</cvename>
<cvename>CVE-2007-3024</cvename>
<cvename>CVE-2007-3122</cvename>
<cvename>CVE-2007-3123</cvename>
<url>http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853</url>
</references>
<dates>
<discovery>2007-04-18</discovery>
<entry>2007-06-19</entry>
</dates>
</vuln>
<vuln vid="8092b820-1d6f-11dc-a0b2-001921ab2fa4">
<topic>p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability</topic>
<affects>
<package>
<name>p5-Mail-SpamAssassin</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SpamAssassin website reports:</p>
<blockquote cite="http://spamassassin.apache.org/advisories/cve-2007-2873.txt">
<p>A local user symlink-attack DoS vulnerability in
SpamAssassin has been found, affecting versions 3.1.x,
3.2.0, and SVN trunk.</p>
</blockquote>
</body>
</description>
<references>
<url>http://spamassassin.apache.org/advisories/cve-2007-2873.txt</url>
<cvename>CVE-2007-2873</cvename>
</references>
<dates>
<discovery>2007-06-11</discovery>
<entry>2007-06-18</entry>
</dates>
</vuln>
<vuln vid="39988ee8-1918-11dc-b6bd-0016179b2dd5">
<topic>cups -- Incomplete SSL Negotiation Denial of Service</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24517/">
<p>CUPS is not using multiple workers to handle connections.
This can be exploited to stop CUPS from accepting new connections
by starting but never completing an SSL negotiation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/24517/</url>
<url>http://security.gentoo.org/glsa/glsa-200703-28.xml</url>
<cvename>CVE-2007-0720</cvename>
</references>
<dates>
<discovery>2007-05-05</discovery>
<entry>2007-06-12</entry>
</dates>
</vuln>
<vuln vid="70ae62b0-16b0-11dc-b803-0016179b2dd5">
<topic>c-ares -- DNS Cache Poisoning Vulnerability</topic>
<affects>
<package>
<name>c-ares</name>
<range><lt>1.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25579/">
<p>The vulnerability is caused due to predictable
DNS "Transaction ID" field in DNS queries and can
be exploited to poison the DNS cache of an application
using the library if a valid ID is guessed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3152</cvename>
<cvename>CVE-2007-3153</cvename>
<url>http://secunia.com/advisories/25579/</url>
<url>http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup</url>
</references>
<dates>
<discovery>2007-06-08</discovery>
<entry>2007-06-09</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="0838733d-1698-11dc-a197-0011098b2f36">
<topic>wordpress -- XMLRPC SQL Injection</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25552/">
<p>Slappter has discovered a vulnerability in WordPress, which can
be exploited by malicious users to conduct SQL injection
attacks.</p>
<p>Input passed to the "wp.suggestCategories" method in xmlrpc.php
is not properly sanitised before being used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary
SQL code.</p>
<p>Successful exploitation allows e.g. retrieving usernames and
password hashes, but requires valid user credentials and knowledge
of the database table prefix.</p>
</blockquote>
</body>
</description>
<references>
<bid>24344</bid>
<url>http://secunia.com/advisories/25552/</url>
</references>
<dates>
<discovery>2007-06-06</discovery>
<entry>2007-06-09</entry>
<modified>2007-06-24</modified>
</dates>
</vuln>
<vuln vid="6a31cbe3-1695-11dc-a197-0011098b2f36">
<topic>wordpress -- unmoderated comments disclosure</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Blogsecurity reports:</p>
<blockquote cite="http://blogsecurity.net/news/news-310507/">
<p>An attacker can read comments on posts that have not been
moderated. This can be a real security risk if blog admins
are using unmoderated comments (comments that have not been
made public) to hide sensitive notes regarding posts, future
work, passwords etc. So please be careful if you are one of
these blog admins.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blogsecurity.net/news/news-310507/</url>
</references>
<dates>
<discovery>2007-06-01</discovery>
<entry>2007-06-09</entry>
<modified>2007-08-16</modified>
</dates>
</vuln>
<vuln vid="12b7286f-16a2-11dc-b803-0016179b2dd5">
<topic>webmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.350</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25580/">
<p>Input passed to unspecified parameters in pam_login.cgi
is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an
affected site.</p>
</blockquote>
</body>
</description>
<references>
<bid>24381</bid>
<cvename>CVE-2007-3156</cvename>
<url>http://secunia.com/advisories/25580/</url>
<url>http://www.webmin.com/changes-1.350.html</url>
</references>
<dates>
<discovery>2007-06-01</discovery>
<entry>2007-06-09</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="3ac80dd2-14df-11dc-bcfc-0016179b2dd5">
<topic>mplayer -- cddb stack overflow</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mplayer Team reports:</p>
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
<p>A stack overflow was found in the code used to handle
cddb queries. When copying the album title and category,
no checking was performed on the size of the strings
before storing them in a fixed-size array. A malicious
entry in the database could trigger a stack overflow in
the program, leading to arbitrary code execution with the
uid of the user running MPlayer.</p>
</blockquote>
</body>
</description>
<references>
<bid>24302</bid>
<cvename>CVE-2007-2948</cvename>
</references>
<dates>
<discovery>2007-06-06</discovery>
<entry>2007-06-07</entry>
</dates>
</vuln>
<vuln vid="d9405748-1342-11dc-a35c-001485ab073e">
<topic>mod_jk -- information disclosure</topic>
<affects>
<package>
<name>mod_jk</name>
<range><lt>1.2.23,1</lt></range>
</package>
<package>
<name>mod_jk-ap2</name>
<range><lt>1.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazu Nambo reports:</p>
<blockquote cite="http://tomcat.apache.org/security-jk.html">
<p>URL decoding the the Apache webserver prior to
decoding in the Tomcat server could pypass access
control rules and give access to pages on a different
AJP by sending a crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1860</cvename>
<url>http://secunia.com/advisories/25383/</url>
<url>http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1</url>
<url>http://tomcat.apache.org/security-jk.html</url>
</references>
<dates>
<discovery>2007-05-18</discovery>
<entry>2007-06-05</entry>
<modified>2007-10-31</modified>
</dates>
</vuln>
<vuln vid="62b8f253-12d9-11dc-a35c-001485ab073e">
<topic>typo3 -- email header injection</topic>
<affects>
<package>
<name>typo3</name>
<range><gt>3.0</gt><lt>4.0.5</lt></range>
<range><gt>4.1</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/">
<p>An unspecified error in the internal form engine can be used for
sending arbitrary mail headers, using it for purposes which it
is not meant for, e.g. sending spam messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1081</cvename>
<url>http://secunia.com/advisories/24207/</url>
<url>http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/</url>
</references>
<dates>
<discovery>2007-02-21</discovery>
<entry>2007-06-04</entry>
</dates>
</vuln>
<vuln vid="3d0e724e-129b-11dc-9f79-0016179b2dd5">
<topic>phppgadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phppgadmin</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about phppgadmin:</p>
<blockquote cite="http://www.securityfocus.com/bid/24115/info">
<p>Exploiting this vulnerability may allow an attacker to perform
cross-site scripting attacks on unsuspecting users in the context
of the affected website. As a result, the attacker may be able to
steal cookie-based authentication credentials and to launch other
attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>24115</bid>
<cvename>CVE-2007-5728</cvename>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html</url>
<url>http://secunia.com/advisories/25446/</url>
</references>
<dates>
<discovery>2007-05-27</discovery>
<entry>2007-06-04</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="7ca2a709-103b-11dc-8e82-00001cd613f9">
<topic>findutils -- GNU locate heap buffer overrun</topic>
<affects>
<package>
<name>findutils</name>
<range><lt>4.2.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Youngman reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html">
<p>When GNU locate reads filenames from an old-format locate database,
they are read into a fixed-length buffer allocated on the heap.
Filenames longer than the 1026-byte buffer can cause a buffer
overrun. The overrunning data can be chosen by any person able to
control the names of filenames created on the local system. This
will normally include all local users, but in many cases also remote
users (for example in the case of FTP servers allowing uploads).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2452</cvename>
<mlist>http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html</mlist>
</references>
<dates>
<discovery>2007-05-30</discovery>
<entry>2007-06-01</entry>
</dates>
</vuln>
<vuln vid="de2fab2d-0a37-11dc-aae2-00304881ac9a">
<topic>FreeType 2 -- Heap overflow vulnerability</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754">
<p>Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and
earlier might allow remote attackers to execute arbitrary code via a
crafted TTF image with a negative n_points value, which leads to an
integer overflow and heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2754</cvename>
<mlist>http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html</mlist>
<url>http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200</url>
<freebsdpr>ports/112769</freebsdpr>
</references>
<dates>
<discovery>2007-04-27</discovery>
<entry>2007-05-24</entry>
</dates>
</vuln>
<vuln vid="8e01ab5b-0949-11dc-8163-000e0c2e438a">
<topic>FreeBSD -- heap overflow in file(1)</topic>
<affects>
<package>
<name>file</name>
<range><lt>4.21</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_5</lt></range>
<range><ge>6.1</ge><lt>6.1_17</lt></range>
<range><ge>5.5</ge><lt>5.5_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When writing data into a buffer in the file_printf function,
the length of the unused portion of the buffer is not
correctly tracked, resulting in a buffer overflow when
processing certain files.</p>
<h1>Impact:</h1>
<p>An attacker who can cause file(1) to be run on a maliciously
constructed input can cause file(1) to crash. It may be
possible for such an attacker to execute arbitrary code with
the privileges of the user running file(1).</p>
<p>The above also applies to any other applications using the
libmagic(3) library.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems where file(1) and
other libmagic(3)-using applications are never run on
untrusted input are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2007-1536</cvename>
<freebsdsa>SA-07:04.file</freebsdsa>
</references>
<dates>
<discovery>2007-05-23</discovery>
<entry>2007-05-23</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0e575ed3-0764-11dc-a80b-0016179b2dd5">
<topic>squirrelmail -- Cross site scripting in HTML filter</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.9a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail developers report:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2007-05-09">
<p>Multiple cross-site scripting (XSS) vulnerabilities in the HTML
filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers
to inject arbitrary web script or HTML via the (1) data: URI in an
HTML e-mail attachment or (2) various non-ASCII character sets that
are not properly filtered when viewed with Microsoft Internet
Explorer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1262</cvename>
<url>http://www.squirrelmail.org/security/issue/2007-05-09</url>
</references>
<dates>
<discovery>2007-05-09</discovery>
<entry>2007-05-21</entry>
</dates>
</vuln>
<vuln vid="4cb9c513-03ef-11dc-a51d-0019b95d4f14">
<topic>png -- DoS crash vulnerability</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Libpng Security Advisory reports:</p>
<blockquote cite="http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt">
<p>A grayscale PNG image with a malformed (bad CRC) tRNS
chunk will crash some libpng applications.</p>
<p>This vulnerability could be used to crash a browser when
a user tries to view such a malformed PNG file. It is not
known whether the vulnerability could be exploited
otherwise.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2445</cvename>
<certvu>684664</certvu>
<url>http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt</url>
</references>
<dates>
<discovery>2007-05-15</discovery>
<entry>2007-05-16</entry>
</dates>
</vuln>
<vuln vid="3546a833-03ea-11dc-a51d-0019b95d4f14">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><gt>3.*</gt><lt>3.0.25</lt></range>
<range><gt>3.*,1</gt><lt>3.0.25,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2444.html">
<p>A bug in the local SID/Name translation routines may
potentially result in a user being able to issue SMB/CIFS
protocol operations as root.</p>
<p>When translating SIDs to/from names using Samba local
list of user and group accounts, a logic error in the smbd
daemon's internal security stack may result in a
transition to the root user id rather than the non-root
user. The user is then able to temporarily issue SMB/CIFS
protocol operations as the root user. This window of
opportunity may allow the attacker to establish additional
means of gaining root access to the server.</p>
</blockquote>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2446.html">
<p>Various bugs in Samba's NDR parsing can allow a user to
send specially crafted MS-RPC requests that will overwrite
the heap space with user defined data.</p>
</blockquote>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2447.html">
<p>Unescaped user input parameters are passed as arguments
to /bin/sh allowing for remote command execution.</p>
<p>This bug was originally reported against the anonymous
calls to the SamrChangePassword() MS-RPC function in
combination with the "username map script" smb.conf option
(which is not enabled by default).</p>
<p>After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well. The
root cause is passing unfiltered user input provided via
MS-RPC calls to /bin/sh when invoking externals scripts
defined in smb.conf. However, unlike the "username map
script" vulnerability, the remote file and printer
management scripts require an authenticated user
session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2444</cvename>
<cvename>CVE-2007-2446</cvename>
<cvename>CVE-2007-2447</cvename>
<url>http://de5.samba.org/samba/security/CVE-2007-2444.html</url>
<url>http://de5.samba.org/samba/security/CVE-2007-2446.html</url>
<url>http://de5.samba.org/samba/security/CVE-2007-2447.html</url>
</references>
<dates>
<discovery>2007-05-14</discovery>
<entry>2007-05-16</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="f5e52bf5-fc77-11db-8163-000e0c2e438a">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-imap</name>
<name>php5-odbc</name>
<name>php5-session</name>
<name>php5-shmop</name>
<name>php5-sqlite</name>
<name>php5-wddx</name>
<name>php5</name>
<range><lt>5.2.2</lt></range>
</package>
<package>
<name>php4-odbc</name>
<name>php4-session</name>
<name>php4-shmop</name>
<name>php4-wddx</name>
<name>php4</name>
<range><lt>4.4.7</lt></range>
</package>
<package>
<name>mod_php4-twig</name>
<name>mod_php4</name>
<name>mod_php5</name>
<name>mod_php</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<range><ge>4</ge><lt>4.4.7</lt></range>
<range><ge>5</ge><lt>5.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_2.php">
<p>Security Enhancements and Fixes in PHP 5.2.2 and PHP
4.4.7:</p>
<ul>
<li>Fixed CVE-2007-1001, GD wbmp used with invalid image
size</li>
<li>Fixed asciiz byte truncation inside mail()</li>
<li>Fixed a bug in mb_parse_str() that can be used to
activate register_globals</li>
<li>Fixed unallocated memory access/double free in in
array_user_key_compare()</li>
<li>Fixed a double free inside session_regenerate_id()</li>
<li>Added missing open_basedir & safe_mode checks to zip://
and bzip:// wrappers.</li>
<li>Limit nesting level of input variables with
max_input_nesting_level as fix for.</li>
<li>Fixed CRLF injection inside ftp_putcmd().</li>
<li>Fixed a possible super-global overwrite inside
import_request_variables().</li>
<li>Fixed a remotely trigger-able buffer overflow inside
bundled libxmlrpc library.</li>
</ul>
<p>Security Enhancements and Fixes in PHP 5.2.2 only:</p>
<ul>
<li>Fixed a header injection via Subject and To parameters
to the mail() function</li>
<li>Fixed wrong length calculation in unserialize S
type.</li>
<li>Fixed substr_compare and substr_count information
leak.</li>
<li>Fixed a remotely trigger-able buffer overflow inside
make_http_soap_request().</li>
<li>Fixed a buffer overflow inside
user_filter_factory_create().</li>
</ul>
<p>Security Enhancements and Fixes in PHP 4.4.7 only:</p>
<ul>
<li>XSS in phpinfo()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1001</cvename>
<url>http://www.php.net/releases/4_4_7.php</url>
<url>http://www.php.net/releases/5_2_2.php</url>
</references>
<dates>
<discovery>2007-05-03</discovery>
<entry>2007-05-07</entry>
<modified>2014-04-01</modified>
</dates>
</vuln>
<vuln vid="0ac89b39-f829-11db-b55c-000e0c6d38a9">
<topic>qemu -- several vulnerabilities</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.0_1</lt></range>
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070405_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian Security Team reports:</p>
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html">
<p>Several vulnerabilities have been discovered in the QEMU processor
emulator, which may lead to the execution of arbitrary code or
denial of service. The Common Vulnerabilities and Exposures project
identifies the following problems:</p>
<p>CVE-2007-1320<br/>Tavis Ormandy discovered that a memory management
routine of the Cirrus video driver performs insufficient bounds
checking, which might allow the execution of arbitrary code through
a heap overflow.</p>
<p>CVE-2007-1321<br/>Tavis Ormandy discovered that the NE2000 network
driver and the socket code perform insufficient input validation,
which might allow the execution of arbitrary code through a heap
overflow.</p>
<p>CVE-2007-1322<br/>Tavis Ormandy discovered that the "icebp"
instruction can be abused to terminate the emulation, resulting in
denial of service.</p>
<p>CVE-2007-1323<br/>Tavis Ormandy discovered that the NE2000 network
driver and the socket code perform insufficient input validation,
which might allow the execution of arbitrary code through a heap
overflow.</p>
<p>CVE-2007-1366<br/>Tavis Ormandy discovered that the "aam"
instruction can be abused to crash qemu through a division by zero,
resulting in denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1320</cvename>
<cvename>CVE-2007-1321</cvename>
<cvename>CVE-2007-1322</cvename>
<cvename>CVE-2007-1323</cvename>
<cvename>CVE-2007-1366</cvename>
<mlist msgid="20070501100313.GA4074@galadriel.inutil.org">http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html</mlist>
</references>
<dates>
<discovery>2007-05-01</discovery>
<entry>2007-05-01</entry>
<modified>2007-05-02</modified>
</dates>
</vuln>
<vuln vid="632c98be-aad2-4af2-849f-41a6862afd6a">
<topic>p5-Imager -- possibly exploitable buffer overflow</topic>
<affects>
<package>
<name>p5-Imager</name>
<range><lt>0.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Imager 0.56 and all earlier versions with BMP support have
a security issue when reading compressed 8-bit per pixel BMP
files where either a compressed run of data or a literal run
of data overflows the scan-line.</p>
<p>Such an overflow causes a buffer overflow in a malloc()
allocated memory buffer, possibly corrupting the memory arena
headers.</p>
<p>The effect depends on your system memory allocator, with glibc
this typically results in an abort, but with other memory
allocators it may be possible to cause local code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2007-1942</cvename>
<cvename>CVE-2007-1943</cvename>
<cvename>CVE-2007-1946</cvename>
<cvename>CVE-2007-1948</cvename>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=26811</url>
<url>http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html</url>
</references>
<dates>
<discovery>2007-04-04</discovery>
<entry>2007-04-30</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="275b845e-f56c-11db-8163-000e0c2e438a">
<topic>FreeBSD -- IPv6 Routing Header 0 is dangerous</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_4</lt></range>
<range><ge>6.1</ge><lt>6.1_16</lt></range>
<range><ge>5.5</ge><lt>5.5_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>There is no mechanism for preventing IPv6 routing headers
from being used to route packets over the same link(s) many
times.</p>
<h1>Impact</h1>
<p>An attacker can "amplify" a denial of service attack against
a link between two vulnerable hosts; that is, by sending a
small volume of traffic the attacker can consume a much larger
amount of bandwidth between the two vulnerable hosts.</p>
<p>An attacker can use vulnerable hosts to "concentrate" a
denial of service attack against a victim host or network;
that is, a set of packets sent over a period of 30 seconds
or more could be constructed such that they all arrive at
the victim within a period of 1 second or less over a
period of 30 seconds or more could be constructed such that
they all arrive at the victim within a period of 1 second or
less.</p>
<p>Other attacks may also be possible.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-2242</cvename>
<freebsdsa>SA-07:03.ipv6</freebsdsa>
</references>
<dates>
<discovery>2007-04-26</discovery>
<entry>2007-04-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ef2ffb03-f2b0-11db-ad25-0010b5a0a860">
<topic>mod_perl -- remote DoS in PATH_INFO parsing</topic>
<affects>
<package>
<name>mod_perl</name>
<range><lt>1.30</lt></range>
</package>
<package>
<name>mod_perl2</name>
<range><lt>2.0.3_2,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mandriva reports:</p>
<blockquote cite="http://www.mandriva.com/security/advisories?name=MDKSA-2007:083">
<p>PerlRun.pm in Apache mod_perl 1.29 and earlier, and
RegistryCooker.pm in mod_perl 2.x, does not properly escape
PATH_INFO before use in a regular expression, which allows remote
attackers to cause a denial of service (resource consumption) via a
crafted URI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1349</cvename>
<url>http://www.mandriva.com/security/advisories?name=MDKSA-2007:083</url>
<url>http://secunia.com/advisories/24839</url>
</references>
<dates>
<discovery>2007-03-29</discovery>
<entry>2007-04-24</entry>
<modified>2007-06-27</modified>
</dates>
</vuln>
<vuln vid="c389d06d-ee57-11db-bd51-0016179b2dd5">
<topic>claws-mail -- APOP vulnerability</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558">
<p>The APOP protocol allows remote attackers to guess the first 3
characters of a password via man-in-the-middle (MITM) attacks
that use crafted message IDs and MD5 collisions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1558</cvename>
<url>http://www.claws-mail.org/news.php</url>
</references>
<dates>
<discovery>2007-04-02</discovery>
<entry>2007-04-19</entry>
</dates>
</vuln>
<vuln vid="5678da43-ea99-11db-a802-000fea2763ce">
<topic>lighttpd -- DOS when access files with mtime 0</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd SA:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt">
<p>Lighttpd caches the rendered string for mtime. The cache key has
as a default value 0. At that point the pointer to the string are
still NULL. If a file with an mtime of 0 is requested it tries to
access the pointer and crashes.</p>
<p>The bug requires that a malicious user can either upload files or
manipulate the mtime of the files.</p>
<p>The bug was reported by cubiq and fixed by Marcus Rueckert.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1870</cvename>
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt</url>
</references>
<dates>
<discovery>2007-01-14</discovery>
<entry>2007-04-14</entry>
</dates>
</vuln>
<vuln vid="d2b48d30-ea97-11db-a802-000fea2763ce">
<topic>lighttpd -- Remote DOS in CRLF parsing</topic>
<affects>
<package>
<name>lighttpd</name>
<range><gt>1.4.11</gt><lt>1.4.13_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd SA:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt">
<p>If the connection aborts during parsing "\r\n\r\n" the server
might get into a infinite loop and use 100% of the CPU time.
lighttpd still responses to other requests. This can be repeated
until either the server limit for concurrent connections or file
descriptors is reached.</p>
<p>The bug was reported and fixed by Robert Jakabosky.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1869</cvename>
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt</url>
</references>
<dates>
<discovery>2006-12-15</discovery>
<entry>2007-04-14</entry>
</dates>
</vuln>
<vuln vid="c110eda2-e995-11db-a944-0012f06707f0">
<topic>freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<name>freeradius-mysql</name>
<range><le>1.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradius development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>A malicious 802.1x supplicant could send malformed Diameter format
attributes inside of an EAP-TTLS tunnel. The server would reject
the authentication request, but would leak one VALUE_PAIR data
structure, of approximately 300 bytes. If an attacker performed
the attack many times (e.g. thousands or more over a period of
minutes to hours), the server could leak megabytes of memory,
potentially leading to an "out of memory" condition, and early
process exit.</p>
</blockquote>
</body>
</description>
<references>
<bid>23466</bid>
<cvename>CVE-2005-1455</cvename>
<cvename>CVE-2005-1454</cvename>
<cvename>CVE-2007-2028</cvename>
<cvename>CVE-2005-4745</cvename>
<url>http://www.freeradius.org/security.html</url>
</references>
<dates>
<discovery>2007-04-10</discovery>
<entry>2007-04-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f1c4d133-e6d3-11db-99ea-0060084a00e5">
<topic>fetchmail -- insecure APOP authentication</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-01.txt">
<p>The POP3 standard, currently RFC-1939, has specified an optional,
MD5-based authentication scheme called "APOP" which no longer
should be considered secure.</p>
<p>Additionally, fetchmail's POP3 client implementation has been
validating the APOP challenge too lightly and accepted random
garbage as a POP3 server's APOP challenge. This made it easier
than necessary for man-in-the-middle attackers to retrieve by
several probing and guessing the first three characters of the
APOP secret, bringing brute forcing the remaining characters well
within reach.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1558</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2007-01.txt</url>
</references>
<dates>
<discovery>2007-04-06</discovery>
<entry>2007-04-09</entry>
</dates>
</vuln>
<vuln vid="84d3fbb2-e607-11db-8a32-000c76189c4c">
<topic>mcweject -- exploitable buffer overflow</topic>
<affects>
<package>
<name>mcweject</name>
<range><le>0.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1719">
<p>Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on
FreeBSD, and possibly other versions, allows local users to execute
arbitrary code via a long command line argument, possibly involving
the device name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1719</cvename>
<freebsdpr>ports/111365</freebsdpr>
<url>http://www.milw0rm.com/exploits/3578</url>
</references>
<dates>
<discovery>2007-03-27</discovery>
<entry>2007-04-08</entry>
</dates>
</vuln>
<vuln vid="72999d57-d6f6-11db-961b-005056847b26">
<topic>WebCalendar -- "noSet" variable overwrite vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24403/">
<p>A vulnerability has been discovered in WebCalendar,
which can be exploited by malicious people to compromise
a vulnerable system.</p>
<p>Input passed to unspecified parameters is not properly
verified before being used with the "noSet" parameter set.
This can be exploited to overwrite certain variables, and
allows e.g. the inclusion of arbitrary PHP files from internal
or external resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1343</cvename>
<bid>22834</bid>
<url>http://sourceforge.net/project/shownotes.php?release_id=491130</url>
<url>http://xforce.iss.net/xforce/xfdb/32832</url>
</references>
<dates>
<discovery>2007-03-04</discovery>
<entry>2007-04-08</entry>
</dates>
</vuln>
<vuln vid="34414a1e-e377-11db-b8ab-000c76189c4c">
<topic>zope -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>zope</name>
<range><lt>2.7.9_2</lt></range>
<range><ge>2.8.0</ge><le>2.8.8</le></range>
<range><ge>2.9.0</ge><le>2.9.6</le></range>
<range><ge>2.10.0</ge><le>2.10.2</le></range>
</package>
<package>
<name>plone</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zope Team reports:</p>
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view">
<p>A vulnerability has been discovered in Zope, where by certain types
of misuse of HTTP GET, an attacker could gain elevated privileges.
All Zope versions up to and including 2.10.2 are affected.</p>
</blockquote>
</body>
</description>
<references>
<bid>23084</bid>
<cvename>CVE-2007-0240</cvename>
<freebsdpr>ports/111119</freebsdpr>
<url>http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view</url>
<url>http://plone.org/products/plone/releases/2.5.3</url>
</references>
<dates>
<discovery>2007-01-16</discovery>
<entry>2007-04-05</entry>
<modified>2009-03-22</modified>
</dates>
</vuln>
<vuln vid="c27bc173-d7aa-11db-b141-0016179b2dd5">
<topic>Squid -- TRACE method handling denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.6.*</ge><lt>2.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid advisory 2007:1 notes:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_1.txt">
<p>Due to an internal error Squid-2.6 is vulnerable to a denial of
service attack when processing the TRACE request method.</p>
<p>Workarounds:</p>
<p>To work around the problem deny access to using the TRACE method by
inserting the following two lines before your first http_access
rule.</p>
<p>acl TRACE method TRACE</p>
<p>http_access deny TRACE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1560</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2007_1.txt</url>
</references>
<dates>
<discovery>2007-03-20</discovery>
<entry>2007-03-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="8e02441d-d39c-11db-a6da-0003476f14d3">
<topic>sql-ledger -- security bypass vulnerability</topic>
<affects>
<package>
<name>sql-ledger</name>
<range><lt>2.6.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Travers reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/462375">
<p>George Theall of Tenable Security notified the LedgerSMB
core team today of an authentication bypass vulnerability
allowing full access to the administrator interface of
LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused
by the password checking routine failing to enforce a
password check under certain circumstances. The user
can then create accounts or effect denial of service
attacks.</p>
<p>This is not related to any previous CVE.</p>
<p>We have coordinated with the SQL-Ledger vendor and
today both of us released security patches correcting
the problem. SQL-Ledger users who can upgrade to 2.6.26
should do so, and LedgerSMB 1.1 or 1.0 users should
upgrade to 1.1.9. Users who cannot upgrade should
configure their web servers to use http authentication
for the admin.pl script in the main root directory.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/110350</freebsdpr>
<url>http://www.securityfocus.com/archive/1/462375</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="f235fe7a-b9ca-11db-bf0f-0013720b182d">
<topic>samba -- potential Denial of Service bug in smbd</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0452.html">
<p>Internally Samba's file server daemon, smbd, implements
support for deferred file open calls in an attempt to serve
client requests that would otherwise fail due to a share mode
violation. When renaming a file under certain circumstances
it is possible that the request is never removed from the deferred
open queue. smbd will then become stuck is a loop trying to
service the open request.</p>
<p>This bug may allow an authenticated user to exhaust resources
such as memory and CPU on the server by opening multiple CIFS
sessions, each of which will normally spawn a new smbd process,
and sending each connection into an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0452</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-0452.html</url>
</references>
<dates>
<discovery>2007-02-05</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="57ae52f7-b9cc-11db-bf0f-0013720b182d">
<topic>samba -- format string bug in afsacl.so VFS plugin</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0454.html">
<p>NOTE: This security advisory only impacts Samba servers
that share AFS file systems to CIFS clients and which have
been explicitly instructed in smb.conf to load the afsacl.so
VFS module.</p>
<p>The source defect results in the name of a file stored on
disk being used as the format string in a call to snprintf().
This bug becomes exploitable only when a user is able
to write to a share which utilizes Samba's afsacl.so library
for setting Windows NT access control lists on files residing
on an AFS file system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0454</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-0454.html</url>
</references>
<dates>
<discovery>2007-02-05</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="73f53712-d028-11db-8c07-0211d85f11fb">
<topic>ktorrent -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ktorrent</name>
<range><lt>2.1.2</lt></range>
</package>
<package>
<name>ktorrent-devel</name>
<range><lt>20070311</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two problems have been found in KTorrent:</p>
<ul>
<li>KTorrent does not properly sanitize file names to filter
out ".." components, so it's possible for an attacker to create
a malicious torrent in order to overwrite arbitrary files within
the filesystem.</li>
<li>Messages with invalid chunk indexes aren't rejected.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-1384</cvename>
<cvename>CVE-2007-1385</cvename>
<url>http://ktorrent.org/forum/viewtopic.php?t=1401</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-11</entry>
<modified>2007-03-14</modified>
</dates>
</vuln>
<vuln vid="abeb9b64-ce50-11db-bc24-0016179b2dd5">
<topic>mplayer -- DMO File Parsing Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>"Moritz Jodeit reports:</p>
<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html">
<p>There's an exploitable buffer overflow in the current version
of MPlayer (v1.0rc1) which can be exploited with a maliciously
crafted video file. It is hidden in the DMO_VideoDecoder()
function of `loader/dmo/DMO_VideoDecoder.c' file.</p>
</blockquote>
</body>
</description>
<references>
<bid>22771</bid>
<cvename>CVE-2007-1246</cvename>
</references>
<dates>
<discovery>2007-02-11</discovery>
<entry>2007-03-09</entry>
</dates>
</vuln>
<vuln vid="e546c7ce-ce46-11db-bc24-0016179b2dd5">
<topic>trac -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>trac</name>
<range><lt>0.10.3</lt></range>
</package>
<package>
<name>ja-trac</name>
<range><lt>0.10.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24470/">
<p>The vulnerability is caused due to an error within the
"download wiki page as text" function, which can be exploited
to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
<p>Successful exploitation may require that the victim uses IE.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/24470</url>
<url>http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-09</entry>
</dates>
</vuln>
<vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9">
<topic>mod_jk -- long URL stack overflow vulnerability</topic>
<affects>
<package>
<name>mod_jk-ap2</name>
<name>mod_jk</name>
<range><ge>1.2.19</ge><lt>1.2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TippingPoint and The Zero Day Initiative reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html">
<p>This vulnerability allows remote attackers to execute
arbitrary code on vulnerable installations of Apache
Tomcat JK Web Server Connector. Authentication is not
required to exploit this vulnerability.</p>
<p>The specific flaw exists in the URI handler for the
mod_jk.so library, map_uri_to_worker(), defined in
native/common/jk_uri_worker_map.c. When parsing a long URL
request, the URI worker map routine performs an unsafe
memory copy. This results in a stack overflow condition
which can be leveraged to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0774</cvename>
<url>http://tomcat.apache.org/security-jk.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url>
</references>
<dates>
<discovery>2007-03-02</discovery>
<entry>2007-03-05</entry>
<modified>2007-03-06</modified>
</dates>
</vuln>
<vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a">
<topic>bind -- Multiple Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>named</name>
<range><lt>9.3.4</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_1</lt></range>
<range><ge>6.1</ge><lt>6.1_13</lt></range>
<range><ge>5.5</ge><lt>5.5_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A type * (ANY) query response containing multiple RRsets can
trigger an assertion failure.</p>
<p>Certain recursive queries can cause the nameserver to crash
by using memory which has already been freed.</p>
<h1>Impact:</h1>
<p>A remote attacker sending a type * (ANY) query to an
authoritative DNS server for a DNSSEC signed zone can cause
the named(8) daemon to exit, resulting in a Denial of
Service.</p>
<p>A remote attacker sending recursive queries can cause the
nameserver to crash, resulting in a Denial of Service.</p>
<h1>Workaround:</h1>
<p>There is no workaround available, but systems which are not
authoritative servers for DNSSEC signed zones are not
affected by the first issue; and systems which do not permit
untrusted users to perform recursive DNS resolution are not
affected by the second issue. Note that the default
configuration for named(8) in FreeBSD allows local access
only (which on many systems is equivalent to refusing access
to untrusted users).</p>
</body>
</description>
<references>
<cvename>CVE-2007-0493</cvename>
<cvename>CVE-2007-0494</cvename>
<freebsdsa>SA-07:02.bind</freebsdsa>
</references>
<dates>
<discovery>2007-02-09</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="46b922a8-c69c-11db-9f82-000e0c2e438a">
<topic>FreeBSD -- Jail rc.d script privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_12</lt></range>
<range><ge>6.0</ge><lt>6.0_17</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In multiple situations the host's jail rc.d(8) script does
not check if a path inside the jail file system structure is
a symbolic link before using the path. In particular this is
the case when writing the output from the jail start-up to
/var/log/console.log and when mounting and unmounting file
systems inside the jail directory structure.</p>
<h1>Impact:</h1>
<p>Due to the lack of handling of potential symbolic links the
host's jail rc.d(8) script is vulnerable to "symlink
attacks". By replacing /var/log/console.log inside the jail
with a symbolic link it is possible for the superuser (root)
inside the jail to overwrite files on the host system outside
the jail with arbitrary content. This in turn can be used to
execute arbitrary commands with non-jailed superuser
privileges.</p>
<p>Similarly, by changing directory mount points inside the
jail file system structure into symbolic links, it may be
possible for a jailed attacker to mount file systems which
were meant to be mounted inside the jail at arbitrary points
in the host file system structure, or to unmount arbitrary
file systems on the host system.</p>
<p>NOTE WELL: The above vulnerabilities occur only when a jail
is being started or stopped using the host's jail rc.d(8)
script; once started (and until stopped), running jails
cannot exploit this.</p>
<h1>Workaround:</h1>
<p>If the sysctl(8) variable security.jail.chflags_allowed is
set to 0 (the default), setting the "sunlnk" system flag on
/var, /var/log, /var/log/console.log, and all file system
mount points and their parent directories inside the jail(s)
will ensure that the console log file and mount points are
not replaced by symbolic links. If this is done while jails
are running, the administrator must check that an attacker
has not replaced any directories with symlinks after setting
the "sunlnk" flag.</p>
</body>
</description>
<references>
<cvename>CVE-2007-0166</cvename>
<freebsdsa>SA-07:01.jail</freebsdsa>
</references>
<dates>
<discovery>2007-01-11</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="44449bf7-c69b-11db-9f82-000e0c2e438a">
<topic>gtar -- name mangling symlink vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.5</ge><lt>5.5_9</lt></range>
<range><ge>4.11</ge><lt>4.11_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Symlinks created using the "GNUTYPE_NAMES" tar extension can
be absolute due to lack of proper sanity checks.</p>
<h1>Impact:</h1>
<p>If an attacker can get a user to extract a specially crafted
tar archive the attacker can overwrite arbitrary files with
the permissions of the user running gtar. If file system
permissions allow it, this may allow the attacker to overwrite
important system file (if gtar is being run as root), or
important user configuration files such as .tcshrc or .bashrc,
which would allow the attacker to run arbitrary commands.</p>
<h1>Workaround:</h1>
<p>Use "bsdtar", which is the default tar implementation in
FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available
in the FreeBSD Ports Collection as
ports/archivers/libarchive.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6097</cvename>
<freebsdsa>SA-06:26.gtar</freebsdsa>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5c554c0f-c69a-11db-9f82-000e0c2e438a">
<topic>FreeBSD -- Kernel memory disclosure in firewire(4)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_11</lt></range>
<range><ge>6.0</ge><lt>6.2_16</lt></range>
<range><ge>5.5</ge><lt>5.5_9</lt></range>
<range><ge>4.11</ge><lt>4.11_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In the FW_GCROM ioctl, a signed integer comparison is used
instead of an unsigned integer comparison when computing the
length of a buffer to be copied from the kernel into the
calling application.</p>
<h1>Impact:</h1>
<p>A user in the "operator" group can read the contents of
kernel memory. Such memory might contain sensitive
information, such as portions of the file cache or terminal
buffers. This information might be directly useful, or it
might be leveraged to obtain elevated privileges in some way;
for example, a terminal buffer might include a user-entered
password.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems without IEEE 1394
("FireWire") interfaces are not vulnerable. (Note that
systems with IEEE 1394 interfaces are affected regardless of
whether any devices are attached.)</p>
<p>Note also that FreeBSD does not have any non-root users in
the "operator" group by default; systems on which no users
have been added to this group are therefore also not
vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6013</cvename>
<freebsdsa>SA-06:25.kmem</freebsdsa>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="792bc222-c5d7-11db-9f82-000e0c2e438a">
<topic>libarchive -- Infinite loop in corrupt archives handling in libarchive</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the end of an archive is reached while attempting to
"skip" past a region of an archive, libarchive will enter an
infinite loop wherein it repeatedly attempts (and fails) to
read further data.</p>
<h1>Impact:</h1>
<p>An attacker able to cause a system to extract (via "tar -x"
or another application which uses libarchive) or list the
contents (via "tar -t" or another libarchive-using
application) of an archive provided by the attacker can cause
libarchive to enter an infinite loop and use all available
CPU time.</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5680</cvename>
<freebsdsa>SA-06:24.libarchive</freebsdsa>
</references>
<dates>
<discovery>2006-11-08</discovery>
<entry>2007-02-26</entry>
</dates>
</vuln>
<vuln vid="0f37d765-c5d4-11db-9f82-000e0c2e438a">
<topic>OpenSSL -- Multiple problems in crypto(3)</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>0.9.7l_0</lt></range>
<range><ge>0.9.8</ge><lt>0.9.8d_0</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_9</lt></range>
<range><ge>6.0</ge><lt>6.0_14</lt></range>
<range><ge>5.5</ge><lt>5.5_7</lt></range>
<range><ge>5.4</ge><lt>5.4_21</lt></range>
<range><ge>5.3</ge><lt>5.3_36</lt></range>
<range><ge>4.11</ge><lt>4.11_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Several problems have been found in OpenSSL:</p>
<ul>
<li>During the parsing of certain invalid ASN1 structures an
error condition is mishandled, possibly resulting in an
infinite loop.</li>
<li>A buffer overflow exists in the SSL_get_shared_ciphers
function.</li>
<li>A NULL pointer may be dereferenced in the SSL version 2
client code.</li>
</ul>
<p>In addition, many applications using OpenSSL do not perform
any validation of the lengths of public keys being used.</p>
<h1>Impact:</h1>
<p>Servers which parse ASN1 data from untrusted sources may be
vulnerable to a denial of service attack.</p>
<p>An attacker accessing a server which uses SSL version 2 may
be able to execute arbitrary code with the privileges of that
server.</p>
<p>A malicious SSL server can cause clients connecting using
SSL version 2 to crash.</p>
<p>Applications which perform public key operations using
untrusted keys may be vulnerable to a denial of service
attack.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but not all of the
vulnerabilities mentioned affect all applications.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2937</cvename>
<cvename>CVE-2006-2938</cvename>
<cvename>CVE-2006-2940</cvename>
<cvename>CVE-2006-3738</cvename>
<cvename>CVE-2006-4343</cvename>
<freebsdsa>SA-06:23.openssl</freebsdsa>
</references>
<dates>
<discovery>2006-09-28</discovery>
<entry>2007-02-26</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="12bd6ecf-c430-11db-95c5-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.10,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.10</lt></range>
</package>
<package>
<name>lightning</name>
<range><lt>0.3.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.8</lt></range>
<range><ge>1.1</ge><lt>1.1.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.10</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.04.18</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>1.5.a2007.04.18</lt></range>
</package>
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.2">
<ul>
<li>MFSA 2007-08 onUnload + document.write() memory corruption</li>
<li>MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks</li>
<li>MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow</li>
<li>MFSA 2007-05 XSS and local file access by opening blocked popups</li>
<li>MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot</li>
<li>MFSA 2007-03 Information disclosure through cache collisions</li>
<li>MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks</li>
<li>MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6077</cvename>
<cvename>CVE-2007-0008</cvename>
<cvename>CVE-2007-0009</cvename>
<cvename>CVE-2007-0775</cvename>
<cvename>CVE-2007-0776</cvename>
<cvename>CVE-2007-0777</cvename>
<cvename>CVE-2007-0778</cvename>
<cvename>CVE-2007-0779</cvename>
<cvename>CVE-2007-0780</cvename>
<cvename>CVE-2007-0800</cvename>
<cvename>CVE-2007-0981</cvename>
<cvename>CVE-2007-0995</cvename>
<cvename>CVE-2007-1092</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-01.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-02.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-03.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-04.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-05.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-06.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-07.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-08.html</url>
</references>
<dates>
<discovery>2007-02-23</discovery>
<entry>2007-02-24</entry>
<modified>2007-04-19</modified>
</dates>
</vuln>
<vuln vid="afdf500f-c1f6-11db-95c5-000c6ec775d9">
<topic>snort -- DCE/RPC preprocessor vulnerability</topic>
<affects>
<package>
<name>snort</name>
<range><ge>2.6.1</ge><lt>2.6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A IBM Internet Security Systems Protection Advisory
reports:</p>
<blockquote cite="http://iss.net/threats/257.html">
<p>Snort is vulnerable to a stack-based buffer overflow as a
result of DCE/RPC reassembly. This vulnerability is in a
dynamic-preprocessor enabled in the default configuration,
and the configuration for this preprocessor allows for
auto-recognition of SMB traffic to perform reassembly
on. No checks are performed to see if the traffic is part
of a valid TCP session, and multiple Write AndX requests
can be chained in the same TCP segment. As a result, an
attacker can exploit this overflow with a single TCP PDU
sent across a network monitored by Snort or Sourcefire.</p>
<p>Snort users who cannot upgrade immediately are advised to
disable the DCE/RPC preprocessor by removing the DCE/RPC
preprocessor directives from snort.conf and restarting
Snort. However, be advised that disabling the DCE/RPC
preprocessor reduces detection capabilities for attacks in
DCE/RPC traffic. After upgrading, customers should
re-enable the DCE/RPC preprocessor.</p>
</blockquote>
</body>
</description>
<references>
<certvu>196240</certvu>
<cvename>CVE-2006-5276</cvename>
<url>http://xforce.iss.net/xforce/xfdb/31275</url>
<url>http://www.snort.org/docs/advisory-2007-02-19.html</url>
</references>
<dates>
<discovery>2007-02-19</discovery>
<entry>2007-02-21</entry>
</dates>
</vuln>
<vuln vid="94234e00-be8a-11db-b2ec-000c6ec775d9">
<topic>rar -- password prompt buffer overflow vulnerability</topic>
<affects>
<package>
<name>rar</name>
<range><lt>3.70.b1,1</lt></range>
</package>
<package>
<name>unrar</name>
<name>zh-unrar</name>
<range><lt>3.70.b1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472">
<p>Remote exploitation of a stack based buffer overflow
vulnerability in RARLabs Unrar may allow an attacker to
execute arbitrary code with the privileges of the user
opening the archive.</p>
<p>Unrar is prone to a stack based buffer overflow when
processing specially crafted password protected
archives.</p>
<p>If users are using the vulnerable command line based
unrar, they still need to interact with the program in
order to trigger the vulnerability. They must respond to
the prompt asking for the password, after which the
vulnerability will be triggered. They do not need to enter
a correct password, but they must at least push the enter
key.</p>
</blockquote>
</body>
</description>
<references>
<bid>22447</bid>
<cvename>CVE-2007-0855</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472</url>
<url>http://www.rarsoft.com/rarnew.htm</url>
</references>
<dates>
<discovery>2007-02-07</discovery>
<entry>2007-02-17</entry>
</dates>
</vuln>
<vuln vid="7fcf1727-be71-11db-b2ec-000c6ec775d9">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-imap</name>
<name>php5-odbc</name>
<name>php5-session</name>
<name>php5-shmop</name>
<name>php5-sqlite</name>
<name>php5-wddx</name>
<name>php5</name>
<range><lt>5.2.1_2</lt></range>
</package>
<package>
<name>php4-odbc</name>
<name>php4-session</name>
<name>php4-shmop</name>
<name>php4-wddx</name>
<name>php4</name>
<range><lt>4.4.5</lt></range>
</package>
<package>
<name>mod_php4-twig</name>
<name>mod_php4</name>
<name>mod_php5</name>
<name>mod_php</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<range><ge>4</ge><lt>4.4.5</lt></range>
<range><ge>5</ge><lt>5.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been found in PHP, including:
buffer overflows, stack overflows, format string, and
information disclosure vulnerabilities.</p>
<p>The session extension contained <code>safe_mode</code> and
<code>open_basedir</code> bypasses, but the FreeBSD Security
Officer does not consider these real security
vulnerabilities, since <code>safe_mode</code> and
<code>open_basedir</code> are insecure by design and should
not be relied upon.</p>
</body>
</description>
<references>
<cvename>CVE-2007-0905</cvename>
<cvename>CVE-2007-0906</cvename>
<cvename>CVE-2007-0907</cvename>
<cvename>CVE-2007-0908</cvename>
<cvename>CVE-2007-0909</cvename>
<cvename>CVE-2007-0910</cvename>
<cvename>CVE-2007-0988</cvename>
<url>http://secunia.com/advisories/24089/</url>
<url>http://www.php.net/releases/4_4_5.php</url>
<url>http://www.php.net/releases/5_2_1.php</url>
</references>
<dates>
<discovery>2007-02-09</discovery>
<entry>2007-02-17</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="7bb127c1-a5aa-11db-9ddc-0011098b2f36">
<topic>joomla -- multiple remote vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23563/">
<p>Some vulnerabilities have been reported in Joomla!, where some
have unknown impacts and one can be exploited by malicious people
to conduct cross-site scripting attacks.</p>
<ol>
<li>Input passed to an unspecified parameter is not properly
sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.</li>
<li>The vulnerabilities are caused due to unspecified errors
in Joomla!. The vendor describes them as "several low level
security issues". No further information is currently
available.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>21810</bid>
<cvename>CVE-2006-6832</cvename>
<cvename>CVE-2006-6833</cvename>
<cvename>CVE-2006-6834</cvename>
<url>http://secunia.com/advisories/23563/</url>
</references>
<dates>
<discovery>2006-12-29</discovery>
<entry>2007-01-17</entry>
</dates>
</vuln>
<vuln vid="1374b96c-a1c2-11db-9ddc-0011098b2f36">
<topic>sircd -- remote reverse DNS buffer overflow</topic>
<affects>
<package>
<name>sircd</name>
<range><le>0.4.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/8153/">
<p>A vulnerability in sircd can be exploited by a malicious person
to compromise a vulnerable system. The vulnerability is caused
by a boundary error in the code handling reverse DNS lookups,
when a user connects to the service. If the FQDN (Fully Qualified
Domain Name) returned is excessively long, the allocated buffer
is overflowed making it possible to execute arbitrary code on the
system with the privileges of the sircd daemon.</p>
</blockquote>
</body>
</description>
<references>
<bid>6924</bid>
<url>http://secunia.com/advisories/8153</url>
</references>
<dates>
<discovery>2003-02-24</discovery>
<entry>2007-01-15</entry>
</dates>
</vuln>
<vuln vid="e92d8f6b-a1c0-11db-9ddc-0011098b2f36">
<topic>sircd -- remote operator privilege escalation vulnerability</topic>
<affects>
<package>
<name>sircd</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/10274/">
<p>A vulnerability has been reported in sircd, which can be
exploited by malicious users to gain operator privileges.
The problem is that any user reportedly can set their usermode
to operator. The vulnerability has been reported in
versions 0.5.2 and 0.5.3. Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<bid>9097</bid>
<url>http://secunia.com/advisories/10274/</url>
</references>
<dates>
<discovery>2003-11-20</discovery>
<entry>2007-01-15</entry>
</dates>
</vuln>
<vuln vid="41da2ba4-a24e-11db-bd24-000f3dcc6a5d">
<topic>cacti -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6i.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23528/">
<p>rgod has discovered four vulnerabilities in Cacti,
which can be exploited by malicious people to bypass
certain security restrictions, manipulate data
and compromise vulnerable systems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/23528/</url>
<url>http://forums.cacti.net/about18846-0-asc-0.html</url>
</references>
<dates>
<discovery>2006-12-28</discovery>
<entry>2007-01-12</entry>
</dates>
</vuln>
<vuln vid="b2ff68b2-9f29-11db-a4e4-0211d87675b7">
<topic>mplayer -- buffer overflow in the code for RealMedia RTSP streams.</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
<p>A potential buffer overflow was found in the code used to handle
RealMedia RTSP streams. When checking for matching asm rules, the code
stores the results in a fixed-size array, but no boundary checks are
performed. This may lead to a buffer overflow if the user is tricked
into connecting to a malicious server. Since the attacker cannot write
arbitrary data into the buffer, creating an exploit is very hard; but a
DoS attack is easily made.
A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006
UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c,
stream/realrtsp/asmrp.h and stream/realrtsp/real.c.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/107217</freebsdpr>
<cvename>CVE-2006-6172</cvename>
<url>http://www.mplayerhq.hu/design7/news.html</url>
</references>
<dates>
<discovery>2006-12-31</discovery>
<entry>2007-01-08</entry>
</dates>
</vuln>
<vuln vid="37e30313-9d8c-11db-858b-0060084a00e5">
<topic>fetchmail -- crashes when refusing a message bound for an MDA</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.5</ge><lt>6.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-03.txt">
<p>When delivering messages to a message delivery agent by means
of the "mda" option, fetchmail can crash (by passing
a NULL pointer to ferror() and fflush()) when refusing a message.
SMTP and LMTP delivery modes aren't affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5974</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-03.txt</url>
</references>
<dates>
<discovery>2007-01-04</discovery>
<entry>2007-01-06</entry>
</dates>
</vuln>
<vuln vid="5238ac45-9d8c-11db-858b-0060084a00e5">
<topic>fetchmail -- TLS enforcement problem/MITM attack/password exposure</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-02.txt">
<p>Fetchmail has had several longstanding password disclosure
vulnerabilities.</p>
<ul>
<li>sslcertck/sslfingerprint options should have implied
"sslproto tls1" in order to enforce TLS negotiation,
but did not.</li>
<li>Even with "sslproto tls1" in the config, fetches
would go ahead in plain text if STLS/STARTTLS wasn't available
(not advertised, or advertised but rejected).</li>
<li>POP3 fetches could completely ignore all TLS options
whether available or not because it didn't reliably issue
CAPA before checking for STLS support - but CAPA is a
requisite for STLS. Whether or not CAPAbilities were probed,
depended on the "auth" option. (Fetchmail only
tried CAPA if the auth option was not set at all, was set
to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)</li>
<li>POP3 could fall back to using plain text passwords, even
if strong authentication had been configured.</li>
<li>POP2 would not complain if strong authentication or TLS
had been requested.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5867</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-02.txt</url>
</references>
<dates>
<discovery>2007-01-04</discovery>
<entry>2007-01-06</entry>
</dates>
</vuln>
<vuln vid="78ad2525-9d0c-11db-a5f6-000c6ec775d9">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457">
<p>The vulnerability specifically exists due to Opera
improperly processing a JPEG DHT marker. The DHT marker is
used to define a Huffman Table which is used for decoding
the image data. An invalid number of index bytes in the
DHT marker will trigger a heap overflow with partially
user controlled data.</p>
<p>Exploitation of this vulnerability would allow an
attacker to execute arbitrary code on the affected
host. The attacker would first need to construct a website
containing the malicious image and trick the vulnerable
user into visiting the site. This would trigger the
vulnerability and allow the code to execute with the
privileges of the local user.</p>
</blockquote>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458">
<p>A flaw exists within Opera's Javascript SVG
implementation. When processing a
createSVGTransformFromMatrix request Opera does not
properly validate the type of object passed to the
function. Passing an incorrect object to this function can
result in it using a pointer that is user controlled when
it attempts to make the virtual function call.</p>
<p>Exploitation of this vulnerability would allow an
attacker to execute arbitrary code on the affected
host. The attacker would first need to construct a website
containing the malicious JavaScript and trick the
vulnerable user into visiting the site. This would trigger
the vulnerability and allow the code to execute with the
privileges of the local user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0126</cvename>
<cvename>CVE-2007-0127</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=851</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=852</url>
</references>
<dates>
<discovery>2007-01-05</discovery>
<entry>2007-01-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="3d8d3548-9d02-11db-a541-000ae42e9b93">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><gt>4.7</gt><lt>4.7.5</lt></range>
<range><lt>4.6.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal security team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2007-001/advisory.txt">
<p>A few arguments passed via URLs are not properly sanitized
before display. When an attacker is able to entice an
administrator to follow a specially crafted link, arbitrary
HTML and script code can be injected and executed in the
victim's session. Such an attack may lead to administrator
access if certain conditions are met.</p>
</blockquote>
<blockquote cite="http://drupal.org/files/sa-2007-002/advisory.txt">
<p>The way page caching was implemented allows a denial of
service attack. An attacker has to have the ability to post
content on the site. He or she would then be able to poison
the page cache, so that it returns cached 404 page not found
errors for existing pages.</p>
<p>If the page cache is not enabled, your site is not vulnerable.
The vulnerability only affects sites running on top of MySQL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0136</cvename>
<url>http://drupal.org/files/sa-2007-001/advisory.txt</url>
<url>http://drupal.org/files/sa-2007-002/advisory.txt</url>
</references>
<dates>
<discovery>2007-01-05</discovery>
<entry>2007-01-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9347d82d-9a66-11db-b271-000e35248ad7">
<topic>w3m -- format string vulnerability</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>w3m-m17n</name>
<name>w3m-m17n-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An anonymous person reports:</p>
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439">
<p>w3m-0.5.1 crashes when using the -dump or -backend options to
open a HTTPS URL with a SSL certificate where the CN contains
"%n%n%n%n%n%n".</p>
</blockquote>
</body>
</description>
<references>
<bid>21735</bid>
<cvename>CVE-2006-6772</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439</url>
<url>http://secunia.com/advisories/23492/</url>
</references>
<dates>
<discovery>2006-12-10</discovery>
<entry>2007-01-03</entry>
</dates>
</vuln>
<vuln vid="f4ff7434-9505-11db-9ddc-0011098b2f36">
<topic>plone -- user can masquerade as a group</topic>
<affects>
<package>
<name>plone</name>
<range><gt>2.5</gt><lt>2.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="http://plone.org/products/plone-hotfix/releases/20061031">
<p>PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a
potential vulnerability that allows a user to masquerade as a group.
Please update your sites.</p>
</blockquote>
</body>
</description>
<references>
<bid>21460</bid>
<cvename>CVE-2006-4249</cvename>
<url>http://plone.org/products/plone-hotfix/releases/20061031</url>
</references>
<dates>
<discovery>2006-11-02</discovery>
<entry>2006-12-27</entry>
</dates>
</vuln>
<vuln vid="3f851b22-89fb-11db-a937-003048116330">
<topic>proftpd -- remote code execution vulnerabilities</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The proftpd development team reports that several
remote buffer overflows had been found in the
proftpd server.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5815</cvename>
<cvename>CVE-2006-6170</cvename>
</references>
<dates>
<discovery>2006-11-10</discovery>
<entry>2006-12-21</entry>
</dates>
</vuln>
<vuln vid="11a84092-8f9f-11db-ab33-000e0c2e438a">
<topic>gzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_7</lt></range>
<range><ge>6.0</ge><lt>6.0_12</lt></range>
<range><ge>5.5</ge><lt>5.5_5</lt></range>
<range><ge>5.4</ge><lt>5.4_19</lt></range>
<range><ge>5.3</ge><lt>5.3_34</lt></range>
<range><lt>4.11_22</lt></range>
</package>
<package>
<name>gzip</name>
<range><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Multiple programming errors have been found in gzip which
can be triggered when gzip is decompressing files. These
errors include insufficient bounds checks in buffer use, a
NULL pointer dereference, and a potential infinite loop.</p>
<h1>Impact</h1>
<p>The insufficient bounds checks in buffer use can cause gzip
to crash, and may permit the execution of arbitrary code.
The NULL pointer deference can cause gzip to crash. The
infinite loop can cause a Denial-of-Service situation where
gzip uses all available CPU time.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4334</cvename>
<cvename>CVE-2006-4335</cvename>
<cvename>CVE-2006-4336</cvename>
<cvename>CVE-2006-4337</cvename>
<cvename>CVE-2006-4338</cvename>
<freebsdsa>SA-06:21.gzip</freebsdsa>
</references>
<dates>
<discovery>2006-09-19</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ef3306fc-8f9b-11db-ab33-000e0c2e438a">
<topic>bind9 -- Denial of Service in named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_6</lt></range>
<range><ge>6.0</ge><lt>6.0_11</lt></range>
<range><ge>5.5</ge><lt>5.5_4</lt></range>
<range><ge>5.4</ge><lt>5.4_18</lt></range>
<range><ge>5.0</ge><lt>5.3_33</lt></range>
</package>
<package>
<name>bind9</name>
<range><ge>9.0</ge><lt>9.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>For a recursive DNS server, a remote attacker sending enough
recursive queries for the replies to arrive after all the
interested clients have left the recursion queue will trigger
an INSIST failure in the named(8) daemon. Also for a
recursive DNS server, an assertion failure can occur when
processing a query whose reply will contain more than one
SIG(covered) RRset.</p>
<p>For an authoritative DNS server serving a RFC 2535 DNSSEC
zone which is queried for the SIG records where there are
multiple SIG(covered) RRsets (e.g. a zone apex), named(8)
will trigger an assertion failure when it tries to construct
the response.</p>
<h1>Impact</h1>
<p>An attacker who can perform recursive lookups on a DNS server
and is able to send a sufficiently large number of recursive
queries, or is able to get the DNS server to return more than
one SIG(covered) RRsets can stop the functionality of the DNS
service.</p>
<p>An attacker querying an authoritative DNS server serving a
RFC 2535 DNSSEC zone may be able to crash the DNS server.</p>
<h1>Workaround</h1>
<p>A possible workaround is to only allow trusted clients to
perform recursive queries.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4095</cvename>
<cvename>CVE-2006-4096</cvename>
<freebsdsa>SA-06:20.bind</freebsdsa>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="077c2dca-8f9a-11db-ab33-000e0c2e438a">
<topic>openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_6</lt></range>
<range><ge>6.0</ge><lt>6.0_11</lt></range>
<range><ge>5.5</ge><lt>5.5_4</lt></range>
<range><ge>5.4</ge><lt>5.4_18</lt></range>
<range><ge>5.3</ge><lt>5.3_33</lt></range>
<range><lt>4.11_21</lt></range>
</package>
<package>
<name>openssl</name>
<range><gt>0.9.8</gt><lt>0.9.8c_9</lt></range>
<range><lt>0.9.7k_0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
bytes which follow the cryptographic hash being signed. In
a valid signature there will be no such bytes.</p>
<h1>Impact</h1>
<p>OpenSSL will incorrectly report some invalid signatures as
valid. When an RSA public exponent of 3 is used, or more
generally when a small public exponent is used with a
relatively large modulus (e.g., a public exponent of 17 with
a 4096-bit modulus), an attacker can construct a signature
which OpenSSL will accept as a valid PKCS#1 v1.5 signature.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4339</cvename>
<freebsdsa>SA-06:19.openssl</freebsdsa>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0679deeb-8eaf-11db-abc9-0003476f14d3">
<topic>sql-ledger -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sql-ledger</name>
<range><lt>2.6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian security Team reports:</p>
<blockquote cite="http://www.us.debian.org/security/2006/dsa-1239">
<p>Several remote vulnerabilities have been discovered in SQL
Ledger, a web based double-entry accounting program, which may
lead to the execution of arbitrary code. The Common
Vulnerabilities and Exposures project identifies the following
problems:</p>
<p>Chris Travers discovered that the session management can be
tricked into hijacking existing sessions.</p>
<p>Chris Travers discovered that directory traversal
vulnerabilities can be exploited to execute arbitrary Perl
code.</p>
<p>It was discovered that missing input sanitising allows
execution of arbitrary Perl code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4244</cvename>
<cvename>CVE-2006-4731</cvename>
<cvename>CVE-2006-5872</cvename>
<url>http://www.us.debian.org/security/2006/dsa-1239</url>
</references>
<dates>
<discovery>2006-12-17</discovery>
<entry>2006-12-18</entry>
</dates>
</vuln>
<vuln vid="5b47b70d-8ba9-11db-81d5-00123ffe8333">
<topic>dbus -- match_rule_equal() Weakness</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23373/">
<p>D-Bus have a weakness, which can be exploited by malicious, local
users to cause a DoS (Denial of Service).</p>
<p>An error within the "match_rule_equal()" function can be
exploited to disable the ability of other processes to receive
messages by removing their matches from D-Bus.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6107</cvename>
<url>http://www.freedesktop.org/wiki/Software/dbus</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055</url>
<url>http://secunia.com/advisories/23373/</url>
</references>
<dates>
<discovery>2006-12-12</discovery>
<entry>2006-12-14</entry>
</dates>
</vuln>
<vuln vid="779a2d55-8ba8-11db-81d5-00123ffe8333">
<topic>evince -- Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>evince</name>
<range><lt>0.6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23111/">
<p>A vulnerability has been discovered in Evince, which can be
exploited by malicious people to compromise a user's system.</p>
<p>The vulnerability is caused due to a boundary error within the
"get_next_text()" function in ps/ps.c. This can be exploited to
cause a buffer overflow by e.g. tricking a user into opening a
specially crafted PostScript file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5864</cvename>
<url>http://secunia.com/advisories/23111/</url>
</references>
<dates>
<discovery>2006-11-27</discovery>
<entry>2006-12-14</entry>
</dates>
</vuln>
<vuln vid="fefd93d8-8af5-11db-9d01-0016179b2dd5">
<topic>tdiary -- injection vulnerability</topic>
<affects>
<package>
<name>ja-tdiary</name>
<name>tdiary</name>
<range><le>2.0.3</le></range>
</package>
<package>
<name>ja-tdiary-devel</name>
<name>tdiary-devel</name>
<range><gt>2.1</gt><lt>2.1.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An undisclosed eRuby injection vulnerability had been discovered in
tDiary.</p>
</body>
</description>
<references>
<url>http://sourceforge.net/forum/forum.php?forum_id=642685</url>
</references>
<dates>
<discovery>2006-12-10</discovery>
<entry>2006-12-13</entry>
<modified>2007-03-16</modified>
</dates>
</vuln>
<vuln vid="d29dc506-8aa6-11db-bd0d-00123ffe8333">
<topic>wv -- Multiple Integer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>wv</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22595/">
<p>Some vulnerabilities have been reported in wvWare, which can be
exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise an application using the library.</p>
<p>The vulnerabilities are caused due to integer overflows within
the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can
be exploited to cause heap-based buffer overflows by e.g. tricking
a user to open a specially crafted Microsoft Word document with an
application using the library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4513</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434</url>
<url>http://secunia.com/advisories/22595/</url>
</references>
<dates>
<discovery>2006-10-26</discovery>
<entry>2006-12-13</entry>
</dates>
</vuln>
<vuln vid="b9044cc2-8aa5-11db-bd0d-00123ffe8333">
<topic>wv2 -- Integer Overflow Vulnerability</topic>
<affects>
<package>
<name>wv2</name>
<range><lt>0.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20665/">
<p>A vulnerability has been reported in wvWare wv2 Library, which
potentially can be exploited by malicious people to compromise an
application using the library.</p>
<p>The vulnerability is caused due to an integer overflow error in
"word_helper.h" when handling a Word document. This can be
exploited to cause a buffer overflow and may allow arbitrary code
execution via a specially crafted Word document.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2197</cvename>
<url>http://secunia.com/advisories/20665/</url>
</references>
<dates>
<discovery>2006-06-12</discovery>
<entry>2006-12-13</entry>
</dates>
</vuln>
<vuln vid="e969e6cb-8911-11db-9d01-0016179b2dd5">
<topic>tnftpd -- Remote root Exploit</topic>
<affects>
<package>
<name>tnftpd</name>
<range><lt>20040810</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The tnftpd port suffer from a remote stack overrun,
which can lead to a root compromise.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6652</cvename>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html</url>
</references>
<dates>
<discovery>2006-12-01</discovery>
<entry>2006-12-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="eb5124a4-8a20-11db-b033-00123ffe8333">
<topic>clamav -- Multipart Nestings Denial of Service</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.7</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20061029</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23347/">
<p>Clam AntiVirus have a vulnerability, which can be exploited by
malicious people to cause a DoS (Denial of Service).</p>
<p>The vulnerability is caused due to a stack overflow when scanning
messages with deeply nested multipart content. This can be
exploited to crash the service by sending specially crafted emails
to a vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6481</cvename>
<url>http://secunia.com/advisories/23347/</url>
<url>http://www.quantenblog.net/security/virus-scanner-bypass</url>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2006-12-12</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="1b043693-8617-11db-93b2-000e35248ad7">
<topic>libxine -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libxine development team reports that several
vulnerabilities had been found in the libxine library. The
first vulnerability is caused by improper checking of the
src/input/libreal/real.c "real_parse_sdp()" function.
A remote attacker could exploit this by tricking an user to
connect to a preparated server potentially causing a buffer
overflow. Another buffer overflow had been found in the
libmms library, potentially allowing a remote attacker to
cause a denial of service vulnerability, and possible remote
code execution through the following functions: send_command,
string_utf16, get_data and get_media_packets. Other functions
might be affected as well.</p>
</body>
</description>
<references>
<bid>18608</bid>
<bid>21435</bid>
<cvename>CVE-2006-2200</cvename>
<cvename>CVE-2006-6172</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=468432</url>
</references>
<dates>
<discovery>2006-05-04</discovery>
<entry>2006-12-07</entry>
<modified>2006-12-09</modified>
</dates>
</vuln>
<vuln vid="4db1669c-8589-11db-ac4f-02e081235dab">
<topic>gnupg -- remotely controllable function pointer</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">
<p>GnuPG uses data structures called filters to process
OpenPGP messages. These filters are used in a similar
way as a pipelines in the shell. For communication
between these filters context structures are used. These
are usually allocated on the stack and passed to the
filter functions. At most places the OpenPGP data stream
fed into these filters is closed before the context
structure gets deallocated. While decrypting encrypted
packets, this may not happen in all cases and the filter
may use a void contest structure filled with garbage. An
attacker may control this garbage. The filter context
includes another context used by the low-level decryption
to access the decryption algorithm. This is done using a
function pointer. By carefully crafting an OpenPGP
message, an attacker may control this function pointer and
call an arbitrary function of the process. Obviously an
exploit needs to prepared for a specific version,
compiler, libc, etc to be successful - but it is
definitely doable.</p>
<p>Fixing this is obvious: We need to allocate the context on
the heap and use a reference count to keep it valid as
long as either the controlling code or the filter code
needs it.</p>
<p>We have checked all other usages of such a stack based
filter contexts but fortunately found no other vulnerable
places. This allows to release a relatively small patch.
However, for reasons of code cleanness and easier audits
we will soon start to change all these stack based filter
contexts to heap based ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6235</cvename>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html</url>
<url>http://secunia.com/advisories/23245/</url>
</references>
<dates>
<discovery>2006-12-04</discovery>
<entry>2006-12-07</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="a8674c14-83d7-11db-88d5-0012f06707f0">
<topic>ruby -- cgi.rb library Denial of Service</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.5_5,1</lt></range>
</package>
<package>
<name>ruby_static</name>
<range><ge>1.8.*,1</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/">
<p>Another vulnerability has been discovered in the CGI library
(cgi.rb) that ships with Ruby which could be used by a malicious
user to create a denial of service attack (DoS).</p>
<p>A specific HTTP request for any web application using cgi.rb
causes CPU consumption on the machine on which the web application
is running. Many such requests result in a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6303</cvename>
<url>http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/</url>
</references>
<dates>
<discovery>2006-12-04</discovery>
<entry>2006-12-04</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="ed124f8c-82a2-11db-b46b-0012f06707f0">
<topic>libmusicbrainz -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>libmusicbrainz</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about libmusicbrainz:</p>
<blockquote cite="http://www.securityfocus.com/bid/19508/discuss">
<p>The libmusicbrainz library is prone to multiple buffer-overflow
vulnerabilities because the application fails to check the size of
the data before copying it into a finite-sized internal memory
buffer.</p>
<p>An attacker can exploit these issues to execute arbitrary code
within the context of the application or to cause a
denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>19508</bid>
<cvename>CVE-2006-4197</cvename>
<url>http://www.securityfocus.com/bid/21185/discuss</url>
</references>
<dates>
<discovery>2006-08-17</discovery>
<entry>2006-12-02</entry>
</dates>
</vuln>
<vuln vid="666b8c9e-8212-11db-851e-0016179b2dd5">
<topic>tdiary -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>ja-tdiary</name>
<name>tdiary</name>
<range><le>2.0.2</le></range>
</package>
<package>
<name>ja-tdiary-devel</name>
<name>tdiary-devel</name>
<range><gt>2.1</gt><lt>2.1.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tDiary was vulnerable to an unspecified Cross-Site
Scripting vulnerability</p>
</body>
</description>
<references>
<cvename>CVE-2006-6174</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=638868</url>
</references>
<dates>
<discovery>2006-11-26</discovery>
<entry>2006-12-02</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="18e3a5be-81f9-11db-95a2-0012f06707f0">
<topic>ImageMagick -- SGI Image File heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><ge>6.0.0</ge><lt>6.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about ImageMagick:</p>
<blockquote cite="http://www.securityfocus.com/bid/21185/info">
<p>ImageMagick is prone to a remote heap-based buffer-overflow
vulnerability because the application fails to properly
bounds-check user-supplied input before copying it to an
insufficiently sized memory buffer.</p>
<p>Exploiting this issue allows attackers to execute arbitrary
machine code in the context of applications that use the
ImageMagick library.</p>
</blockquote>
</body>
</description>
<references>
<bid>21185</bid>
<cvename>CVE-2006-5868</cvename>
<url>http://www.securityfocus.com/bid/21185/discuss</url>
</references>
<dates>
<discovery>2006-11-14</discovery>
<entry>2006-12-02</entry>
</dates>
</vuln>
<vuln vid="3dd7eb58-80ae-11db-b4ec-000854d03344">
<topic>gtar -- GNUTYPE_NAMES directory traversal vulnerability</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Teemu Salmela reports:</p>
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html">
<p>There is a tar record type, called GNUTYPE_NAMES (an
obsolete GNU extension), that allows the creation of
symbolic links pointing to arbitrary locations in the
filesystem, which makes it possible to create/overwrite
arbitrary files.</p>
</blockquote>
</body>
</description>
<references>
<bid>21235</bid>
<cvename>CVE-2006-6097</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html</url>
</references>
<dates>
<discovery>2006-11-21</discovery>
<entry>2006-11-30</entry>
</dates>
</vuln>
<vuln vid="a8af7d70-8007-11db-b280-0008743bf21a">
<topic>kronolith -- arbitrary local file inclusion vulnerability</topic>
<affects>
<package>
<name>kronolith</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Labs reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445">
<p>Remote exploitation of a design error in Horde's Kronolith
could allow an authenticated web mail user to execute
arbitrary PHP code under the security context of the running
web server.</p>
<p>The vulnerability specifically exists due to a design error in the
way it includes certain files. Specifically, the 'lib/FBView.php'
file contains a function 'Kronolith_FreeBusy_View::factory' which
will include local files that are supplied via the 'view' HTTP GET
request parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.horde.org/archives/announce/2006/000307.html</url>
</references>
<dates>
<discovery>2006-11-29</discovery>
<entry>2006-11-30</entry>
</dates>
</vuln>
<vuln vid="34c93ae8-7e6f-11db-bf00-02e081235dab">
<topic>gnupg -- buffer overflow</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html">
<p>When running GnuPG interactively, special crafted
messages may be used to crash gpg or gpg2. Running gpg in
batch mode, as done by all software using gpg as a backend
(e.g. mailers), is not affected by this bug.</p>
<p>Exploiting this overflow seems to be possible.</p>
<p>gpg-agent, gpgsm, gpgv or other tools from the GnuPG
suite are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html</url>
</references>
<dates>
<discovery>2006-11-27</discovery>
<entry>2006-11-27</entry>
</dates>
</vuln>
<vuln vid="cca97f5f-7435-11db-91de-0008743bf21a">
<topic>proftpd -- Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><le>1.3.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/4451">
<p>A vulnerability has been identified in ProFTPD, which could be
exploited by attackers to cause a denial of service or execute
arbitrary commands. This flaw is due to a buffer overflow error
in the "main.c" file where the "cmd_buf_size" size of the buffer
used to handle FTP commands sent by clients is not properly set
to the size configured via the "CommandBufferSize" directive,
which could be exploited by attackers to compromise a vulnerable
server via a specially crafted FTP command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.frsirt.com/english/advisories/2006/4451</url>
</references>
<dates>
<discovery>2006-11-10</discovery>
<entry>2006-11-14</entry>
<modified>2006-11-15</modified>
</dates>
</vuln>
<vuln vid="5a945904-73b1-11db-91d2-0002a5c2f4ef">
<topic>unzoo -- Directory Traversal Vulnerability</topic>
<affects>
<package>
<name>unzoo</name>
<range><lt>4.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/12857/">
<p>Doubles has discovered a vulnerability in Unzoo, which
potentially can be exploited by malicious people to
compromise a user's system.</p>
<p>The vulnerability is caused due to an input validation error
when unpacking archives. This can be exploited via a
directory traversal attack to overwrite files outside the
directory, where the files are extracted to, if a user is
tricked into extracting a malicious archive using Unzoo.</p>
</blockquote>
</body>
</description>
<references>
<bid>11417</bid>
<url>http://secunia.com/advisories/12857/</url>
<url>http://securitytracker.com/alerts/2004/Oct/1011673.html</url>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2006-11-14</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="6d68618a-7199-11db-a2ad-000c6ec775d9">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><gt>2.*</gt><lt>2.22.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.18.5/">
<ul>
<li>Sometimes the information put into the <h1> and
<h2> tags in Bugzilla was not properly escaped,
leading to a possible XSS vulnerability.</li>
<li>Bugzilla administrators were allowed to put raw,
unfiltered HTML into many fields in Bugzilla, leading to
a possible XSS vulnerability. Now, the HTML allowed in
those fields is limited.</li>
<li>attachment.cgi could leak the names of private
attachments</li>
<li>The "deadline" field was visible in the XML format of
a bug, even to users who were not a member of the
"timetrackinggroup."</li>
<li>A malicious user could pass a URL to an admin, and
make the admin delete or change something that he had
not intended to delete or change.</li>
<li>It is possible to inject arbitrary HTML into the
showdependencygraph.cgi page, allowing for a cross-site
scripting attack.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5453</cvename>
<cvename>CVE-2006-5454</cvename>
<cvename>CVE-2006-5455</cvename>
<url>http://www.bugzilla.org/security/2.18.5/</url>
</references>
<dates>
<discovery>2006-10-15</discovery>
<entry>2006-11-11</entry>
</dates>
</vuln>
<vuln vid="92442c4b-6f4a-11db-bd28-0012f06707f0">
<topic>Imlib2 -- multiple image file processing vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>20060926_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22732/">
<p>Some vulnerabilities have been reported in imlib2, which can be
exploited by malicious people to cause a DoS (Denial of Service)
or potentially compromise an application using the library.</p>
<p>The vulnerabilities are caused due to unspecified errors within
the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images.
This may be exploited to execute arbitrary code by e.g. tricking a
user into opening a specially crafted image file with an
application using imlib2.</p>
</blockquote>
</body>
</description>
<references>
<bid>20903</bid>
<cvename>CVE-2006-4806</cvename>
<cvename>CVE-2006-4807</cvename>
<cvename>CVE-2006-4808</cvename>
<cvename>CVE-2006-4809</cvename>
</references>
<dates>
<discovery>2006-11-03</discovery>
<entry>2006-11-08</entry>
</dates>
</vuln>
<vuln vid="ab8dbe98-6be4-11db-ae91-0012f06707f0">
<topic>ruby -- cgi.rb library Denial of Service</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.5_4,1</lt></range>
</package>
<package>
<name>ruby_static</name>
<range><ge>1.8.*,1</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2006/11/03/CVE-2006-5467/">
<p>A vulnerability has been discovered in the CGI library (cgi.rb)
that ships with Ruby which could be used by a malicious user to
create a denial of service attack (DoS). The problem is triggered
by sending the library an HTTP request that uses multipart MIME
encoding and as an invalid boundary specifier that begins with
"-" instead of "--". Once triggered it will
exhaust all available memory resources effectively creating a DoS
condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>20777</bid>
<cvename>CVE-2006-5467</cvename>
<url>http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html</url>
</references>
<dates>
<discovery>2006-10-25</discovery>
<entry>2006-11-04</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="b318dc8c-6756-11db-83c3-000c6ec775d9">
<topic>screen -- combined UTF-8 characters vulnerability</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability in the handling of combined UTF-8
characters in screen may allow an user-assisted attacker to
crash screen or potentially allow code execution as the user
running screen. To exploit this issue the user running
scren must in some way interact with the attacker.</p>
</body>
</description>
<references>
<bid>20727</bid>
<cvename>CVE-2006-4573</cvename>
<mlist>http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html</mlist>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056</url>
</references>
<dates>
<discovery>2006-10-23</discovery>
<entry>2006-10-29</entry>
</dates>
</vuln>
<vuln vid="a9c51caf-6603-11db-ab90-000e35fd8194">
<topic>mysql -- database suid privilege escalation</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.12</lt></range>
<range><ge>5.0</ge><lt>5.0.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dmitri Lenev reports a privilege escalation in
MySQL. MySQL evaluates arguments of suid routines in the
security context of the routine's definer instead of the
routine's caller, which allows remote and local
authenticated users to gain privileges through a routine
that has been made available using GRANT EXECUTE.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4227</cvename>
<url>http://bugs.mysql.com/bug.php?id=18630</url>
</references>
<dates>
<discovery>2006-03-29</discovery>
<entry>2006-10-29</entry>
<modified>2006-10-30</modified>
</dates>
</vuln>
<vuln vid="a0e92718-6603-11db-ab90-000e35fd8194">
<topic>mysql -- database "case-sensitive" privilege escalation</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.12</lt></range>
<range><ge>5.0</ge><lt>5.0.25</lt></range>
<range><lt>4.1.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Prokopiuk reports a privilege escalation in MySQL.
The vulnerability causes MySQL, when run on case-sensitive
filesystems, to allow remote and local authenticated users
to create or access a database when the database name
differs only in case from a database for which they have
permissions.</p>
</body>
</description>
<references>
<bid>19559</bid>
<cvename>CVE-2006-4226</cvename>
<url>http://bugs.mysql.com/bug.php?id=17647</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-10-29</entry>
</dates>
</vuln>
<vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
<topic>Serendipity -- XSS Vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Serendipity Team reports:</p>
<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
<p>Serendipity failed to correctly sanitize user input on the
media manager administration page. The content of GET variables
were written into JavaScript strings. By using standard string
evasion techniques it was possible to execute arbitrary
JavaScript.</p>
<p>Additionally Serendipity dynamically created a HTML form on
the media manager administration page that contained all
variables found in the URL as hidden fields. While the variable
values were correctly escaped it was possible to break out
by specifying strange variable names.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
<url>http://secunia.com/advisories/22501/</url>
</references>
<dates>
<discovery>2006-10-19</discovery>
<entry>2006-10-21</entry>
</dates>
</vuln>
<vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
<topic>kdelibs -- integer overflow in khtml</topic>
<affects>
<package>
<name>kdelibs</name>
<name>kdelibs-nocups</name>
<range><lt>3.5.4_4</lt></range>
</package>
<package>
<name>qt</name>
<name>qt-copy</name>
<range><lt>3.3.6_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2006-0720.html">
<p>An integer overflow flaw was found in the way Qt handled pixmap
images. The KDE khtml library uses Qt in such a way that untrusted
parameters could be passed to Qt, triggering the overflow.
An attacker could for example create a malicious web page that when
viewed by a victim in the Konqueror browser would cause Konqueror
to crash or possibly execute arbitrary code with the privileges of
the victim.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4811</cvename>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742</url>
<url>http://rhn.redhat.com/errata/RHSA-2006-0720.html</url>
</references>
<dates>
<discovery>2006-10-14</discovery>
<entry>2006-10-22</entry>
</dates>
</vuln>
<vuln vid="4867ae85-608d-11db-8faf-000c6ec775d9">
<topic>opera -- URL parsing heap overflow vulnerability</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><gt>9.*</gt><lt>9.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Labs reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424">
<p>Remote exploitation of a heap overflow vulnerability
within version 9 of Opera Software's Opera Web browser
could allow an attacker to execute arbitrary code on the
affected host.</p>
<p>A flaw exists within Opera when parsing a tag that
contains a URL. A heap buffer with a constant size of 256
bytes is allocated to store the URL, and the tag's URL is
copied into this buffer without sufficient bounds checking
of its length.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4819</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424</url>
<url>http://secunia.com/advisories/22218/</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=848</url>
</references>
<dates>
<discovery>2006-10-17</discovery>
<entry>2006-10-20</entry>
</dates>
</vuln>
<vuln vid="1c0def84-5fb1-11db-b2e9-0008c79fa3d2">
<topic>asterisk -- remote heap overwrite vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<name>asterisk-bristuff</name>
<range><lt>1.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Boileau of Security-Assessment.com reports:</p>
<blockquote cite="http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf">
<p>The Asterisk Skinny channel driver for Cisco SCCP phones
(chan_skinny.so) incorrectly validates a length value in
the packet header. An integer wrap-around leads to heap
overwrite, and arbitrary remote code execution as root.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf</url>
<mlist msgid="4536A2F2.2020902@security-assessment.com">http://marc.theaimsgroup.com/?l=bugtraq&m=116121567530170</mlist>
</references>
<dates>
<discovery>2006-10-17</discovery>
<entry>2006-10-20</entry>
</dates>
</vuln>
<vuln vid="b6c18956-5fa3-11db-ad2d-0016179b2dd5">
<topic>plone -- unprotected MembershipTool methods</topic>
<affects>
<package>
<name>plone</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Plone Team reports:</p>
<blockquote cite="http://dev.plone.org/plone/ticket/5432">
<p>Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict
access to the:</p>
<ul>
<li>changeMemberPortrait</li>
<li>deletePersonalPortrait</li>
<li>testCurrentPassword</li>
</ul>
<p>methods, which allows remote attackers to modify portraits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1711</cvename>
<url>http://plone.org/products/plone/releases/2.1.4</url>
<url>https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt</url>
</references>
<dates>
<discovery>2006-10-19</discovery>
<entry>2006-10-19</entry>
<modified>2006-10-20</modified>
</dates>
</vuln>
<vuln vid="19207592-5f17-11db-ae08-0008743bf21a">
<topic>drupal -- HTML attribute injection</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-026/advisory.txt">
<p>A malicious user may entice users to visit a specially
crafted URL that may result in the redirection of Drupal
form submission to a third-party site. A user visiting the
user registration page via such a url, for example, will
submit all data, such as his/her e-mail address, but also
possible private profile data, to a third-party site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-026/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="937d5911-5f16-11db-ae08-0008743bf21a">
<topic>drupal -- cross site request forgeries</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-025/advisory.txt">
<p>Visiting a specially crafted page, anywhere on the web, may
allow that page to post forms to a Drupal site in the
context of the visitor's session. To illustrate; suppose
one has an active user 1 session, the most powerful
administrator account for a site, to a Drupal site while
visiting a website created by an attacker. This website
will now be able to submit any form to the Drupal site with
the privileges of user 1, either by enticing the user to
submit a form or by automated means.</p>
<p>An attacker can exploit this vulnerability by changing
passwords, posting PHP code or creating new users, for
example. The attack is only limited by the privileges of
the session it executes in.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-025/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="b2383758-5f15-11db-ae08-0008743bf21a">
<topic>drupal -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-024/advisory.txt">
<p>A bug in input validation and lack of output validation
allows HTML and script insertion on several pages.</p>
<p>Drupal's XML parser passes unescaped data to watchdog
under certain circumstances. A malicious user may execute
an XSS attack via a specially crafted RSS feed. This
vulnerability exists on systems that do not use PHP's
mb_string extension (to check if mb_string is being used,
navigate to admin/settings and look under "String
handling"). Disabling the aggregator module provides an
immediate workaround.</p>
<p>The aggregator module, profile module, and forum module do
not properly escape output of certain fields.</p>
<p>Note: XSS attacks may lead to administrator access if
certain conditions are met.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-024/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="18a14baa-5ee5-11db-ae08-0008743bf21a">
<topic>ingo -- local arbitrary shell command execution</topic>
<affects>
<package>
<name>ingo</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports a vulnerability within Ingo, the
filter management suite. The vulnerability is caused due to
inadequete escaping, possibly allowing a local user to execute
arbitrary shell commands via procmail.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5449</cvename>
<url>http://bugs.horde.org/ticket/?id=4513</url>
<url>http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&r2=1.55.2.59&ty=h</url>
<url>http://lists.horde.org/archives/announce/2006/000296.html</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="a6d9da4a-5d5e-11db-8faf-000c6ec775d9">
<topic>NVIDIA UNIX driver -- arbitrary root code execution vulnerability</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><ge>1.0.8762</ge><lt>1.0.8776</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rapid7 reports:</p>
<blockquote cite="http://www.rapid7.com/advisories/R7-0025.jsp">
<p>The NVIDIA Binary Graphics Driver for Linux is vulnerable
to a buffer overflow that allows an attacker to run
arbitrary code as root. This bug can be exploited both
locally or remotely (via a remote X client or an X client
which visits a malicious web page). A working
proof-of-concept root exploit is included with this
advisory.</p>
<p>The NVIDIA drivers for Solaris and FreeBSD are also
likely to be vulnerable.</p>
</blockquote>
<p>Disabling Render acceleration in the "nvidia" driver, via
the "RenderAccel" X configuration option, can be used as a
workaround for this issue.</p>
</body>
</description>
<references>
<certvu>147252</certvu>
<cvename>CVE-2006-5379</cvename>
<url>http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971</url>
<url>http://secunia.com/advisories/22419/</url>
<url>http://www.rapid7.com/advisories/R7-0025.jsp</url>
</references>
<dates>
<discovery>2006-10-16</discovery>
<entry>2006-10-16</entry>
<modified>2006-10-21</modified>
</dates>
</vuln>
<vuln vid="8012a79d-5d21-11db-bb8d-00123ffe8333">
<topic>clamav -- CHM unpacker and PE rebuilding vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.5</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20060922</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22370/">
<p>Two vulnerabilities have been reported in Clam AntiVirus, which
potentially can be exploited by malicious people to cause a DoS
(Denial of Service) or compromise a vulnerable system.</p>
<p>1) An unspecified error in the CHM unpacker in chmunpack.c can be
exploited to cause a DoS.</p>
<p>2) An unspecified error in rebuildpe.c when rebuilding PE files
after unpacking can be exploited to cause a heap-based buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/22370/</url>
<url>http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=455799</url>
</references>
<dates>
<discovery>2006-10-15</discovery>
<entry>2006-10-16</entry>
</dates>
</vuln>
<vuln vid="93ba13f8-5c41-11db-a5ae-00508d6a62df">
<topic>tkdiff -- temporary file symlink privilege escalation</topic>
<affects>
<package>
<name>tkdiff</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports a vulnerability in
tkdiff which allows local users to gain priveleges of the
user running tkdiff due to insecure temporary file creation.</p>
</body>
</description>
<references>
<url>http://www.debian.org/security/2005/dsa-927</url>
<cvename>CVE-2005-3343</cvename>
<bid>16064</bid>
<url>http://secunia.com/advisories/18083</url>
</references>
<dates>
<discovery>2005-12-20</discovery>
<entry>2006-10-15</entry>
</dates>
</vuln>
<vuln vid="2c8a84d9-5bee-11db-a5ae-00508d6a62df">
<topic>vtiger -- multiple remote file inclusion vulnerabilities</topic>
<affects>
<package>
<name>vtiger</name>
<range><lt>5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dedi Dwianto a.k.a the_day reports:</p>
<blockquote cite="http://www.milw0rm.com/exploits/2508">
<p>Input passed to the "$calpath" parameter in update.php is
not properly verified before being used. This can be
exploited to execute arbitrary PHP code by including files
from local or external resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5289</cvename>
<bid>20435</bid>
<mlist msgid="20061009094328.15530.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=116049557032343</mlist>
<url>http://advisories.echo.or.id/adv/adv54-theday-2006.txt</url>
</references>
<dates>
<discovery>2006-10-09</discovery>
<entry>2006-10-15</entry>
</dates>
</vuln>
<vuln vid="5c9a2769-5ade-11db-a5ae-00508d6a62df">
<topic>google-earth -- heap overflow in the KML engine</topic>
<affects>
<package>
<name>google-earth</name>
<range><lt>4.0.2414</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JAAScois reports:</p>
<p>While processing KML/KMZ data Google Earth fails to verify
its size prior to copying it into a fixed-sized buffer.
This can be exploited as a buffer-overflow vulnerability to
cause the application to crash and/or to execute arbitrary
code.</p>
</body>
</description>
<references>
<bid>20464</bid>
<url>http://www.jaascois.com/exploits/18602024/</url>
</references>
<dates>
<discovery>2006-10-10</discovery>
<entry>2006-10-14</entry>
<modified>2007-04-13</modified>
</dates>
</vuln>
<vuln vid="72f21372-55e4-11db-a5ae-00508d6a62df">
<topic>torrentflux -- User-Agent XSS Vulnerability</topic>
<affects>
<package>
<name>torrentflux</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/">
<p>Steven Roddis reports that User-Agent string is not
properly escaped when handled by torrentflux. This allows
for arbitrary code insertion.</p>
</blockquote>
</body>
</description>
<references>
<bid>20371</bid>
<cvename>CVE-2006-5227</cvename>
<url>http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/</url>
<url>http://secunia.com/advisories/22293/</url>
</references>
<dates>
<discovery>2006-09-30</discovery>
<entry>2006-10-07</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="fe83eb5b-55e1-11db-a5ae-00508d6a62df">
<topic>python -- buffer overrun in repr() for unicode strings</topic>
<affects>
<package>
<name>python+ipv6</name>
<range><ge>0</ge></range>
</package>
<package>
<name>python</name>
<range><lt>2.4.3_1</lt></range>
<range><gt>2.5.*</gt><lt>2.5.c2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Benjamin C. Wiley Sittler reports:</p>
<blockquote cite="https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633">
<p>I discovered a [buffer overrun in repr() for unicode
strings]. This causes an unpatched non-debug wide
(UTF-32/UCS-4) build of python to abort.</p>
</blockquote>
<p>Ubuntu security team reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-359-1">
<p>If an application uses repr() on arbitrary untrusted data,
this [bug] could be exploited to execute arbitrary code
with the privileges of the python application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4980</cvename>
<url>https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633</url>
<url>http://www.ubuntu.com/usn/usn-359-1</url>
<url>http://secunia.com/advisories/22276/</url>
</references>
<dates>
<discovery>2006-08-15</discovery>
<entry>2006-10-07</entry>
<modified>2006-10-08</modified>
</dates>
</vuln>
<vuln vid="e329550b-54f7-11db-a5ae-00508d6a62df">
<topic>php -- _ecalloc Integer Overflow Vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.1.6_1</lt></range>
</package>
<package>
<name>php5-cli</name>
<name>php5-cgi</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<name>mod_php5</name>
<range><ge>5</ge><lt>5.1.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_092006.133.html">
<p>The PHP 5 branch of the PHP source code lacks the
protection against possible integer overflows inside
ecalloc() that is present in the PHP 4 branch and also for
several years part of our Hardening-Patch and our new
Suhosin-Patch.</p>
<p>It was discovered that such an integer overflow can be
triggered when user input is passed to the unserialize()
function. Earlier vulnerabilities in PHP's unserialize()
that were also discovered by one of our audits in December
2004 are unrelated to the newly discovered flaw, but they
have shown, that the unserialize() function is exposed to
user-input in many popular PHP applications. Examples for
applications that use the content of COOKIE variables with
unserialize() are phpBB and Serendipity.</p>
<p>The successful exploitation of this integer overflow will
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4812</cvename>
<url>http://www.hardened-php.net/advisory_092006.133.html</url>
<url>http://secunia.com/advisories/22280/</url>
</references>
<dates>
<discovery>2006-09-30</discovery>
<entry>2006-10-06</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="8a5770b4-54b5-11db-a5ae-00508d6a62df">
<topic>mambo -- multiple SQL injection vulnerabilities</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Bercegay reports:</p>
<blockquote cite="http://www.gulftech.org/?node=research&article_id=00116-10042006">
<p>Mambo is vulnerable to an Authentication Bypass issue that
is due to an SQL Injection in the login function. The SQL
Injection is possible because the $passwd variable is only
sanitized when it is not passed as an argument to the
function.</p>
</blockquote>
<p>Omid reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2006/Aug/0491.html">
<p>There are several sql injections in Mambo 4.6 RC2 &
Joomla 1.0.10 (and maybe other versions):</p>
<ul>
<li>When a user edits a content, the "id" parameter is not
checked properly in /components/com_content/content.php,
which can cause 2 sql injections.</li>
<li>The "limit" parameter in the administration section is
not checked. This affects many pages of administration
section</li>
<li>In the administration section, while editing/creating a
user, the "gid" parameter is not checked properly.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>19719</bid>
<bid>19734</bid>
<url>http://www.gulftech.org/?node=research&article_id=00116-10042006</url>
<url>http://seclists.org/bugtraq/2006/Aug/0491.html</url>
<url>http://www.frsirt.com/english/advisories/2006/3918</url>
<url>http://mamboxchange.com/forum/forum.php?forum_id=7704</url>
<url>http://secunia.com/advisories/21644/</url>
<url>http://secunia.com/advisories/22221/</url>
</references>
<dates>
<discovery>2006-08-26</discovery>
<entry>2006-10-05</entry>
<modified>2011-06-27</modified>
</dates>
</vuln>
<vuln vid="19a92df1-548d-11db-8f1a-000a48049292">
<topic>tin -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>tin</name>
<name>zh-tin</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES">
<p>Urs Janssen and Aleksey Salow report possible buffer
overflows in tin versions 1.8.0 and 1.8.1.</p>
</blockquote>
<blockquote cite="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">
<p>OpenPKG project elaborates there is an allocation
off-by-one bug in version 1.8.0 which can lead to a buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES</url>
<url>http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html</url>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="ae7124ff-547c-11db-8f1a-000a48049292">
<topic>openldap -- slapd acl selfwrite Security Issue</topic>
<affects>
<package>
<name>openldap-server</name>
<name>openldap-sasl-server</name>
<range><lt>2.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Howard Chu reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587">
<p>An ACL of the form 'access to dn.subtree="ou=groups,
dc=example,dc=com" attr=member by * selfwrite' is intended
to only allow users to add/delete their own DN to the
target attribute. Currently it allows any DNs to be
modified.</p>
</blockquote>
</body>
</description>
<references>
<bid>19832</bid>
<cvename>CVE-2006-4600</cvename>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url>
<url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url>
<url>http://secunia.com/advisories/21721</url>
<url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url>
</references>
<dates>
<discovery>2006-06-14</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="5a39a22e-5478-11db-8f1a-000a48049292">
<topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic>
<affects>
<package>
<name>mono</name>
<range><lt>1.1.13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-357-1">
<p>Sebastian Krahmer of the SuSE security team discovered
that the System.CodeDom.Compiler classes used temporary
files in an insecure way. This could allow a symbolic link
attack to create or overwrite arbitrary files with the
privileges of the user invoking the program. Under some
circumstances, a local attacker could also exploit this to
inject arbitrary code into running Mono processes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5072</cvename>
<url>http://www.ubuntu.com/usn/usn-357-1</url>
<url>http://secunia.com/advisories/22237/</url>
</references>
<dates>
<discovery>2006-10-04</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="edabe438-542f-11db-a5ae-00508d6a62df">
<topic>php -- open_basedir Race Condition Vulnerability</topic>
<affects>
<package>
<name>php4</name>
<name>php5</name>
<range><lt>4.4.4_1</lt></range>
<range><ge>5</ge><lt>5.1.6_2</lt></range>
</package>
<package>
<name>php-suhosin</name>
<range><lt>0.9.6</lt></range>
</package>
<package>
<name>php4-cli</name>
<name>php5-cli</name>
<name>php4-cgi</name>
<name>php5-cgi</name>
<name>php4-dtc</name>
<name>php5-dtc</name>
<name>php4-horde</name>
<name>php5-horde</name>
<name>php4-nms</name>
<name>php5-nms</name>
<name>mod_php4</name>
<name>mod_php5</name>
<range><ge>4</ge><lt>4.4.4_1</lt></range>
<range><ge>5</ge><lt>5.1.6_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_082006.132.html">
<p>PHP's open_basedir feature is meant to disallow scripts to
access files outside a set of configured base directories.
The checks for this are placed within PHP functions dealing
with files before the actual open call is performed.</p>
<p>Obviously there is a little span of time between the check
and the actual open call. During this time span the checked
path could have been altered and point to a file that is
forbidden to be accessed due to open_basedir restrictions.</p>
<p>Because the open_basedir restrictions often not call PHP
functions but 3rd party library functions to actually open
the file it is impossible to close this time span in a
general way. It would only be possible to close it when PHP
handles the actual opening on it's own.</p>
<p>While it seems hard to change the path during this little
time span it is very simple with the use of the symlink()
function combined with a little trick. PHP's symlink()
function ensures that source and target of the symlink
operation are allowed by open_basedir restrictions (and
safe_mode). However it is possible to point a symlink to
any file by the use of mkdir(), unlink() and at least two
symlinks.</p>
</blockquote>
</body>
</description>
<references>
<bid>20326</bid>
<cvename>CVE-2006-5178</cvename>
<url>http://www.hardened-php.net/advisory_082006.132.html</url>
<url>http://secunia.com/advisories/22235/</url>
</references>
<dates>
<discovery>2006-10-02</discovery>
<entry>2006-10-05</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="86526ba4-53c8-11db-8f1a-000a48049292">
<topic>phpbb -- NULL byte injection vulnerability</topic>
<affects>
<package>
<name>phpbb</name>
<name>zh-phpbb-tw</name>
<range><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22188/">
<p>ShAnKaR has discovered a vulnerability in phpBB, which can
be exploited by malicious users to compromise a vulnerable
system.</p>
<p>Input passed to the "avatar_path" parameter in
admin/admin_board.php is not properly sanitised before
being used as a configuration variable to store avatar
images. This can be exploited to upload and execute
arbitrary PHP code by changing "avatar_path" to a file with
a trailing NULL byte.</p>
<p>Successful exploitation requires privileges to the
administration section.</p>
</blockquote>
</body>
</description>
<references>
<bid>20347</bid>
<cvename>CVE-2006-4758</cvename>
<url>http://secunia.com/advisories/22188/</url>
<url>http://xforce.iss.net/xforce/xfdb/28884</url>
<url>http://www.security.nnov.ru/Odocument221.html</url>
</references>
<dates>
<discovery>2006-09-12</discovery>
<entry>2006-10-04</entry>
<modified>2006-12-24</modified>
</dates>
</vuln>
<vuln vid="35f2679f-52d7-11db-8f1a-000a48049292">
<topic>postnuke -- admin section SQL injection</topic>
<affects>
<package>
<name>postnuke</name>
<range><lt>0.763</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISS X-Force reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/29271">
<p>PostNuke is vulnerable to SQL injection. A remote attacker
could send specially-crafted SQL statements to the admin
section using the hits parameter, which could allow the
attacker to view, add, modify or delete information in the
back-end database.</p>
</blockquote>
</body>
</description>
<references>
<bid>20317</bid>
<cvename>CVE-2006-5121</cvename>
<url>http://xforce.iss.net/xforce/xfdb/29271</url>
<url>http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded</url>
<url>http://secunia.com/advisories/22197/</url>
</references>
<dates>
<discovery>2006-09-29</discovery>
<entry>2006-10-03</entry>
<modified>2007-11-17</modified>
</dates>
</vuln>
<vuln vid="b975763f-5210-11db-8f1a-000a48049292">
<topic>freetype -- LWFN Files Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.1.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityTracker reports:</p>
<blockquote cite="http://securitytracker.com/alerts/2006/Jul/1016522.html">
<p>A vulnerability was reported in FreeType. A remote user
can cause arbitrary code to be executed on the target
user's system.</p>
<p>A remote user can create a specially crafted font file
that, when loaded by the target user's system, will trigger
an integer underflow or integer overflow and crash the
application or execute arbitrary code on the target system.</p>
<p>Chris Evans reported these vulnerabilities.</p>
<p>Impact: A remote user can create a file that, when loaded
by the target user, will execute arbitrary code on the
target user's system.</p>
</blockquote>
</body>
</description>
<references>
<bid>18034</bid>
<cvename>CVE-2006-0747</cvename>
<cvename>CVE-2006-1861</cvename>
<cvename>CVE-2006-3467</cvename>
<url>http://securitytracker.com/alerts/2006/Jul/1016522.html</url>
</references>
<dates>
<discovery>2006-07-10</discovery>
<entry>2006-10-02</entry>
</dates>
</vuln>
<vuln vid="74ff10f6-520f-11db-8f1a-000a48049292">
<topic>cscope -- Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21601">
<p>Will Drewry has reported some vulnerabilities in Cscope,
which potentially can be exploited by malicious people to
compromise a vulnerable system.</p>
<p>Various boundary errors within the parsing of file lists
or the expansion of environment variables can be exploited
to cause stack-based buffer overflows when parsing
specially crafted "cscope.lists" files or directories.</p>
<p>A boundary error within the parsing of command line
arguments can be exploited to cause a stack-based buffer
overflow when supplying an overly long "reffile" argument.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<bid>19686</bid>
<bid>19687</bid>
<cvename>CVE-2006-4262</cvename>
<url>http://secunia.com/advisories/21601</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500</url>
</references>
<dates>
<discovery>2006-08-20</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-11</modified>
</dates>
</vuln>
<vuln vid="64bf6234-520d-11db-8f1a-000a48049292">
<topic>gnutls -- RSA Signature Forgery Vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<name>gnutls-devel</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21937">
<p>A vulnerability has been reported in GnuTLS, which can be
exploited by malicious people to bypass certain security
restrictions.</p>
<p>The vulnerability is caused due to an error in the
verification of certain signatures. If a RSA key with
exponent 3 is used, it may be possible to forge PKCS #1
v1.5 signatures signed with that key.</p>
</blockquote>
</body>
</description>
<references>
<bid>20027</bid>
<cvename>CVE-2006-4790</cvename>
<url>http://secunia.com/advisories/21937</url>
<url>http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-10-02</entry>
</dates>
</vuln>
<vuln vid="350a5bd9-520b-11db-8f1a-000a48049292">
<topic>MT -- Search Unspecified XSS</topic>
<affects>
<package>
<name>MT</name>
<range><ge>3.3</ge><lt>3.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22109">
<p>Arai has reported a vulnerability in Movable Type and
Movable Type Enterprise, which can be exploited by
malicious people to conduct cross-site scripting attacks.</p>
<p>Some unspecified input passed via the search functionality
isn't properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
</blockquote>
</body>
</description>
<references>
<bid>20228</bid>
<cvename>CVE-2006-5080</cvename>
<url>http://secunia.com/advisories/22109</url>
<url>http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html</url>
</references>
<dates>
<discovery>2006-09-26</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="19b17ab4-51e0-11db-a5ae-00508d6a62df">
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.9.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5">
<p>We received a security advisory from Stefan Esser
(sesser@hardened-php.net) and we wish to thank him for his
work.</p>
<p>It was possible to inject arbitrary SQL commands by
forcing an authenticated user to follow a crafted link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5116</cvename>
<cvename>CVE-2006-5117</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5</url>
<url>http://secunia.com/advisories/22126/</url>
<bid>20253</bid>
</references>
<dates>
<discovery>2006-09-28</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-03</modified>
</dates>
</vuln>
<vuln vid="32db37a5-50c3-11db-acf3-000c6ec775d9">
<topic>openssh -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_10</lt></range>
<range><ge>6.0</ge><lt>6.0_15</lt></range>
<range><ge>5.5</ge><lt>5.5_8</lt></range>
<range><ge>5.4</ge><lt>5.4_22</lt></range>
<range><ge>5.0</ge><lt>5.3_37</lt></range>
<range><lt>4.11_25</lt></range>
</package>
<package>
<name>openssh</name>
<range><lt>4.4,1</lt></range>
</package>
<package>
<name>openssh-portable</name>
<range><lt>4.4.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The CRC compensation attack detector in the sshd(8) daemon,
upon receipt of duplicate blocks, uses CPU time cubic in the
number of duplicate blocks received. [CVE-2006-4924]</p>
<p>A race condition exists in a signal handler used by the
sshd(8) daemon to handle the LoginGraceTime option, which
can potentially cause some cleanup routines to be executed
multiple times. [CVE-2006-5051]</p>
<h1>Impact</h1>
<p>An attacker sending specially crafted packets to sshd(8)
can cause a Denial of Service by using 100% of CPU time
until a connection timeout occurs. Since this attack can be
performed over multiple connections simultaneously, it is
possible to cause up to MaxStartups (10 by default) sshd
processes to use all the CPU time they can obtain.
[CVE-2006-4924]</p>
<p>The OpenSSH project believe that the race condition can
lead to a Denial of Service or potentially remote code
execution, but the FreeBSD Security Team has been unable to
verify the exact impact. [CVE-2006-5051]</p>
<h1>Workaround</h1>
<p>The attack against the CRC compensation attack detector can
be avoided by disabling SSH Protocol version 1 support in
sshd_config(5).</p>
<p>There is no workaround for the second issue.</p>
</body>
</description>
<references>
<bid>20216</bid>
<cvename>CVE-2006-4924</cvename>
<cvename>CVE-2006-5051</cvename>
<freebsdsa>SA-06:22.openssh</freebsdsa>
<url>http://www.openssh.com/txt/release-4.4</url>
</references>
<dates>
<discovery>2006-09-25</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="fcba5764-506a-11db-a5ae-00508d6a62df">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309c</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20060909</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21819/">
<p>rgod has discovered a vulnerability in DokuWiki, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>Input passed to the "TARGET_FN" parameter in
bin/dwpage.php is not properly sanitised before being used
to copy files. This can be exploited via directory
traversal attacks in combination with DokuWiki's file
upload feature to execute arbitrary PHP code.</p>
</blockquote>
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">
<p>Direct static code injection vulnerability in doku.php in
DokuWiki before 2006-03-09c allows remote attackers to
execute arbitrary PHP code via the X-FORWARDED-FOR HTTP
header, which is stored in config.php.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">
<p>Unrestricted file upload vulnerability in
lib/exe/media.php in DokuWiki before 2006-03-09c allows
remote attackers to upload executable files into the
data/media folder via unspecified vectors.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">
<p>DokuWiki before 2006-03-09c enables the debug feature by
default, which allows remote attackers to obtain sensitive
information by calling doku.php with the X-DOKUWIKI-DO HTTP
header set to "debug".</p>
</blockquote>
</body>
</description>
<references>
<bid>19911</bid>
<cvename>CVE-2006-4674</cvename>
<cvename>CVE-2006-4675</cvename>
<cvename>CVE-2006-4679</cvename>
<url>http://secunia.com/advisories/21819/</url>
<url>http://bugs.splitbrain.org/index.php?do=details&id=906</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-30</entry>
<modified>2006-10-02</modified>
</dates>
</vuln>
<vuln vid="450b76ee-5068-11db-a5ae-00508d6a62df">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_5</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20060609_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22192/">
<p>Some vulnerabilities have been reported in DokuWiki, which
can be exploited by malicious people to cause a DoS (Denial
of Service) or potentially compromise a vulnerable system.</p>
<p>Input passed to the "w" and "h" parameters in
lib/exec/fetch.php is not properly sanitised before being
passed as resize parameters to the "convert" application.
This can be exploited to cause a DoS due to excessive CPU
and memory consumption by passing very large numbers, or to
inject arbitrary shell commands by passing specially
crafted strings to the "w" and "h" parameter.</p>
<p>Successful exploitation requires that the
"$conf[imconvert]" option is set.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5098</cvename>
<cvename>CVE-2006-5099</cvename>
<url>http://secunia.com/advisories/22192/</url>
<url>http://secunia.com/advisories/22199/</url>
<url>http://bugs.splitbrain.org/?do=details&id=924</url>
<url>http://bugs.splitbrain.org/?do=details&id=926</url>
</references>
<dates>
<discovery>2006-09-26</discovery>
<entry>2006-09-30</entry>
<modified>2006-10-02</modified>
</dates>
</vuln>
<vuln vid="e4c62abd-5065-11db-a5ae-00508d6a62df">
<topic>tikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tikiwiki</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21536/">
<p>Thomas Pollet has discovered a vulnerability in TikiWiki,
which can be exploited by malicious people to conduct
cross-site scripting attacks.</p>
<p>Input passed to the "highlight" parameter in
tiki-searchindex.php is not properly sanitised before being
returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session
in context of an affected site.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/21733/">
<p>rgod has discovered a vulnerability in TikiWiki, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to the "jhot.php" script
not correctly verifying uploaded files. This can e.g. be
exploited to execute arbitrary PHP code by uploading a
malicious PHP script to the "img/wiki" directory.</p>
</blockquote>
</body>
</description>
<references>
<bid>19654</bid>
<bid>19819</bid>
<cvename>CVE-2006-4299</cvename>
<cvename>CVE-2006-4602</cvename>
<url>http://secunia.com/advisories/21536/</url>
<url>http://secunia.com/advisories/21733/</url>
</references>
<dates>
<discovery>2006-08-21</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="e79876e4-5061-11db-a5ae-00508d6a62df">
<topic>punbb -- NULL byte injection vulnerability</topic>
<affects>
<package>
<name>punbb</name>
<range><lt>1.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4759">
<p>PunBB 1.2.12 does not properly handle an avatar directory
pathname ending in %00, which allows remote authenticated
administrative users to upload arbitrary files and execute
code, as demonstrated by a query to admin_options.php with
an avatars_dir parameter ending in %00. NOTE: this issue
was originally disputed by the vendor, but the dispute was
withdrawn on 20060926.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4759</cvename>
<url>http://forums.punbb.org/viewtopic.php?id=13255</url>
</references>
<dates>
<discovery>2006-09-13</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="2d9ad236-4d26-11db-b48d-00508d6a62df">
<topic>freeciv -- Denial of Service Vulnerabilities</topic>
<affects>
<package>
<name>freeciv</name>
<name>freeciv-gtk</name>
<name>freeciv-gtk2</name>
<name>freeciv-nox11</name>
<range><lt>2.0.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21171/">
<p>Luigi Auriemma has reported a vulnerability in Freeciv,
which can be exploited by malicious people to cause a DoS
(Denial of Service).</p>
<p>An error in the "generic_handle_player_attribute_chunk()"
function in common/packets.c can be exploited to crash the
service via a specially crafted
PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.</p>
<p>An error in the "handle_unit_orders()" function in
server/unithand.c can be exploited to crash the service
via a specially crafted packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3913</cvename>
<bid>19117</bid>
<url>http://secunia.com/advisories/21171/</url>
<url>http://aluigi.altervista.org/adv/freecivx-adv.txt</url>
</references>
<dates>
<discovery>2006-07-23</discovery>
<entry>2006-09-26</entry>
</dates>
</vuln>
<vuln vid="339fbbc1-4d23-11db-b48d-00508d6a62df">
<topic>freeciv -- Packet Parsing Denial of Service Vulnerability</topic>
<affects>
<package>
<name>freeciv</name>
<name>freeciv-gtk</name>
<name>freeciv-gtk2</name>
<name>freeciv-nox11</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19120/">
<p>Luigi Auriemma has reported a vulnerability in Freeciv, which
can be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an error within the
handling of the packet length in "common/packets.c". This can
be exploited to crash the Freeciv server via a specially-
crafted packet with the size set to "0xffff".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0047</cvename>
<bid>16975</bid>
<url>http://secunia.com/advisories/19120/</url>
<url>http://aluigi.altervista.org/adv/freecivdos-adv.txt</url>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-09-26</entry>
</dates>
</vuln>
<vuln vid="1709084d-4d21-11db-b48d-00508d6a62df">
<topic>plans -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plans</name>
<range><lt>6.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/15854/">
<p>A vulnerability has been reported in Plans, which can be
exploited by malicious people to conduct SQL injection
attacks.</p>
<p>Input passed to the "evt_id" parameter in "plans.cgi"
isn't properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.</p>
<p>Successful exploitation requires that SQL database
support has been enabled in "plans_config.pl" (the default
setting is flat files).</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/15167/">
<p>Some vulnerabilities have been reported in Plans, which
can be exploited by malicious people to conduct cross-site
scripting attacks or gain knowledge of sensitive
information.</p>
<p>Input passed to various unspecified parameters is not
properly sanitised before being returned to users. This
can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of a vulnerable
site.</p>
<p>An unspecified error can be exploited to gain knowledge
of the MySQL password.</p>
</blockquote>
</body>
</description>
<references>
<bid>14069</bid>
<url>http://secunia.com/advisories/15167/</url>
<url>http://secunia.com/advisories/15854/</url>
<url>http://planscalendar.com/forum/viewtopic.php?t=660</url>
</references>
<dates>
<discovery>2005-04-28</discovery>
<entry>2006-09-26</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="d3527663-4ccb-11db-b48d-00508d6a62df">
<topic>eyeOS -- multiple XSS security bugs</topic>
<affects>
<package>
<name>eyeOS</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>eyeOS team reports:</p>
<blockquote cite="http://eyeos.blogspot.com/2006/09/eyeos-091-released.html">
<p>[EyeOS 0.9.1] release fixes two XSS security bugs, so we
recommend all users to upgrade to this new version in order
to have the best security. These two bugs were discovered by
Jose Carlos Norte, who is a new eyeOS developer.</p>
</blockquote>
</body>
</description>
<references>
<bid>20213</bid>
<cvename>CVE-2006-5071</cvename>
<url>http://eyeos.blogspot.com/2006/09/eyeos-091-released.html</url>
</references>
<dates>
<discovery>2006-09-25</discovery>
<entry>2006-09-25</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="65a8f773-4a37-11db-a4cc-000a48049292">
<topic>zope -- restructuredText "csv_table" Information Disclosure</topic>
<affects>
<package>
<name>zope</name>
<range><ge>2.7.0</ge><lt>2.7.9_1</lt></range>
<range><ge>2.8.0</ge><lt>2.8.8_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21947/">
<p>A vulnerability has been reported in Zope, which can be
exploited by malicious people to disclose potentially
sensitive information.</p>
<p>The vulnerability is caused due to an error in the use of
the docutils module to parse and render "restructured"
text. This can be exploited to disclose certain information
via the "csv_table" reStructuredText directive.</p>
</blockquote>
</body>
</description>
<references>
<bid>20022</bid>
<cvename>CVE-2006-4684</cvename>
<url>http://secunia.com/advisories/21947/</url>
<url>http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt</url>
</references>
<dates>
<discovery>2006-08-21</discovery>
<entry>2006-09-22</entry>
<modified>2006-12-27</modified>
</dates>
</vuln>
<vuln vid="f6bff909-4a26-11db-a4cc-000a48049292">
<topic>libmms -- stack-based buffer overflow</topic>
<affects>
<package>
<name>libmms</name>
<range><lt>0.3</lt></range>
</package>
<package>
<name>libxine</name>
<range><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">
<p>Stack-based buffer overflow in libmms, as used by (a)
MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows
remote attackers to cause a denial of service (application
crash) and possibly execute arbitrary code via the (1)
send_command, (2) string_utf16, (3) get_data, and (4)
get_media_packet functions, and possibly other functions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2200</cvename>
<bid>18608</bid>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577</url>
</references>
<dates>
<discovery>2006-05-04</discovery>
<entry>2006-09-22</entry>
</dates>
</vuln>
<vuln vid="1fe734bf-4a06-11db-b48d-00508d6a62df">
<topic>opera -- RSA Signature Forgery</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=845">
<p>A specially crafted digital certificate can bypass Opera's
certificate signature verification. Forged certificates can
contain any false information the forger chooses, and Opera
will still present it as valid. Opera will not present any
warning dialogs in this case, and the security status will
be the highest possible (3). This defeats the protection
against "man in the middle", the attacks that SSL was
designed to prevent.</p>
<p>There is a flaw in OpenSSL's RSA signature verification
that affects digital certificates using 3 as the public
exponent. Some of the certificate issuers that are on
Opera's list of trusted signers have root certificates with
3 as the public exponent. The forged certificate can appear
to be signed by one of these.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4339</cvename>
<url>http://secunia.com/advisories/21982/</url>
<url>http://secunia.com/advisories/21709/</url>
<url>http://www.cdc.informatik.tu-darmstadt.de/securebrowser/</url>
<url>http://www.openssl.org/news/secadv_20060905.txt</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
</references>
<dates>
<discovery>2006-09-18</discovery>
<entry>2006-09-22</entry>
</dates>
</vuln>
<vuln vid="e6296105-449b-11db-ba89-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.7,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.5</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.7</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2006.09.21</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>1.5.a2006.09.21</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<ul>
<li>MFSA 2006-64 Crashes with evidence of memory
corruption (rv:1.8.0.7)</li>
<li>MFSA 2006-63 JavaScript execution in mail via XBL</li>
<li>MFSA 2006-62 Popup-blocker cross-site scripting (XSS)</li>
<li>MFSA 2006-61 Frame spoofing using document.open()</li>
<li>MFSA 2006-60 RSA Signature Forgery</li>
<li>MFSA 2006-59 Concurrency-related vulnerability</li>
<li>MFSA 2006-58 Auto-Update compromise through DNS and
SSL spoofing</li>
<li>MFSA 2006-57 JavaScript Regular Expression Heap
Corruption</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>20042</bid>
<cvename>CVE-2006-4253</cvename>
<cvename>CVE-2006-4340</cvename>
<cvename>CVE-2006-4565</cvename>
<cvename>CVE-2006-4566</cvename>
<cvename>CVE-2006-4567</cvename>
<cvename>CVE-2006-4568</cvename>
<cvename>CVE-2006-4569</cvename>
<cvename>CVE-2006-4570</cvename>
<cvename>CVE-2006-4571</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-57.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-58.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-59.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-61.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-62.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-63.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-64.html</url>
</references>
<dates>
<discovery>2006-09-14</discovery>
<entry>2006-09-15</entry>
<modified>2006-11-02</modified>
</dates>
</vuln>
<vuln vid="24f6b1eb-43d5-11db-81e1-000e0c2e438a">
<topic>win32-codecs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>win32-codecs</name>
<range><lt>3.1.0.p8_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apple Security Team reports that there are multiple
vulnerabilities within QuickTime (one of the plugins for
win32-codecs). A remote attacker capable of creating a
malicious SGI image, FlashPix, FLC movie, or a QuickTime
movie can possibly lead to execution of arbitrary code or
cause a Denial of Service (application crash).</p>
<p>Users who have QuickTime (/win32-codecs) as a browser plugin
may be vulnerable to remote code execution by visiting a
website containing a malicious SGI image, FlashPix, FLC movie
or a QuickTime movie.</p>
</body>
</description>
<references>
<bid>20138</bid>
<cvename>CVE-2006-4381</cvename>
<cvename>CVE-2006-4382</cvename>
<cvename>CVE-2006-4384</cvename>
<cvename>CVE-2006-4385</cvename>
<cvename>CVE-2006-4386</cvename>
<cvename>CVE-2006-4388</cvename>
<cvename>CVE-2006-4389</cvename>
<url>http://docs.info.apple.com/article.html?artnum=304357</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-14</entry>
<modified>2006-10-17</modified>
</dates>
</vuln>
<vuln vid="ea09c5df-4362-11db-81e1-000e0c2e438a">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php4</name>
<name>php5</name>
<range><lt>4.4.4</lt></range>
<range><ge>5</ge><lt>5.1.5</lt></range>
</package>
<package>
<name>php4-cli</name>
<name>php5-cli</name>
<name>php4-cgi</name>
<name>php5-cgi</name>
<name>php4-dtc</name>
<name>php5-dtc</name>
<name>php4-horde</name>
<name>php5-horde</name>
<name>php4-nms</name>
<name>php5-nms</name>
<name>mod_php4</name>
<name>mod_php5</name>
<range><lt>4.4.4</lt></range>
<range><ge>5</ge><lt>5.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/release_5_1_5.php">
<ul>
<li>Added missing safe_mode/open_basedir checks inside the
error_log(), file_exists(), imap_open() and imap_reopen()
functions.</li>
<li>Fixed overflows inside str_repeat() and wordwrap()
functions on 64bit systems.</li>
<li>Fixed possible open_basedir/safe_mode bypass in cURL
extension and with realpath cache.</li>
<li>Fixed overflow in GD extension on invalid GIF
images.</li>
<li>Fixed a buffer overflow inside sscanf() function.</li>
<li>Fixed an out of bounds read inside stripos()
function.</li>
<li>Fixed memory_limit restriction on 64 bit system.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4481</cvename>
<cvename>CVE-2006-4482</cvename>
<cvename>CVE-2006-4483</cvename>
<cvename>CVE-2006-4484</cvename>
<cvename>CVE-2006-4485</cvename>
<cvename>CVE-2006-4486</cvename>
<url>http://www.php.net/release_4_4_4.php</url>
<url>http://www.php.net/release_5_1_5.php</url>
</references>
<dates>
<discovery>2006-08-18</discovery>
<entry>2006-09-13</entry>
<modified>2014-03-28</modified>
</dates>
</vuln>
<vuln vid="c0fd7890-4346-11db-89cc-000ae42e9b93">
<topic>drupal-pubcookie -- authentication may be bypassed</topic>
<affects>
<package>
<name>drupal-pubcookie</name>
<range><le>4.6.0_20060210</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/83064">
<p>It is possible for a malicious user to spoof a user's
identity by bypassing the login redirection mechanism in the
pubcookie module. The malicious user may gain the privileges
of the user they are spoofing, including the administrative
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4717</cvename>
<url>http://drupal.org/node/83064</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="7c75d48c-429b-11db-afae-000c6ec775d9">
<topic>linux-flashplugin7 -- arbitrary code execution vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>7.0r68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb06-11.html">
<p>Multiple input validation errors have been identified in
Flash Player 8.0.24.0 and earlier versions that could lead
to the potential execution of arbitrary code. These
vulnerabilities could be accessed through content
delivered from a remote location via the user?s web
browser, email client, or other applications that include
or reference the Flash Player. (CVE-2006-3311,
CVE-2006-3587, CVE-2006-3588)</p>
<p>These updates include changes to prevent circumvention of
the "allowScriptAccess" option. (CVE-2006-4640)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3311</cvename>
<cvename>CVE-2006-3587</cvename>
<cvename>CVE-2006-3588</cvename>
<cvename>CVE-2006-4640</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb06-11.html</url>
</references>
<dates>
<discovery>2006-09-12</discovery>
<entry>2006-09-12</entry>
</dates>
</vuln>
<vuln vid="28ce7102-4039-11db-a838-00148584c7dd">
<cancelled/>
</vuln>
<vuln vid="fffa9257-3c17-11db-86ab-00123ffe8333">
<topic>mailman -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<name>mailman-with-htdig</name>
<range><lt>2.1.9.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21732/">
<p>Mailman can be exploited by malicious people to conduct cross-site
scripting and phishing attacks, and cause a DoS (Denial of
Service).</p>
<p>1) An error in the logging functionality can be exploited to
inject a spoofed log message into the error log via a specially
crafted URL.</p>
<p>Successful exploitation may trick an administrator into visiting
a malicious web site.</p>
<p>2) An error in the processing of malformed headers which does not
follow the RFC 2231 standard can be exploited to cause a DoS
(Denial of Service).</p>
<p>3) Some unspecified input isn't properly sanitised before being
returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an
affected site.</p>
</blockquote>
</body>
</description>
<references>
<bid>19831</bid>
<cvename>CVE-2006-2191</cvename>
<cvename>CVE-2006-2941</cvename>
<cvename>CVE-2006-3636</cvename>
<cvename>CVE-2006-4624</cvename>
<url>http://secunia.com/advisories/21732/</url>
<url>http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295</url>
</references>
<dates>
<discovery>2006-06-09</discovery>
<entry>2006-09-04</entry>
<modified>2006-10-04</modified>
</dates>
</vuln>
<vuln vid="09639ccc-3abb-11db-81e1-000e0c2e438a">
<topic>hlstats -- multiple cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>hlstats</name>
<range><le>1.35</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kefka reports multiple cross site scripting vulnerabilities
within hlstats. The vulnerabilities are caused due to
improper checking of variables, allowing an attacker to
perform cross site scripting.</p>
</body>
</description>
<references>
<bid>19745</bid>
<cvename>CVE-2006-4454</cvename>
<cvename>CVE-2006-6780</cvename>
<cvename>CVE-2006-6781</cvename>
<cvename>CVE-2007-2812</cvename>
</references>
<dates>
<discovery>2006-08-29</discovery>
<entry>2006-09-02</entry>
<modified>2011-09-03</modified>
</dates>
</vuln>
<vuln vid="0b79743b-3ab7-11db-81e1-000e0c2e438a">
<topic>gtetrinet -- remote code execution</topic>
<affects>
<package>
<name>gtetrinet</name>
<range><lt>0.7.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian Security Team reports:</p>
<blockquote cite="http://www.debian.org/security/2006/dsa-1163">
<p>Michael Gehring discovered several potential out-of-bounds
index accesses in gtetrinet, a multiplayer Tetris-like game,
which may allow a remote server to execute arbitrary
code</p>
</blockquote>
</body>
</description>
<references>
<bid>19766</bid>
<cvename>CVE-2006-3125</cvename>
<url>http://www.debian.org/security/2006/dsa-1163</url>
</references>
<dates>
<discovery>2006-08-30</discovery>
<entry>2006-09-02</entry>
<modified>2006-10-01</modified>
</dates>
</vuln>
<vuln vid="0ab423e7-3822-11db-81e1-000e0c2e438a">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Joomla development team reports multiple vulnerabilities
within the joomla application. Joomla is vulnerable to the
following vulnerabilities:</p>
<ul>
<li>Improper validation of the mosMail function</li>
<li>Improper validation of the JosIsValidEmail function.</li>
<li>Remote code execution in PEAR.php</li>
<li>Zend Hash del key or index vulnerability</li>
</ul>
</body>
</description>
<references>
<url>http://www.joomla.org/content/view/1841/78/</url>
</references>
<dates>
<discovery>2006-08-28</discovery>
<entry>2006-08-30</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="c9d2e361-32fb-11db-a6e2-000e0c2e438a">
<topic>sppp -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><lt>4.11_20</lt></range>
<range><ge>5.3</ge><lt>5.3_32</lt></range>
<range><ge>5.4</ge><lt>5.4_17</lt></range>
<range><ge>5.5</ge><lt>5.5_3</lt></range>
<range><ge>6.0</ge><lt>6.0_10</lt></range>
<range><ge>6.1</ge><lt>6.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>While processing Link Control Protocol (LCP) configuration
options received from the remote host, sppp(4) fails to
correctly validate option lengths. This may result in data
being read or written beyond the allocated kernel memory
buffer.</p>
<h1>Impact</h1>
<p>An attacker able to send LCP packets, including the remote
end of a sppp(4) connection, can cause the FreeBSD kernel to
panic. Such an attacker may also be able to obtain
sensitive information or gain elevated privileges.</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not use sppp(4) are
not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4304</cvename>
<freebsdsa>SA-06:18.ppp</freebsdsa>
</references>
<dates>
<discovery>2006-08-23</discovery>
<entry>2006-08-23</entry>
<modified>2006-08-30</modified>
</dates>
</vuln>
<vuln vid="e2e8d374-2e40-11db-b683-0008743bf21a">
<topic>horde -- Phishing and Cross-Site Scripting Vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<range><le>3.1.2</le></range>
</package>
<package>
<name>imp</name>
<range><le>4.1.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21500/">
<p>Some vulnerabilities have been reported in Horde, which
can be exploited by malicious people to conduct phishing
and cross-site scripting attacks.</p>
<ol>
<li>Input passed to the "url" parameter in index.php isn't
properly verified before it is being used to include an
arbitrary web site in a frameset. This can e.g. be
exploited to trick a user into believing certain
malicious content is served from a trusted web site.</li>
<li>Some unspecified input passed in index.php isn't
properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an
affected site.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>19557</bid>
<bid>19544</bid>
<url>http://secunia.com/advisories/21500/</url>
<url>http://lists.horde.org/archives/announce/2006/000292.html</url>
</references>
<dates>
<discovery>2006-08-17</discovery>
<entry>2006-08-17</entry>
</dates>
</vuln>
<vuln vid="5039ae61-2c9f-11db-8401-000ae42e9b93">
<topic>globus -- Multiple tmpfile races</topic>
<affects>
<package>
<name>globus</name>
<range><lt>4.0.2_20060706</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Globus Alliance reports:</p>
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html">
<p>The proxy generation tool (grid-proxy-init) creates the
file, secures the file to provide access only to owner and
writes proxy to the file. A race condition exists between
the opening of the proxy credentials file, and making sure
it is safe file to write to. The checks to ensure this
file is accessible only to the owner take place using the
filename after the file is opened for writing, but before
any data is written.</p>
</blockquote>
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html">
<p>Various components of the toolkit use files in shared
directories to store information, some being sensitive
information. For example, the tool to create proxy
certificates, stores the generated proxy certificate by
default in /tmp. Specific vulnerabilities in handling such
files were reported in myproxy-admin-adduser, grid-ca-sign
and grid-security-config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4232</cvename>
<cvename>CVE-2006-4233</cvename>
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html</url>
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html</url>
</references>
<dates>
<discovery>2006-08-08</discovery>
<entry>2006-08-15</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9dda3ff1-2b02-11db-a6e2-000e0c2e438a">
<topic>x11vnc -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>x11vnc</name>
<range><lt>0.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludwig Nussel reports that x11vnc is vulnerable to an
authentication bypass vulnerability. The vulnerability is
caused by an error in auth.c. This could allow a remote
attacker to gain unauthorized and unauthenticated access
to the system.</p>
</body>
</description>
<references>
<bid>18977</bid>
<cvename>CVE-2006-2450</cvename>
<url>http://bugs.debian.org/376824</url>
</references>
<dates>
<discovery>2006-08-08</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="9855ac8e-2aec-11db-a6e2-000e0c2e438a">
<topic>alsaplayer -- multiple vulnerabilities</topic>
<affects>
<package>
<name>alsaplayer</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luigi Auriemma reports three vulnerabilities within
alsaplayer:</p>
<blockquote cite="http://aluigi.altervista.org/adv/alsapbof-adv.txt">
<ul>
<li>The function which handles the HTTP connections is
vulnerable to a buffer-overflow that happens when it uses
sscanf for copying the URL in the Location's field
received from the server into the redirect buffer of only
1024 bytes declared in http_open.</li>
<li>A buffer-overflow exists in the functions which add items
to the playlist when the GTK interface is used (so the other
interfaces are not affected by this problem): new_list_item
and CbUpdated in interface/gtk/PlaylistWindow.cpp.</li>
<li>AlsaPlayer automatically queries the CDDB server
specified in its configuration (by default
freedb.freedb.org) when the user choices the CDDA function
for playing audio CDs. The function which queries the
server uses a buffer of 20 bytes and one of 9 for storing
the category and ID strings received from the server while
the buffer which contains this server's response is 32768
bytes long. Naturally for exploiting this bug the attacker
must have control of the freedb server specified in the
AlsaPlayer's configuration.</li>
</ul>
</blockquote>
<p>These vulnerabilities could allow a remote attacker to
execute arbitrary code, possibly gaining access to the
system.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4089</cvename>
<bid>19450</bid>
<url>http://aluigi.altervista.org/adv/alsapbof-adv.txt</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-08-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="17f53c1d-2ae9-11db-a6e2-000e0c2e438a">
<topic>postgresql -- encoding based SQL injection</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><ge>7.3</ge><lt>7.3.15</lt></range>
<range><ge>7.4</ge><lt>7.4.13</lt></range>
<range><ge>8.0.0</ge><lt>8.0.8</lt></range>
<range><ge>8.1.0</ge><lt>8.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL development team reports:</p>
<blockquote cite="http://www.postgresql.org/docs/techdocs.50">
<p>An attacker able to submit crafted strings to an
application that will embed those strings in SQL commands
can use invalidly-encoded multibyte characters to bypass
standard string-escaping methods, resulting in possible
injection of hostile SQL commands into the database. The
attacks covered here work in any multibyte encoding.</p>
<p>The widely-used practice of escaping ASCII single quote
"'" by turning it into "\'" is unsafe when operating in
multibyte encodings that allow 0x5c (ASCII code for
backslash) as the trailing byte of a multibyte character;
this includes at least SJIS, BIG5, GBK, GB18030, and UHC.
An application that uses this conversion while embedding
untrusted strings in SQL commands is vulnerable to
SQL-injection attacks if it communicates with the server in
one of these encodings. While the standard client libraries
used with PostgreSQL have escaped "'" in the safe,
SQL-standard way of "''" for some time, the older practice
remains common.</p>
</blockquote>
</body>
</description>
<references>
<bid>18092</bid>
<cvename>CVE-2006-2313</cvename>
<cvename>CVE-2006-2314</cvename>
<url>http://www.postgresql.org/docs/techdocs.50</url>
</references>
<dates>
<discovery>2006-05-11</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="65c8ecf9-2adb-11db-a6e2-000e0c2e438a">
<topic>postgresql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><ge>7.2</ge><lt>7.2.7</lt></range>
<range><ge>7.3</ge><lt>7.3.9</lt></range>
<range><ge>7.4</ge><lt>7.4.7</lt></range>
<range><ge>8.0.0</ge><lt>8.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities had been reported in various
versions of PostgreSQL:</p>
<ul>
<li>The EXECUTE restrictions can be bypassed by using the
AGGREGATE function, which is missing a permissions check.</li>
<li>A buffer overflow exists in gram.y which could allow an
attacker to execute arbitrary code by sending a large
number of arguments to a refcursor function, found in
gram.y</li>
<li>The intagg contributed module allows an attacker to crash
the server (Denial of Service) by constructing a malicious
crafted array.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2005-0244</cvename>
<cvename>CVE-2005-0245</cvename>
<cvename>CVE-2005-0246</cvename>
<url>http://secunia.com/advisories/12948</url>
</references>
<dates>
<discovery>2005-02-01</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="fcb90eb0-2ace-11db-a6e2-000e0c2e438a">
<topic>mysql -- format string vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.6</lt></range>
<range><ge>5.0</ge><lt>5.0.19</lt></range>
<range><ge>4.1</ge><lt>4.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-David Maillefer reports a Denial of Service vulnerability
within MySQL. The vulnerability is caused by improper checking
of the data_format routine, which cause the MySQL server to
crash. The crash is triggered by the following code:<br/>
<code>"SELECT date_format('%d%s', 1);</code></p>
</body>
</description>
<references>
<bid>19032</bid>
<cvename>CVE-2006-3469</cvename>
<url>http://bugs.mysql.com/bug.php?id=20729</url>
</references>
<dates>
<discovery>2006-06-27</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="21b7c550-2a22-11db-a6e2-000e0c2e438a">
<topic>squirrelmail -- random variable overwrite vulnerability</topic>
<affects>
<package>
<name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.8,2</lt></range>
</package>
<package>
<name>squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail developers report:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-08-11">
<p>A logged in user could overwrite random variables in
compose.php, which might make it possible to read/write
other users' preferences or attachments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4019</cvename>
<url>http://www.squirrelmail.org/security/issue/2006-08-11</url>
</references>
<dates>
<discovery>2006-08-11</discovery>
<entry>2006-08-12</entry>
</dates>
</vuln>
<vuln vid="90064567-28b1-11db-844d-000c6ec775d9">
<topic>rubygem-rails -- evaluation of ruby code</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
<range><ge>1.1.4</ge><lt>1.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ruby on Rails blog reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">
<p>With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3),
you can trigger the evaluation of Ruby code through the URL
because of a bug in the routing code of Rails. This means that
you can essentially take down a Rails process by starting
something like /script/profiler, as the code will run for a
long time and that process will be hung while it happens.
Other URLs can even cause data loss.</p>
</blockquote>
</body>
</description>
<references>
<url>http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-08-10</entry>
</dates>
</vuln>
<vuln vid="342d2e48-26db-11db-9275-000475abc56f">
<topic>clamav -- heap overflow vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>0.88.1</ge><lt>0.88.4</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20060808</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav team reports:</p>
<blockquote cite="http://www.clamav.net/security/0.88.4.html">
<p>A heap overflow vulnerability was discovered in libclamav
which could cause a denial of service or allow the
execution of arbitrary code.</p>
<p>The problem is specifically located in the PE file rebuild
function used by the UPX unpacker.</p>
<p>Relevant code from libclamav/upx.c:</p>
<p>
memcpy(dst, newbuf, foffset);
*dsize = foffset;
free(newbuf);
cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n");
return 1;</p>
<p>Due to improper validation it is possible to overflow the above
memcpy() beyond the allocated memory block.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4018</cvename>
<url>http://www.clamav.net/security/0.88.4.html</url>
</references>
<dates>
<discovery>2006-08-07</discovery>
<entry>2006-08-08</entry>
</dates>
</vuln>
<vuln vid="c905298c-2274-11db-896e-000ae42e9b93">
<topic>drupal -- XSS vulnerability</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal project reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-011/advisory.txt">
<p>A malicious user can execute a cross site scripting attack
by enticing someone to visit a Drupal site via a specially
crafted link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-011/advisory.txt</url>
</references>
<dates>
<discovery>2006-08-02</discovery>
<entry>2006-08-02</entry>
<modified>2006-08-08</modified>
</dates>
</vuln>
<vuln vid="ed529baa-21c6-11db-b625-02e081235dab">
<topic>gnupg -- 2 more possible memory allocation attacks</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Author reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html">
<p>Fixed 2 more possible memory allocation attacks. They are
similar to the problem we fixed with 1.4.4. This bug can easily
be exploted for a DoS; remote code execution is not entirely
impossible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html</url>
</references>
<dates>
<discovery>2006-08-01</discovery>
<entry>2006-08-02</entry>
</dates>
</vuln>
<vuln vid="76562594-1f19-11db-b7d4-0008743bf21a">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><gt>1.6.*</gt><lt>1.8.*</lt></range>
<range><gt>1.8.*</gt><lt>1.8.4_9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21009/">
<p>Two vulnerabilities have been reported in Ruby, which can
be exploited by malicious people to bypass certain security
restrictions.</p>
<ol>
<li>An error in the handling of the "alias" functionality
can be exploited to bypass the safe level protection and
replace methods called in the trusted level.</li>
<li>An error caused due to directory operations not being
properly checked can be exploited to bypass the safe
level protection and close untainted directory streams.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>18944</bid>
<cvename>CVE-2006-3694</cvename>
<url>http://secunia.com/advisories/21009/</url>
<url>http://jvn.jp/jp/JVN%2383768862/index.html</url>
<url>http://jvn.jp/jp/JVN%2313947696/index.html</url>
</references>
<dates>
<discovery>2006-07-12</discovery>
<entry>2006-07-29</entry>
<modified>2006-07-30</modified>
</dates>
</vuln>
<vuln vid="dc8c08c7-1e7c-11db-88cf-000c6ec775d9">
<topic>apache -- mod_rewrite buffer overflow vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
<range><ge>2.0.46</ge><lt>2.0.58_2</lt></range>
<range><ge>2.2.0</ge><lt>2.2.2_1</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><ge>1.3.28</ge><lt>1.3.37</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><ge>0</ge></range>
</package>
<package>
<name>ru-apache</name>
<range><ge>1.3.28</ge><lt>1.3.37+30.23</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><ge>1.3.28</ge><lt>1.3.36+2.8.27_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation and The Apache HTTP Server
Project reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955">
<p>An off-by-one flaw exists in the Rewrite module,
mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0
since 2.0.46, and 2.2 since 2.2.0.</p>
<p>Depending on the manner in which Apache HTTP Server was
compiled, this software defect may result in a
vulnerability which, in combination with certain types of
Rewrite rules in the web server configuration files, could
be triggered remotely. For vulnerable builds, the nature
of the vulnerability can be denial of service (crashing of
web server processes) or potentially allow arbitrary code
execution. This issue has been rated as having important
security impact by the Apache HTTP Server Security Team.</p>
<p>This flaw does not affect a default installation of
Apache HTTP Server. Users who do not use, or have not
enabled, the Rewrite module mod_rewrite are not affected
by this issue. This issue only affects installations using
a Rewrite rule with the following characteristics:</p>
<ul>
<li>The RewriteRule allows the attacker to control the
initial part of the rewritten URL (for example if the
substitution URL starts with $1)</li>
<li>The RewriteRule flags do NOT include any of the
following flags: Forbidden (F), Gone (G), or NoEscape
(NE).</li>
</ul>
<p>Please note that ability to exploit this issue is
dependent on the stack layout for a particular compiled
version of mod_rewrite. If the compiler used to compile
Apache HTTP Server has added padding to the stack
immediately after the buffer being overwritten, it will
not be possible to exploit this issue, and Apache HTTP
Server will continue operating normally.</p>
<p>The Apache HTTP Server project thanks Mark Dowd of McAfee
Avert Labs for the responsible reporting of this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<certvu>395412</certvu>
<cvename>CVE-2006-3747</cvename>
<mlist msgid="44CA22D9.6020200@apache.org">http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955</mlist>
</references>
<dates>
<discovery>2006-07-27</discovery>
<entry>2006-07-28</entry>
<modified>2006-11-01</modified>
</dates>
</vuln>
<vuln vid="e2a92664-1d60-11db-88cf-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.5,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.5</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2006.07.26</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.5</lt></range>
</package>
<package>
<name>mozilla</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues. Several of which can be used to run arbitrary code
with the privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3">
<ul>
<li>MFSA 2006-56 chrome: scheme loading remote content</li>
<li>MFSA 2006-55 Crashes with evidence of memory corruption
(rv:1.8.0.5)</li>
<li>MFSA 2006-54 XSS with
XPCNativeWrapper(window).Function(...)</li>
<li>MFSA 2006-53 UniversalBrowserRead privilege escalation</li>
<li>MFSA 2006-52 PAC privilege escalation using
Function.prototype.call</li>
<li>MFSA 2006-51 Privilege escalation using named-functions
and redefined "new Object()"</li>
<li>MFSA 2006-50 JavaScript engine vulnerabilities</li>
<li>MFSA 2006-49 Heap buffer overwrite on malformed VCard</li>
<li>MFSA 2006-48 JavaScript new Function race condition</li>
<li>MFSA 2006-47 Native DOM methods can be hijacked across
domains</li>
<li>MFSA 2006-46 Memory corruption with simultaneous events</li>
<li>MFSA 2006-45 Javascript navigator Object Vulnerability</li>
<li>MFSA 2006-44 Code execution through deleted frame
reference</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3113</cvename>
<cvename>CVE-2006-3677</cvename>
<cvename>CVE-2006-3801</cvename>
<cvename>CVE-2006-3802</cvename>
<cvename>CVE-2006-3803</cvename>
<cvename>CVE-2006-3804</cvename>
<cvename>CVE-2006-3805</cvename>
<cvename>CVE-2006-3806</cvename>
<cvename>CVE-2006-3807</cvename>
<cvename>CVE-2006-3808</cvename>
<cvename>CVE-2006-3809</cvename>
<cvename>CVE-2006-3810</cvename>
<cvename>CVE-2006-3811</cvename>
<cvename>CVE-2006-3812</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-44.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-45.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-46.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-47.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-48.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-49.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-50.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-51.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-52.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-53.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-54.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-55.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-56.html</url>
</references>
<dates>
<discovery>2006-07-25</discovery>
<entry>2006-07-27</entry>
<modified>2006-11-02</modified>
</dates>
</vuln>
<vuln vid="5f2a0c40-1322-11db-bd23-000475abc56f">
<topic>zope -- information disclosure vulnerability</topic>
<affects>
<package>
<name>zope</name>
<range><ge>2.7.0</ge><lt>2.7.9</lt></range>
<range><ge>2.8.0</ge><lt>2.8.7</lt></range>
<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zope team reports:</p>
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view">
<p>Unspecified vulnerability in (Zope2) allows local users
to obtain sensitive information via unknown attack vectors
related to the docutils module and "restructured text".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3458</cvename>
<url>http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view</url>
</references>
<dates>
<discovery>2006-07-05</discovery>
<entry>2006-07-14</entry>
</dates>
</vuln>
<vuln vid="6da7344b-128a-11db-b25f-00e00c69a70d">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal team reports:</p>
<blockquote cite="http://drupal.org/node/66767">
<p>Vulnerability: XSS Vulnerability in taxonomy module</p>
<p>It is possible for a malicious user to insert and execute
XSS into terms, due to lack of validation on output of the
page title. The fix wraps the display of terms in
check_plain().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2833</cvename>
<url>http://drupal.org/node/66767</url>
</references>
<dates>
<discovery>2006-05-18</discovery>
<entry>2006-07-13</entry>
<modified>2006-07-14</modified>
</dates>
</vuln>
<vuln vid="67dbe99f-0f09-11db-94f8-00e029485e38">
<topic>shoutcast -- cross-site scripting, information exposure</topic>
<affects>
<package>
<name>shoutcast</name>
<name>linux-shoutcast</name>
<range><lt>1.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Goober's advisory reports reports that shoutcast is vulnerable to an
arbitrary file reading vulnerability:</p>
<blockquote cite="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">
<p>Impact of the vulnerability depends on the way the product was
installed. In general, the vulnerability allows the attacker to read
any file which can be read by the Shoutcast server process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3007</cvename>
<url>http://secunia.com/advisories/20524/</url>
<url>http://people.ksp.sk/~goober/advisory/001-shoutcast.html</url>
</references>
<dates>
<discovery>2006-06-09</discovery>
<entry>2006-07-11</entry>
</dates>
</vuln>
<vuln vid="b168ddea-105a-11db-ac96-000c6ec775d9">
<topic>samba -- memory exhaustion DoS in smbd</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.1,1</ge><lt>3.0.23,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CAN-2006-3403.html">
<p>The smbd daemon maintains internal data structures used
track active connections to file and printer shares. In
certain circumstances an attacker may be able to
continually increase the memory usage of an smbd process
by issuing a large number of share connection requests.
This defect affects all Samba configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3403</cvename>
<url>http://www.samba.org/samba/security/CAN-2006-3403.html</url>
</references>
<dates>
<discovery>2006-07-10</discovery>
<entry>2006-07-10</entry>
</dates>
</vuln>
<vuln vid="a876df84-0fef-11db-ac96-000c6ec775d9">
<topic>twiki -- multiple file extensions file upload vulnerability</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>4.0.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A TWiki Security Alert reports:</p>
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
<p>The TWiki upload filter already prevents executable
scripts such as .php, .php1, .phps, .pl from potentially
getting executed by appending a .txt suffix to the
uploaded filename. However, PHP and some other types
allows additional file suffixes, such as .php.en, .php.1,
and .php.2. TWiki does not check for these suffixes,
e.g. it is possible to upload php scripts with such
suffixes without the .txt filename padding.</p>
</blockquote>
<p>This issue can also be worked around with a restrictive web
server configuration. See the
<a href="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
TWiki Security Alert</a> for more information about how to do
this.</p>
</body>
</description>
<references>
<bid>18854</bid>
<cvename>CVE-2006-3336</cvename>
<url>http://secunia.com/advisories/20992/</url>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads</url>
</references>
<dates>
<discovery>2006-07-05</discovery>
<entry>2006-07-10</entry>
</dates>
</vuln>
<vuln vid="b0d61f73-0e11-11db-a47b-000c2957fdf1">
<topic>trac -- reStructuredText breach of privacy and denial of service vulnerability</topic>
<affects>
<package>
<name>trac</name>
<name>ja-trac</name>
<range><lt>0.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Trac 0.9.6 Release Notes reports:</p>
<blockquote cite="http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html">
<p>Fixed reStructuredText breach of privacy and denial of
service vulnerability found by Felix Wiemann.</p>
<p>The discovered vulnerability requires docutils to be
installed and enabled. Systems that do not have docutils
installed or enabled are not vulnerable. As of this
version version 0.3.9 or greater of docutils is required
for using reStructuredText markup in Trac.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3980</cvename>
<cvename>CVE-2005-4305</cvename>
<cvename>CVE-2005-4065</cvename>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
<mlist>http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html</mlist>
</references>
<dates>
<discovery>2006-07-06</discovery>
<entry>2006-07-07</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e94cb43d-0c4a-11db-9016-0050bf27ba24">
<topic>horde -- various problems in dereferrer</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Horde 3.1.2 release announcement:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2006/000288.html">
<p>Security Fixes:</p>
<ul>
<li>Closed XSS problems in dereferrer (IE only), help viewer
and problem reporting screen.</li>
<li>Removed unused image proxy code from dereferrer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3548</cvename>
<url>http://lists.horde.org/archives/announce/2006/000288.html</url>
</references>
<dates>
<discovery>2006-06-28</discovery>
<entry>2006-07-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f70d09cb-0c46-11db-aac7-000c6ec775d9">
<topic>mambo -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Team Mambo reports that two SQL injection
vulnerabilities have been found in Mambo. The
vulnerabilities exists due to missing sanitation of the
<code>title</code> and <code>catid</code> parameters in the
<code>weblinks.php</code> page and can lead to execution of
arbitrary SQL code.</p>
</body>
</description>
<references>
<bid>16775</bid>
<cvename>CVE-2006-0871</cvename>
<cvename>CVE-2006-1794</cvename>
<cvename>CVE-2006-3262</cvename>
<cvename>CVE-2006-3263</cvename>
<mlist msgid="20060617123242.1684.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=115056811230529</mlist>
<url>http://secunia.com/advisories/18935/</url>
<url>http://secunia.com/advisories/20745/</url>
<url>http://www.mamboserver.com/?option=com_content&task=view&id=207</url>
<url>http://www.gulftech.org/?node=research&article_id=00104-02242006</url>
</references>
<dates>
<discovery>2006-06-19</discovery>
<entry>2006-07-05</entry>
<modified>2006-10-05</modified>
</dates>
</vuln>
<vuln vid="229577a8-0936-11db-bf72-00046151137e">
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyadmin Site reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4">
<p>It was possible to craft a request that contains XSS by attacking
the "table" parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4</url>
<url>http://securitynews.ir/advisories/phpmyadmin281.txt</url>
</references>
<dates>
<discovery>2006-06-30</discovery>
<entry>2006-07-03</entry>
<modified>2007-10-16</modified>
</dates>
</vuln>
<vuln vid="227475c2-09cb-11db-9156-000e0c2e438a">
<topic>webmin, usermin -- arbitrary file disclosure vulnerability</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.290</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.220</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The webmin development team reports:</p>
<blockquote cite="http://www.webmin.com/security.html">
<p>An attacker without a login to Webmin can read the
contents of any file on the server using a specially
crafted URL. All users should upgrade to version
1.290 as soon as possible, or setup IP access control
in Webmin.</p>
</blockquote>
</body>
</description>
<references>
<bid>18744</bid>
<url>http://www.webmin.com/security.html</url>
</references>
<dates>
<discovery>2006-06-30</discovery>
<entry>2006-07-02</entry>
</dates>
</vuln>
<vuln vid="d2a43243-087b-11db-bc36-0008743bf21a">
<topic>mutt -- Remote Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<name>mutt-lite</name>
<range><le>1.4.2.1_2</le></range>
</package>
<package>
<name>mutt-devel</name>
<name>mutt-devel-lite</name>
<range><le>1.5.11_2</le></range>
</package>
<package>
<name>ja-mutt</name>
<range><le>1.4.2.1.j1</le></range>
</package>
<package>
<name>zh-mutt-devel</name>
<range><le>1.5.11_20040617</le></range>
</package>
<package>
<name>ja-mutt-devel</name>
<range><le>1.5.6.j1_2</le></range>
</package>
<package>
<name>mutt-ng</name>
<range><le>20060501</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/18642">
<p>Mutt is prone to a remote buffer-overflow vulnerability.
This issue is due to the application's failure to properly
bounds-check user-supplied input before copying it to an
insufficiently sized memory buffer.</p>
<p>This issue may allow remote attackers to execute arbitrary
machine code in the context of the affected application.
Failed exploit attempts will likely crash the application,
denying further service to legitimate users.</p>
</blockquote>
</body>
</description>
<references>
<bid>18642</bid>
<url>http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540</url>
</references>
<dates>
<discovery>2006-06-26</discovery>
<entry>2006-06-30</entry>
</dates>
</vuln>
<vuln vid="1f935f61-075d-11db-822b-728b50d539a3">
<topic>Joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla Site reports:</p>
<blockquote cite="http://www.joomla.org/content/view/1510/74/">
<ul>
<li>Secured "Remember Me" functionality against SQL injection
attacks</li>
<li>Secured "Related Items" module against SQL injection
attacks</li>
<li>Secured "Weblinks" submission against SQL injection
attacks</li>
<li>Secured SEF from XSS vulnerability</li>
<li>Hardened frontend submission forms against spoofing</li>
<li>Secured mosmsg from misuse</li>
<li>Hardened mosgetparam by setting variable type to integer if
default value is detected as numeric</li>
<li>Secured com_messages from XSS vulnerability</li>
<li>Secured getUserStateFromRequest() from XSS vulnerability</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20746/</url>
<url>http://www.joomla.org/content/view/1510/74/</url>
</references>
<dates>
<discovery>2006-06-26</discovery>
<entry>2006-06-30</entry>
</dates>
</vuln>
<vuln vid="2be7c122-0614-11db-9156-000e0c2e438a">
<topic>hashcash -- heap overflow vulnerability</topic>
<affects>
<package>
<name>hashcash</name>
<range><lt>1.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Seltenreich reports that hashcash is prone to a heap
overflow vulnerability. This vulnerability is caused by
improper checking of memory allocations within the
"array_push()" function. An attacker could trigger this
vulnerability by passing a lot of "-r" or "-j" flags from
the command line, this only applies when the application is
configured to allow command line options, or by passing a lot
of resource names when the application was started with the
"-m" flag set. This could lead to a Denial or Service or
could allow remote access to the targeted system.</p>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20800/</url>
<url>http://www.hashcash.org/source/CHANGELOG</url>
</references>
<dates>
<discovery>2006-06-27</discovery>
<entry>2006-06-27</entry>
</dates>
</vuln>
<vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9">
<topic>gnupg -- user id integer overflow vulnerability</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If GnuPG processes a userid with a very long packet length,
GnuPG can crash due to insufficient bounds check. This can
result in a denial-of-service condition or potentially
execution of arbitrary code with the privileges of the user
running GnuPG.</p>
</body>
</description>
<references>
<bid>18554</bid>
<cvename>CVE-2006-3082</cvename>
<mlist msgid="87psgxic5e.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-users&m=115124706210430</mlist>
<mlist msgid="20060531115548.A2E4923E4B6@dzeta.agava.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=114907659313360</mlist>
<url>http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-25</entry>
</dates>
</vuln>
<vuln vid="0a4cd819-0291-11db-bbf7-000c6ec775d9">
<cancelled/>
</vuln>
<vuln vid="09429f7c-fd6e-11da-b1cd-0050bf27ba24">
<topic>horde -- multiple parameter cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><le>3.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT advisory ADV-2006-2356 reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/2356">
<p>Multiple vulnerabilities have been identified in Horde
Application Framework, which may be exploited by attackers
to execute arbitrary scripting code. These flaws are due
to input validation errors in the "test.php" and
"templates/problem/problem.inc" scripts that do not
validate the "url", "name", "email", "subject" and
"message" parameters, which could be exploited by
attackers to cause arbitrary scripting code to be executed
by the user's browser in the security context of an
affected Web site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2195</cvename>
<url>http://www.frsirt.com/english/advisories/2006/2356</url>
<url>http://cvs.horde.org/diff.php?f=horde%2Ftest.php&r1=1.145&r2=1.146</url>
<url>http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&r1=2.25&r2=2.26</url>
</references>
<dates>
<discovery>2006-06-10</discovery>
<entry>2006-06-17</entry>
</dates>
</vuln>
<vuln vid="09c92f3a-fd49-11da-995c-605724cdf281">
<topic>WebCalendar -- information disclosure vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20367/">
<p>socsam has discovered a vulnerability in WebCalendar,
which can be exploited by malicious people to bypass
certain security restrictions and disclose sensitive
information.</p>
<p>Input passed to the "includedir" parameter isn't properly
verified, before it is used in an "fopen()" call. This can
be exploited to load an arbitrary setting file from an
external web site.</p>
<p>This can further be exploited to disclose the content of
arbitrary files by defining the "user_inc" variable in a
malicious setting file.</p>
<p>Successful exploitation requires that "register_globals"
is enabled.</p>
</blockquote>
</body>
</description>
<references>
<bid>18175</bid>
<cvename>CVE-2006-2762</cvename>
<url>http://www.securityfocus.com/archive/1/435379</url>
<url>http://www.securityfocus.com/archive/1/436263</url>
</references>
<dates>
<discovery>2006-05-30</discovery>
<entry>2006-06-16</entry>
<modified>2006-06-17</modified>
</dates>
</vuln>
<vuln vid="c611be81-fbc2-11da-9156-000e0c2e438a">
<topic>sendmail -- Incorrect multipart message handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.11</ge><lt>4.11_19</lt></range>
<range><ge>5.3</ge><lt>5.3_31</lt></range>
<range><ge>5.4</ge><lt>5.4_16</lt></range>
<range><ge>5.5</ge><lt>5.5_2</lt></range>
<range><ge>6.0</ge><lt>6.0_9</lt></range>
<range><ge>6.1</ge><lt>6.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A suitably malformed multipart MIME message can cause
sendmail to exceed predefined limits on its stack usage.</p>
<h1>Impact</h1>
<p>An attacker able to send mail to, or via, a server can cause
queued messages on the system to not be delivered, by causing
the sendmail process which handles queued messages to crash.
Note that this will not stop new messages from entering the
queue (either from local processes, or incoming via SMTP).</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not receive
email from untrusted sources are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1173</cvename>
<freebsdsa>SA-06:17.sendmail</freebsdsa>
</references>
<dates>
<discovery>2006-06-14</discovery>
<entry>2006-06-14</entry>
</dates>
</vuln>
<vuln vid="23573650-f99a-11da-994e-00142a5f241c">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported within dokuwiki.
dokuwiki is proven vulnerable to:</p>
<ul>
<li>arbitrary PHP code insertion via spellcheck module,</li>
<li>XSS attack via "Update your account profile,"</li>
<li>bypassing of ACL controls when enabled.</li>
</ul>
</body>
</description>
<references>
<url>http://bugs.splitbrain.org/index.php?do=details&id=820</url>
<url>http://bugs.splitbrain.org/index.php?do=details&id=823</url>
<url>http://bugs.splitbrain.org/index.php?do=details&id=825</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-11</entry>
<modified>2006-06-12</modified>
</dates>
</vuln>
<vuln vid="107e2ee5-f941-11da-b1fa-020039488e34">
<topic>libxine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/20369">
<p>Federico L. Bossi Bonin has discovered a weakness in xine-lib,
which can be exploited by malicious people to crash certain
applications on a user's system.</p>
<p>The weakness is cause due to a heap corruption within the
"xineplug_inp_http.so" plugin when handling an overly large
reply from the HTTP server. This can be exploited to crash
an application that uses the plugin (e.g. gxine).</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20369</url>
<cvename>CVE-2006-2802</cvename>
<bid>18187</bid>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-11</entry>
</dates>
</vuln>
<vuln vid="cf3b9a96-f7bb-11da-9156-000e0c2e438a">
<topic>smbfs -- chroot escape</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.10</ge><lt>4.10_24</lt></range>
<range><ge>4.11</ge><lt>4.11_18</lt></range>
<range><ge>5.3</ge><lt>5.3_30</lt></range>
<range><ge>5.4</ge><lt>5.4_15</lt></range>
<range><ge>5.5</ge><lt>5.5_1</lt></range>
<range><ge>6.0</ge><lt>6.0_8</lt></range>
<range><ge>6.1</ge><lt>6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>smbfs does not properly sanitize paths containing a backslash
character; in particular the directory name '..\' is
interpreted as the parent directory by the SMB/CIFS server,
but smbfs handles it in the same manner as any other
directory.</p>
<h1>Impact</h1>
<p>When inside a chroot environment which resides on a smbfs
mounted file-system it is possible for an attacker to escape
out of this chroot to any other directory on the smbfs
mounted file-system.</p>
<h1>Workaround</h1>
<p>Mount the smbfs file-systems which need to be used with
chroot on top, in a way so the chroot directory is exactly on
the mount point and not a sub directory</p>
</body>
</description>
<references>
<cvename>CVE-2006-2654</cvename>
<freebsdsa>SA-06:16.smbfs</freebsdsa>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-09</entry>
</dates>
</vuln>
<vuln vid="0ac1aace-f7b9-11da-9156-000e0c2e438a">
<topic>ypserv -- Inoperative access controls in ypserv</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.3</ge><lt>5.3_30</lt></range>
<range><ge>5.4</ge><lt>5.4_15</lt></range>
<range><ge>5.5</ge><lt>5.5_1</lt></range>
<range><ge>6.0</ge><lt>6.0_8</lt></range>
<range><ge>6.1</ge><lt>6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>There are two documented methods of restricting access to
NIS maps through ypserv(8): through the use of the
/var/yp/securenets file, and through the /etc/hosts.allow file.
While both mechanisms are implemented in the server, a change
in the build process caused the "securenets" access restrictions
to be inadvertantly disabled.</p>
<h1>Impact</h1>
<p>ypserv(8) will not load or process any of the networks or
hosts specified in the /var/yp/securenets file, rendering
those access controls ineffective.</p>
<h1>Workaround</h1>
<p>One possible workaround is to use /etc/hosts.allow for access
control, as shown by examples in that file.</p>
<p>Another workaround is to use a firewall (e.g., ipfw(4),
ipf(4), or pf(4)) to limit access to RPC functions from
untrusted systems or networks, but due to the complexities of
RPC, it might be difficult to create a set of firewall rules
which accomplish this without blocking all access to the
machine in question.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2655</cvename>
<freebsdsa>SA-06:15.ypserv</freebsdsa>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-09</entry>
</dates>
</vuln>
<vuln vid="ec2f2ff5-f710-11da-9156-000e0c2e438a">
<topic>freeradius -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>1.0.0</ge><le>1.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradious development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>Multiple issues exist with version 1.0.4, and all prior
versions of the server. Externally exploitable
vulnerabilities exist only for sites that use the
rlm_sqlcounter module. Those sites may be vulnerable to
SQL injection attacks, similar to the issues noted below.
All sites that have not deployed the rlm_sqlcounter module
are not vulnerable to external exploits.</p>
<p>The issues are:<br/>
SQL Injection attack in the rlm_sqlcounter module.<br/>
Buffer overflow in the rlm_sqlcounter module, that may cause
a server crash. <br/>
Buffer overflow while expanding %t, that may cause a server
crash.</p>
</blockquote>
</body>
</description>
<references>
<bid>17171</bid>
<cvename>CVE-2005-4744</cvename>
</references>
<dates>
<discovery>2005-09-09</discovery>
<entry>2006-06-08</entry>
</dates>
</vuln>
<vuln vid="1a216dfd-f710-11da-9156-000e0c2e438a">
<topic>freeradius -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<range><gt>1.0.0</gt><le>1.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradius development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>A validation issue exists with the EAP-MSCHAPv2 module
in all versions from 1.0.0 (where the module first
appeared) to 1.1.0. Insufficient input validation was being
done in the EAP-MSCHAPv2 state machine. A malicious
attacker could manipulate their EAP-MSCHAPv2 client state
machine to potentially convince the server to bypass
authentication checks. This bypassing could also result
in the server crashing</p>
</blockquote>
</body>
</description>
<references>
<bid>17293</bid>
<cvename>CVE-2006-1354</cvename>
</references>
<dates>
<discovery>2006-06-03</discovery>
<entry>2006-06-08</entry>
</dates>
</vuln>
<vuln vid="00784d6e-f4ce-11da-87a1-000c6ec775d9">
<topic>squirrelmail -- plugin.php local file inclusion vulnerability</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>1.4.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail Project Team reports:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-06-01">
<p>A security issue has been uncovered in
functions/plugin.php that could allow a remote user to
access local files on the server without requiring
login. This issue manifests itself if register_globals is
enabled, and magic_quotes_gpc is disabled.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squirrelmail.org/security/issue/2006-06-01</url>
<url>http://secunia.com/advisories/20406/</url>
</references>
<dates>
<discovery>2006-06-01</discovery>
<entry>2006-06-05</entry>
<modified>2006-06-06</modified>
</dates>
</vuln>
<vuln vid="af8dba15-f4cc-11da-87a1-000c6ec775d9">
<topic>dokuwiki -- spellchecker remote PHP code execution</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_042006.119.html">
<p>During the evaluation of DokuWiki for a german/korean
wiki of mine a flaw in DokuWiki's spellchecker was
discovered, that allows injecting arbitrary PHP commands,
by requesting a spellcheck on PHP commands in 'complex
curly syntax'.</p>
<p>Because the spellchecker is written as part of the AJAX
functionality of DokuWiki, it can be directly called by
any website visitor, without the need for a wiki
account.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_042006.119.html</url>
<url>http://bugs.splitbrain.org/index.php?do=details&id=823</url>
<url>http://secunia.com/advisories/20429/</url>
</references>
<dates>
<discovery>2006-06-05</discovery>
<entry>2006-06-05</entry>
</dates>
</vuln>
<vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal team reports:</p>
<blockquote cite="http://drupal.org/node/65357">
<p>Vulnerability: SQL injection</p>
<p>A security vulnerability in the database layer allowed
certain queries to be submitted to the database without
going through Drupal's query sanitizer.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/65409">
<p>Vulnerability: Execution of arbitrary files</p>
<p>Certain -- alas, typical -- configurations of Apache
allows execution of carefully named arbitrary scripts in
the files directory. Drupal now will attempt to
automatically create a .htaccess file in your "files"
directory to protect you.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2742</cvename>
<cvename>CVE-2006-2743</cvename>
<url>http://drupal.org/node/65357</url>
<url>http://drupal.org/node/65409</url>
</references>
<dates>
<discovery>2006-05-18</discovery>
<entry>2006-06-05</entry>
</dates>
</vuln>
<vuln vid="7f8cecea-f199-11da-8422-00123ffe8333">
<topic>MySQL -- SQL-injection security vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><le>5.1.9</le></range>
<range><ge>5.0</ge><lt>5.0.22</lt></range>
<range><ge>4.1</ge><lt>4.1.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://lists.mysql.com/announce/364">
<p>An SQL-injection security hole has been found in multibyte
encoding processing. An SQL-injection security hole can include a
situation whereby when inserting user supplied data into a
database, the user might inject his own SQL statements that the
server will execute. With regards to this vulnerability discovered,
when character set unaware escaping is used (e.g., addslashes() in
PHP), it is possible to bypass it in some multibyte character sets
(e.g., SJIS, BIG5 and GBK). As a result, a function like
addslashes() is not able to prevent SQL injection attacks. It is
impossible to fix this on the server side. The best solution is for
applications to use character set aware escaping offered in a
function like mysql_real_escape().</p>
<p>Workarounds:</p>
<p>One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug
in mysql_real_escape_string(), if you cannot upgrade your server
for some reason. It will enable SQL standard compatibility mode,
where backslash is not considered a special character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.mysql.com/announce/364</url>
<url>http://lists.mysql.com/announce/365</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-01</entry>
</dates>
</vuln>
<vuln vid="4913886c-e875-11da-b9f4-00123ffe8333">
<topic>MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>mysql-server</name>
<range><gt>4.0</gt><lt>4.0.27</lt></range>
<range><gt>4.1</gt><lt>4.1.19</lt></range>
<range><gt>5.1</gt><le>5.1.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19929/">
<p>MySQL have some vulnerabilities, which can be exploited by
malicious users to disclose potentially sensitive information
and compromise a vulnerable system.</p>
<p>1) An error within the code that generates an error response
to an invalid COM_TABLE_DUMP packet can be exploited by an
authenticated client to disclosure certain memory content of the
server process.</p>
<p>2) A boundary error within the handling of specially crafted
invalid COM_TABLE_DUMP packets can be exploited by an authenticated
client to cause a buffer overflow and allows arbitrary code
execution.</p>
<p>3) An error within the handling of malformed login packets can be
exploited to disclosure certain memory content of the server
process in the error messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1516</cvename>
<cvename>CVE-2006-1517</cvename>
<cvename>CVE-2006-1518</cvename>
<certvu>602457</certvu>
<url>http://www.wisec.it/vulns.php?page=7</url>
<url>http://www.wisec.it/vulns.php?page=8</url>
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html</url>
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html</url>
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html</url>
<url>http://secunia.com/advisories/19929/</url>
<url>http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-06-01</entry>
</dates>
</vuln>
<vuln vid="c0171f59-ea8a-11da-be02-000c6ec775d9">
<topic>frontpage -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>frontpage</name>
<name>mod_frontpage13</name>
<name>mod_frontpage20</name>
<name>mod_frontpage21</name>
<name>mod_frontpage22</name>
<range><lt>5.0.2.4803</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Esteban Martinez Fayo reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000">
<p>The FrontPage Server Extensions 2002 (included in Windows
Sever 2003 IIS 6.0 and available as a separate download
for Windows 2000 and XP) has a web page
/_vti_bin/_vti_adm/fpadmdll.dll that is used for
administrative purposes. This web page is vulnerable to
cross site scripting attacks allowing an attacker to run
client-side script on behalf of an FPSE user. If the
victim is an administrator, the attacker could take
complete control of a Front Page Server Extensions 2002
server.</p>
<p>To exploit the vulnerability an attacker can send a
specially crafted e-mail message to a FPSE user and then
persuade the user to click a link in the e-mail
message.</p>
<p>In addition, this vulnerability can be exploited if an
attacker hosts a malicious website and persuade the user
to visit it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0015</cvename>
<mlist msgid="0e3f01c65e78$93c00800$de00a8c0@rigel">http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000</mlist>
<url>http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx</url>
<url>http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm</url>
</references>
<dates>
<discovery>2006-04-12</discovery>
<entry>2006-05-23</entry>
</dates>
</vuln>
<vuln vid="72d8df84-ea6d-11da-8a53-00123ffe8333">
<topic>cscope -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Duell reports:</p>
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664">
<p>Cscope contains an alarming number of buffer overflow
vulnerabilities. By a rough count, there are at least 48 places
where we blindly sprintf() a file name into a fixed-length buffer
of size PATHLEN without checking to see if the file's name
is <= PATHLEN. We do similar things with environment variable
values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-2541</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664</url>
<url>http://secunia.com/advisories/13237</url>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2006-05-23</entry>
</dates>
</vuln>
<vuln vid="0b628470-e9a6-11da-b9f4-00123ffe8333">
<topic>coppermine -- Multiple File Extensions Vulnerability</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20211/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious users to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an error in the handling of
file uploads where a filename has multiple file extensions. This
can be exploited to upload malicious script files inside the web
root (e.g. a PHP script).</p>
<p>Successful exploitation may allow execution of script code
depending on the HTTP server configuration (it requires e.g. an
Apache server with the "mod_mime" module installed).</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266</url>
<url>http://secunia.com/advisories/20211/</url>
</references>
<dates>
<discovery>2006-05-22</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="6738977b-e9a5-11da-b9f4-00123ffe8333">
<topic>coppermine -- "file" Local File Inclusion Vulnerability</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19665/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious people to disclose sensitive
information.</p>
<p>Input passed to the "file" parameter in "index.php" isn't properly
verified, before it is used to include files. This can be exploited
to include arbitrary files from local resources.</p>
<p>Example:
http://[host]/index.php?file=.//././/././/././/./[file]%00</p>
<p>Successful exploitation requires that "magic_quotes_gpc" is
disabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1909</cvename>
<url>http://coppermine-gallery.net/forum/index.php?topic=30655.0</url>
<url>http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html</url>
<url>http://secunia.com/advisories/19665/</url>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="77cceaef-e9a4-11da-b9f4-00123ffe8333">
<topic>coppermine -- File Inclusion Vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/18941/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious people and by malicious users to compromise
a vulnerable system.</p>
<p>1) Input passed to the "lang" parameter in include/init.inc.php
isn't properly verified, before it is used to include files. This
can be exploited to include arbitrary files from local resources.
The vulnerability can be further exploited by users who are allowed
to upload image files to execute arbitrary PHP code.</p>
<p>2) Input passed to the "f" parameter in docs/showdoc.php isn't
properly verified, before it is used to include files. This can be
exploited to include arbitrary files from local resources on the
Windows platform, and remote files from Windows shared folders.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0872</cvename>
<cvename>CVE-2006-0873</cvename>
<url>http://retrogod.altervista.org/cpg_143_adv.html</url>
<url>http://secunia.com/advisories/18941/</url>
</references>
<dates>
<discovery>2006-02-20</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="2ecd02e2-e864-11da-b9f4-00123ffe8333">
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3">
<p>It was possible to inject arbitrary SQL commands by forcing an
authenticated user to follow a crafted link.</p>
<p>Such issue is quite common in many PHP applications and users
should take care what links they follow. We consider these
vulnerabilities to be quite dangerous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1804</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3</url>
<url>http://secunia.com/advisories/19659</url>
</references>
<dates>
<discovery>2006-05-20</discovery>
<entry>2006-05-21</entry>
</dates>
</vuln>
<vuln vid="4645b98c-e46e-11da-9ae7-00123fcc6e5c">
<topic>vnc -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>vnc</name>
<range><eq>4.1.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RealVNC is susceptible to an authentication-bypass vulnerability.
A malicious VNC client can cause a VNC server to allow it to connect
without any authentication regardless of the authentication settings
configured in the server. Exploiting this issue allows attackers to
gain unauthenticated, remote access to the VNC servers.</p>
</body>
</description>
<references>
<bid>17978</bid>
<mlist>http://www.securityfocus.com/archive/1/433994/30/0/threaded</mlist>
</references>
<dates>
<discovery>2006-05-15</discovery>
<entry>2006-05-18</entry>
</dates>
</vuln>
<vuln vid="6d78202e-e2f9-11da-8674-00123ffe8333">
<topic>phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities</topic>
<affects>
<package>
<name>phpldapadmin098</name>
<range><lt>0.9.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19747/">
<p>phpLDAPadmin have some vulnerabilities, which can be exploited by
malicious users to conduct script insertion attacks and by
malicious people to conduct cross-site scripting attacks.</p>
<p>1) Some input isn't properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.</p>
<p>2) Input passed to the "Container DN", "Machine Name", and "UID
Number" parameters in "template_engine.php" isn't properly
sanitised before being used. This can be exploited to inject
arbitrary HTML and script code, which will be executed in a user's
browser session in context of an affected site when the malicious
user data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2016</cvename>
<url>http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html</url>
<url>http://www.frsirt.com/english/advisories/2006/1450</url>
<url>http://secunia.com/advisories/19747/</url>
</references>
<dates>
<discovery>2006-04-21</discovery>
<entry>2006-05-14</entry>
</dates>
</vuln>
<vuln vid="a86f30e7-dce7-11da-bf3f-02e081235dab">
<topic>fswiki -- XSS vulnerability</topic>
<affects>
<package>
<name>fswiki</name>
<range><lt>3.5.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JVN reports:</p>
<blockquote cite="http://jvn.jp/jp/JVN%2335274905/">
<p>FreeStyleWiki has XSS vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://jvn.jp/jp/JVN%2335274905/</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-05-06</entry>
</dates>
</vuln>
<vuln vid="a8d8713e-dc83-11da-a22b-000c6ec775d9">
<topic>mysql50-server -- COM_TABLE_DUMP arbitrary code execution</topic>
<affects>
<package>
<name>mysql-server</name>
<range><gt>5.0</gt><lt>5.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefano Di Paola reports:</p>
<blockquote cite="http://www.wisec.it/vulns.php?page=8">
<p>An authenticated user could remotely execute arbitrary
commands by taking advantage of a stack overflow.</p>
<p>To take advantage of these flaws an attacker should have
direct access to MySQL server communication layer (port
3306 or unix socket). But if used in conjuction with some
web application flaws (i.e. php code injection) an
attacker could use socket programming (i.e. php sockets)
to gain access to that layer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1518</cvename>
<url>http://www.wisec.it/vulns.php?page=8</url>
<mlist msgid="1146577257.5679.217.camel@first">http://marc.theaimsgroup.com/?l=bugtraq&m=114659633220473</mlist>
<url>http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-05-06</entry>
</dates>
</vuln>
<vuln vid="2df297a2-dc74-11da-a22b-000c6ec775d9">
<topic>awstats -- arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.5_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OS Reviews reports:</p>
<blockquote cite="http://www.osreviews.net/reviews/comm/awstats">
<p>If the update of the stats via web front-end is allowed,
a remote attacker can execute arbitrary code on the server
using a specially crafted request involving the migrate
parameter. Input starting with a pipe character ("|")
leads to an insecure call to Perl's open function and the
rest of the input being executed in a shell. The code is
run in the context of the process running the AWStats
CGI.</p>
<p>Arbitrary code can be executed by uploading a specially
crafted configuration file if an attacker can put a file
on the server with chosen file name and content (e.g. by
using an FTP account on a shared hosting server). In this
configuration file, the LogFile directive can be used to
execute shell code following a pipe character. As above,
an open call on unsanitized input is the source of this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://awstats.sourceforge.net/awstats_security_news.php</url>
<url>http://secunia.com/advisories/19969/</url>
<url>http://www.osreviews.net/reviews/comm/awstats</url>
</references>
<dates>
<discovery>2006-05-03</discovery>
<entry>2006-05-05</entry>
<modified>2006-11-15</modified>
</dates>
</vuln>
<vuln vid="d9dc2697-dadf-11da-912f-00123ffe8333">
<topic>phpwebftp -- "language" Local File Inclusion</topic>
<affects>
<package>
<name>phpwebftp</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19706/">
<p>phpWebFTP have a vulnerability, which can be exploited by
malicious people to disclose sensitive information.</p>
<p>Input passed to the "language" parameter in index.php isn't
properly verified, before it is used to include files. This can be
exploited to include arbitrary files from local resources.</p>
<p>Successful exploitation requires that "magic_quotes_gpc" is
disabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1812</cvename>
<cvename>CVE-2006-1813</cvename>
<url>https://sourceforge.net/forum/forum.php?forum_id=566199</url>
<url>http://secunia.com/advisories/19706/</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-05-03</entry>
</dates>
</vuln>
<vuln vid="e2476979-da74-11da-a67b-0013d4a4a40e">
<topic>firefox -- denial of service vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>1.5.*,1</gt><lt>1.5.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports for
deleted object reference when designMode="on"</p>
<blockquote cite="http://www.mozilla.org/security/announce/2006/mfsa2006-30.html">
<p>Martijn Wargers and Nick Mott each described crashes that
were discovered to ultimately stem from the same root cause:
attempting to use a deleted controller context when designMode
was turned on. This generally results in crashing the browser,
but in theory references to deleted objects can be abused to
run malicious code.</p>
<p>"splices" reported the same crash at the fan site MozillaZine and
on Bugtraq, incorrectly describing it as a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1993</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-30.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-05-03</entry>
<modified>2006-05-05</modified>
</dates>
</vuln>
<vuln vid="400d9d22-d6c5-11da-a14b-00123ffe8333">
<topic>trac -- Wiki Macro Script Insertion Vulnerability</topic>
<affects>
<package>
<name>trac</name>
<name>ja-trac</name>
<range><lt>0.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19870/">
<p>A vulnerability has been reported, which can be exploited by
malicious people to conduct script insertion attacks.</p>
<p>Input passed using the wiki macro isn't properly sanitised before
being used. This can be exploited to inject arbitrary HTML and
script code, which will be executed in a user's browser session in
context of an affected site when the malicious user data is
viewed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
<url>http://jvn.jp/jp/JVN%2384091359/index.html</url>
<url>http://secunia.com/advisories/19870/</url>
</references>
<dates>
<discovery>2006-04-28</discovery>
<entry>2006-05-02</entry>
</dates>
</vuln>
<vuln vid="af2a60ed-da3e-11da-93e0-00123ffe8333">
<cancelled/>
</vuln>
<vuln vid="b088bf48-da3b-11da-93e0-00123ffe8333">
<topic>clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>0.80</ge><lt>0.88.2</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><ge>20040826</ge><lt>20060502</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19880/">
<p>A vulnerability has been reported in ClamAV, which can be
exploited by malicious people to cause a DoS (Denial of Service)
and potentially to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to a boundary error within the
HTTP client in the Freshclam command line utility. This can be
exploited to cause a stack-based buffer overflow when the HTTP
headers received from a web server exceeds 8KB.</p>
<p>Successful exploitation requires that Freshclam is used to
download virus signature updates from a malicious mirror web
server e.g. via DNS poisoning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1989</cvename>
<url>http://www.clamav.net/security/0.88.2.html</url>
<url>http://secunia.com/advisories/19880/</url>
</references>
<dates>
<discovery>2006-05-01</discovery>
<entry>2006-05-03</entry>
</dates>
</vuln>
<vuln vid="f4af098d-d921-11da-ad4a-00123ffe8333">
<topic>jabberd -- SASL Negotiation Denial of Service Vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19281/">
<p>A vulnerability has been reported in jabberd, which can be
exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an error within the handling
of SASL negotiation. This can be exploited to cause a crash by
sending a "response" stanza before an "auth" stanza.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1329</cvename>
<url>http://article.gmane.org/gmane.network.jabber.admin/27372</url>
<url>http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826</url>
<url>http://secunia.com/advisories/19281/</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-05-01</entry>
</dates>
</vuln>
<vuln vid="79c1154d-d5a5-11da-8098-00123ffe8333">
<topic>cacti -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/18276/">
<p>Cacti have a security issue, which can be exploited by malicious
people to execute arbitrary SQL code and potentially compromise a
vulnerable system.</p>
<p>The problem is caused due to the presence of the insecure
"server.php" test script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/18276/</url>
<url>http://secunia.com/advisories/17418/</url>
</references>
<dates>
<discovery>2006-01-09</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="dc930435-d59f-11da-8098-00123ffe8333">
<topic>amaya -- Attribute Value Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>amaya</name>
<range><lt>9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19670/">
<p>Amaya have two vulnerabilities, which can be exploited by
malicious people to compromise a user's system.</p>
<p>The vulnerabilities are caused due to boundary errors within the
parsing of various attribute values. This can be exploited to cause
stack-based buffer overflows when a user opens a specially crafted
HTML document containing certain tags with overly long attribute
values.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1900</cvename>
<url>http://morph3us.org/advisories/20060412-amaya-94.txt</url>
<url>http://morph3us.org/advisories/20060412-amaya-94-2.txt</url>
<url>http://secunia.com/advisories/19670/</url>
</references>
<dates>
<discovery>2006-04-14</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="116b0820-d59c-11da-8098-00123ffe8333">
<topic>lifetype -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
<affects>
<package>
<name>lifetype</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19699/">
<p>A security issue has been discovered in LifeType, which can be
exploited by malicious people to execute arbitrary SQL code and
potentially compromise a vulnerable system.</p>
<p>The problem is caused due to the presence of the insecure
"server.php" test script.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0146</cvename>
<url>http://secunia.com/advisories/19699/</url>
<url>http://secunia.com/advisories/17418/</url>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="21c223f2-d596-11da-8098-00123ffe8333">
<topic>ethereal -- Multiple Protocol Dissector Vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.5</ge><lt>0.99.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19769/">
<p>Multiple vulnerabilities have been reported in Ethereal, which
can be exploited by malicious people to cause a DoS (Denial of
Service) or compromise a vulnerable system.</p>
<p>The vulnerabilities are caused due to various types of errors
including boundary errors, an off-by-one error, an infinite loop
error, and several unspecified errors in a multitude of protocol
dissectors.</p>
<p>Successful exploitation causes Ethereal to stop responding,
consume a large amount of system resources, crash, or execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1932</cvename>
<cvename>CVE-2006-1933</cvename>
<cvename>CVE-2006-1934</cvename>
<cvename>CVE-2006-1935</cvename>
<cvename>CVE-2006-1936</cvename>
<cvename>CVE-2006-1937</cvename>
<cvename>CVE-2006-1938</cvename>
<cvename>CVE-2006-1939</cvename>
<cvename>CVE-2006-1940</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00023.html</url>
<url>http://secunia.com/advisories/19769/</url>
</references>
<dates>
<discovery>2006-04-25</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="8b683bea-d49c-11da-a672-000e0c2e438a">
<topic>asterisk -- denial of service vulnerability, local system access</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Emmanouel Kellenis reports a denial of service vulnerability
within asterisk. The vulnerability is caused by a buffer
overflow in "format_jpeg.c". A large JPEG image could
trigger this bug, potentially allowing a local attacker to
execute arbitrary code.</p>
</body>
</description>
<references>
<bid>17561</bid>
<cvename>CVE-2006-1827</cvename>
<url>http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory</url>
</references>
<dates>
<discovery>2006-04-07</discovery>
<entry>2006-04-25</entry>
</dates>
</vuln>
<vuln vid="a813a219-d2d4-11da-a672-000e0c2e438a">
<topic>zgv, xzgv -- heap overflow vulnerability</topic>
<affects>
<package>
<name>zgv</name>
<range><lt>5.9_1</lt></range>
</package>
<package>
<name>xzgv</name>
<range><lt>0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml">
<p>Andrea Barisani of Gentoo Linux discovered xzgv and zgv
allocate insufficient memory when rendering images with
more than 3 output components, such as images using the
YCCK or CMYK colour space. When xzgv or zgv attempt to
render the image, data from the image overruns a heap
allocated buffer.</p>
<p>An attacker may be able to construct a malicious image that
executes arbitrary code with the permissions of the xzgv or
zgv user when attempting to render the image.</p>
</blockquote>
</body>
</description>
<references>
<bid>17409</bid>
<cvename>CVE-2006-1060</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml</url>
</references>
<dates>
<discovery>2006-04-21</discovery>
<entry>2006-04-23</entry>
<modified>2010-03-22</modified>
</dates>
</vuln>
<vuln vid="86cc5c6f-d2b4-11da-a672-000e0c2e438a">
<topic>crossfire-server -- denial of service and remote code execution vulnerability</topic>
<affects>
<package>
<name>crossfire-server</name>
<range><lt>1.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FRSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/0760">
<p>A vulnerability has been identified in CrossFire, which
could be exploited by remote attackers to execute arbitrary
commands or cause a denial of service. This flaw is due to
a buffer overflow error in the "oldsocketmode" module that
fails to properly handle overly large requests, which could
be exploited by a malicious client to crash or compromise a
vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<bid>16883</bid>
<cvename>CVE-2006-1010</cvename>
<url>http://www.frsirt.com/english/advisories/2006/0760</url>
</references>
<dates>
<discovery>2006-02-28</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="8cfb6f42-d2b0-11da-a672-000e0c2e438a">
<topic>p5-DBI -- insecure temporary file creation vulnerability</topic>
<affects>
<package>
<name>p5-DBI-137</name>
<range><ge>0</ge></range>
</package>
<package>
<name>p5-DBI</name>
<range><lt>1.37_1</lt></range>
<range><ge>1.38</ge><lt>1.48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-658">
<p>The DBI library, the Perl5 database interface, creates a
temporary PID file in an insecure manner. This can be
exploited by a malicious user to overwrite arbitrary files
owned by the person executing the parts of the library.</p>
</blockquote>
</body>
</description>
<references>
<bid>12360</bid>
<cvename>CAN-2005-0077</cvename>
<url>http://www.debian.org/security/2005/dsa-658</url>
</references>
<dates>
<discovery>2005-01-25</discovery>
<entry>2006-04-23</entry>
<modified>2006-05-11</modified>
</dates>
</vuln>
<vuln vid="e0b342a1-d2ae-11da-a672-000e0c2e438a">
<topic>wordpress -- full path disclosure</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dedi Dwianto reports:</p>
<blockquote cite="http://echo.or.id/adv/adv24-theday-2005.txt">
<p>A remote user can access the file directly to cause the
system to display an error message that indicates the
installation path. The resulting error message will
disclose potentially sensitive installation path
information to the remote attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4463</cvename>
<url>http://echo.or.id/adv/adv24-theday-2005.txt</url>
</references>
<dates>
<discovery>2005-12-20</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="8d4ae57d-d2ab-11da-a672-000e0c2e438a">
<topic>xine -- multiple remote string vulnerabilities</topic>
<affects>
<package>
<name>xine</name>
<range><lt>0.99.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>c0ntexb reports:</p>
<blockquote cite="http://www.open-security.org/advisories/16">
<p>There are 2 format string bugs in the latest version of
Xine that could be exploited by a malicious person to
execute code on the system of a remote user running the
media player against a malicious playlist file. By passing
a format specifier in the path of a file that is embedded
in a remote playlist, it is possible to trigger this bug.</p>
</blockquote>
</body>
</description>
<references>
<bid>17579</bid>
<cvename>CVE-2006-1905</cvename>
<url>http://www.open-security.org/advisories/16</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="408f6ebf-d152-11da-962f-000b972eb521">
<topic>cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><ge>2.*</ge><lt>2.1.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unspecified vulnerability in the CMU Cyrus Simple
Authentication and Security Layer (SASL) library, has unknown
impact and remote unauthenticated attack vectors, related to
DIGEST-MD5 negotiation.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1721</cvename>
</references>
<dates>
<discovery>2006-04-11</discovery>
<entry>2006-04-22</entry>
</dates>
</vuln>
<vuln vid="1fa4c9f1-cfca-11da-a672-000e0c2e438a">
<topic>FreeBSD -- FPU information disclosure</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_7</lt></range>
<range><ge>5.4</ge><lt>5.4_14</lt></range>
<range><ge>5.3</ge><lt>5.3_29</lt></range>
<range><ge>5</ge><lt>5.3</lt></range>
<range><ge>4.11</ge><lt>4.11_17</lt></range>
<range><ge>4.10</ge><lt>4.10_23</lt></range>
<range><lt>4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>On "7th generation" and "8th generation" processors
manufactured by AMD, including the AMD Athlon, Duron, Athlon
MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and
Sempron, the fxsave and fxrstor instructions do not save and
restore the FOP, FIP, and FDP registers unless the exception
summary bit (ES) in the x87 status word is set to 1,
indicating that an unmasked x87 exception has occurred.</p>
<p>This behaviour is consistent with documentation provided by
AMD, but is different from processors from other vendors,
which save and restore the FOP, FIP, and FDP registers
regardless of the value of the ES bit. As a result of this
discrepancy remaining unnoticed until now, the FreeBSD kernel
does not restore the contents of the FOP, FIP, and FDP
registers between context switches.</p>
<h1>Impact</h1>
<p>On affected processors, a local attacker can monitor the
execution path of a process which uses floating-point
operations. This may allow an attacker to steal
cryptographic keys or other sensitive information.</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not use AMD
Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX,
Opteron, Turion, or Sempron processors are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1056</cvename>
<freebsdsa>SA-06:14.fpu</freebsdsa>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-04-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="22c6b826-cee0-11da-8578-00123ffe8333">
<topic>plone -- "member_id" Parameter Portrait Manipulation Vulnerability</topic>
<affects>
<package>
<name>plone</name>
<range><lt>2.1.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19633/">
<p>The vulnerability is caused due to missing security declarations
in "changeMemberPortrait" and "deletePersonalPortrait". This can
be exploited to manipulate or delete another user's portrait via
the "member_id" parameter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1711</cvename>
<url>http://dev.plone.org/plone/ticket/5432</url>
<url>http://www.debian.org/security/2006/dsa-1032</url>
<url>http://secunia.com/advisories/19633/</url>
</references>
<dates>
<discovery>2006-04-13</discovery>
<entry>2006-04-18</entry>
</dates>
</vuln>
<vuln vid="84630f4a-cd8c-11da-b7b9-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.8,1</lt></range>
<range><gt>1.5.*,1</gt><lt>1.5.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.13,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.13</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues. Several of which can be used to run arbitrary code
with the privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<ul>
<li>MFSA 2006-29 Spoofing with translucent windows</li>
<li>MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented</li>
<li>MFSA 2006-26 Mail Multiple Information Disclosure</li>
<li>MFSA 2006-25 Privilege escalation through Print Preview</li>
<li>MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest</li>
<li>MFSA 2006-23 File stealing by changing input type</li>
<li>MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability</li>
<li>MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)</li>
<li>MFSA 2006-19 Cross-site scripting using .valueOf.call()</li>
<li>MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability</li>
<li>MFSA 2006-17 cross-site scripting through window.controllers</li>
<li>MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()</li>
<li>MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent</li>
<li>MFSA 2006-14 Privilege escalation via XBL.method.eval</li>
<li>MFSA 2006-13 Downloading executables with "Save Image As..."</li>
<li>MFSA 2006-12 Secure-site spoof (requires security warning dialog)</li>
<li>MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)</li>
<li>MFSA 2006-10 JavaScript garbage-collection hazard audit</li>
<li>MFSA 2006-09 Cross-site JavaScript injection using event handlers</li>
</ul>
</blockquote>
</body>
</description>
<references>
<certvu>179014</certvu>
<certvu>252324</certvu>
<certvu>329500</certvu>
<certvu>350262</certvu>
<certvu>488774</certvu>
<certvu>736934</certvu>
<certvu>813230</certvu>
<certvu>842094</certvu>
<certvu>932734</certvu>
<certvu>935556</certvu>
<certvu>968814</certvu>
<cvename>CVE-2006-0749</cvename>
<cvename>CVE-2006-1045</cvename>
<cvename>CVE-2006-1529</cvename>
<cvename>CVE-2006-1530</cvename>
<cvename>CVE-2006-1531</cvename>
<cvename>CVE-2006-1723</cvename>
<cvename>CVE-2006-1724</cvename>
<cvename>CVE-2006-1725</cvename>
<cvename>CVE-2006-1726</cvename>
<cvename>CVE-2006-1727</cvename>
<cvename>CVE-2006-1728</cvename>
<cvename>CVE-2006-1729</cvename>
<cvename>CVE-2006-1730</cvename>
<cvename>CVE-2006-1731</cvename>
<cvename>CVE-2006-1732</cvename>
<cvename>CVE-2006-1733</cvename>
<cvename>CVE-2006-1734</cvename>
<cvename>CVE-2006-1735</cvename>
<cvename>CVE-2006-1736</cvename>
<cvename>CVE-2006-1737</cvename>
<cvename>CVE-2006-1738</cvename>
<cvename>CVE-2006-1739</cvename>
<cvename>CVE-2006-1740</cvename>
<cvename>CVE-2006-1741</cvename>
<cvename>CVE-2006-1742</cvename>
<cvename>CVE-2006-1790</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-09.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-10.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-11.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-12.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-13.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-14.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-15.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-16.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-17.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-18.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-19.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-20.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-22.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-23.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-25.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-26.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-28.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-29.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-010.html</url>
<uscertta>TA06-107A</uscertta>
</references>
<dates>
<discovery>2006-04-13</discovery>
<entry>2006-04-16</entry>
<modified>2006-04-27</modified>
</dates>
</vuln>
<vuln vid="8be2e304-cce6-11da-a3b1-00123ffe8333">
<topic>mailman -- Private Archive Script Cross-Site Scripting</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<name>mailman-with-htdig</name>
<range><lt>2.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19558/">
<p>A vulnerability has been reported in Mailman, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Unspecified input passed to the private archive script is not
properly sanitised before being returned to users. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of a vulnerable site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1712</cvename>
<mlist>http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html</mlist>
<url>http://secunia.com/advisories/19558/</url>
</references>
<dates>
<discovery>2006-04-07</discovery>
<entry>2006-04-16</entry>
</dates>
</vuln>
<vuln vid="43cb40b3-c8c2-11da-a672-000e0c2e438a">
<topic>f2c -- insecure temporary files</topic>
<affects>
<package>
<name>f2c</name>
<range><lt>20060506</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports two temporary file
vulnerability within f2c. The vulnerabilities are caused
due to weak temporary file handling. An attacker could
create an symbolic link, causing a local user running f2c
to overwrite the symlinked file. This could give the
attacker elevated privileges.</p>
</body>
</description>
<references>
<bid>1280</bid>
<cvename>CAN-2005-0017</cvename>
</references>
<dates>
<discovery>2005-01-27</discovery>
<entry>2006-04-10</entry>
<modified>2006-08-15</modified>
</dates>
</vuln>
<vuln vid="c7526a14-c4dc-11da-9699-00123ffe8333">
<topic>mplayer -- Multiple integer overflows</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.7_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19418/">
<p>The vulnerabilities are caused due to integer overflow errors
in "libmpdemux/asfheader.c" within the handling of an ASF file,
and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in
an AVI file. This can be exploited to cause heap-based buffer
overflows via a malicious ASF file, or via a AVI file with
specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in
the "indx" chunk.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1502</cvename>
<url>http://www.xfocus.org/advisories/200603/11.html</url>
<url>http://secunia.com/advisories/19418/</url>
</references>
<dates>
<discovery>2006-03-29</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="4bfcd857-c628-11da-b2fb-000e0c2e438a">
<topic>kaffeine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>kaffeine</name>
<range><ge>0.4.2</ge><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20060404-1.txt">
<p>Kaffeine can produce a buffer overflow in http_peek() while
creating HTTP request headers for fetching remote playlists,
which under certain circumstances could be used to crash the
application and/or execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>17372</bid>
<cvename>CVE-2006-0051</cvename>
<url>http://www.kde.org/info/security/advisory-20060404-1.txt</url>
</references>
<dates>
<discovery>2006-04-04</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="61349f77-c620-11da-b2fb-000e0c2e438a">
<topic>thunderbird -- javascript execution</topic>
<affects>
<package>
<name>thunderbird</name>
<name>mozilla-thunderbird</name>
<range><le>1.0.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Renaud Lifchitz reports a vulnerability within thunderbird.
The vulnerability is caused by improper checking of javascript
scripts. This could lead to javascript code execution which
can lead to information disclosure or a denial of service
(application crash). This vulnerability is present even if
javascript had been disabled in the preferences.</p>
</body>
</description>
<references>
<bid>16770</bid>
<cvename>CAN-2006-0884</cvename>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="fba75b43-c588-11da-9110-00123ffe8333">
<topic>phpmyadmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1">
<p>It was possible to conduct an XSS attack with a direct call
to some scripts under the themes directory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1</url>
<url>http://secunia.com/advisories/19556/</url>
</references>
<dates>
<discovery>2006-04-06</discovery>
<entry>2006-04-06</entry>
<modified>2006-04-07</modified>
</dates>
</vuln>
<vuln vid="7b55f5c2-c58b-11da-9110-00123ffe8333">
<topic>phpmyadmin -- 'set_theme' Cross-Site Scripting</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19277">
<p>A vulnerability has been reported in phpMyAdmin, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed to the "set_theme" parameter isn't properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1258</cvename>
<url>http://secunia.com/advisories/19277</url>
</references>
<dates>
<discovery>2006-03-17</discovery>
<entry>2006-04-06</entry>
</dates>
</vuln>
<vuln vid="6a5174bd-c580-11da-9110-00123ffe8333">
<topic>clamav -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.1</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20051104_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19534/">
<p>Some vulnerabilities have been reported in ClamAV, which
potentially can be exploited by malicious people to cause a
DoS (Denial of Service) and compromise a vulnerable system.</p>
<p>An unspecified integer overflow error exists in the PE header
parser in "libclamav/pe.c". Successful exploitation requires that
the ArchiveMaxFileSize option is disabled.</p>
<p>Some format string errors in the logging handling in
"shared/output.c" may be exploited to execute arbitrary code.</p>
<p>An out-of-bounds memory access error in the "cli_bitset_test()"
function in "ibclamav/others.c" may be exploited to cause a
crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1614</cvename>
<cvename>CVE-2006-1615</cvename>
<cvename>CVE-2006-1630</cvename>
<url>http://secunia.com/advisories/19534/</url>
<url>http://www.us.debian.org/security/2006/dsa-1024</url>
</references>
<dates>
<discovery>2006-04-06</discovery>
<entry>2006-04-06</entry>
</dates>
</vuln>
<vuln vid="99015cf5-c4dd-11da-b2fb-000e0c2e438a">
<topic>mediawiki -- hardcoded placeholder string security bypass vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mediawiki development team reports a vulnerability
within the mediawiki application. The vulnerability is
caused by improper checking of inline style attributes. This
could result in the execution of arbitrary javascript code in
Microsoft Internet Explorer. It appears that other browsers
are not affected by this vulnerability.</p>
</body>
</description>
<references>
<bid>16032</bid>
<cvename>CAN-2005-4501</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=379951</url>
</references>
<dates>
<discovery>2005-12-22</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a">
<topic>netpbm -- buffer overflow in pnmtopng</topic>
<affects>
<package>
<name>netpbm</name>
<range><lt>10.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu reports:</p>
<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-210-1">
<p>A buffer overflow was found in the "pnmtopng" conversion
program. By tricking an user (or automated system) to
process a specially crafted PNM image with pnmtopng, this
could be exploited to execute arbitrary code with the
privileges of the user running pnmtopng.</p>
</blockquote>
</body>
</description>
<references>
<bid>15128</bid>
<cvename>CAN-2005-2978</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-210-1</url>
</references>
<dates>
<discovery>2005-10-18</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="d9307a41-c4d7-11da-b2fb-000e0c2e438a">
<topic>zoo -- stack based buffer overflow</topic>
<affects>
<package>
<name>zoo</name>
<range><lt>2.10.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Sébastien Guay-Leroux report a vulnerability
within the zoo archiver. The vulnerability which is present
in the fullpath() function (from the misc.c file) is caused by
improper checking of user supplied data. The data returned
to the buffer can be up to 512 bytes, while the buffer is
created to hold 256 bytes. This could result in a buffer
overflow which could allow remote code execution.</p>
</body>
</description>
<references>
<bid>16790</bid>
<cvename>CVE-2006-0855</cvename>
<url>http://www.guay-leroux.com/projects/zoo-advisory.txt</url>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-04-05</entry>
<modified>2006-04-06</modified>
</dates>
</vuln>
<vuln vid="74b7403c-c4d5-11da-b2fb-000e0c2e438a">
<topic>mediawiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><ge>1.4</ge><lt>1.4.14</lt></range>
<range><ge>1.5</ge><lt>1.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mediawiki development team reports that there is an
site scripting vulnerability within mediawiki. The
vulnerability is caused by improper checking of encoded
links which could allow the injection of html in the output
generated by mediawiki. This could lead to cross site
scripting attacks against mediawiki installations.</p>
</body>
</description>
<references>
<bid>17269</bid>
<cvename>CVE-2006-1498</cvename>
<url>http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html</url>
</references>
<dates>
<discovery>2006-03-27</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="b5fc63ad-c4c3-11da-9699-00123ffe8333">
<topic>dia -- XFig Import Plugin Buffer Overflow</topic>
<affects>
<package>
<name>dia</name>
<name>dia-gnome</name>
<range><gt>0.86_1</gt><lt>0.94_6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19469/">
<p>Some vulnerabilities have been reported in Dia, which
potentially can be exploited by malicious people to
compromise a user's system.</p>
<p>The vulnerabilities are caused due to boundary errors
within the XFig import plugin. This can be exploited to
cause buffer overflows and may allow arbitrary code
execution when a specially-crafted FIG file is imported.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1550</cvename>
<url>http://secunia.com/advisories/19469/</url>
<mlist msgid="1143662924.6460.60.camel@linux.site">http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html</mlist>
</references>
<dates>
<discovery>2006-03-31</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="be4ccb7b-c48b-11da-ae12-0002b3b60e4c">
<topic>openvpn -- LD_PRELOAD code execution on client through malicious or compromised server</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.0</ge><lt>2.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hendrik Weimer reports:</p>
<blockquote cite="http://www.osreviews.net/reviews/security/openvpn-print">
<p>OpenVPN clients are a bit too generous when accepting
configuration options from a server. It is possible to transmit
environment variables to client-side shell scripts. There are some
filters in place to prevent obvious nonsense, however they don't
catch the good old LD_PRELOAD trick. All we need is to put a file
onto the client under a known location (e.g. by returning a
specially crafted document upon web access) and we have a remote
root exploit. But since the attack may only come from authenticated
servers, this threat is greatly reduced.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1629</cvename>
<url>http://www.osreviews.net/reviews/security/openvpn-print</url>
<url>http://openvpn.net/changelog.html</url>
<mlist msgid="4431F7C4.4030804@yonan.net">http://sourceforge.net/mailarchive/message.php?msg_id=15298074</mlist>
</references>
<dates>
<discovery>2006-04-03</discovery>
<entry>2006-04-05</entry>
<modified>2006-04-06</modified>
</dates>
</vuln>
<vuln vid="92fd40eb-c458-11da-9c79-00123ffe8333">
<topic>samba -- Exposure of machine account credentials in winbind log files</topic>
<affects>
<package>
<name>samba</name>
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
</package>
<package>
<name>ja-samba</name>
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba Security Advisory:</p>
<blockquote cite="http://us1.samba.org/samba/security/CAN-2006-1059.html">
<p>The machine trust account password is the secret
shared between a domain controller and a specific
member server. Access to the member server machine
credentials allows an attacker to impersonate the
server in the domain and gain access to additional
information regarding domain users and groups.</p>
<p>The winbindd daemon writes the clear text of server's
machine credentials to its log file at level 5.
The winbindd log files are world readable by default
and often log files are requested on open mailing
lists as tools used to debug server misconfigurations.</p>
<p>This affects servers configured to use domain or
ads security and possibly Samba domain controllers
as well (if configured to use winbindd).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1059</cvename>
<url>http://us1.samba.org/samba/security/CAN-2006-1059.html</url>
<url>http://secunia.com/advisories/19455/</url>
</references>
<dates>
<discovery>2006-03-30</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="91afa94c-c452-11da-8bff-000ae42e9b93">
<topic>mod_pubcookie -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mod_pubcookie</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors of the Pubcookie Project reports:</p>
<blockquote cite="http://www.pubcookie.org/news/20060306-apps-secadv.html">
<p>Non-persistent XSS vulnerabilities were found in the
Pubcookie Apache module (mod_pubcookie) and ISAPI
filter. These components mishandle untrusted data when
printing responses to the browser. This makes them
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to a vulnerable Pubcookie application
server and attempt to exploit the XSS vulnerabilities.</p>
<p>These vulnerabilities are classified as *high* due to the
nature and purpose of Pubcookie application servers for user
authentication and Web Single Sign-on (SSO). An attacker
who injects malicious script through the vulnerabilities
might steal private Pubcookie data including a user's
authentication assertion ("granting") cookies and
application session cookies.</p>
</blockquote>
</body>
</description>
<references>
<certvu>314540</certvu>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="855cd9fa-c452-11da-8bff-000ae42e9b93">
<topic>pubcookie-login-server -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>pubcookie-login-server</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors of the Pubcookie Project reports:</p>
<blockquote cite="">
<p> Multiple non-persistent XSS vulnerabilities were found
in the Pubcookie login server's compiled binary "index.cgi"
CGI program. The CGI program mishandles untrusted data when
printing responses to the browser. This makes the program
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to his or her local Pubcookie login page
and attempt to exploit the XSS vulnerabilities.</p>
<p> These vulnerabilities are classified as *critical* due
to the nature and purpose of the Pubcookie login server for
user authentication and Web Single Sign-on (SSO). Specific
threats include:</p>
<ul>
<li>An attacker who injects malicious script through the
vulnerabilities might steal senstive user data including
a user's authentication credentials (usernames and
passwords);</li>
<li>An attacker who injects malicious script through the
vulnerabilities might steal private Pubcookie data
including a user's authentication assertion ("granting")
cookies and SSO ("login") session cookies;</li>
<li>An attacker who injects HTML tags through the
vulnerabilities might deface a site's Pubcookie login page
for a single visit by a single user (i.e. a non-persistent
defacement).</li>
</ul>
<p>At the heart of these threats lies a violation of the
user's trust in the Pubcookie login server.</p>
</blockquote>
</body>
</description>
<references>
<certvu>337585</certvu>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="37a5c10f-bf56-11da-b0e9-00123ffe8333">
<topic>freeradius -- EAP-MSCHAPv2 Authentication Bypass</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>1.0.0</ge><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Freeradius Security Contact reports:</p>
<blockquote cite="http://www.freeradius.org/security.html#1.1.0">
<p>Insufficient input validation was being done in the
EAP-MSCHAPv2 state machine. A malicious attacker could
manipulate their EAP-MSCHAPv2 client state machine to
potentially convince the server to bypass authentication
checks. This bypassing could also result in the server
crashing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1354</cvename>
<url>http://www.freeradius.org/security.html#1.1.0</url>
<url>http://secunia.com/advisories/19300/</url>
</references>
<dates>
<discovery>2006-03-21</discovery>
<entry>2006-03-29</entry>
</dates>
</vuln>
<vuln vid="2db97aa6-be81-11da-9b82-0050bf27ba24">
<topic>horde -- remote code execution vulnerability in the help viewer</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Horde 3.1.1 release announcement:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2006/000271.html">
<p>Major changes compared to Horde 3.1 are:</p>
<ul>
<li>Fix for remote code execution vulnerability in the
help viewer, discovered by Jan Schneider from the Horde
team.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>17292</bid>
<cvename>CVE-2006-1491</cvename>
<url>http://lists.horde.org/archives/announce/2006/000271.html</url>
</references>
<dates>
<discovery>2006-03-28</discovery>
<entry>2006-03-28</entry>
<modified>2006-03-30</modified>
</dates>
</vuln>
<vuln vid="25858c37-bdab-11da-b7d4-00123ffe8333">
<topic>linux-realplayer -- buffer overrun</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><ge>10.0.1</ge><lt>10.0.7.785.20060201</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisories Reports:</p>
<blockquote cite="http://secunia.com/advisories/19358/">
<p>A boundary error when processing SWF files can be exploited to
cause a buffer overflow. This may allow execution of arbitrary
code on the user's system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0323</cvename>
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
<url>http://secunia.com/advisories/19358/</url>
</references>
<dates>
<discovery>2006-03-23</discovery>
<entry>2006-03-27</entry>
</dates>
</vuln>
<vuln vid="fe4c84fc-bdb5-11da-b7d4-00123ffe8333">
<topic>linux-realplayer -- heap overflow</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><ge>10.0.1</ge><lt>10.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Reports:</p>
<blockquote cite="http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404">
<p>Remote exploitation of a heap-based buffer overflow in
RealNetwork Inc's RealPlayer could allow the execution of
arbitrary code in the context of the currently logged in
user.</p>
<p>In order to exploit this vulnerability, an attacker would
need to entice a user to follow a link to a malicious server.
Once the user visits a website under the control of an
attacker, it is possible in a default install of RealPlayer
to force a web-browser to use RealPlayer to connect to an
arbitrary server, even when it is not the default application
for handling those types, by the use of embedded object tags
in a webpage. This may allow automated exploitation when the
page is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2922</cvename>
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
<url>http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404</url>
<url>http://secunia.com/advisories/19358/</url>
</references>
<dates>
<discovery>2006-03-23</discovery>
<entry>2006-03-27</entry>
</dates>
</vuln>
<vuln vid="08ac7b8b-bb30-11da-b2fb-000e0c2e438a">
<topic>sendmail -- race condition vulnerability</topic>
<affects>
<package>
<name>sendmail</name>
<range><gt>8.13</gt><lt>8.13.6</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A race condition has been reported to exist in the handling
by sendmail of asynchronous signals.</p>
<h1>Impact</h1>
<p>A remote attacker may be able to execute arbitrary code with
the privileges of the user running sendmail, typically
root.</p>
<h1>Workaround</h1>
<p>There is no known workaround other than disabling
sendmail.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0058</cvename>
<freebsdsa>SA-06:13.sendmail</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="e93bc5b0-bb2e-11da-b2fb-000e0c2e438a">
<topic>OPIE -- arbitrary password change</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The opiepasswd(1) program uses getlogin(2) to identify the
user calling opiepasswd(1). In some circumstances
getlogin(2) will return "root" even when running as an
unprivileged user. This causes opiepasswd(1) to allow an
unpriviled user to configure OPIE authentication for the root
user.</p>
<h1>Impact</h1>
<p>In certain cases an attacker able to run commands as a non
privileged users which have not explicitly logged in, for
example CGI scripts run by a web server, is able to configure
OPIE access for the root user. If the attacker is able to
authenticate as root using OPIE authentication, for example if
"PermitRootLogin" is set to "yes" in sshd_config or the
attacker has access to a local user in the "wheel" group, the
attacker can gain root privileges.</p>
<h1>Workaround</h1>
<p>Disable OPIE authentication in PAM:</p>
<pre># sed -i "" -e /opie/s/^/#/ /etc/pam.d/*</pre>
<p>or</p>
<p>Remove the setuid bit from opiepasswd:</p>
<pre># chflags noschg /usr/bin/opiepasswd</pre>
<pre># chmod 555 /usr/bin/opiepasswd</pre>
<pre># chflags schg /usr/bin/opiepasswd</pre>
</body>
</description>
<references>
<cvename>CVE-2006-1283</cvename>
<freebsdsa>SA-06:12.opie</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="e50a7476-bb2d-11da-b2fb-000e0c2e438a">
<topic>ipsec -- reply attack vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>IPsec provides an anti-replay service which when enabled
prevents an attacker from successfully executing a replay
attack. This is done through the verification of sequence
numbers. A programming error in the fast_ipsec(4)
implementation results in the sequence number associated with
a Security Association not being updated, allowing packets to
unconditionally pass sequence number verification checks.</p>
<h1>Impact</h1>
<p>An attacker able to intercept IPSec packets can replay
them. If higher level protocols which do not provide any
protection against packet replays (e.g., UDP) are used, this
may have a variety of effects.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0905</cvename>
<freebsdsa>SA-06:11.ipsec</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="61534682-b8f4-11da-8e62-000e0c33c2dc">
<topic>xorg-server -- privilege escalation</topic>
<affects>
<package>
<name>xorg-server</name>
<range><eq>6.9.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Stone of X.Org reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2006-March/013992.html">
<p>During the analysis of results from the Coverity code review
of X.Org, we discovered a flaw in the server that allows local
users to execute arbitrary code with root privileges, or cause
a denial of service by overwriting files on the system, again
with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0745</cvename>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=6213</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-03-21</entry>
</dates>
</vuln>
<vuln vid="b62c80c2-b81a-11da-bec5-00123ffe8333">
<topic>heimdal -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>0.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Project heimdal Security Advisory reports:</p>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-04-20/">
<p>The telnet client program in Heimdal has buffer overflows
in the functions slc_add_reply() and env_opt_add(), which
may lead to remote code execution.</p>
</blockquote>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">
<p>The telnetd server program in Heimdal has buffer overflows
in the function getterminaltype, which may lead to remote code
execution.</p>
</blockquote>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">
<p>The rshd server in Heimdal has a privilege escalation bug
when storing forwarded credentials. The code allowes a user
to overwrite a file with its credential cache, and get ownership
of the file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0469</cvename>
<cvename>CVE-2005-2040</cvename>
<cvename>CVE-2006-0582</cvename>
<cvename>CVE-2006-0677</cvename>
<url>http://www.pdc.kth.se/heimdal/advisory/2005-04-20</url>
<url>http://www.pdc.kth.se/heimdal/advisory/2005-06-20</url>
<url>http://www.pdc.kth.se/heimdal/advisory/2006-02-06</url>
</references>
<dates>
<discovery>2006-02-06</discovery>
<entry>2006-03-20</entry>
</dates>
</vuln>
<vuln vid="b8e361b8-b7ff-11da-8414-0013d4a4a40e">
<topic>curl -- TFTP packet buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<name>linux-curl</name>
<range><gt>7.14.1</gt><lt>7.15.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Project cURL Security Advisory reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20060320.html">
<p>libcurl uses the given file part of a TFTP URL in a manner that
allows a malicious user to overflow a heap-based memory buffer due
to the lack of boundary check.</p>
<p>This overflow happens if you pass in a URL with a TFTP
protocol prefix ("tftp://"), using a valid host and a path
part that is longer than 512 bytes.</p>
<p>The affected flaw can be triggered by a redirect, if
curl/libcurl is told to follow redirects and an HTTP
server points the client to a tftp URL with the
characteristics described above.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1061</cvename>
<url>http://curl.haxx.se/docs/adv_20060320.html</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-03-20</entry>
<modified>2006-10-05</modified>
</dates>
</vuln>
<vuln vid="6779e82f-b60b-11da-913d-000ae42e9b93">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>3.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal reports:</p>
<blockquote cite="http://drupal.org/node/53806">
<p>Mail header injection vulnerability.</p>
<p>Linefeeds and carriage returns were not being stripped from
email headers, raising the possibility of bogus headers
being inserted into outgoing email.</p>
<p>This could lead to Drupal sites being used to send unwanted
email.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53805">
<p>Session fixation vulnerability.</p>
<p>If someone creates a clever enough URL and convinces you to
click on it, and you later log in but you do not log off
then the attacker may be able to impersonate you.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53803">
<p>XSS vulnerabilities.</p>
<p>Some user input sanity checking was missing. This could
lead to possible cross-site scripting (XSS) attacks.</p>
<p>XSS can lead to user tracking and theft of accounts and
services.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53796">
<p>Security bypass in menu.module.</p>
<p>If you use menu.module to create a menu item, the page you
point to will be accessible to all, even if it is an admin
page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/53806</url>
<url>http://drupal.org/node/53805</url>
<url>http://drupal.org/node/53803</url>
<url>http://drupal.org/node/53796</url>
</references>
<dates>
<discovery>2006-03-13</discovery>
<entry>2006-03-17</entry>
</dates>
</vuln>
<vuln vid="c7c09579-b466-11da-82d0-0050bf27ba24">
<topic>horde -- "url" disclosure of sensitive information vulnerability</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Secunia advisory SA19246:</p>
<blockquote cite="http://secunia.com/advisories/19246/">
<p>Paul Craig has discovered a vulnerability in Horde, which
can be exploited by malicious people to disclose sensitive
information.
Input passed to the "url" parameter in "services/go.php"
isn't properly verified, before it is used in a
"readfile()" call. This can be exploited to disclose the
content of arbitrary files via e.g. the "php://" protocol
wrapper.</p>
<p>The vulnerability has been confirmed in version 3.0.9 and
has also been reported in prior versions.</p>
<p>Provided and/or discovered by:
Paul Craig, Security-Assessment.com.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/19246/</url>
</references>
<dates>
<discovery>2006-03-15</discovery>
<entry>2006-03-15</entry>
</dates>
</vuln>
<vuln vid="83421018-b3ef-11da-a32d-000c6ec775d9">
<topic>linux-flashplugin -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>7.0r63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">
<p>Critical vulnerabilities have been identified in Flash
Player that could allow an attacker who successfully
exploits these vulnerabilities to take control of the
affected system. A malicious SWF must be loaded in Flash
Player by the user for an attacker to exploit these
vulnerabilities.</p>
<p>Flash Player 8 update (8.0.24.0), and Flash Player 7
update (7.0.63.0) address security vulnerabilities in
previous versions of Flash Player, which could lead to the
potential execution of arbitrary code. These
vulnerabilities could be accessed through content
delivered from a remote location via the users web
browser, email client, or other applications that include
or reference the Flash Player.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0024</cvename>
<url>http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html</url>
</references>
<dates>
<discovery>2006-03-14</discovery>
<entry>2006-03-15</entry>
</dates>
</vuln>
<vuln vid="6111ecb8-b20d-11da-b2fb-000e0c2e438a">
<topic>nfs -- remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_5</lt></range>
<range><ge>5.4</ge><lt>5.4_12</lt></range>
<range><ge>5.3</ge><lt>5.3_27</lt></range>
<range><ge>4.11</ge><lt>4.11_15</lt></range>
<range><ge>4.10</ge><lt>4.10_21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description:</h1>
<p>A part of the NFS server code charged with handling incoming
RPC messages via TCP had an error which, when the server
received a message with a zero-length payload, would cause a
NULL pointer dereference which results in a kernel panic. The
kernel will only process the RPC messages if a userland nfsd
daemon is running.</p>
<h1>Impact:</h1>
<p>The NULL pointer deference allows a remote attacker capable
of sending RPC messages to an affected FreeBSD system to crash
the FreeBSD system.</p>
<h1>Workaround:</h1>
<ol>
<li>
<p>Disable the NFS server: set the nfs_server_enable
variable to "NO" in /etc/rc.conf, and reboot.</p>
<p>Alternatively, if there are no active NFS clients (as
listed by the showmount(8) utility), simply killing the
mountd and nfsd processes should suffice.</p>
</li>
<li>
<p>Add firewall rules to block RPC traffic to the NFS server
from untrusted hosts.</p>
</li>
</ol>
</body>
</description>
<references>
<cvename>CVE-2006-0900</cvename>
<freebsdsa>SA-06:10.nfs</freebsdsa>
</references>
<dates>
<discovery>2006-03-01</discovery>
<entry>2006-03-12</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6a308e8e-b1b4-11da-b2fb-000e0c2e438a">
<topic>openssh -- remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_12</lt></range>
<range><ge>5.3</ge><lt>5.3_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description:</h1>
<p>Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated. The parent process then terminates, and the
PAM child is left behind.</p>
<p>Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process. Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.</p>
<h1>Impact:</h1>
<p>By repeatedly connecting to a vulnerable server, waiting for
a password prompt, and closing the connection, an attacker can
cause OpenSSH to stop accepting client connections until the
system restarts or an administrator manually kills the orphaned
PAM processes.</p>
<h1>Workaround:</h1>
<p>The following command will show a list of orphaned PAM
processes:</p>
<pre># pgrep -lf 'sshd.*\[pam\]'</pre>
<p>The following command will kill orphaned PAM processes:</p>
<pre># pkill -f 'sshd.*\[pam\]'</pre>
<p>To prevent OpenSSH from leaving orphaned PAM processes behind,
perform one of the following:</p>
<ol>
<li>
<p>Disable PAM authentication in OpenSSH. Users will still
be able to log in using their Unix password, OPIE or SSH
keys.</p>
<p>To do this, execute the following commands as root:</p>
<pre># echo 'UsePAM no' >>/etc/ssh/sshd_config</pre>
<pre># echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config</pre>
<pre># /etc/rc.d/sshd restart</pre>
</li>
<li>
<p>If disabling PAM is not an option - if, for instance, you use
RADIUS authentication, or store user passwords in an SQL database
- you may instead disable privilege separation. However, this may
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
considered a last resort.</p>
<p>To do this, execute the following commands as root:</p>
<pre># echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config</pre>
<pre># /etc/rc.d/sshd restart</pre>
</li>
</ol>
</body>
</description>
<references>
<cvename>CVE-2006-0883</cvename>
<freebsdsa>SA-06:09.openssh</freebsdsa>
</references>
<dates>
<discovery>2006-03-01</discovery>
<entry>2006-03-12</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="948921ad-afbc-11da-bad9-02e081235dab">
<topic>GnuPG does not detect injection of unsigned data</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">
<p>In the aftermath of the false positive signature
verfication bug (announced 2006-02-15) more thorough testing
of the fix has been done and another vulnerability has been
detected. This new problem affects the use of *gpg* for
verification of signatures which are _not_ detached
signatures. The problem also affects verification of
signatures embedded in encrypted messages; i.e. standard use
of gpg for mails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0049</cvename>
<mlist msgid="87d5gvh2kr.fsf@wheatstone.g10code.de">http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html</mlist>
</references>
<dates>
<discovery>2006-03-09</discovery>
<entry>2006-03-10</entry>
<modified>2006-03-11</modified>
</dates>
</vuln>
<vuln vid="104beb63-af4d-11da-8414-0013d4a4a40e">
<topic>mplayer -- heap overflow in the ASF demuxer</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<range><lt>0.99.7_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mplayer team reports:</p>
<blockquote cite="http://www.mplayerhq.hu/design7/news.html#vuln13">
<p>A potential buffer overflow was found in the ASF demuxer.
Arbitrary remote code execution is possible (under the user ID
running the player) when streaming an ASF file from a malicious
server or local code execution (under the user ID running the
player) if a malicious ASF file is played locally.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0579</cvename>
<url>http://www.mplayerhq.hu/design7/news.html#vuln13</url>
<url>http://secunia.com/advisories/18718</url>
<url>http://bugs.gentoo.org/show_bug.cgi?id=122029</url>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-03-09</entry>
</dates>
</vuln>
<vuln vid="594ad3c5-a39b-11da-926c-0800209adf0e">
<topic>SSH.COM SFTP server -- format string vulnerability</topic>
<affects>
<package>
<name>ssh2</name>
<name>ssh2-nox11</name>
<range><lt>3.2.9.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SSH Communications Security Corp reports a format string
vulnerability in their SFTP server. This vulnerability could
cause a user with SCP/SFTP access only to get permission to
execute also other commands. It could also allow user A to
create a special file that when accessed by user B allows
user A to execute commands as user B.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0705</cvename>
<bid>16640</bid>
<url>http://www.ssh.com/company/newsroom/article/715/</url>
<url>http://www.frsirt.com/english/advisories/2006/0554</url>
<url>http://securitytracker.com/id?1015619</url>
<url>http://secunia.com/advisories/18828</url>
<url>http://xforce.iss.net/xforce/xfdb/24651</url>
</references>
<dates>
<discovery>2006-02-13</discovery>
<entry>2006-03-04</entry>
<modified>2006-03-06</modified>
</dates>
</vuln>
<vuln vid="6107efb9-aae3-11da-aea1-000854d03344">
<topic>gtar -- invalid headers buffer overflow</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.15.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU tar is vulnerable to a buffer overflow, caused by
improper bounds checking of the PAX extended headers. By
tricking an user into processing a specially crafted tar
archive, this could be exploited to execute arbitrary
code with the privileges of the user.</p>
</body>
</description>
<references>
<bid>16764</bid>
<cvename>CVE-2006-0300</cvename>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-03-03</entry>
</dates>
</vuln>
<vuln vid="46f7b598-a781-11da-906a-fde5cdde365e">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.17.1</ge><lt>2.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Some vulnerabilities have been reported in Bugzilla,
which can be exploited by malicious users to conduct SQL injection
attacks, and by malicious people to disclose sensitive information
and conduct script insertion attacks.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2420</cvename>
<cvename>CVE-2006-0916</cvename>
<cvename>CVE-2006-0915</cvename>
<cvename>CVE-2006-0914</cvename>
<cvename>CVE-2006-0913</cvename>
<url>http://www.bugzilla.org/security/2.18.4/</url>
</references>
<dates>
<discovery>2006-02-20</discovery>
<entry>2006-02-27</entry>
<modified>2006-11-11</modified>
</dates>
</vuln>
<vuln vid="af9018b6-a4f5-11da-bb41-0011433a9404">
<topic>squirrelmail -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities has been discovered since 1.4.5,
including IMAP injection as well as some XSS issues.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0377</cvename>
<cvename>CVE-2006-0195</cvename>
<cvename>CVE-2006-0188</cvename>
</references>
<dates>
<discovery>2006-02-23</discovery>
<entry>2006-02-24</entry>
</dates>
</vuln>
<vuln vid="e319da0b-a228-11da-b410-000e0c2e438a">
<topic>gedit -- format string vulnerability</topic>
<affects>
<package>
<name>gedit</name>
<range><lt>2.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yan Feng reports a format string vulnerability in gedit.
This vulnerability could cause a denial of service with a
binary file that contains format string characters within
the filename. It had been reported that web browsers
and email clients can be configured to provide a filename as
an argument to gedit.:</p>
</body>
</description>
<references>
<cvename>CAN-2005-1686</cvename>
<mlist msgid="20050520202628.12260.qmail@www.securityfocus.com">:http://marc.theaimsgroup.com/?l=bugtraq&m=111661117701398</mlist>
</references>
<dates>
<discovery>2005-05-20</discovery>
<entry>2006-02-20</entry>
</dates>
</vuln>
<vuln vid="07ead557-a220-11da-b410-000e0c2e438a">
<topic>WebCalendar -- unauthorized access vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports that WebCalendar is affected by
an unauthorized access vulnerability. The vulnerability
is caused by improper checking of the authentication
mechanism before access is being permitted to the
"assistant_edit.php" file.</p>
</body>
</description>
<references>
<bid>14072</bid>
<cvename>CAN-2005-2320</cvename>
</references>
<dates>
<discovery>2005-06-27</discovery>
<entry>2006-02-20</entry>
</dates>
</vuln>
<vuln vid="9cd52bc6-a213-11da-b410-000e0c2e438a">
<topic>abiword, koffice -- stack based buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>koffice</name>
<range><gt>1.2.0</gt><lt>1.4.1_1,1</lt></range>
</package>
<package>
<name>abiword</name>
<range><lt>2.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans reports that AbiWord is vulnerable to multiple
stack-based buffer overflow vulnerabilities. This
is caused by improper checking of the user-supplied data
before it is being copied to an too small buffer. The
vulnerability is triggered when someone is importing RTF
files.</p>
</body>
</description>
<references>
<bid>15096</bid>
<cvename>CAN-2005-2972</cvename>
<url>http://scary.beasts.org/security/CESA-2005-006.txt</url>
<url>http://www.abisource.com/changelogs/2.2.11.phtml</url>
<url>http://www.kde.org/info/security/advisory-20051011-1.txt</url>
</references>
<dates>
<discovery>2005-10-14</discovery>
<entry>2006-02-20</entry>
<modified>2006-02-20</modified>
</dates>
</vuln>
<vuln vid="0b2b4b4d-a07c-11da-be0a-000c6ec775d9">
<topic>postgresql81-server -- SET ROLE privilege escalation</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><ge>8.1.0</ge><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL team reports:</p>
<blockquote cite="http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3">
<p>Due to inadequate validity checking, a user could exploit
the special case that SET ROLE normally uses to restore
the previous role setting after an error. This allowed
ordinary users to acquire superuser status, for
example.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0553</cvename>
<url>http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3</url>
</references>
<dates>
<discovery>2006-02-14</discovery>
<entry>2006-02-18</entry>
<modified>2006-08-13</modified>
</dates>
</vuln>
<vuln vid="63fe4189-9f97-11da-ac32-0001020eed82">
<topic>gnupg -- false positive signature verification</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114">
<p>The Gentoo project identified a security related bug in
GnuPG. When using any current version of GnuPG for
unattended signature verification (e.g. by scripts and
mail programs), false positive signature verification of
detached signatures may occur.</p>
<p>This problem affects the tool *gpgv*, as well as using
"gpg --verify" to imitate gpgv, if only the exit code of
the process is used to decide whether a detached signature
is valid. This is a plausible mode of operation for
gpgv.</p>
<p>If, as suggested, the --status-fd generated output is
used to decide whether a signature is valid, no problem
exists. In particular applications making use of the
GPGME library[2] are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0455</cvename>
<mlist msgid="87u0b1xdru.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114</mlist>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-02-17</entry>
</dates>
</vuln>
<vuln vid="e34d0c2e-9efb-11da-b410-000e0c2e438a">
<topic>rssh -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pizzashack reports:</p>
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
<p>Max Vozeler has reported a problem whereby rssh can
allow users who have shell access to systems where rssh
is installed (and rssh_chroot_helper is installed SUID)
to gain root access to the system, due to the ability to
chroot to arbitrary locations. There are a lot of
potentially mitigating factors, but to be safe you should
upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<bid>16050</bid>
<cvename>CVE-2005-3345</cvename>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
</references>
<dates>
<discovery>2005-12-18</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="d38e1810-9ef7-11da-b410-000e0c2e438a">
<topic>tor -- malicious tor server can locate a hidden service</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.1.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roger Dingledine reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Jan-2006/msg00001.html">
<p>If you offer a Tor hidden service, an adversary who can
run a fast Tor server and who knows some basic statistics
can find the location of your hidden service in a matter of
minutes to hours.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0414</cvename>
<url>http://archives.seul.org/or/announce/Jan-2006/msg00001.html</url>
</references>
<dates>
<discovery>2006-01-12</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="1b725079-9ef6-11da-b410-000e0c2e438a">
<topic>sudo -- arbitrary command execution</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.6.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy reports:</p>
<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_env.html">
<p>The bash shell uses the value of the PS4 environment
variable (after expansion) as a prefix for commands run
in execution trace mode. Execution trace mode (xtrace) is
normally set via bash's -x command line option or
interactively by running "set -o xtrace". However, it may
also be enabled by placing the string "xtrace" in the
SHELLOPTS environment variable before bash is started.</p>
<p>A malicious user with sudo access to a shell script that
uses bash can use this feature to run arbitrary commands
for each line of the script.</p>
</blockquote>
</body>
</description>
<references>
<bid>15191</bid>
<cvename>CVE-2005-2959</cvename>
<url>http://www.courtesan.com/sudo/alerts/bash_env.html</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="a78299e7-9ef3-11da-b410-000e0c2e438a">
<topic>libtomcrypt -- weak signature scheme with ECC keys</topic>
<affects>
<package>
<name>libtomcrypt</name>
<range><le>1.02</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Secure Science Corporation reports that libtomcrypt is
vulnerable to a weak signature scheme. This allows an
attacker to create a valid random signature and use that to
sign arbitrary messages without requiring the private key.</p>
</body>
</description>
<references>
<mlist msgid="4276CC31.9000307@securescience.net">http://marc.theaimsgroup.com/?l=bugtraq&m=111540819703204</mlist>
</references>
<dates>
<discovery>2005-05-01</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="592815da-9eed-11da-b410-000e0c2e438a">
<topic>mantis -- "view_filters_page.php" cross site scripting vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.0.0a4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>r0t reports:</p>
<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
<p>Mantis contains a flaw that allows a remote cross site
scripting attack. This flaw exists because input passed to
"target_field" parameter in "view_filters_page.php" is not
properly sanitised before being returned to the user. This
could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the
trust relationship between the browser and the server,
leading to a loss of integrity.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CAN-2005-4238</cvename>
<url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
</references>
<dates>
<discovery>2005-12-13</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="28c9243a-72ed-11da-8c1d-000e0c2e438a">
<topic>phpbb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpbb</name>
<name>zh-phpbb-tw</name>
<range><lt>2.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported within phpbb.
phpbb is proven vulnerable to:</p>
<ul>
<li>script insertion,</li>
<li>bypassing of protetion mechanisms,</li>
<li>multiple cross site scripting vulnerabilities,</li>
<li>SQL injection,</li>
<li>arbitrary code execution</li>
</ul>
</body>
</description>
<references>
<bid>15170</bid>
<bid>15243</bid>
<cvename>CVE-2005-3310</cvename>
<cvename>CVE-2005-3415</cvename>
<cvename>CVE-2005-3416</cvename>
<cvename>CVE-2005-3417</cvename>
<cvename>CVE-2005-3418</cvename>
<cvename>CVE-2005-3419</cvename>
<cvename>CVE-2005-3420</cvename>
<cvename>CVE-2005-3536</cvename>
<cvename>CVE-2005-3537</cvename>
<mlist msgid="20051022132217.10390.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=113017003617987</mlist>
<url>http://www.hardened-php.net/advisory_172005.75.html</url>
</references>
<dates>
<discovery>2005-10-24</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="486aff57-9ecd-11da-b410-000e0c2e438a">
<topic>postgresql -- character conversion and tsearch2 vulnerabilities</topic>
<affects>
<package>
<name>postgresql</name>
<range><ge>7.2.0</ge><lt>7.2.8</lt></range>
<range><ge>7.3.0</ge><lt>7.3.10</lt></range>
<range><ge>7.4.0</ge><lt>7.4.8</lt></range>
<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The postgresql development team reports:</p>
<blockquote cite="http://www.postgresql.org/about/news.315">
<p>The more severe of the two errors is that the functions
that support client-to-server character set conversion
can be called from SQL commands by unprivileged users,
but these functions are not designed to be safe against
malicious choices of argument values. This problem exists
in PostgreSQL 7.3.* through 8.0.*. The recommended fix is
to disable public EXECUTE access for these functions. This
does not affect normal usage of the functions for character
set conversion, but it will prevent misuse.</p>
<p>The other error is that the contrib/tsearch2 module
misdeclares several functions as returning type "internal"
when they do not have any "internal" argument. This breaks
the type safety of "internal" by allowing users to
construct SQL commands that invoke other functions accepting
"internal" arguments. The consequences of this have not been
investigated in detail, but it is certainly at least possible
to crash the backend.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CAN-2005-1409</cvename>
<cvename>CAN-2005-1410</cvename>
<url>http://www.postgresql.org/about/news.315</url>
</references>
<dates>
<discovery>2005-05-02</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="f6447303-9ec9-11da-b410-000e0c2e438a">
<topic>heartbeat -- insecure temporary file creation vulnerability</topic>
<affects>
<package>
<name>heartbeat</name>
<range><lt>1.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Romang reports a temporary file creation vulnerability
within heartbeat. The vulnerability is caused by hardcoded
temporary file usage. This can cause an attacker to create
an arbitrary symlink causing the application to overwrite the
symlinked file with the permissions of the user executing the
application.</p>
</body>
</description>
<references>
<cvename>CAN-2005-2231</cvename>
<url>http://www.zataz.net/adviso/heartbeat-06272005.txt</url>
</references>
<dates>
<discovery>2005-07-12</discovery>
<entry>2006-02-16</entry>
<modified>2006-04-16</modified>
</dates>
</vuln>
<vuln vid="432bf98d-9e25-11da-b410-000e0c2e438a">
<topic>kpdf -- heap based buffer overflow</topic>
<affects>
<package>
<name>kdegraphics</name>
<range><lt>3.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20060202-1.txt">
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf
contains a heap based buffer overflow in the splash
rasterizer engine that can crash kpdf or even execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0301</cvename>
<url>http://www.kde.org/info/security/advisory-20060202-1.txt</url>
</references>
<dates>
<discovery>2006-02-02</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="bb33981a-7ac6-11da-bf72-00123f589060">
<topic>perl, webmin, usermin -- perl format string integer wrap vulnerability</topic>
<affects>
<package>
<name>perl</name>
<range><ge>5.6.0</ge><lt>5.6.2</lt></range>
<range><ge>5.8.0</ge><lt>5.8.7_1</lt></range>
</package>
<package>
<name>webmin</name>
<range><lt>1.250</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.180</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Perl Development page reports:</p>
<blockquote cite="http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html">
<p>Dyad Security recently released a security advisory explaining how
in certain cases, a carefully crafted format string passed to
sprintf can cause a buffer overflow. This buffer overflow can then
be used by an attacker to execute code on the machine. This was
discovered in the context of a design problem with the Webmin
administration package that allowed a malicious user to pass
unchecked data into sprintf.</p>
</blockquote>
</body>
</description>
<references>
<bid>15629</bid>
<cvename>CVE-2005-3912</cvename>
<cvename>CVE-2005-3962</cvename>
<url>http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html</url>
<url>http://www.dyadsecurity.com/perl-0002.html</url>
<url>http://www.dyadsecurity.com/webmin-0001.html</url>
<url>http://www.webmin.com/security.html</url>
</references>
<dates>
<discovery>2005-09-23</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="12f9d9e9-9e1e-11da-b410-000e0c2e438a">
<topic>phpicalendar -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpicalendar</name>
<range><lt>2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Francesco Ongaro reports that phpicalendar is vulnerable for
a cross site scripting attack. The vulnerability is caused by
improper validation of the index.php file allowing attackers
to include an arbitrary file with the .php extension</p>
</body>
</description>
<references>
<bid>15193</bid>
<cvename>CVE-2005-3366</cvename>
<url>http://www.ush.it/2005/10/25/php-icalendar-css/</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="f1f163ce-9e09-11da-b410-000e0c2e438a">
<topic>phpicalendar -- file disclosure vulnerability</topic>
<affects>
<package>
<name>phpicalendar</name>
<range><lt>2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpicalendar team reports that there is an
unspecified vulnerability within phpicalendar. This
seems to be a file disclosure vulnerability caused by
improper checking of the template parsing function.
This would allow an attacker to disclose any file
readable by the user under which the webserver runs.</p>
</body>
</description>
<references>
<url>http://phpicalendar.net/forums/viewtopic.php?t=396</url>
</references>
<dates>
<discovery>2006-02-08</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="dfb71c00-9d44-11da-8c1d-000e0c2e438a">
<topic>FreeBSD -- Infinite loop in SACK handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_11</lt></range>
<range><ge>5.3</ge><lt>5.3_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>When insufficient memory is available to handle an
incoming selective acknowledgement, the TCP/IP stack may
enter an infinite loop.</p>
<p>Impact:</p>
<p>By opening a TCP connection and sending a carefully crafted
series of packets, an attacker may be able to cause a denial
of service.</p>
<p>Workaround:</p>
<p>On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
disable the use of SACK:</p>
<p># sysctl net.inet.tcp.sack.enable=0</p>
<p>No workaround is available for FreeBSD 5.3.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0433</cvename>
<freebsdsa>SA-06:08.sack</freebsdsa>
</references>
<dates>
<discovery>2006-02-01</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="52ba7713-9d42-11da-8c1d-000e0c2e438a">
<topic>pf -- IP fragment handling panic</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_4</lt></range>
<range><ge>5.4</ge><lt>5.4_10</lt></range>
<range><ge>5.3</ge><lt>5.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A logic bug in pf's IP fragment cache may result in a packet
fragment being inserted twice, violating a kernel
invariant.</p>
<p>Impact:</p>
<p>By sending carefully crafted sequence of IP packet fragments,
a remote attacker can cause a system running pf with a ruleset
containing a 'scrub fragment crop' or 'scrub fragment
drop-ovl' rule to crash.</p>
<p>Workaround:</p>
<p>Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl'
rules on systems running pf. In most cases, such rules can be
replaced by 'scrub fragment reassemble' rules; see the
pf.conf(5) manual page for more details.</p>
<p>Systems which do not use pf, or use pf but do not use the
aforementioned rules, are not affected by this issue.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0381</cvename>
<freebsdsa>SA-06:07.pf</freebsdsa>
</references>
<dates>
<discovery>2006-01-25</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="7a4f2aca-9d40-11da-8c1d-000e0c2e438a">
<topic>FreeBSD -- Local kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A buffer allocated from the kernel stack may not be completely
initialized before being copied to userland. [CVE-2006-0379]</p>
<p>A logic error in computing a buffer length may allow too much
data to be copied into userland. [CVE-2006-0380]</p>
<p>Impact:</p>
<p>Portions of kernel memory may be disclosed to local users.
Such memory might contain sensitive information, such as
portions of the file cache or terminal buffers. This
information might be directly useful, or it might be
leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might include a user-entered
password.</p>
<p>Workaround:</p>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0379</cvename>
<cvename>CVE-2006-0380</cvename>
<freebsdsa>SA-06:06.kmem</freebsdsa>
</references>
<dates>
<discovery>2006-01-25</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="dade3316-9d31-11da-8c1d-000e0c2e438a">
<topic>IEEE 802.11 -- buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>An integer overflow in the handling of corrupt IEEE 802.11
beacon or probe response frames when scanning for existing
wireless networks can result in the frame overflowing a
buffer.</p>
<p>Impact:</p>
<p>An attacker able broadcast a carefully crafted beacon or
probe response frame may be able to execute arbitrary code
within the context of the FreeBSD kernel on any system
scanning for wireless networks.</p>
<p>Workaround:</p>
<p>No workaround is available, but systems without IEEE 802.11
hardware or drivers loaded are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0226</cvename>
<freebsdsa>SA-06:05.80211</freebsdsa>
</references>
<dates>
<discovery>2006-01-18</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="d7c1d00d-9d2e-11da-8c1d-000e0c2e438a">
<topic>ipfw -- IP fragment denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>The firewall maintains a pointer to layer 4 header
information in the event that it needs to send a TCP reset
or ICMP error message to discard packets. Due to incorrect
handling of IP fragments, this pointer fails to get
initialized.</p>
<p>Impact:</p>
<p>An attacker can cause the firewall to crash by sending ICMP
IP fragments to or through firewalls which match any reset,
reject or unreach actions.</p>
<p>Workaround:</p>
<p>Change any reset, reject or unreach actions to deny. It
should be noted that this will result in packets being
silently discarded.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0054</cvename>
<freebsdsa>SA-06:04.ipfw</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="1613db79-8e52-11da-8426-000fea0a9611">
<topic>kpopup -- local root exploit and local denial of service</topic>
<affects>
<package>
<name>kpopup</name>
<range><ge>0.9.1</ge><le>0.9.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre CVE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1170">
<p>Format string vulnerability in main.cpp in kpopup
0.9.1-0.9.5pre2 allows local users to cause a denial of
service (segmentation fault) and possibly execute
arbitrary code via format string specifiers in command
line arguments.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1167">
<p>misc.cpp in KPopup 0.9.1 trusts the PATH variable when
executing killall, which allows local users to elevate
their privileges by modifying the PATH variable to
reference a malicious killall program.</p>
</blockquote>
<p>SecurityFocus credits "b0f" b0fnet@yahoo.com</p>
</body>
</description>
<references>
<cvename>CVE-2003-1170</cvename>
<bid>8918</bid>
<cvename>CVE-2003-1167</cvename>
<bid>8915</bid>
<url>http://www.securityfocus.com/archive/1/342736</url>
<url>http://www.henschelsoft.de/kpopup_en.html</url>
</references>
<dates>
<discovery>2003-10-28</discovery>
<entry>2006-02-07</entry>
</dates>
</vuln>
<vuln vid="6b0215ae-8f26-11da-8c1d-000e0c2e438a">
<topic>cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A number of issues has been discovered in cpio:</p>
<p>When creating a new file, cpio closes the file before setting
its permissions. (CVE-2005-1111)</p>
<p>When extracting files cpio does not properly sanitize file
names to filter out ".." components, even if the
--no-absolute-filenames option is used. (CVE-2005-1229)</p>
<p>When adding large files (larger than 4 GB) to a cpio archive
on 64-bit platforms an internal buffer might overflow.
(CVE-2005-4268)</p>
<p>Impact</p>
<p>The first problem can allow a local attacker to change the
permissions of files owned by the user executing cpio providing
that they have write access to the directory in which the file
is being extracted. (CVE-2005-1111)</p>
<p>The lack of proper file name sanitation can allow an attacker
to overwrite arbitrary local files when extracting files from
a cpio archive. (CVE-2005-1229)</p>
<p>The buffer-overflow on 64-bit platforms could lead cpio to a
Denial-of-Service situation (crash) or possibly execute
arbitrary code with the permissions of the user running
cpio. (CVE-2005-4268)</p>
<p>Workaround</p>
<p>Use a different utility to create and extract cpio archives,
for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If
this is not possible, do not extract untrusted archives and
when running on 64-bit platforms do not add untrusted files
to cpio archives.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1111</cvename>
<cvename>CVE-2005-1229</cvename>
<cvename>CVE-2005-4268</cvename>
<freebsdsa>SA-06:03.cpio</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="726dd9bd-8f25-11da-8c1d-000e0c2e438a">
<topic>ee -- temporary file privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>The ispell_op function used by ee(1) while executing spell
check operations employs an insecure method of temporary file
generation. This method produces predictable file names based
on the process ID and fails to confirm which path will be over
written with the user.<br/>
It should be noted that ispell does not have to be installed
in order for this to be exploited. The option simply needs to
be selected.</p>
<p>Impact</p>
<p>These predictable temporary file names are problematic
because they allow an attacker to take advantage of a race
condition in order to execute a symlink attack, which could
allow them to overwrite files on the system in the context of
the user running the ee(1) editor.</p>
<p>Workaround</p>
<p>Instead of invoking ispell through ee(1), invoke it directly.</p>
</body>
</description>
<references>
<bid>16207</bid>
<cvename>CVE-2006-0055</cvename>
<freebsdsa>SA-06:02.ee</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="c01a25f5-8f20-11da-8c1d-000e0c2e438a">
<topic>texindex -- temporary file privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>The "sort_offline" function used by texindex(1) employs the
"maketempname" function, which produces predictable file names
and fails to validate that the paths do not exist.</p>
<p>Impact</p>
<p>These predictable temporary file names are problematic because
they allow an attacker to take advantage of a race condition in
order to execute a symlink attack, which could enable them to
overwrite files on the system in the context of the user running
the texindex(1) utility.</p>
<p>Workaround</p>
<p>No workaround is available, but the problematic code is only
executed if the input file being processed is 500kB or more in
length; as a result, users working with documents of less than
several hundred pages are very unlikely to be affected.</p>
</body>
</description>
<references>
<bid>14854</bid>
<cvename>CAN-2005-3011</cvename>
<freebsdsa>SA-06:01.texindex</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="c5c17ead-8f23-11da-8c1d-000e0c2e438a">
<topic>cvsbug -- race condition</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_7</lt></range>
<range><ge>5.3</ge><lt>5.3_22</lt></range>
<range><ge>4.11</ge><lt>4.11_12</lt></range>
<range><ge>4.10</ge><lt>4.10_18</lt></range>
</package>
<package>
<name>cvs+ipv6</name>
<range><lt>1.11.17_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>A temporary file is created, used, deleted, and then
re-created with the same name. This creates a window during
which an attacker could replace the file with a link to
another file. While cvsbug(1) is based on the send-pr(1)
utility, this problem does not exist in the version of
send-pr(1) distributed with FreeBSD.<br/>
In FreeBSD 4.10 and 5.3, some additional problems exist
concerning temporary file usage in both cvsbug(1) and
send-pr(1).</p>
<p>Impact</p>
<p>A local attacker could cause data to be written to any file
to which the user running cvsbug(1) (or send-pr(1) in FreeBSD
4.10 and 5.3) has write access. This may cause damage in
itself (e.g., by destroying important system files or
documents) or may be used to obtain elevated privileges.</p>
<p>Workaround</p>
<p>Do not use the cvsbug(1) utility on any system with untrusted
users.<br/>
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3
system with untrusted users.</p>
</body>
</description>
<references>
<cvename>CAN-2005-2693</cvename>
<freebsdsa>SA-05:20.cvsbug</freebsdsa>
</references>
<dates>
<discovery>2005-09-07</discovery>
<entry>2006-01-27</entry>
<modified>2006-11-08</modified>
</dates>
</vuln>
<vuln vid="57a0242d-8c4e-11da-8ddf-000ae42e9b93">
<topic>sge -- local root exploit in bundled rsh executable</topic>
<affects>
<package>
<name>sge</name>
<name>sgeee</name>
<range><lt>5.3.6.20040330_1</lt></range>
<range><gt>6.*</gt><lt>6.0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sun Microsystems reports:</p>
<blockquote cite="http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html">
<p>The SGE 6.0u7_1 release fixes a security bug which can
allow malicious users to gain root access.</p>
</blockquote>
</body>
</description>
<references>
<url>http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html</url>
</references>
<dates>
<discovery>2005-12-23</discovery>
<entry>2006-01-23</entry>
</dates>
</vuln>
<vuln vid="f11d3b22-88c6-11da-a7b2-0060084a00e5">
<topic>fetchmail -- crash when bouncing a message</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.0</ge><lt>6.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-01.txt">
<p>Fetchmail contains a bug that causes itself to crash when
bouncing a message to the originator or to the local
postmaster. The crash happens after the bounce message has
been sent, when fetchmail tries to free the dynamic array
of failed addresses, and calls the free() function with an
invalid pointer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0321</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-01.txt</url>
<url>http://bugs.debian.org/348747</url>
</references>
<dates>
<discovery>2006-01-22</discovery>
<entry>2006-01-23</entry>
</dates>
</vuln>
<vuln vid="612a34ec-81dc-11da-a043-0002a5c3d308">
<topic>clamav -- possible heap overflow in the UPX code</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20060110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zero Day Initiative reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-06-001.html">
<p>This vulnerability allows remote attackers to execute
arbitrary code on vulnerable Clam AntiVirus
installations. Authentication is not required to exploit
this vulnerability.</p>
<p>This specific flaw exists within libclamav/upx.c during
the unpacking of executable files compressed with UPX. Due
to an invalid size calculation during a data copy from the
user-controlled file to heap allocated memory, an
exploitable memory corruption condition is created.</p>
</blockquote>
</body>
</description>
<references>
<bid>16191</bid>
<cvename>CVE-2006-0162</cvename>
<mlist>http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html</mlist>
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-001.html</url>
<url>http://secunia.com/advisories/18379/</url>
</references>
<dates>
<discovery>2006-01-09</discovery>
<entry>2006-01-10</entry>
<modified>2006-01-15</modified>
</dates>
</vuln>
<vuln vid="6d9a28f8-8152-11da-817c-0001020eed82">
<topic>milter-bogom -- headerless message crash</topic>
<affects>
<package>
<name>milter-bogom</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Juan J. Marítnez reports:</p>
<blockquote cite="http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt">
<p>The milter crashes while processing a headerless
message</p>
<p>Impact: bogom crashes and sendmail moves it to error
state</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt</url>
<mlist>http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html</mlist>
</references>
<dates>
<discovery>2006-01-05</discovery>
<entry>2006-01-09</entry>
</dates>
</vuln>
<vuln vid="b747b2a9-7be0-11da-8ec4-0002b3b60e4c">
<topic>bogofilter -- heap corruption through excessively long words</topic>
<affects>
<package>
<name>bogofilter</name>
<range><ge>0.96.2</ge><lt>0.96.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02">
<p>Bogofilter's/bogolexer's input handling in version 0.96.2 was not
keeping track of its output buffers properly and could overrun a
heap buffer if the input contained words whose length exceeded
16,384 bytes, the size of flex's input buffer. A "word" here refers
to a contiguous run of input octets that was not '_' and did not
match at least one of ispunct(), iscntrl() or isspace().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4592</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02</url>
</references>
<dates>
<discovery>2005-10-23</discovery>
<entry>2006-01-07</entry>
</dates>
</vuln>
<vuln vid="92140bc9-7bde-11da-8ec4-0002b3b60e4c">
<topic>bogofilter -- heap corruption through malformed input</topic>
<affects>
<package>
<name>bogofilter</name>
<range><ge>0.93.5</ge><lt>0.96.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01">
<p>When using Unicode databases (default in more recent bogofilter
installations), upon encountering invalid input sequences,
bogofilter or bogolexer could overrun a malloc()'d buffer,
corrupting the heap, while converting character sets. Bogofilter
would usually be processing untrusted data received from the
network at that time.</p>
<p>This problem was aggravated by an unrelated bug that made
bogofilter process binary attachments as though they were text, and
attempt charset conversion on them. Given the MIME default
character set, US-ASCII, all input octets in the range 0x80...0xff
were considered invalid input sequences and could trigger the heap
corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4591</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01</url>
</references>
<dates>
<discovery>2005-10-22</discovery>
<entry>2006-01-07</entry>
</dates>
</vuln>
<vuln vid="c2fdb3bc-7d72-11da-b96e-000fb586ba73">
<topic>rxvt-unicode -- restore permissions on tty devices</topic>
<affects>
<package>
<name>rxvt-unicode</name>
<range><lt>6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A rxvt-unicode changelog reports:</p>
<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
<p>SECURITY FIX: on systems using openpty, permissions were
not correctly updated on the tty device and were left as
world-readable and world-writable (likely in original rxvt,
too), and were not restored properly. Affected are only
systems where non-unix ptys were used (such as most BSDs).
Found, patched and debugged by Ryan Beasley.</p>
</blockquote>
</body>
</description>
<references>
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
</references>
<dates>
<discovery>2005-12-31</discovery>
<entry>2006-01-04</entry>
</dates>
</vuln>
<vuln vid="9fff8dc8-7aa7-11da-bf72-00123f589060">
<topic>apache -- mod_imap cross-site scripting flaw</topic>
<affects>
<package>
<name>apache</name>
<range><ge>1.3</ge><lt>1.3.34_3</lt></range>
<range><ge>2.0.35</ge><lt>2.0.55_2</lt></range>
<range><ge>2.1</ge><lt>2.1.9_3</lt></range>
<range><ge>2.2</ge><lt>2.2.0_3</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.34_1</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><ge>0</ge></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.37</lt></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.34+30.22_1</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.34+30.22+2.8.25_1</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><ge>1.3.0</ge><lt>1.3.33.1.55_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><lt>1.3.34+2.8.25_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache HTTP Server Project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
<p>A flaw in mod_imap when using the Referer directive with
image maps. In certain site configurations a remote
attacker could perform a cross-site scripting attack if a
victim can be forced to visit a malicious URL using
certain web browsers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3352</cvename>
<bid>15834</bid>
<url>http://www.apacheweek.com/features/security-13</url>
<url>http://www.apacheweek.com/features/security-20</url>
</references>
<dates>
<discovery>2005-11-01</discovery>
<entry>2006-01-01</entry>
<modified>2009-01-23</modified>
</dates>
</vuln>
<vuln vid="8db2f8b2-9e12-11ea-9e83-0cc47ac16c9d">
<topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
<affects>
<package>
<name>netqmail</name>
<range><le>1.06_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski writes:</p>
<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
<p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
<p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
</blockquote>
<p>The national vulnerability database summarizes:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
<p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
<url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
<cvename>CVE-2005-1513</cvename>
<cvename>CVE-2005-1514</cvename>
<cvename>CVE-2005-1515</cvename>
</references>
<dates>
<discovery>2005-05-06</discovery>
<entry>2005-05-11</entry>
</dates>
</vuln>
<vuln vid="b495af21-9e10-11ea-9e83-0cc47ac16c9d">
<topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
<affects>
<package>
<name>netqmail-tls</name>
<range><le>1.06.20160918_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski writes:</p>
<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
<p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
<p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
</blockquote>
<p>The national vulnerability database summarizes:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
<p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
<url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
<cvename>CVE-2005-1513</cvename>
<cvename>CVE-2005-1514</cvename>
<cvename>CVE-2005-1515</cvename>
</references>
<dates>
<discovery>2005-05-06</discovery>
<entry>2005-05-11</entry>
</dates>
</vuln>
<vuln vid="d6540411-9e10-11ea-9e83-0cc47ac16c9d">
<topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
<affects>
<package>
<name>netqmail-mysql</name>
<range><le>1.06.1.1.15_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski writes:</p>
<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
<p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
<p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
</blockquote>
<p>The national vulnerability database summarizes:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
<p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
<url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
<cvename>CVE-2005-1513</cvename>
<cvename>CVE-2005-1514</cvename>
<cvename>CVE-2005-1515</cvename>
</references>
<dates>
<discovery>2005-05-06</discovery>
<entry>2005-05-11</entry>
</dates>
</vuln>
<vuln vid="43770b1c-72f6-11da-8c1d-000e0c2e438a">
<topic>nbd-server -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>nbd-server</name>
<range><lt>2.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Fitzner reports a buffer overflow vulnerability
within nbd. This could potentially allow the execution
of arbitrary code on the nbd server.</p>
</body>
</description>
<references>
<cvename>CVE-2005-3534</cvename>
<url>http://www.debian.org/security/2005/dsa-924</url>
</references>
<dates>
<discovery>2005-12-21</discovery>
<entry>2005-12-22</entry>
<modified>2005-12-25</modified>
</dates>
</vuln>
<vuln vid="b5a49db7-72fc-11da-9827-021106004fd6">
<topic>scponly -- local privilege escalation exploits</topic>
<affects>
<package>
<name>scponly</name>
<range><lt>4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Max Vozeler reports:</p>
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
<p>If ALL the following conditions are true, administrators using
scponly-4.1 or older may be at risk of a local privilege
escalation exploit:</p>
<ul>
<li>the chrooted setuid scponlyc binary is installed</li>
<li>regular non-scponly users have interactive shell access
to the box</li>
<li>a user executable dynamically linked setuid binary
(such as ping) exists on the same file system mount
as the user's home directory</li>
<li>the operating system supports an LD_PRELOAD style
mechanism to overload dynamic library loading</li>
</ul>
</blockquote>
<p>Pekka Pessi also reports:</p>
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
<p>If ANY the following conditions are true, administrators
using scponly-4.1 or older may be at risk of a local privilege
escalation exploit:</p>
<ul>
<li>scp compatibility is enabled</li>
<li>rsync compatibility is enabled</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html</url>
<url>http://sublimation.org/scponly/#relnotes</url>
</references>
<dates>
<discovery>2005-12-21</discovery>
<entry>2005-12-22</entry>
</dates>
</vuln>
<vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5">
<topic>fetchmail -- null pointer dereference in multidrop mode with headerless email</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The fetchmail team reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-03.txt">
<p>Fetchmail contains a bug that causes an application crash
when fetchmail is configured for multidrop mode and the
upstream mail server sends a message without headers. As
fetchmail does not record this message as "previously fetched",
it will crash with the same message if it is re-executed, so it
cannot make progress. A malicious or broken-into upstream server
could thus cause a denial of service in fetchmail clients.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4348</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2005-03.txt</url>
<url>http://article.gmane.org/gmane.mail.fetchmail.user/7573</url>
<url>http://bugs.debian.org/343836</url>
</references>
<dates>
<discovery>2005-12-19</discovery>
<entry>2005-12-19</entry>
</dates>
</vuln>
<vuln vid="82a41084-6ce7-11da-b90c-000e0c2e438a">
<topic>mantis -- "t_core_path" file inclusion vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.0.0rc3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2005-46/advisory/">
<p>Input passed to the "t_core_path" parameter in
"bug_sponsorship_list_view_inc.php" isn't properly verified,
before it used to include files. This can be exploited to
include arbitrary files from external and local
resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3335</cvename>
<url>http://secunia.com/secunia_research/2005-46/advisory/</url>
</references>
<dates>
<discovery>2005-10-26</discovery>
<entry>2005-12-14</entry>
</dates>
</vuln>
<vuln vid="6e3b12e2-6ce3-11da-b90c-000e0c2e438a">
<topic>mantis -- "view_filters_page.php" cross-site scripting vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.0.0rc4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>r0t reports:</p>
<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
<p>Mantis contains a flaw that allows a remote cross site
scripting attack. This flaw exists because input passed to
"target_field" parameter in "view_filters_page.php" isn't
properly sanitised before being returned to the user. This
could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the
trust relationship between the browser and the server,
leading to a loss of integrity.</p>
</blockquote>
</body>
</description>
<references>
<bid>15842</bid>
<url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
</references>
<dates>
<discovery>2005-12-13</discovery>
<entry>2005-12-14</entry>
</dates>
</vuln>
<vuln vid="2506f558-6a8a-11da-b96e-000fb586ba73">
<topic>mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields</topic>
<affects>
<package>
<name>mnemo</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Mnemo H3 (2.0.3) (final):</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2">
<p>This [2.0.3] is a security release that fixes cross site
scripting vulnerabilities in several of the notepad name
and note data fields. None of the vulnerabilities can be
exploited by unauthenticated users; however, we strongly
recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3
as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2</url>
</references>
<dates>
<discovery>2005-12-11</discovery>
<entry>2005-12-11</entry>
</dates>
</vuln>
<vuln vid="ee6b5956-6a89-11da-b96e-000fb586ba73">
<topic>nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields</topic>
<affects>
<package>
<name>nag</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Nag H3 (2.0.4) (final):</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2">
<p>This [2.0.4] is a security release that fixes cross site
scripting vulnerabilities in several of the tasklist name
and task data fields. None of the vulnerabilities can be
exploited by unauthenticated users; however, we strongly
recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as
soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2</url>
</references>
<dates>
<discovery>2005-12-11</discovery>
<entry>2005-12-11</entry>
</dates>
</vuln>
<vuln vid="eeebd55d-6a88-11da-b96e-000fb586ba73">
<topic>turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields</topic>
<affects>
<package>
<name>turba</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Turba H3 (2.0.5) (final):</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2">
<p>This [2.0.5] is a security release that fixes cross site
scripting vulnerabilities in several of the address book
name and contact data fields. None of the vulnerabilities
can be exploited by unauthenticated users; however, we
strongly recommend that all users of Turba 2.0.4 upgrade
to 2.0.5 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2</url>
</references>
<dates>
<discovery>2005-12-11</discovery>
<entry>2005-12-11</entry>
</dates>
</vuln>
<vuln vid="36494478-6a88-11da-b96e-000fb586ba73">
<topic>kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields</topic>
<affects>
<package>
<name>kronolith</name>
<range><lt>2.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Kronolith H3 (2.0.6) (final):</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2">
<p>This [2.0.6] is a security release that fixes cross site
scripting vulnerabilities in several of the calendar name
and event data fields. None of the vulnerabilities can be
exploited by unauthenticated users; however, we strongly
recommend that all users of Kronolith 2.0.5 upgrade to
2.0.6 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2</url>
</references>
<dates>
<discovery>2005-12-11</discovery>
<entry>2005-12-11</entry>
</dates>
</vuln>
<vuln vid="01356ccc-6a87-11da-b96e-000fb586ba73">
<topic>horde -- Cross site scripting vulnerabilities in several of Horde's templates</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Horde H3 3.0.8 (final):</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2">
<p>This [3.0.8] is a security release that fixes cross site
scripting vulnerabilities in several of Horde's templates.
None of the vulnerabilities can be exploited by
unauthenticated users; however, we strongly recommend that
all users of Horde 3.0.7 upgrade to 3.0.8 as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2</url>
</references>
<dates>
<discovery>2005-12-11</discovery>
<entry>2005-12-11</entry>
</dates>
</vuln>
<vuln vid="9b4facec-6761-11da-99f6-00123ffe8333">
<topic>curl -- URL buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.11.2</ge><lt>7.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Project cURL Security Advisory reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20051207.html">
<p>libcurl's URL parser function can overflow a malloced
buffer in two ways, if given a too long URL.</p>
<p>1 - pass in a URL with no protocol (like "http://")
prefix, using no slash and the string is 256 bytes or
longer. This leads to a single zero byte overflow of the
malloced buffer.</p>
<p>2 - pass in a URL with only a question mark as separator
(no slash) between the host and the query part of the URL.
This leads to a single zero byte overflow of the malloced
buffer.</p>
<p>Both overflows can be made with the same input string,
leading to two single zero byte overwrites.</p>
<p>The affected flaw cannot be triggered by a redirect, but
the long URL must be passed in "directly" to libcurl. It
makes this a "local" problem. Of course, lots of programs
may still pass in user-provided URLs to libcurl without doing
much syntax checking of their own, allowing a user to exploit
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<bid>15756</bid>
<cvename>CVE-2005-4077</cvename>
<url>http://curl.haxx.se/docs/adv_20051207.html</url>
<url>http://www.hardened-php.net/advisory_242005.109.html</url>
<url>http://secunia.com/advisories/17907/</url>
</references>
<dates>
<discovery>2005-12-07</discovery>
<entry>2005-12-09</entry>
<modified>2006-01-01</modified>
</dates>
</vuln>
<vuln vid="23afd91f-676b-11da-99f6-00123ffe8333">
<topic>phpmyadmin -- register_globals emulation "import_blacklist" manipulation</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.7.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/17925/">
<p>Stefan Esser has reported a vulnerability in phpMyAdmin,
which can be exploited by malicious people to conduct
cross-site scripting attacks, disclose sensitive
information, and compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an error in the
register_globals emulation layer in "grab_globals.php"
where the "import_blacklist" variable is not properly
protected from being overwritten. This can be exploited
to execute arbitrary HTML and script code in a user's
browser session in context of an affected site, and
include arbitrary files from external and local resources.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9</url>
<url>http://www.hardened-php.net/advisory_252005.110.html</url>
<url>http://secunia.com/advisories/17925/</url>
</references>
<dates>
<discovery>2005-12-07</discovery>
<entry>2005-12-07</entry>
</dates>
</vuln>
<vuln vid="59ada6e5-676a-11da-99f6-00123ffe8333">
<topic>phpmyadmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security advisory reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8">
<p>It was possible to conduct an XSS attack via the
HTTP_HOST variable; also, some scripts in the libraries
directory that handle header generation were vulnerable
to XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3665</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8</url>
<url>http://secunia.com/advisories/17895/</url>
</references>
<dates>
<discovery>2005-12-05</discovery>
<entry>2005-12-07</entry>
</dates>
</vuln>
<vuln vid="964161cd-6715-11da-99f6-00123ffe8333">
<topic>ffmpeg -- libavcodec buffer overflow vulnerability</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>0.4.9.p1_4</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<range><lt>0.4.9.c.2005120600</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/17892/">
<p>Simon Kilvington has reported a vulnerability in
FFmpeg libavcodec, which can be exploited by malicious
people to cause a DoS (Denial of Service) and
potentially to compromise a user's system.</p>
<p>The vulnerability is caused due to a boundary error
in the "avcodec_default_get_buffer()" function of
"utils.c" in libavcodec. This can be exploited to
cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette
is read.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558</url>
<url>http://secunia.com/advisories/17892/</url>
</references>
<dates>
<discovery>2005-11-30</discovery>
<entry>2005-12-07</entry>
</dates>
</vuln>
<vuln vid="7289187b-66a5-11da-99f6-00123ffe8333">
<topic>trac -- search module SQL injection vulnerability</topic>
<affects>
<package>
<name>trac</name>
<range><lt>0.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/17894/">
<p>A vulnerability has been reported in Trac, which
can be exploited by malicious people to conduct SQL
injection attacks.</p>
<p>Some unspecified input passed in the search module
isn't properly sanitised before being used in a SQL
query. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2</url>
<url>http://secunia.com/advisories/17894/</url>
</references>
<dates>
<discovery>2005-12-05</discovery>
<entry>2005-12-07</entry>
</dates>
</vuln>
<vuln vid="faca0843-6281-11da-8630-00123ffe8333">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/17824/">
<p>Some vulnerabilities have been reported in Drupal,
which can be exploited by malicious people to bypass
certain security restrictions, and conduct script
insertion and HTTP response splitting attacks.</p>
<p>1) An input validation error in the filtering of
HTML code can be exploited to inject arbitrary
JavaScript code in submitted content, which will be
executed in a user's browser session in context of
an affected site when the malicious user data is
viewed.
Successful exploitation requires that the user has
access to the full HTML input format.
Ref: sa-2005-007</p>
<p>2) An input validation error in the attachment
handling can be exploited to upload a malicious
image with embedded HTML and script content, which
will be executed in a user's browser session in
context of an affected site when viewed directly with
the Microsoft Internet Explorer browser.
This can also be exploited to inject arbitrary HTTP
headers, which will be included in the response sent
to the user.
Ref: sa-2005-008</p>
<p>3) The problem is that it is possible to bypass the
"access user profile" permission. However, this cannot
be exploited to modify data.
Successful exploitation requires that the server runs
PHP 5.
Ref: sa-2005-009</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2005-007/advisory.txt</url>
<url>http://drupal.org/files/sa-2005-008/advisory.txt</url>
<url>http://drupal.org/files/sa-2005-009/advisory.txt</url>
<url>http://secunia.com/advisories/17824/</url>
</references>
<dates>
<discovery>2005-12-01</discovery>
<entry>2005-12-01</entry>
</dates>
</vuln>
<vuln vid="d6b092bd-61e1-11da-b64c-0001020eed82">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><lt>8.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=819">
<p>It is possible to make a form input that looks like an
image link. If the form input has a "title" attribute, the
status bar will show the "title". A "title" which looks
like a URL can mislead the user, since the title can say
http://nice.familiar.com/, while the form action can be
something else.</p>
<p>Opera's tooltip says "Title:" before the title text,
making a spoof URL less convincing. A user who has enabled
the status bar and disabled tooltips can be affected by
this. Neither of these settings are Opera's defaults.</p>
<p>This exploit is mostly of interest to users who disable
JavaScript. If JavaScript is enabled, any link target or
form action can be overridden by the script. The tooltip
and the statusbar can only be trusted to show the true
location if JavaScript is disabled.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=817">
<p>Java code using LiveConnect methods to remove a property
of a JavaScript object may in some cases use null pointers
that can make Opera crash. This crash is not exploitable
and such code is rare on the web.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3699</cvename>
<url>http://secunia.com/advisories/17571/</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=817</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=819</url>
</references>
<dates>
<discovery>2005-11-16</discovery>
<entry>2005-11-30</entry>
</dates>
</vuln>
<vuln vid="dfc1daa8-61de-11da-b64c-0001020eed82">
<topic>opera -- command line URL shell command injection</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><lt>8.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Opera Advisory reports:</p>
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=818">
<p>Opera for UNIX uses a wrapper shell script to start up
Opera. This shell script reads the input arguments, like
the file names or URLs that Opera is to open. It also
performs some environment checks, for example whether Java
is available and if so, where it is located.</p>
<p>This wrapper script can also run commands embedded in the
URL, so that a specially crafted URL can make arbitrary
commands run on the recipient's machine. Users who have
other programs set up to use Opera to open Web links are
vulnerable to this flaw. For these users, clicking a Web
link in for example OpenOffice.org or Evolution can run a
command that was put into the link.</p>
</blockquote>
</body>
</description>
<references>
<bid>15521</bid>
<cvename>CVE-2005-3750</cvename>
<url>http://secunia.com/secunia_research/2005-57/advisory/</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=818</url>
</references>
<dates>
<discovery>2005-11-17</discovery>
<entry>2005-11-30</entry>
</dates>
</vuln>
<vuln vid="ffb82d3a-610f-11da-8823-00123ffe8333">
<topic>mambo -- "register_globals" emulation layer overwrite vulnerability</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17622/">
<p>peter MC tachatte has discovered a vulnerability in Mambo,
which can be exploited by malicious people to manipulate
certain information and compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an error in the
"register_globals" emulation layer in "globals.php" where
certain arrays used by the system can be overwritten. This
can be exploited to include arbitrary files from external
and local resources via the "mosConfig_absolute_path" parameter.</p>
<p>Successful exploitation requires that "register_globals"
is disabled.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mamboserver.com/index.php?option=com_content&task=view&id=172&Itemid=1</url>
<url>http://secunia.com/advisories/17622/</url>
</references>
<dates>
<discovery>2005-11-17</discovery>
<entry>2005-11-30</entry>
</dates>
</vuln>
<vuln vid="27a70a01-5f6c-11da-8d54-000cf18bbe54">
<topic>ghostscript -- insecure temporary file creation vulnerability</topic>
<affects>
<package>
<name>ghostscript-gnu</name>
<name>ghostscript-gnu-nox11</name>
<range><lt>7.07_14</lt></range>
</package>
<package>
<name>ghostscript-afpl</name>
<name>ghostscript-afpl-nox11</name>
<range><lt>8.53_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.securityfocus.com/bid/11285/discuss">
<p>Ghostscript is affected by an insecure temporary file
creation vulnerability. This issue is likely due
to a design error that causes the application to fail
to verify the existence of a file before writing to it.</p>
<p>An attacker may leverage this issue to overwrite
arbitrary files with the privileges of an unsuspecting
user that activates the vulnerable application.
Reportedly this issue is unlikely to facilitate
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<bid>11285</bid>
<cvename>CVE-2004-0967</cvename>
</references>
<dates>
<discovery>2004-10-19</discovery>
<entry>2005-11-27</entry>
</dates>
</vuln>
<vuln vid="873a6542-5b8d-11da-b96e-000fb586ba73">
<topic>horde -- Cross site scripting vulnerabilities in MIME viewers</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Announce of Horde 3.0.7 (final):</p>
<blockquote cite="http://lists.horde.org/archives/announce/2005/000232.html">
<p>This [3.0.7] is a security release that fixes cross site
scripting vulnerabilities in two of Horde's MIME viewers. These
holes could for example be exploited by an attacker sending
specially crafted emails to Horde's webmail client IMP. The
attack could be used to steal users' identity information, taking
over users' sessions, or changing users' settings.</p>
<p>As a hotfix the css and tgz MIME drivers can be disabled by
removing their entries from the
$mime_drivers_map['horde']['registered'] list in
horde/config/mime_drivers.php.</p>
</blockquote>
</body>
</description>
<references>
<bid>15535</bid>
<cvename>CVE-2005-3759</cvename>
<url>http://lists.horde.org/archives/announce/2005/000232.html</url>
</references>
<dates>
<discovery>2005-11-22</discovery>
<entry>2005-11-22</entry>
<modified>2005-11-26</modified>
</dates>
</vuln>
<vuln vid="c55f9ed0-56a7-11da-a3f0-00123ffe8333">
<topic>phpmyadmin -- HTTP Response Splitting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.6.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security advisory reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6">
<p>Some scripts in phpMyAdmin are vulnerable to an
HTTP Response Splitting attack.</p>
<p>Severity:</p>
<p>We consider these vulnerabilities to be serious.
However, they can only be triggered on systems running
with register_globals = on.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6</url>
<url>http://secunia.com/advisories/17578/</url>
<url>http://www.fitsec.com/advisories/FS-05-02.txt</url>
</references>
<dates>
<discovery>2005-11-15</discovery>
<entry>2005-11-16</entry>
</dates>
</vuln>
<vuln vid="9c1cea79-548a-11da-b53f-0004614cc33d">
<topic>phpSysInfo -- "register_globals" emulation layer overwrite vulnerability</topic>
<affects>
<package>
<name>phpSysInfo</name>
<range><lt>2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17441/">
<p>Christopher Kunz has reported a vulnerability in
phpSysInfo, which can be exploited by malicious people
to manipulate certain information.</p>
<p>The vulnerability is caused due to an error in
the "register_globals" emulation layer where certain
arrays used by the system can be overwritten. This can be
exploited to execute arbitrary HTML and script code in
a user's browser session and include arbitrary files from
local resources.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_222005.81.html</url>
<url>http://secunia.com/advisories/17441/</url>
</references>
<dates>
<discovery>2005-11-10</discovery>
<entry>2005-11-13</entry>
<modified>2005-12-25</modified>
</dates>
</vuln>
<vuln vid="aed343b4-5480-11da-b579-001125afbed7">
<topic>Macromedia flash player -- swf file handling arbitrary code</topic>
<affects>
<package>
<name>linux-flashplugin6</name>
<range><le>6.0r79_3</le></range>
</package>
<package>
<name>linux-flashplugin7</name>
<range><lt>7.0r61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17430/">
<p>A vulnerability has been reported in Macromedia
Flash Player, which can be exploited by malicious
people to compromise a user's system.</p>
<p>The vulnerability is caused due to missing validation
of the frame type identifier that is read from
a SWF file. This value is used as an index in Flash.ocx
to reference an array of function pointers. This can be
exploited via a specially crafted SWF file to cause
the index to reference memory that is under the attacker's
control, which causes Flash Player to use attacker
supplied values as function pointers.</p>
<p>Successful exploitation allows execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html</url>
<url>http://secunia.com/advisories/17430/</url>
<url>http://www.eeye.com/html/research/advisories/AD20051104.html</url>
</references>
<dates>
<discovery>2005-06-27</discovery>
<entry>2005-11-13</entry>
</dates>
</vuln>
<vuln vid="f4b95430-51d8-11da-8e93-0010dc4afb40">
<topic>flyspray -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>flyspray</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17316/">
<p>Lostmon has reported some vulnerabilities in Flyspray,
which can be exploited by malicious people to conduct
cross-site scripting attacks.</p>
<p>Some input isn't properly sanitised before being
returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<bid>15209</bid>
<url>http://secunia.com/advisories/17316/</url>
<url>http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html</url>
</references>
<dates>
<discovery>2005-10-26</discovery>
<entry>2005-11-10</entry>
<modified>2005-11-29</modified>
</dates>
</vuln>
<vuln vid="7f3fdef7-51d2-11da-8e93-0010dc4afb40">
<topic>p5-Mail-SpamAssassin -- long message header denial of service</topic>
<affects>
<package>
<name>p5-Mail-SpamAssassin</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17386/">
<p>A vulnerability has been reported in SpamAssassin,
which can be exploited by malicious people to cause
a DoS (Denial of Service).</p>
<p>The vulnerability is caused due to the use of
an inefficient regular expression in
"/SpamAssassin/Message.pm" to parse email headers.
This can cause perl to crash when it runs out of stack
space and can be exploited via a malicious email that
contains a large number of recipients.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/17386/</url>
<url>http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570</url>
</references>
<dates>
<discovery>2005-11-10</discovery>
<entry>2005-11-10</entry>
</dates>
</vuln>
<vuln vid="eb29a575-3381-11da-8340-000e0c2e438a">
<topic>qpopper -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>qpopper</name>
<range><ge>4.0</ge><le>4.0.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jens Steube reports that qpopper is vulnerable to a privilege
escalation vulnerability. qpopper does not properly drop root
privileges so that user supplied configuration and trace files
can be processed with root privileges. This could allow a
local attacker to create or modify arbitrary files.</p>
<p>qpopper is also affected by improper umask settings
which could allow users to create group or world-writeable
files, possibly allowing an attacker to overwrite arbitrary
files.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1151</cvename>
<cvename>CVE-2005-1152</cvename>
<url>http://secunia.com/advisories/15475/</url>
</references>
<dates>
<discovery>2005-05-26</discovery>
<entry>2005-11-07</entry>
<modified>2005-11-26</modified>
</dates>
</vuln>
<vuln vid="44e5f5bd-4d76-11da-bf37-000fb586ba73">
<topic>pear-PEAR -- PEAR installer arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>pear-PEAR</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gregory Beaver reports:</p>
<blockquote cite="http://pear.php.net/advisory-20051104.txt">
<p>A standard feature of the PEAR installer implemented in
all versions of PEAR can lead to the execution of
arbitrary PHP code upon running the "pear" command
or loading the Web/Gtk frontend.</p>
<p>To be vulnerable, a user must explicitly install a
publicly released malicious package using the PEAR
installer, or explicitly install a package that depends on
a malicious package.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pear.php.net/advisory-20051104.txt</url>
</references>
<dates>
<discovery>2005-11-01</discovery>
<entry>2005-11-04</entry>
</dates>
</vuln>
<vuln vid="3de49331-0dec-422c-93e5-e4719e9869c5">
<topic>openvpn -- potential denial-of-service on servers in TCP mode</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.0</ge><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>If the TCP server accept() call returns an error status, the
resulting exception handler may attempt to indirect through a NULL
pointer, causing a segfault. Affects all OpenVPN 2.0 versions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3409</cvename>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-11-01</discovery>
<entry>2005-11-01</entry>
<modified>2005-11-04</modified>
</dates>
</vuln>
<vuln vid="6129fdc7-6462-456d-a3ef-8fc3fbf44d16">
<topic>openvpn -- arbitrary code execution on client through malicious or compromised server</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.0</ge><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>A format string vulnerability
in the foreign_option function in options.c could
potentially allow a malicious or compromised server
to execute arbitrary code on the client. Only
non-Windows clients are affected. The vulnerability
only exists if (a) the client's TLS negotiation with
the server succeeds, (b) the server is malicious or
has been compromised such that it is configured to
push a maliciously crafted options string to the client,
and (c) the client indicates its willingness to accept
pushed options from the server by having "pull" or
"client" in its configuration file (Credit: Vade79).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3393</cvename>
<mlist>http://www.securityfocus.com/archive/1/415293/30/0/threaded</mlist>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-10-31</discovery>
<entry>2005-11-01</entry>
<modified>2005-11-04</modified>
</dates>
</vuln>
<vuln vid="6821a2db-4ab7-11da-932d-00055d790c25">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php4</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>mod_php</name>
<name>mod_php4</name>
<range><ge>4</ge><lt>4.4.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17371/">
<p>Some vulnerabilities have been reported in PHP,
which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security
restrictions, and potentially compromise a vulnerable
system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/17371/</url>
</references>
<dates>
<discovery>2005-10-31</discovery>
<entry>2005-11-01</entry>
</dates>
</vuln>
<vuln vid="70fc13d9-4ab4-11da-932d-00055d790c25">
<topic>skype -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>skype</name>
<range><lt>1.2.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17305/">
<p>Some vulnerabilities have been reported in Skype,
which can be exploited by malicious people to cause
a DoS or to compromise a user's system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3265</cvename>
<cvename>CVE-2005-3267</cvename>
<certvu>930345</certvu>
<certvu>668193</certvu>
<url>http://secunia.com/advisories/17305/</url>
<url>http://skype.com/security/skype-sb-2005-02.html</url>
<url>http://skype.com/security/skype-sb-2005-03.html</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2005-11-01</entry>
<modified>2005-11-02</modified>
</dates>
</vuln>
<vuln vid="1c3142a3-4ab2-11da-932d-00055d790c25">
<topic>squid -- FTP server response handling denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17271/">
<p>M.A.Young has reported a vulnerability in Squid,
which can be exploited by malicious people to cause
a DoS (Denial of Service).</p>
<p>The vulnerability is caused due to an error in
handling certain FTP server responses. This can be
exploited to crash Squid by visiting a malicious FTP
server via the proxy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3258</cvename>
<url>http://secunia.com/advisories/17271/</url>
</references>
<dates>
<discovery>2005-10-19</discovery>
<entry>2005-11-01</entry>
</dates>
</vuln>
<vuln vid="f38c87a5-4a3e-11da-8ba2-0004614cc33d">
<topic>base -- PHP SQL injection vulnerability</topic>
<affects>
<package>
<name>base</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/17314/">
<p>Remco Verhoef has discovered a vulnerability in
Basic Analysis and Security Engine (BASE), which
can be exploited by malicious users to conduct SQL
injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>15199</bid>
<url>http://secunia.com/advisories/17314/</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2005-10-31</entry>
</dates>
</vuln>
<vuln vid="baf74e0b-497a-11da-a4f4-0060084a00e5">
<topic>fetchmail -- fetchmailconf local password exposure</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.2.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The fetchmail team reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-02.txt">
<p>The fetchmailconf program before and excluding version
1.49 opened the run control file, wrote the configuration
to it, and only then changed the mode to 0600 (rw-------).
Writing the file, which usually contains passwords, before
making it unreadable to other users, can expose sensitive
password information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3088</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2005-02.txt</url>
</references>
<dates>
<discovery>2005-10-21</discovery>
<entry>2005-10-30</entry>
</dates>
</vuln>
<vuln vid="c01170bf-4990-11da-a1b8-000854d03344">
<topic>lynx -- remote buffer overflow</topic>
<affects>
<package>
<name>lynx</name>
<name>ja-lynx</name>
<range><lt>2.8.5_1</lt></range>
<range><gt>2.8.6*</gt><lt>2.8.6d14</lt></range>
</package>
<package>
<name>lynx-ssl</name>
<range><lt>2.8.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reports:</p>
<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html">
<p>When Lynx connects to an NNTP server to fetch information
about the available articles in a newsgroup, it will
call a function called HTrjis() with the information
from certain article headers. The function adds missing
ESC characters to certain data, to support Asian character
sets. However, it does not check if it writes outside
of the char array buf, and that causes a remote stack-based
buffer overflow.</p>
</blockquote>
</body>
</description> <references>
<cvename>CVE-2005-3120</cvename>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html</url>
</references> <dates>
<discovery>2005-10-17</discovery>
<entry>2005-10-30</entry>
<modified>2006-10-05</modified>
</dates>
</vuln>
<vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d">
<topic>ruby -- vulnerability in the safe level settings</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range>
<range><gt>1.8.*</gt><lt>1.8.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby home page reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/20051003.html">
<p>The Object Oriented Scripting Language Ruby supports
safely executing an untrusted code with two mechanisms:
safe level and taint flag on objects.</p>
<p>A vulnerability has been found that allows bypassing
these mechanisms.</p>
<p>By using the vulnerability, arbitrary code can be executed
beyond the restrictions specified in each safe level.
Therefore, Ruby has to be updated on all systems that use
safe level to execute untrusted code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2337</cvename>
<url>http://www.ruby-lang.org/en/20051003.html</url>
</references>
<dates>
<discovery>2005-10-02</discovery>
<entry>2005-10-27</entry>
</dates>
</vuln>
<vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344">
<topic>xloadimage -- buffer overflows in NIFF image title handling</topic>
<affects>
<package>
<name>xloadimage</name>
<range><lt>4.1.15</lt></range>
</package>
<package>
<name>xli</name>
<range><lt>1.17.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ariel Berkman reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2">
<p>Unlike most of the supported image formats in xloadimage,
the NIFF image format can store a title name of arbitrary
length as part of the image file.</p>
<p>When xloadimage is processing a loaded image, it is
creating a new Image object and then writing the processed
image to it. At that point, it will also copy the title
from the old image to the newly created image.</p>
<p>The 'zoom', 'reduce', and 'rotate' functions are using
a fixed length buffer to construct the new title name
when an image processing is done. Since the title name
in a NIFF format is of varying length, and there are
insufficient buffer size validations, the buffer can
be overflowed.</p>
</blockquote>
</body>
</description>
<references>
<bid>15051</bid>
<cvename>CVE-2005-3178</cvename>
<mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2</mlist>
</references>
<dates>
<discovery>2005-10-05</discovery>
<entry>2005-10-20</entry>
<modified>2005-10-23</modified>
</dates>
</vuln>
<vuln vid="97d45e95-3ffc-11da-a263-0001020eed82">
<topic>snort -- Back Orifice preprocessor buffer overflow vulnerability</topic>
<affects>
<package>
<name>snort</name>
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jennifer Steffens reports:</p>
<blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
<p>The Back Orifice preprocessor contains a stack-based
buffer overflow. This vulnerability could be leveraged by
an attacker to execute code remotely on a Snort sensor
where the Back Orifice preprocessor is enabled. However,
there are a number of factors that make remote code
execution difficult to achieve across different builds of
Snort on different platforms, even on the same platform
with different compiler versions, and it is more likely
that an attacker could use the vulnerability as a denial
of service attack.</p>
<p>The Back Orifice preprocessor can be disabled by
commenting out the line "preprocessor bo" in
snort.conf. This can be done in any text editor using the
following procedure:</p>
<ol>
<li>Locate the line "preprocessor bo"</li>
<li>Comment out this line by preceding it with a hash
(#). The new line will look like "#preprocessor bo"</li>
<li>Save the file</li>
<li>Restart snort</li>
</ol>
</blockquote>
</body>
</description>
<references>
<certvu>175500</certvu>
<url>http://www.snort.org/pub-bin/snortnews.cgi#99</url>
<url>http://xforce.iss.net/xforce/alerts/id/207</url>
</references>
<dates>
<discovery>2005-10-18</discovery>
<entry>2005-10-18</entry>
</dates>
</vuln>
<vuln vid="60f8fe7b-3cfb-11da-baa2-0004614cc33d">
<topic>WebCalendar -- remote file inclusion vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WebCalendar is proven vulnerable to a remote file inclusion
vulnerability. The send_reminders.php does not properly
verify the "includedir" parameter, giving remote attackers
the possibility to include local and remote files. These
files can be used by the attacker to gain access to the
system.</p>
</body>
</description>
<references>
<bid>14651</bid>
<cvename>CVE-2005-2717</cvename>
<url>http://sourceforge.net/forum/forum.php?thread_id=1342085&forum_id=11587</url>
</references>
<dates>
<discovery>2005-08-26</discovery>
<entry>2005-10-15</entry>
<modified>2005-11-08</modified>
</dates>
</vuln>
<vuln vid="47bdabcf-3cf9-11da-baa2-0004614cc33d">
<topic>gallery2 -- file disclosure vulnerability</topic>
<affects>
<package>
<name>gallery2</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Dipper wrote:</p>
<blockquote cite="http://dipper.info/security/20051012/">
<p>A vulnerability has been discovered in gallery,
which allows remote users unauthorized access to files
on the webserver.</p>
<p>A remote user accessing gallery over the web may use
specially crafted HTTP parameters to access arbitrary
files located on the webserver. All files readable by
the webserver process are subject to disclosure.
The vulnerability is *not* restricted to the webserver's
document root but extends to the whole server file space.</p>
<p>The vulnerability may be used by any anonymous user,
there is no login to the application required.</p>
</blockquote>
</body>
</description>
<references>
<bid>15108</bid>
<cvename>CVE-2005-3251</cvename>
<url>http://dipper.info/security/20051012/</url>
</references>
<dates>
<discovery>2005-10-12</discovery>
<entry>2005-10-15</entry>
<modified>2005-11-08</modified>
</dates>
</vuln>
<vuln vid="60e26a40-3b25-11da-9484-00123ffe8333">
<topic>openssl -- potential SSL 2.0 rollback</topic>
<affects>
<package>
<name>openssl</name>
<name>openssl-overwrite-base</name>
<range><le>0.9.7g</le></range>
<range><ge>0.9.8</ge><le>0.9.8_1</le></range>
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
</package>
<package>
<name>openssl-beta</name>
<name>openssl-beta-overwrite-base</name>
<range><le>0.9.8_1</le></range>
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
</package>
<package>
<name>compat5x-alpha</name>
<name>compat5x-amd64</name>
<name>compat5x-i386</name>
<name>compat5x-sparc64</name>
<range><lt>5.4.0.8</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><lt>4.10_19</lt></range>
<range><ge>4.11</ge><lt>4.11_13</lt></range>
<range><ge>5.3</ge><lt>5.3_23</lt></range>
<range><ge>5.4</ge><lt>5.4_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vulnerability:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">
<p>Such applications are affected if they use the option
SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
SSL_OP_ALL, which is intended to work around various bugs in
third-party software that might prevent interoperability. The
SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
the SSL 2.0 server supposed to prevent active protocol-version
rollback attacks. With this verification step disabled, an attacker
acting as a "man in the middle" can force a client and a server to
negotiate the SSL 2.0 protocol even if these parties both support
SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
cryptographic weaknesses and is supported as a fallback only.</p>
<p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
SSL_OP_ALL are not affected. Also, applications that disable
use of SSL 2.0 are not affected.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-05:21.openssl</freebsdsa>
<cvename>CVE-2005-2969</cvename>
<url>http://www.openssl.org/news/secadv_20051011.txt</url>
</references>
<dates>
<discovery>2005-10-11</discovery>
<entry>2005-10-12</entry>
<modified>2005-10-25</modified>
</dates>
</vuln>
<vuln vid="9b7053fd-3ab5-11da-9484-00123ffe8333">
<topic>phpmyadmin -- local file inclusion vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>2.6.4.r1</ge><le>2.6.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
<p>In libraries/grab_globals.lib.php, the $__redirect
parameter was not correctly validated, opening the door to
a local file inclusion attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<bid>15053</bid>
<mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112907764728209</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4</url>
</references>
<dates>
<discovery>2005-10-11</discovery>
<entry>2005-10-11</entry>
<modified>2005-10-13</modified>
</dates>
</vuln>
<vuln vid="d2b80c7c-3aae-11da-9484-00123ffe8333">
<topic>zope -- expose RestructuredText functionality to untrusted users</topic>
<affects>
<package>
<name>zope</name>
<range><ge>2.6.0</ge><lt>2.7.8</lt></range>
<range><ge>2.8.0</ge><le>2.8.1_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Zope Hotfix Alert reports:</p>
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
<p>This hotfix resolves a security issue with docutils.</p>
<p>Affected are possibly all Zope instances that expose
RestructuredText functionalies to untrusted users through
the web.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3323</cvename>
<bid>15082</bid>
<url>http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert</url>
</references>
<dates>
<discovery>2005-10-09</discovery>
<entry>2005-10-11</entry>
<modified>2005-11-28</modified>
</dates>
</vuln>
<vuln vid="3bc5691e-38dd-11da-92f5-020039488e34">
<topic>libxine -- format string vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
<p>Ulf Harnhammar discovered a format string bug in the routines
handling CDDB server response contents.</p>
<p>An attacker could submit malicious information about an audio
CD to a public CDDB server (or impersonate a public CDDB server).
When the victim plays this CD on a multimedia frontend relying
on xine-lib, it could end up executing arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2967</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml</url>
<url>http://xinehq.de/index.php/security/XSA-2005-1</url>
</references>
<dates>
<discovery>2005-10-08</discovery>
<entry>2005-10-09</entry>
</dates>
</vuln>
<vuln vid="1f6e2ade-35c2-11da-811d-0050bf27ba24">
<topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>
<affects>
<package>
<name>imap-uw</name>
<range><lt>2004g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">
<p>A vulnerability has been identified in UW-IMAP, which could
be exploited by remote attackers to execute arbitrary commands.
This flaw is due to a stack overflow error in the
"mail_valid_net_parse_work()" [src/c-client/mail.c] function that
does not properly handle specially crafted mailbox names containing
a quote (") character, which could be exploited by authenticated
remote attackers to execute arbitrary commands with the privileges
of the IMAP server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2933</cvename>
<url>http://www.frsirt.com/english/advisories/2005/1953</url>
<url>http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities</url>
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
</references>
<dates>
<discovery>2005-10-05</discovery>
<entry>2005-10-05</entry>
</dates>
</vuln>
<vuln vid="d4c70df5-335d-11da-9c70-0040f42d58c6">
<topic>weex -- remote format string vulnerability</topic>
<affects>
<package>
<name>weex</name>
<range><lt>2.6.1.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Emanuel Haupt reports:</p>
<blockquote>
<p>Someone who controls an FTP server that weex will log in to
can set up malicious data in the account that weex will use,
and that will cause a format string bug that will allow remote
code execution. It will only happen when weex is first run or
when its cache files are rebuilt with the -r option,
though. The vulnerability was found by Ulf Harnhammar.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/86833</freebsdpr>
</references>
<dates>
<discovery>2005-10-02</discovery>
<entry>2005-10-02</entry>
</dates>
</vuln>
<vuln vid="8a3ece40-3315-11da-a263-0001020eed82">
<topic>picasm -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>picasm</name>
<range><lt>1.12c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shaun Colley reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089">
<p>When generating error and warning messages, picasm copies
strings into fixed length buffers without bounds
checking.</p>
<p>If an attacker could trick a user into assembling a
source file with a malformed 'error' directive, arbitrary
code could be executed with the privileges of the user.
This could result in full system compromise.</p>
</blockquote>
</body>
</description>
<references>
<bid>13698</bid>
<cvename>CVE-2005-1679</cvename>
<mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089</mlist>
</references>
<dates>
<discovery>2005-05-20</discovery>
<entry>2005-10-02</entry>
</dates>
</vuln>
<vuln vid="1e606080-3293-11da-ac91-020039488e34">
<topic>uim -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>ja-uim</name>
<range><lt>0.4.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The uim developers reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
<p>Masanari Yamamoto discovered that incorrect use
of environment variables in uim. This bug causes
privilege escalation if setuid/setgid applications
was linked to libuim.</p>
<p>This bug appears in 'immodule for Qt' enabled Qt.
(Normal Qt is also safe.) In some distribution,
mlterm is also an setuid/setgid application.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.freedesktop.org/archives/uim/2005-September/001346.html</url>
</references>
<dates>
<discovery>2005-09-28</discovery>
<entry>2005-10-01</entry>
</dates>
</vuln>
<vuln vid="8688d5cd-328c-11da-a263-0001020eed82">
<topic>cfengine -- arbitrary file overwriting vulnerability</topic>
<affects>
<package>
<name>cfengine</name>
<range><lt>2.1.6_1</lt></range>
</package>
<package>
<name>cfengine2</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Security Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-835">
<p>Javier Fernández-Sanguino Peña discovered several
insecure temporary file uses in cfengine, a tool for
configuring and maintaining networked machines, that can
be exploited by a symlink attack to overwrite arbitrary
files owned by the user executing cfengine, which is
probably root.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2960</cvename>
<bid>14994</bid>
<url>http://www.debian.org/security/2005/dsa-835</url>
<url>http://www.debian.org/security/2005/dsa-836</url>
</references>
<dates>
<discovery>2005-10-01</discovery>
<entry>2005-10-01</entry>
<modified>2005-10-07</modified>
</dates>
</vuln>
<vuln vid="271498a9-2cd4-11da-a263-0001020eed82">
<topic>clamav -- arbitrary code execution and DoS vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.87</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20050917</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
<p>Clam AntiVirus is vulnerable to a buffer overflow in
"libclamav/upx.c" when processing malformed UPX-packed
executables. It can also be sent into an infinite loop in
"libclamav/fsg.c" when processing specially-crafted
FSG-packed executables.</p>
<p>By sending a specially-crafted file an attacker could
execute arbitrary code with the permissions of the user
running Clam AntiVirus, or cause a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<certvu>363713</certvu>
<cvename>CVE-2005-2919</cvename>
<cvename>CVE-2005-2920</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml</url>
</references>
<dates>
<discovery>2005-09-16</discovery>
<entry>2005-09-24</entry>
<modified>2005-10-22</modified>
</dates>
</vuln>
<vuln vid="8f5dd74b-2c61-11da-a263-0001020eed82">
<topic>firefox & mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.12,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.12</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
<h1>Heap overrun in XBM image processing</h1>
<p>jackerror reports that an improperly terminated XBM image
ending with space characters instead of the expected end
tag can lead to a heap buffer overrun. This appears to be
exploitable to install or run malicious code on the user's
machine.</p>
<p>Thunderbird does not support the XBM format and is not
affected by this flaw.</p>
<h1>Crash on "zero-width non-joiner" sequence</h1>
<p>Mats Palmgren discovered that a reported crash on Unicode
sequences with "zero-width non-joiner" characters was due
to stack corruption that may be exploitable.</p>
<h1>XMLHttpRequest header spoofing</h1>
<p>It was possible to add illegal and malformed headers to
an XMLHttpRequest. This could have been used to exploit
server or proxy flaws from the user's machine, or to fool
a server or proxy into thinking a single request was a
stream of separate requests. The severity of this
vulnerability depends on the value of servers which might
be vulnerable to HTTP request smuggling and similar
attacks, or which share an IP address (virtual hosting)
with the attacker's page.</p>
<p>For users connecting to the web through a proxy this flaw
could be used to bypass the same-origin restriction on
XMLHttpRequests by fooling the proxy into handling a
single request as multiple pipe-lined requests directed at
arbitrary hosts. This could be used, for example, to read
files on intranet servers behind a firewall.</p>
<h1>Object spoofing using XBL <implements></h1>
<p>moz_bug_r_a4 demonstrated a DOM object spoofing bug
similar to <a href="http://www.mozilla.org/security/announce/mfsa2005-55.html">MFSA
2005-55</a> using an XBL control that <implements>
an internal interface. The severity depends on the version
of Firefox: investigation so far indicates Firefox 1.0.x
releases don't expose any vulnerable functionality to
interfaces spoofed in this way, but that early Deer Park
Alpha 1 versions did.</p>
<p>XBL was changed to no longer allow unprivileged controls
from web content to implement XPCOM interfaces.</p>
<h1>JavaScript integer overflow</h1>
<p>Georgi Guninski reported an integer overflow in the
JavaScript engine. We presume this could be exploited to
run arbitrary code under favorable conditions.</p>
<h1>Privilege escalation using about: scheme</h1>
<p>heatsync and shutdown report two different ways to bypass
the restriction on loading high privileged "chrome" pages
from an unprivileged "about:" page. By itself this is
harmless--once the "about" page's privilege is raised the
original page no longer has access--but should this be
combined with a same-origin violation this could lead to
arbitrary code execution.</p>
<h1>Chrome window spoofing</h1>
<p>moz_bug_r_a4 demonstrates a way to get a blank "chrome"
canvas by opening a window from a reference to a closed
window. The resulting window is not privileged, but the
normal browser UI is missing and can be used to construct
a spoof page without any of the safety features of the
browser chrome designed to alert users to phishing sites,
such as the address bar and the status bar.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2701</cvename>
<cvename>CVE-2005-2702</cvename>
<cvename>CVE-2005-2703</cvename>
<cvename>CVE-2005-2704</cvename>
<cvename>CVE-2005-2705</cvename>
<cvename>CVE-2005-2706</cvename>
<cvename>CVE-2005-2707</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-58.html</url>
</references>
<dates>
<discovery>2005-09-22</discovery>
<entry>2005-09-23</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="2e28cefb-2aee-11da-a263-0001020eed82">
<topic>firefox & mozilla -- command line URL shell command injection</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.12,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.12</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/16869/">
<p>Peter Zelezny has discovered a vulnerability in Firefox,
which can be exploited by malicious people to compromise a
user's system.</p>
<p>The vulnerability is caused due to the shell script used
to launch Firefox parsing shell commands that are enclosed
within backticks in the URL provided via the command
line. This can e.g. be exploited to execute arbitrary
shell commands by tricking a user into following a
malicious link in an external application which uses
Firefox as the default browser.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2968</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307185</url>
<url>http://secunia.com/advisories/16869/</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-59.html</url>
</references>
<dates>
<discovery>2005-09-06</discovery>
<entry>2005-09-22</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="e936d612-253f-11da-bc01-000e0c2e438a">
<topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Stern reports an off-by-one vulnerability in within
mod_ssl. The vulnerability lies in mod_ssl's Certificate
Revocation List (CRL). If Apache is configured to use a
CRL this could allow an attacker to crash a child process
causing a Denial of Service.</p>
</body>
</description>
<references>
<bid>14366</bid>
<cvename>CVE-2005-1268</cvename>
</references>
<dates>
<discovery>2005-07-12</discovery>
<entry>2005-09-17</entry>
</dates>
</vuln>
<vuln vid="7d52081f-2795-11da-bc01-000e0c2e438a">
<topic>squirrelmail -- _$POST variable handling allows for various attacks</topic>
<affects>
<package>
<name>squirrelmail</name>
<name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Squirrelmail Advisory reports:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">
<p>An extract($_POST) was done in options_identities.php which
allowed for an attacker to set random variables in that
file. This could lead to the reading (and possible
writing) of other people's preferences, cross site scripting
or writing files in webserver-writable locations.</p>
</blockquote>
</body>
</description>
<references>
<bid>14254</bid>
<cvename>CVE-2005-2095</cvename>
<url>http://www.squirrelmail.org/security/issue/2005-07-13</url>
</references>
<dates>
<discovery>2005-07-13</discovery>
<entry>2005-09-17</entry>
<modified>2005-09-19</modified>
</dates>
</vuln>
<vuln vid="a863aa74-24be-11da-8882-000e0c33c2dc">
<topic>X11 server -- pixmap allocation vulnerability</topic>
<affects>
<package>
<name>XFree86-Server</name>
<range><lt>4.5.0_2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>6.8.2_5</lt></range>
<range><gt>6.8.99</gt><lt>6.8.99.12_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Allocating large pixmaps by a client can trigger an integer
overflow in the X server, potentially leading to execution of
arbitrary code with elevated (root) privileges.</p>
</body>
</description>
<references>
<bid>14807</bid>
<certvu>102441</certvu>
<cvename>CVE-2005-2495</cvename>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856</url>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=594</url>
</references>
<dates>
<discovery>2005-09-12</discovery>
<entry>2005-09-15</entry>
</dates>
</vuln>
<vuln vid="9750cf22-216d-11da-bc01-000e0c2e438a">
<topic>unzip -- permission race vulnerability</topic>
<affects>
<package>
<name>unzip</name>
<name>zh-unzip</name>
<name>ko-unzip</name>
<range><lt>5.52_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Imran Ghory reports a vulnerability within unzip. The
vulnerability is caused by a race condition between
extracting an archive and changing the permissions of the
extracted files. This would give an attacker enough time to
remove a file and hardlink it to another file owned by the
user running unzip. When unzip changes the permissions of
the file it could give the attacker access to files that
normally would not have been accessible for others.</p>
</body>
</description>
<references>
<bid>14450</bid>
<cvename>CVE-2005-2475</cvename>
<mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117</mlist>
</references>
<dates>
<discovery>2005-08-02</discovery>
<entry>2005-09-13</entry>
</dates>
</vuln>
<vuln vid="8665ebb9-2237-11da-978e-0001020eed82">
<topic>firefox & mozilla -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.6_5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.11_1,2</lt></range>
<range><ge>1.8.*,2</ge><lt>1.8.b1_5,2</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.12</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tom Ferris reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387">
<p>A buffer overflow vulnerability exists within Firefox
version 1.0.6 and all other prior versions which allows
for an attacker to remotely execute arbitrary code on an
affected host.</p>
<p>The problem seems to be when a hostname which has all
dashes causes the NormalizeIDN call in
nsStandardURL::BuildNormalizedSpec to return true, but is
sets encHost to an empty string. Meaning, Firefox appends
0 to approxLen and then appends the long string of dashes
to the buffer instead.</p>
</blockquote>
<p><strong>Note:</strong> It is possible to disable IDN
support as a workaround to protect against this buffer
overflow. How to do this is described on the <em><a href="http://www.mozilla.org/security/idn.html">What Firefox
and Mozilla users should know about the IDN buffer overflow
security issue</a></em> web page.</p>
</body>
</description>
<references>
<bid>14784</bid>
<certvu>573857</certvu>
<cvename>CVE-2005-2871</cvename>
<url>http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387</url>
<url>http://www.mozilla.org/security/idn.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307259</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-57.html</url>
</references>
<dates>
<discovery>2005-09-08</discovery>
<entry>2005-09-10</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="673aec6f-1cae-11da-bc01-000e0c2e438a">
<topic>htdig -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>htdig</name>
<range><lt>3.2.0.b6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Krax reports a vulnerability within htdig. The
vulnerability lies within an unsanitized config parameter,
allowing a malicious attacker to execute arbitrary scripting
code on the target's browser. This might allow the attacker
to obtain the user's cookies which are associated with the
site, including cookies used for authentication.</p>
</body>
</description>
<references>
<bid>12442</bid>
<cvename>CVE-2005-0085</cvename>
<url>http://www.securitytracker.com/alerts/2005/Feb/1013078.html</url>
</references>
<dates>
<discovery>2005-02-03</discovery>
<entry>2005-09-04</entry>
<modified>2005-09-13</modified>
</dates>
</vuln>
<vuln vid="4e210d72-1c5c-11da-92ce-0048543d60ce">
<topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
<p>After certain slightly odd requests Squid crashes with a
segmentation fault in sslConnectTimeout.</p>
</blockquote>
</body>
</description>
<references>
<bid>14731</bid>
<cvename>CVE-2005-2796</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1355</url>
<url>http://secunia.com/advisories/16674/</url>
</references>
<dates>
<discovery>2005-07-21</discovery>
<entry>2005-09-04</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
<vuln vid="0c0dc409-1c5e-11da-92ce-0048543d60ce">
<topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
<p>Squid crashes with the above assertion failure [assertion failed:
store.c:523: "e->store_status == STORE_PENDING"] in certain
conditions involving aborted requests.</p>
</blockquote>
</body>
</description>
<references>
<bid>14761</bid>
<cvename>CVE-2005-2794</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1368</url>
<url>http://secunia.com/advisories/16708/</url>
</references>
<dates>
<discovery>2005-08-02</discovery>
<entry>2005-09-04</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
<vuln vid="30e4ed7b-1ca6-11da-bc01-000e0c2e438a">
<topic>bind9 -- denial of service</topic>
<affects>
<package>
<name>bind9</name>
<range><eq>9.3.0</eq></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.3</ge><lt>5.3_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>A DNSSEC-related validator function in BIND 9.3.0 contains an
inappropriate internal consistency test. When this test is
triggered, named(8) will exit.</p>
<p>Impact</p>
<p>On systems with DNSSEC enabled, a remote attacker may be able
to inject a specially crafted packet that will cause the
internal consistency test to trigger, and named(8) to
terminate. As a result, the name server will no longer be
available to service requests.</p>
<p>Workaround</p>
<p>DNSSEC is not enabled by default, and the "dnssec-enable"
directive is not normally present. If DNSSEC has been
enabled, disable it by changing the "dnssec-enable" directive
to "dnssec-enable no;" in the named.conf(5) configuration
file.</p>
</body>
</description>
<references>
<certvu>938617</certvu>
<cvename>CVE-2005-0034</cvename>
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en</url>
<url>http://www.isc.org/sw/bind/bind9.3.php#security</url>
</references>
<dates>
<discovery>2005-01-25</discovery>
<entry>2005-09-03</entry>
</dates>
</vuln>
<vuln vid="947f4b14-1c89-11da-bc01-000e0c2e438a">
<topic>bind -- buffer overrun vulnerability</topic>
<affects>
<package>
<name>bind84</name>
<range><ge>8.4.4</ge><lt>8.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An ISC advisory reports a buffer overrun vulnerability within
bind. The vulnerability could result in a Denial of Service.
A workaround is available by disabling recursion and glue
fetching.</p>
</body>
</description>
<references>
<certvu>327633</certvu>
<cvename>CVE-2005-0033</cvename>
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en</url>
<url>http://www.isc.org/sw/bind/bind-security.php</url>
</references>
<dates>
<discovery>2005-01-25</discovery>
<entry>2005-09-03</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
<vuln vid="08df5d46-1baf-11da-8038-0040f42d58c6">
<topic>urban -- stack overflow vulnerabilities</topic>
<affects>
<package>
<name>urban</name>
<range><lt>1.5.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several filename-related stack overflow bugs allow a local
attacker to elevate its privileges to the games group, since
urban is installed setgid games.</p>
<p>Issue discovered and fixed by <shaun@rsc.cx>.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2864</cvename>
<mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&m=112604855119036</mlist>
</references>
<dates>
<discovery>2005-09-02</discovery>
<entry>2005-09-02</entry>
<modified>2005-09-22</modified>
</dates>
</vuln>
<vuln vid="6e27f3b6-189b-11da-b6be-0090274e8dbb">
<topic>fswiki -- command injection vulnerability</topic>
<affects>
<package>
<name>fswiki</name>
<range><lt>3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a command injection vulnerability in admin page
of fswiki.</p>
</body>
</description>
<references>
<url>http://jvn.jp/jp/JVN%2342435855/index.html</url>
</references>
<dates>
<discovery>2005-08-29</discovery>
<entry>2005-08-29</entry>
</dates>
</vuln>
<vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
<topic>evolution -- remote format string vulnerabilities</topic>
<affects>
<package>
<name>evolution</name>
<range><gt>1.5</gt><lt>2.2.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A SITIC Vulnerability Advisory reports:</p>
<blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
<p>Evolution suffers from several format string bugs when
handling data from remote sources. These bugs lead to
crashes or the execution of arbitrary assembly language
code.</p>
<ol>
<li>The first format string bug occurs when viewing the
full vCard data attached to an e-mail message.</li>
<li>The second format string bug occurs when displaying
contact data from remote LDAP servers.</li>
<li>The third format string bug occurs when displaying
task list data from remote servers.</li>
<li>The fourth, and least serious, format string bug
occurs when the user goes to the Calendars tab to save
task list data that is vulnerable to problem 3
above. Other calendar entries that do not come from task
lists are also affected.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>14532</bid>
<cvename>CVE-2005-2549</cvename>
<cvename>CVE-2005-2550</cvename>
<url>http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html</url>
</references>
<dates>
<discovery>2005-08-10</discovery>
<entry>2005-08-27</entry>
<modified>2006-03-24</modified>
</dates>
</vuln>
<vuln vid="38c76fcf-1744-11da-978e-0001020eed82">
<topic>pam_ldap -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>pam_ldap</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Howard reports:</p>
<blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
<p>If a pam_ldap client authenticates against an LDAP server
that returns a passwordPolicyResponse control, but omits
the optional "error" field of the
PasswordPolicyResponseValue, then the LDAP authentication
result will be ignored and the authentication step will
always succeed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2641</cvename>
<certvu>778916</certvu>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163</url>
</references>
<dates>
<discovery>2005-08-22</discovery>
<entry>2005-08-27</entry>
</dates>
</vuln>
<vuln vid="b971d2a6-1670-11da-978e-0001020eed82">
<topic>pcre -- regular expression buffer overflow</topic>
<affects>
<package>
<name>pcre</name>
<name>pcre-utf8</name>
<range><lt>6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pcre library is vulnerable to a buffer overflow
vulnerability due to insufficient validation of quantifier
values. This could lead execution of arbitrary code with
the permissions of the program using pcre by way of a
specially crated regular expression.</p>
</body>
</description>
<references>
<bid>14620</bid>
<cvename>CVE-2005-2491</cvename>
<url>http://www.pcre.org/changelog.txt</url>
</references>
<dates>
<discovery>2005-08-01</discovery>
<entry>2005-08-26</entry>
</dates>
</vuln>
<vuln vid="f66e011d-13ff-11da-af41-0004614cc33d">
<topic>elm -- remote buffer overflow in Expires header</topic>
<affects>
<package>
<name>elm</name>
<range><lt>2.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Harnhammar has discovered a remotely exploitable buffer
overflow in Elm e-mail client when parsing the Expires header
of an e-mail message:</p>
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
<p>The attacker only needs to send the victim an e-mail
message. When the victim with that message in his or her
inbox starts Elm or simply views the inbox in an already
started copy of Elm, the buffer overflow will happen
immediately. The overflow is stack-based, and it gives full
control over EIP, EBP and EBX. It is caused by a bad
sscanf(3) call, using a format string containing "%s"
to copy from a long char array to a shorter array.</p>
</blockquote>
</body>
</description>
<references>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html</url>
</references>
<dates>
<discovery>2005-08-20</discovery>
<entry>2005-08-23</entry>
</dates>
</vuln>
<vuln vid="5ad3e437-e527-4514-b9ed-280b2ca1a8c9">
<topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>If two or more client machines try to connect to the server
at the same time via TCP, using the same client certificate,
and when --duplicate-cn is not enabled on the server, a race
condition can crash the server with "Assertion failed at
mtcp.c:411"</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2534</cvename>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-08-03</discovery>
<entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="1986449a-8b74-40fa-b7cc-0d8def8aad65">
<topic>openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>A malicious [authenticated] client in "dev tap"
ethernet bridging mode could theoretically flood the server
with packets appearing to come from hundreds of thousands
of different MAC addresses, causing the OpenVPN process to
deplete system virtual memory as it expands its internal
routing table.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2533</cvename>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-07-27</discovery>
<entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="d1c39c8e-05ab-4739-870f-765490fa2052">
<topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>If the client sends a packet which fails to decrypt on the
server, the OpenSSL error queue is not properly flushed,
which can result in another unrelated client instance on the
server seeing the error and responding to it, resulting in
disconnection of the unrelated client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2532</cvename>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-07-27</discovery>
<entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="a51ad838-2077-48b2-a136-e888a7db5f8d">
<topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Yonan reports:</p>
<blockquote cite="http://openvpn.net/changelog.html">
<p>DoS attack against server when run with "verb 0" and
without "tls-auth". If a client connection to the server
fails certificate verification, the OpenSSL error queue is
not properly flushed, which can result in another unrelated
client instance on the server seeing the error and
responding to it, resulting in disconnection of the
unrelated client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2531</cvename>
<url>http://openvpn.net/changelog.html</url>
</references>
<dates>
<discovery>2005-08-03</discovery>
<entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="5fde5c30-0f4e-11da-bc01-000e0c2e438a">
<topic>tor -- diffie-hellman handshake flaw</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.1.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A tor advisory reports</p>
<blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
<p>Tor clients can completely loose anonymity, confidentiality,
and data integrity if the first Tor server in their path is
malicious. Specifically, if the Tor client chooses a
malicious Tor server for her first hop in the circuit, that
server can learn all the keys she negotiates for the rest of
the circuit (or just spoof the whole circuit), and then read
and/or modify all her traffic over that circuit.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2643</cvename>
<url>http://archives.seul.org/or/announce/Aug-2005/msg00002.html</url>
</references>
<dates>
<discovery>2005-08-11</discovery>
<entry>2005-08-17</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
<vuln vid="f74dc01b-0e83-11da-bc08-0001020eed82">
<topic>acroread -- plug-in buffer overflow vulnerability</topic>
<affects>
<package>
<name>acroread</name>
<range><lt>7.0.1</lt></range>
<range><gt>5.*,1</gt><lt>7.0.1,1</lt></range>
</package>
<package>
<name>acroread4</name>
<name>acroread5</name>
<range><ge>0</ge></range>
</package>
<package>
<name>acroread7</name>
<range><lt>7.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Adobe Security Advisory reports:</p>
<blockquote cite="http://www.adobe.com/support/techdocs/321644.html">
<p>The identified vulnerability is a buffer overflow within
a core application plug-in, which is part of Adobe Acrobat
and Adobe Reader. If a malicious file were opened it could
trigger a buffer overflow as the file is being loaded into
Adobe Acrobat and Adobe Reader. A buffer overflow can
cause the application to crash and increase the risk of
malicious code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2470</cvename>
<url>http://www.adobe.com/support/techdocs/321644.html</url>
</references>
<dates>
<discovery>2005-08-16</discovery>
<entry>2005-08-16</entry>
</dates>
</vuln>
<vuln vid="e65ad1bf-0d8b-11da-90d0-00304823c0d3">
<topic>pear-XML_RPC -- remote PHP code injection vulnerability</topic>
<affects>
<package>
<name>pear-XML_RPC</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>phpmyfaq</name>
<range><lt>1.4.11</lt></range>
</package>
<package>
<name>drupal</name>
<range><lt>4.6.3</lt></range>
</package>
<package>
<name>eGroupWare</name>
<range><lt>1.0.0.009</lt></range>
</package>
<package>
<name>phpAdsNew</name>
<range><lt>2.0.5</lt></range>
</package>
<package>
<name>phpgroupware</name>
<range><lt>0.9.16.007</lt></range>
</package>
<package>
<name>b2evolution</name>
<range><lt>0.9.0.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Hardened-PHP Project Security Advisory reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">
<p>When the library parses XMLRPC requests/responses, it constructs
a string of PHP code, that is later evaluated. This means any
failure to properly handle the construction of this string can
result in arbitrary execution of PHP code.</p>
<p>This new injection vulnerability is cause by not properly
handling the situation, when certain XML tags are nested
in the parsed document, that were never meant to be nested
at all. This can be easily exploited in a way, that
user-input is placed outside of string delimiters within
the evaluation string, which obviously results in
arbitrary code execution.</p>
</blockquote>
<p>Note that several applications contains an embedded version
on XML_RPC, therefor making them the vulnerable to the same
code injection vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2498</cvename>
<url>http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1</url>
<url>http://downloads.phpgroupware.org/changelog</url>
<url>http://drupal.org/files/sa-2005-004/advisory.txt</url>
<url>http://phpadsnew.com/two/nucleus/index.php?itemid=45</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=349626</url>
<url>http://www.hardened-php.net/advisory_142005.66.html</url>
<url>http://www.hardened-php.net/advisory_152005.67.html</url>
<url>http://www.phpmyfaq.de/advisory_2005-08-15.php</url>
</references>
<dates>
<discovery>2005-08-15</discovery>
<entry>2005-08-15</entry>
<modified>2005-09-04</modified>
</dates>
</vuln>
<vuln vid="e86fbb5f-0d04-11da-bc08-0001020eed82">
<topic>awstats -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities">
<p>Remote exploitation of an input validation vulnerability
in AWStats allows remote attackers to execute arbitrary
commands.</p>
<p>The problem specifically exists because of insufficient
input filtering before passing user-supplied data to an
<code>eval()</code> function. As part of the statistics
reporting function, AWStats displays information about the
most common referrer values that caused users to visit the
website. The referrer data is used without proper
sanitation in an <code>eval()</code> statement, resulting
in the execution of arbitrary perl code.</p>
<p>Successful exploitation results in the execution of
arbitrary commands with permissions of the web
service. Exploitation will not occur until the stats page
has been regenerated with the tainted referrer values from
the http access log. Note that AWStats is only vulnerable
in situations where at least one URLPlugin is enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1527</cvename>
<mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=112377934108902</mlist>
<url>http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities</url>
</references>
<dates>
<discovery>2005-08-09</discovery>
<entry>2005-08-14</entry>
<modified>2005-08-23</modified>
</dates>
</vuln>
<vuln vid="3b4a6982-0b24-11da-bc08-0001020eed82">
<topic>libgadu -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.4.0_1</lt></range>
</package>
<package>
<name>kdenetwork</name>
<range><gt>3.2.2</gt><lt>3.4.2</lt></range>
</package>
<package>
<name>pl-ekg</name>
<range><lt>1.6r3,1</lt></range>
</package>
<package>
<name>centericq</name>
<range><lt>4.21.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wojtek Kaniewski reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250">
<p>Multiple vulnerabilities have been found in libgadu, a
library for handling Gadu-Gadu instant messaging
protocol. It is a part of ekg, a Gadu-Gadu client, but is
widely used in other clients. Also some of the user
contributed scripts were found to behave in an insecure
manner.</p>
<ul>
<li>integer overflow in libgadu (CVE-2005-1852) that could
be triggered by an incomming message and lead to
application crash and/or remote code execution</li>
<li>insecure file creation (CVE-2005-1850) and shell
command injection (CVE-2005-1851) in other user
contributed scripts (discovered by Marcin Owsiany and
Wojtek Kaniewski)</li>
<li>several signedness errors in libgadu that could be
triggered by an incomming network data or an application
passing invalid user input to the library</li>
<li>memory alignment errors in libgadu that could be
triggered by an incomming message and lead to bus errors
on architectures like SPARC</li>
<li>endianness errors in libgadu that could cause invalid
behaviour of applications on big-endian
architectures</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>14345</bid>
<cvename>CVE-2005-1850</cvename>
<cvename>CVE-2005-1851</cvename>
<cvename>CVE-2005-1852</cvename>
<cvename>CVE-2005-2369</cvename>
<cvename>CVE-2005-2370</cvename>
<cvename>CVE-2005-2448</cvename>
<mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250</mlist>
<url>http://gaim.sourceforge.net/security/?id=20</url>
<url>http://www.kde.org/info/security/advisory-20050721-1.txt</url>
</references>
<dates>
<discovery>2005-07-21</discovery>
<entry>2005-08-12</entry>
<modified>2005-10-23</modified>
</dates>
</vuln>
<vuln vid="09db2844-0b21-11da-bc08-0001020eed82">
<topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.4.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=21">
<p>A remote user could cause Gaim to crash on some systems
by sending the Gaim user a file whose filename contains
certain invalid characters. It is unknown what combination
of systems are affected, but it is suspected that Windows
users and systems with older versions of GTK+ are
especially susceptible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2102</cvename>
<url>http://gaim.sourceforge.net/security/?id=21</url>
</references>
<dates>
<discovery>2005-08-09</discovery>
<entry>2005-08-12</entry>
</dates>
</vuln>
<vuln vid="6d1761d2-0b23-11da-bc08-0001020eed82">
<topic>gaim -- AIM/ICQ away message buffer overflow</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.4.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=22">
<p>A remote AIM or ICQ user can cause a buffer overflow in
Gaim by setting an away message containing many AIM
substitution strings (such as %t or %n).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2103</cvename>
<url>http://gaim.sourceforge.net/security/?id=22</url>
</references>
<dates>
<discovery>2005-08-09</discovery>
<entry>2005-08-12</entry>
</dates>
</vuln>
<vuln vid="24eee285-09c7-11da-bc08-0001020eed82">
<topic>xpdf -- disk fill DoS vulnerability</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.00_7</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.4.2</lt></range>
</package>
<package>
<name>gpdf</name>
<range><lt>2.10.0_2</lt></range>
</package>
<package>
<name>cups-base</name>
<range><lt>1.1.23.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xpdf is vulnerable to a denial of service vulnerability
which can cause xpdf to create an infinitely large file,
thereby filling up the /tmp partition, when opening a
specially crafted PDF file.</p>
<p>Note that several applications contains an embedded version
of xpdf, therefor making them the vulnerable to the same
DoS. In CUPS this vulnerability would cause the pdftops
filter to crash.</p>
</body>
</description>
<references>
<bid>14529</bid>
<cvename>CVE-2005-2097</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2005-670.html</url>
<url>http://www.kde.org/info/security/advisory-20050809-1.txt</url>
</references>
<dates>
<discovery>2005-08-09</discovery>
<entry>2005-08-12</entry>
<modified>2005-09-07</modified>
</dates>
</vuln>
<vuln vid="d7cd5015-08c9-11da-bc08-0001020eed82">
<topic>gforge -- XSS and email flood vulnerabilities</topic>
<affects>
<package>
<name>gforge</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jose Antonio Coret reports that GForge contains multiple
Cross Site Scripting vulnerabilities and an e-mail flood
vulnerability:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350">
<p>The login form is also vulnerable to XSS (Cross Site
Scripting) attacks. This may be used to launch phising
attacks by sending HTML e-mails (i.e.: saying that you
need to upgrade to the latest GForge version due to a
security problem) and putting in the e-mail an HTML link
that points to an specially crafted url that inserts an
html form in the GForge login page and when the user press
the login button, he/she send the credentials to the
attackers website.</p>
<p>The 'forgot your password?' feature allows a remote user
to load a certain URL to cause the service to send a
validation e-mail to the specified user's e-mail address.
There is no limit to the number of messages sent over a
period of time, so a remote user can flood the target
user's secondary e-mail address. E-Mail Flood, E-Mail
bomber.</p>
</blockquote>
</body>
</description>
<references>
<bid>14405</bid>
<cvename>CVE-2005-2430</cvename>
<cvename>CVE-2005-2431</cvename>
<mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350</mlist>
</references>
<dates>
<discovery>2005-07-27</discovery>
<entry>2005-08-09</entry>
</dates>
</vuln>
<vuln vid="0274a9f1-0759-11da-bc08-0001020eed82">
<topic>postnuke -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postnuke</name>
<range><lt>0.760</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Postnuke Security Announcementss reports of the following
vulnerabilities:</p>
<blockquote cite="http://news.postnuke.com/Article2691.html">
<ul>
<li>missing input validation within /modules/Messages/readpmsg.php</li>
<li>possible path disclosure within /user.php</li>
<li>possible path disclosure within /modules/News/article.php</li>
<li>possible remote code injection within /includes/pnMod.php</li>
<li>possible cross-site-scripting in /index.php</li>
</ul>
</blockquote>
<blockquote cite="http://news.postnuke.com/Article2699.html">
<ul>
<li>remote code injection via xml rpc library</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1621</cvename>
<cvename>CVE-2005-1695</cvename>
<cvename>CVE-2005-1696</cvename>
<cvename>CVE-2005-1698</cvename>
<cvename>CVE-2005-1777</cvename>
<cvename>CVE-2005-1778</cvename>
<cvename>CVE-2005-1921</cvename>
<mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520</mlist>
<url>http://secunia.com/advisories/15450/</url>
<url>http://news.postnuke.com/Article2691.html</url>
<url>http://news.postnuke.com/Article2699.html</url>
</references>
<dates>
<discovery>2005-05-27</discovery>
<entry>2005-08-08</entry>
</dates>
</vuln>
<vuln vid="0bf9d7fb-05b3-11da-bc08-0001020eed82">
<topic>mambo -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.5.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15710/">
<p>Some vulnerabilities have been reported in Mambo, where
some have unknown impacts and others can be exploited by
malicious people to conduct spoofing and SQL injection
attacks.</p>
<ol>
<li>Input passed to the "user_rating" parameter when
voting isn't properly sanitised before being used in a
SQL query. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.</li>
<li>Some unspecified vulnerabilities in the "mosDBTable"
class and the "DOMIT" library have an unknown
impact.</li>
<li>An unspecified error in the "administrator/index3.php"
script can be exploited to spoof session IDs.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>13966</bid>
<cvename>CVE-2005-2002</cvename>
<url>http://secunia.com/advisories/15710/</url>
</references>
<dates>
<discovery>2005-06-15</discovery>
<entry>2005-08-05</entry>
</dates>
</vuln>
<vuln vid="2b6e47b1-0598-11da-86bc-000e0c2e438a">
<topic>ipsec -- Incorrect key usage in AES-XCBC-MAC</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_6</lt></range>
<range><ge>5.*</ge><lt>5.3_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description</h1>
<p>A programming error in the implementation of the
AES-XCBC-MAC algorithm for authentication resulted in a
constant key being used instead of the key specified by the
system administrator.</p>
<h1>Impact</h1>
<p>If the AES-XCBC-MAC algorithm is used for authentication in
the absence of any encryption, then an attacker may be able to
forge packets which appear to originate from a different
system and thereby succeed in establishing an IPsec session.
If access to sensitive information or systems is controlled
based on the identity of the source system, this may result
in information disclosure or privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2359</cvename>
<freebsdsa>SA-05:19.ipsec</freebsdsa>
</references>
<dates>
<discovery>2005-07-27</discovery>
<entry>2005-08-05</entry>
</dates>
</vuln>
<vuln vid="837b9fb2-0595-11da-86bc-000e0c2e438a">
<topic>zlib -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>linux_base-suse</name>
<range><lt>9.3_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_6</lt></range>
<range><ge>5.3</ge><lt>5.3_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description</h1>
<p>A fixed-size buffer is used in the decompression of data
streams. Due to erronous analysis performed when zlib was
written, this buffer, which was belived to be sufficiently
large to handle any possible input stream, is in fact too
small.</p>
<h1>Impact</h1>
<p>A carefully constructed compressed data stream can result in
zlib overwriting some data structures. This may cause
applications to halt, resulting in a denial of service; or
it may result in an attacker gaining elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1849</cvename>
<freebsdsa>SA-05:18.zlib</freebsdsa>
</references>
<dates>
<discovery>2005-07-27</discovery>
<entry>2005-08-05</entry>
<modified>2005-09-24</modified>
</dates>
</vuln>
<vuln vid="7257b26f-0597-11da-86bc-000e0c2e438a">
<topic>devfs -- ruleset bypass</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_5</lt></range>
<range><ge>5.*</ge><lt>5.3_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description</h1>
<p>Due to insufficient parameter checking of the node type
during device creation, any user can expose hidden device
nodes on devfs mounted file systems within their jail.
Device nodes will be created in the jail with their normal
default access permissions.</p>
<h1>Impact</h1>
<p>Jailed processes can get access to restricted resources on
the host system. For jailed processes running with superuser
privileges this implies access to all devices on the system.
This level of access can lead to information leakage and
privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2218</cvename>
<freebsdsa>SA-05:17.devfs</freebsdsa>
</references>
<dates>
<discovery>2005-07-20</discovery>
<entry>2005-08-05</entry>
</dates>
</vuln>
<vuln vid="c28f4705-043f-11da-bc08-0001020eed82">
<topic>proftpd -- format string vulnerabilities</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.0.rc2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ProFTPD release notes states:</p>
<blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
<p>sean <infamous42md at hotpop.com> found two format
string vulnerabilities, one in mod_sql's SQLShowInfo
directive, and one involving the 'ftpshut' utility. Both
can be considered low risk, as they require active
involvement on the part of the site administrator in order
to be exploited.</p>
</blockquote>
<p>These vulnerabilities could potentially lead to information
disclosure, a denial-of-server situation, or execution of
arbitrary code with the permissions of the user running
ProFTPD.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2390</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml</url>
<url>http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2</url>
</references>
<dates>
<discovery>2005-07-26</discovery>
<entry>2005-08-03</entry>
</dates>
</vuln>
<vuln vid="debbb39c-fdb3-11d9-a30d-00b0d09acbfc">
<topic>nbsmtp -- format string vulnerability</topic>
<affects>
<package>
<name>nbsmtp</name>
<range><lt>0.99_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When nbsmtp is executed in debug mode, server messages
will be printed to stdout and logged via syslog. Syslog is
used insecurely and user-supplied format characters are
directly fed to the syslog function, which results in a
format string vulnerability.</p>
<p>Under some circumstances, an SMTP server may be able to
abuse this vulnerability in order to alter the nbsmtp
process and execute malicious code.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt</url>
</references>
<dates>
<discovery>2005-07-25</discovery>
<entry>2005-08-01</entry>
</dates>
</vuln>
<vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
<topic>sylpheed -- MIME-encoded file name buffer overflow vulnerability</topic>
<affects>
<package>
<name>sylpheed</name>
<name>sylpheed-gtk2</name>
<name>sylpheed-claws</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sylpheed is vulnerable to a buffer overflow when displaying
emails with attachments that have MIME-encoded file names.
This could be used by a remote attacker to crash sylpheed
potentially allowing execution of arbitrary code with the
permissions of the user running sylpheed.</p>
</body>
</description>
<references>
<bid>12934</bid>
<cvename>CVE-2005-0926</cvename>
<url>http://sylpheed.good-day.net/changelog.html.en</url>
</references>
<dates>
<discovery>2005-03-29</discovery>
<entry>2005-07-31</entry>
</dates>
</vuln>
<vuln vid="58247a96-01c8-11da-bc08-0001020eed82">
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<name>phpMyAdmin</name>
<range><lt>2.6.2.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
<p>The convcharset parameter was not correctly validated,
opening the door to a XSS attack.</p>
</blockquote>
</body>
</description>
<references>
<bid>12982</bid>
<cvename>CVE-2005-0992</cvename>
<mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111264361622660</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3</url>
</references>
<dates>
<discovery>2005-04-03</discovery>
<entry>2005-07-31</entry>
</dates>
</vuln>
<vuln vid="8375a73f-01bf-11da-bc08-0001020eed82">
<topic>gnupg -- OpenPGP symmetric encryption vulnerability</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.1</lt></range>
</package>
<package>
<name>p5-Crypt-OpenPGP</name>
<range><le>1.03</le></range>
</package>
<package>
<name>pgp</name>
<range><ge>3.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Serge Mister and Robert Zuccherato reports that the OpenPGP
protocol is vulnerable to a cryptographic attack when using
symmetric encryption in an automated way.</p>
<p>David Shaw reports about the impact:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
<p>This attack, while very significant from a cryptographic
point of view, is not generally effective in the real
world. To be specific, unless you have your OpenPGP
program set up as part of an automated system to accept
encrypted messages, decrypt them, and then provide a
response to the submitter, then this does not affect you
at all.</p>
</blockquote>
<p>Note that the <q>fix</q> in GnuPG does note completely
eliminate the potential problem:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
<p>These patches disable a portion of the OpenPGP protocol
that the attack is exploiting. This change should not be
user visible. With the patch in place, this attack will
not work using a public-key encrypted message. It will
still work using a passphrase-encrypted message.</p>
</blockquote>
</body>
</description>
<references>
<certvu>303094</certvu>
<cvename>CVE-2005-0366</cvename>
<url>http://eprint.iacr.org/2005/033</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html</url>
<url>http://www.pgp.com/newsroom/ctocorner/openpgp.html</url>
</references>
<dates>
<discovery>2005-02-08</discovery>
<entry>2005-07-31</entry>
<modified>2007-04-23</modified>
</dates>
</vuln>
<vuln vid="81f127a8-0038-11da-86bc-000e0c2e438a">
<topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim+ruby</name>
<range><ge>6.3</ge><lt>6.3.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski discovered a way to construct Vim modelines
that execute arbitrary shell commands. The vulnerability
can be exploited by including shell commands in modelines
that call the glob() or expand() functions. An attacker
could trick an user to read or edit a trojaned file with
modelines enabled, after which the attacker is able to
execute arbitrary commands with the privileges of the user.</p>
<p><strong>Note:</strong> It is generally recommended that VIM
users use <code>set nomodeline</code> in
<code>~/.vimrc</code> to avoid the possibility of trojaned
text files.</p>
</body>
</description>
<references>
<bid>14374</bid>
<cvename>CVE-2005-2368</cvename>
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html</url>
</references>
<dates>
<discovery>2005-07-25</discovery>
<entry>2005-07-31</entry>
</dates>
</vuln>
<vuln vid="68222076-010b-11da-bc08-0001020eed82">
<topic>tiff -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.7.3</lt></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.6.1_3</lt></range>
</package>
<package>
<name>pdflib</name>
<name>pdflib-perl</name>
<range><lt>6.0.1_2</lt></range>
</package>
<package>
<name>gdal</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>ivtools</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>paraview</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>fractorama</name>
<range><lt>1.6.7_1</lt></range>
</package>
<package>
<name>iv</name>
<name>ja-iv</name>
<name>ja-libimg</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
discovered a stack based buffer overflow in the libTIFF
library when reading a TIFF image with a malformed
BitsPerSample tag.</p>
<p>Successful exploitation would require the victim to open
a specially crafted TIFF image, resulting in the execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1544</cvename>
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=843</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml</url>
<url>http://www.remotesensing.org/libtiff/v3.7.3.html</url>
</references>
<dates>
<discovery>2005-05-10</discovery>
<entry>2005-07-30</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="934b1de4-00d7-11da-bc08-0001020eed82">
<topic>opera -- image dragging vulnerability</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><lt>8.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15756/">
<p>Secunia Research has discovered a vulnerability in Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks and retrieve a user's
files.</p>
<p>The vulnerability is caused due to Opera allowing a user
to drag e.g. an image, which is actually a "javascript:"
URI, resulting in cross-site scripting if dropped over
another site. This may also be used to populate a file
upload form, resulting in uploading of arbitrary files to
a malicious web site.</p>
<p>Successful exploitation requires that the user is tricked
into dragging and dropping e.g. an image or a link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/15756/</url>
<url>http://www.opera.com/freebsd/changelogs/802/</url>
</references>
<dates>
<discovery>2005-07-28</discovery>
<entry>2005-07-30</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="a2aa24fd-00d4-11da-bc08-0001020eed82">
<topic>opera -- download dialog spoofing vulnerability</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><lt>8.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15870/">
<p>Secunia Research has discovered a vulnerability in Opera,
which can be exploited by malicious people to trick users
into executing malicious files.</p>
<p>The vulnerability is caused due to an error in the
handling of extended ASCII codes in the download
dialog. This can be exploited to spoof the file extension
in the file download dialog via a specially crafted
"Content-Disposition" HTTP header.</p>
<p>Successful exploitation may result in users being tricked
into executing a malicious file via the download dialog,
but requires that the "Arial Unicode MS" font
(ARIALUNI.TTF) has been installed on the system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/15870/</url>
<url>http://www.opera.com/freebsd/changelogs/802/</url>
</references>
<dates>
<discovery>2005-07-28</discovery>
<entry>2005-07-30</entry>
</dates>
</vuln>
<vuln vid="5d51d245-00ca-11da-bc08-0001020eed82">
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.5</ge><lt>0.10.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ethreal Security Advisories reports:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
<p>Our testing program has turned up several more security
issues:</p>
<ul>
<li>The LDAP dissector could free static memory and crash.</li>
<li>The AgentX dissector could crash.</li>
<li>The 802.3 dissector could go into an infinite loop.</li>
<li>The PER dissector could abort.</li>
<li>The DHCP dissector could go into an infinite loop.</li>
<li>The BER dissector could abort or loop infinitely.</li>
<li>The MEGACO dissector could go into an infinite loop.</li>
<li>The GIOP dissector could dereference a null pointer.</li>
<li>The SMB dissector was susceptible to a buffer overflow.</li>
<li>The WBXML could dereference a null pointer.</li>
<li>The H1 dissector could go into an infinite loop.</li>
<li>The DOCSIS dissector could cause a crash.</li>
<li>The SMPP dissector could go into an infinite loop.</li>
<li>SCTP graphs could crash.</li>
<li>The HTTP dissector could crash.</li>
<li>The SMB dissector could go into a large loop.</li>
<li>The DCERPC dissector could crash.</li>
<li>Several dissectors could crash while reassembling packets.</li>
</ul>
<p>Steve Grubb at Red Hat found the following issues:</p>
<ul>
<li>The CAMEL dissector could dereference a null pointer.</li>
<li>The DHCP dissector could crash.</li>
<li>The CAMEL dissector could crash.</li>
<li>The PER dissector could crash.</li>
<li>The RADIUS dissector could crash.</li>
<li>The Telnet dissector could crash.</li>
<li>The IS-IS LSP dissector could crash.</li>
<li>The NCP dissector could crash.</li>
</ul>
<p>iDEFENSE found the following issues:</p>
<ul>
<li>Several dissectors were susceptible to a format string
overflow.</li>
</ul>
<h1>Impact:</h1>
<p>It may be possible to make Ethereal crash, use up
available memory, or run arbitrary code by injecting a
purposefully malformed packet onto the wire or by
convincing someone to read a malformed packet trace
file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00020.html</url>
</references>
<dates>
<discovery>2005-07-26</discovery>
<entry>2005-07-30</entry>
</dates>
</vuln>
<vuln vid="651996e0-fe07-11d9-8329-000e0c2e438a">
<topic>apache -- http request smuggling</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.33_2</lt></range>
<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
<range><gt>2.1.0</gt><lt>2.1.6_1</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><lt>1.3.33.1.55_1</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.33_3</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><lt>1.3.33+2.8.22_1</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><gt>0</gt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.37</lt></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.34+30.22</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.34+30.22+2.8.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Watchfire whitepaper reports an vulnerability in the
Apache webserver. The vulnerability can be exploited by
malicious people causing cross site scripting, web cache
poisoining, session hijacking and most importantly the
ability to bypass web application firewall protection.
Exploiting this vulnerability requires multiple carefully
crafted HTTP requests, taking advantage of an caching server,
proxy server, web application firewall etc. This only affects
installations where Apache is used as HTTP proxy in
combination with the following web servers:</p>
<ul>
<li>IIS/6.0 and 5.0</li>
<li>Apache 2.0.45 (as web server)</li>
<li>apache 1.3.29</li>
<li>WebSphere 5.1 and 5.0</li>
<li>WebLogic 8.1 SP1</li>
<li>Oracle9iAS web server 9.0.2</li>
<li>SunONE web server 6.1 SP4</li>
</ul>
</body>
</description>
<references>
<bid>14106</bid>
<cvename>CVE-2005-2088</cvename>
<url>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</url>
</references>
<dates>
<discovery>2005-07-25</discovery>
<entry>2005-07-26</entry>
<modified>2009-01-23</modified>
</dates>
</vuln>
<vuln vid="1db7ecf5-fd24-11d9-b4d6-0007e900f87b">
<topic>clamav -- multiple remote buffer overflows</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.86.2</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20050704</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/16180/">
<p>Neel Mehta and Alex Wheeler have reported some
vulnerabilities in Clam AntiVirus, which can be exploited
by malicious people to cause a DoS (Denial of Service)
or compromise a vulnerable system.</p>
<ol>
<li>Two integer overflow errors in "libclamav/tnef.c"
when processing TNEF files can be exploited to cause
a heap-based buffer overflow via a specially crafted
TNEF file with a length value of -1 in the header.</li>
<li>An integer overflow error in "libclamav/chmunpack.c"
can be exploited to cause a heap-based buffer overflow
via a specially crafted CHM file with a chunk entry that
has a filename length of -1.</li>
<li>A boundary error in "libclamav/fsg.c" when
processing a FSG compressed file can cause a heap-based
buffer overflow.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://www.rem0te.com/public/images/clamav.pdf</url>
<url>http://secunia.com/advisories/16180/</url>
</references>
<dates>
<discovery>2005-07-24</discovery>
<entry>2005-07-25</entry>
</dates>
</vuln>
<vuln vid="ccd325d2-fa08-11d9-bc08-0001020eed82">
<topic>isc-dhcpd -- format string vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp3-client</name>
<name>isc-dhcp3-devel</name>
<name>isc-dhcp3-relay</name>
<name>isc-dhcp3-server</name>
<name>isc-dhcp3</name>
<name>isc-dhcp</name>
<name>isc-dhcpd</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ISC DHCP programs are vulnerable to several format
string vulnerabilities which may allow a remote attacker to
execute arbitrary code with the permissions of the DHCP
programs, typically root for the DHCP server.</p>
</body>
</description>
<references>
<bid>11591</bid>
<certvu>448384</certvu>
<cvename>CVE-2004-1006</cvename>
<mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290</mlist>
</references>
<dates>
<discovery>2004-11-08</discovery>
<entry>2005-07-23</entry>
</dates>
</vuln>
<vuln vid="b4892b5b-fb1c-11d9-96ba-00909925db3e">
<topic>egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>egroupware</name>
<range><lt>1.0.0.007</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple cross-site scripting (XSS) vulnerabilities in eGroupware
before 1.0.0.007 allow remote attackers to inject arbitrary web
script or HTML via the (1) ab_id, (2) page, (3) type,
or (4) lang parameter to index.php or (5) category_id parameter.
</p>
<p>Multiple SQL injection vulnerabilities in index.php in eGroupware
before 1.0.0.007 allow remote attackers to execute arbitrary SQL
commands via the (1) filter or (2) cats_app parameter.
</p>
</body>
</description>
<references>
<cvename>CVE-2005-1202</cvename>
<cvename>CVE-2005-1203</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=320768</url>
</references>
<dates>
<discovery>2005-04-20</discovery>
<entry>2005-07-23</entry>
</dates>
</vuln>
<vuln vid="3f4ac724-fa8b-11d9-afcf-0060084a00e5">
<topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>
<affects>
<package>
<name>fetchmail</name>
<range><eq>6.2.5.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In fetchmail 6.2.5.1, the remote code injection via
POP3 UIDL was fixed, but a denial of service attack was
introduced:</p>
<p>Two possible NULL-pointer dereferences allow a malicious
POP3 server to crash fetchmail by respondig with UID lines
containing only the article number but no UID (in violation
of RFC-1939), or a message without Message-ID when no UIDL
support is available.</p>
</body>
</description>
<references>
<mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
<url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
</references>
<dates>
<discovery>2005-07-21</discovery>
<entry>2005-07-22</entry>
</dates>
</vuln>
<vuln vid="e72fd82b-fa01-11d9-bc08-0001020eed82">
<topic>dnrd -- remote buffer and stack overflow vulnerabilities</topic>
<affects>
<package>
<name>dnrd</name>
<range><lt>2.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Natanael Copa reports that dnrd is vulnerable to a remote
buffer overflow and a remote stack overflow. These
vulnerabilities can be triggered by sending invalid DNS
packets to dnrd.</p>
<p>The buffer overflow could potentially be used to execute
arbitrary code with the permissions of the dnrd daemon.
Note that dnrd runs in an chroot environment and runs as
non-root.</p>
<p>The stack overflow vulnerability can cause dnrd to
crash.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2315</cvename>
<cvename>CVE-2005-2316</cvename>
<freebsdpr>ports/83851</freebsdpr>
</references>
<dates>
<discovery>2005-07-21</discovery>
<entry>2005-07-21</entry>
</dates>
</vuln>
<vuln vid="43a7b0a7-f9bc-11d9-b473-00061bc2ad93">
<topic>PowerDNS -- LDAP backend fails to escape all queries</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>2.9.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The LDAP backend in PowerDNS has issues with escaping
queries which could cause connection errors. This would
make it possible for a malicious user to temporarily blank
domains.</p>
<blockquote cite="http://doc.powerdns.com/security-policy.html">
<p>This is known to affect all releases prior to 2.9.18.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2302</cvename>
<url>http://doc.powerdns.com/security-policy.html</url>
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=112155941310297&w=2</url>
</references>
<dates>
<discovery>2005-07-16</discovery>
<entry>2005-07-21</entry>
</dates>
</vuln>
<vuln vid="3497d7be-2fef-45f4-8162-9063751b573a">
<topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>fetchmail's POP3/UIDL code does not truncate received UIDs properly.
A malicious or compromised POP3 server can thus corrupt fetchmail's
stack and inject code when fetchmail is using UIDL, either through
configuration, or as a result of certain server capabilities. Note
that fetchmail is run as root on some sites, so an attack might
compromise the root account and thus the whole machine.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2335</cvename>
<freebsdpr>ports/83805</freebsdpr>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url>
<url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
</references>
<dates>
<discovery>2005-07-20</discovery>
<entry>2005-07-20</entry>
<modified>2005-07-21</modified>
</dates>
</vuln>
<vuln vid="2e116ba5-f7c3-11d9-928e-000b5d7e6dd5">
<topic>kdebase -- Kate backup file permission leak</topic>
<affects>
<package>
<name>kdebase</name>
<range><ge>3.2.0</ge><lt>3.4.1</lt></range>
</package>
<package>
<name>linux_base-suse</name>
<range><ge>9.3</ge><lt>9.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A KDE Security Advisory explains:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
<p>Kate / Kwrite create a file backup before saving a modified
file. These backup files are created with default permissions,
even if the original file had more strict permissions set.</p>
<p>Depending on the system security settings, backup files
might be readable by other users. Kate / Kwrite are
network transparent applications and therefore this
vulnerability might not be restricted to local users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1920</cvename>
<url>https://bugs.kde.org/show_bug.cgi?id=103331</url>
<url>http://www.kde.org/info/security/advisory-20050718-1.txt</url>
</references>
<dates>
<discovery>2005-07-18</discovery>
<entry>2005-07-18</entry>
<modified>2005-10-09</modified>
</dates>
</vuln>
<vuln vid="5d72701a-f601-11d9-bcd1-02061b08fc24">
<topic>firefox & mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.5</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.9,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.9</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security
vulnerabilities in Firefox and Mozilla:</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<ul>
<li><em>MFSA 2005-56</em> Code execution through shared function
objects</li>
<li><em>MFSA 2005-55</em> XHTML node spoofing</li>
<li><em>MFSA 2005-54</em> Javascript prompt origin spoofing</li>
<li><em>MFSA 2005-53</em> Standalone applications can run arbitrary
code through the browser</li>
<li><em>MFSA 2005-52</em> Same origin violation: frame calling
top.focus()</li>
<li><em>MFSA 2005-51</em> The return of frame-injection
spoofing</li>
<li><em>MFSA 2005-50</em> Possibly exploitable crash in
InstallVersion.compareTo()</li>
<li><em>MFSA 2005-49</em> Script injection from Firefox sidebar
panel using data:</li>
<li><em>MFSA 2005-48</em> Same-origin violation with InstallTrigger
callback</li>
<li><em>MFSA 2005-47</em> Code execution via "Set as
Wallpaper"</li>
<li><em>MFSA 2005-46</em> XBL scripts ran even when Javascript
disabled</li>
<li><em>MFSA 2005-45</em> Content-generated event
vulnerabilities</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1937</cvename>
<cvename>CVE-2005-2260</cvename>
<cvename>CVE-2005-2261</cvename>
<cvename>CVE-2005-2262</cvename>
<cvename>CVE-2005-2263</cvename>
<cvename>CVE-2005-2264</cvename>
<cvename>CVE-2005-2265</cvename>
<cvename>CVE-2005-2266</cvename>
<cvename>CVE-2005-2267</cvename>
<cvename>CVE-2005-2268</cvename>
<cvename>CVE-2005-2269</cvename>
<cvename>CVE-2005-2270</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-45.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-46.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-47.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-48.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-49.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-50.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-51.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-52.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-53.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-54.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-55.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-56.html</url>
</references>
<dates>
<discovery>2005-07-12</discovery>
<entry>2005-07-16</entry>
</dates>
</vuln>
<vuln vid="f241641e-f5ea-11d9-a6db-000d608ed240">
<topic>drupal -- PHP code execution vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kuba Zygmunt discovered a flaw in the input validation routines
of Drupal's filter mechanism. An attacker could execute
arbitrary PHP code on a target site when public comments or
postings are allowed.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1921</cvename>
<cvename>CVE-2005-2106</cvename>
<url>http://drupal.org/files/sa-2005-002/advisory.txt</url>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-07-16</entry>
</dates>
</vuln>
<vuln vid="50457509-d05e-11d9-9aed-000e0c2e438a">
<topic>phpSysInfo -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpSysInfo</name>
<range><lt>2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Securityreason.com advisory reports that various cross
site scripting vulnerabilities have been found in phpSysInfo.
Input is not properly sanitised before it is returned to the
user. A malicious person could exploit this to execute
arbitrary HTML and script code in a users browser session.
Also it is possible to view the full path of certain scripts
by accessing them directly.</p>
</body>
</description>
<references>
<bid>12887</bid>
<cvename>CVE-2005-0869</cvename>
<cvename>CVE-2005-0870</cvename>
<mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111161017209422</mlist>
</references>
<dates>
<discovery>2005-03-22</discovery>
<entry>2005-07-09</entry>
<modified>2005-12-25</modified>
</dates>
</vuln>
<vuln vid="eeae6cce-d05c-11d9-9aed-000e0c2e438a">
<topic>mysql-server -- insecure temporary file creation</topic>
<affects>
<package>
<name>mysql-server</name>
<range><gt>4.1</gt><lt>4.1.12</lt></range>
<range><gt>5.0</gt><lt>5.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Zataz advisory reports that MySQL contains a security
flaw which could allow a malicious local user to inject
arbitrary SQL commands during the initial database creation
process.</p>
<p>The problem lies in the mysql_install_db script which
creates temporary files based on the PID used by the
script.</p>
</body>
</description>
<references>
<bid>13660</bid>
<cvename>CVE-2005-1636</cvename>
<url>http://www.zataz.net/adviso/mysql-05172005.txt</url>
</references>
<dates>
<discovery>2005-05-07</discovery>
<entry>2005-07-09</entry>
</dates>
</vuln>
<vuln vid="3e0072d4-d05b-11d9-9aed-000e0c2e438a">
<topic>net-snmp -- fixproc insecure temporary file creation</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
<p>Net-SNMP creates temporary files in an insecure manner,
possibly allowing the execution of arbitrary code.</p>
<p>A malicious local attacker could exploit a race condition
to change the content of the temporary files before they
are executed by fixproc, possibly leading to the execution
of arbitrary code. A local attacker could also create
symbolic links in the temporary files directory, pointing
to a valid file somewhere on the filesystem. When fixproc
is executed, this would result in the file being
overwritten.</p>
</blockquote>
</body>
</description>
<references>
<bid>13715</bid>
<cvename>CVE-2005-1740</cvename>
<url>http://security.gentoo.org/glsa/glsa-200505-18.xml</url>
</references>
<dates>
<discovery>2005-05-23</discovery>
<entry>2005-07-09</entry>
<modified>2005-07-13</modified>
</dates>
</vuln>
<vuln vid="326c517a-d029-11d9-9aed-000e0c2e438a">
<topic>phpbb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpBB is vulnerable to remote exploitation of an input
validation vulnerability allows attackers to read the
contents of arbitrary system files under the privileges
of the webserver. This also allows remote attackers to
unlink arbitrary system files under the privileges of the
webserver.</p>
</body>
</description>
<references>
<bid>12618</bid>
<bid>12621</bid>
<bid>12623</bid>
<cvename>CVE-2005-0258</cvename>
<cvename>CVE-2005-0259</cvename>
<url>http://security.gentoo.org/glsa/glsa-200503-02.xml</url>
<url>http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities</url>
<url>http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities</url>
</references>
<dates>
<discovery>2005-02-22</discovery>
<entry>2005-07-09</entry>
</dates>
</vuln>
<vuln vid="6596bb80-d026-11d9-9aed-000e0c2e438a">
<topic>shtool -- insecure temporary file creation</topic>
<affects>
<package>
<name>shtool</name>
<range><le>2.0.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Zataz advisory reports that shtool contains a security
flaw which could allow a malicious local user to create or
overwrite the contents of arbitrary files. The attacker
could fool a user into executing the arbitrary file possibly
executing arbitrary code.</p>
</body>
</description>
<references>
<bid>13767</bid>
<url>http://www.zataz.net/adviso/shtool-05252005.txt</url>
</references>
<dates>
<discovery>2005-05-25</discovery>
<entry>2005-07-09</entry>
</dates>
</vuln>
<vuln vid="88188a8c-eff6-11d9-8310-0001020eed82">
<topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>
<affects>
<package>
<name>phppgadmin</name>
<range><lt>3.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15941/">
<p>A vulnerability has been reported in phpPgAdmin, which
can be exploited by malicious people to disclose sensitive
information.</p>
<p>Input passed to the "formLanguage" parameter in
"index.php" isn't properly verified, before it is used to
include files. This can be exploited to include arbitrary
files from local resources.</p>
<p>Successful exploitation requires that "magic_quotes_gpc"
is disabled.</p>
</blockquote>
</body>
</description>
<references>
<bid>14142</bid>
<cvename>CVE-2005-2256</cvename>
<url>http://secunia.com/advisories/15941/</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=342261</url>
</references>
<dates>
<discovery>2005-07-05</discovery>
<entry>2005-07-08</entry>
<modified>2005-07-21</modified>
</dates>
</vuln>
<vuln vid="b64481d9-eff4-11d9-8310-0001020eed82">
<topic>pear-XML_RPC -- information disclosure vulnerabilities</topic>
<affects>
<package>
<name>pear-XML_RPC</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pear-XML_RPC release notes reports that the following
issues has been fixed:</p>
<blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
<p>Eliminate path disclosure vulnerabilities by suppressing
error messages when eval()'ing.</p>
<p>Eliminate path disclosure vulnerability by catching bogus
parameters submitted to
<code>XML_RPC_Value::serializeval()</code>.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pear.php.net/package/XML_RPC/download/1.3.2</url>
</references>
<dates>
<discovery>2005-07-07</discovery>
<entry>2005-07-08</entry>
</dates>
</vuln>
<vuln vid="9a035a56-eff0-11d9-8310-0001020eed82">
<topic>ekg -- insecure temporary file creation</topic>
<affects>
<package>
<name>pl-ekg</name>
<range><lt>1.6r2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Romang reports that ekg creates temporary files in an
insecure manner. This can be exploited by an attacker using
a symlink attack to overwrite arbitrary files and possibly
execute arbitrary commands with the permissions of the user
running ekg.</p>
</body>
</description>
<references>
<bid>14146</bid>
<cvename>CVE-2005-1916</cvename>
<mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&m=112060146011122</mlist>
<url>http://bugs.gentoo.org/show_bug.cgi?id=94172</url>
</references>
<dates>
<discovery>2005-07-05</discovery>
<entry>2005-07-08</entry>
<modified>2005-07-31</modified>
</dates>
</vuln>
<vuln vid="6e33f4ab-efed-11d9-8310-0001020eed82">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.17.1</ge><lt>2.18.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.18.1/">
<p>Any user can change any flag on any bug, even if they
don't have access to that bug, or even if they can't
normally make bug changes. This also allows them to expose
the summary of a bug.</p>
<p>Bugs are inserted into the database before they are
marked as private, in Bugzilla code. Thus, MySQL
replication can lag in between the time that the bug is
inserted and when it is marked as private (usually less
than a second). If replication lags at this point, the bug
summary will be accessible to all users until replication
catches up. Also, on a very slow machine, there may be a
pause longer than a second that allows users to see the
title of the newly-filed bug.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2173</cvename>
<cvename>CVE-2005-2174</cvename>
<url>http://www.bugzilla.org/security/2.18.1/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=292544</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=293159</url>
</references>
<dates>
<discovery>2005-07-07</discovery>
<entry>2005-07-08</entry>
<modified>2005-07-18</modified>
</dates>
</vuln>
<vuln vid="d177d9f9-e317-11d9-8088-00123f0f7307">
<topic>nwclient -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nwclient</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Insecure file permissions, network access control and DNS
usage put systems that use Legato NetWorker at risk.</p>
<p>When the software is running, several files that contain
sensitive information are created with insecure permissions.
The information exposed include passwords and can therefore
be used for privilege elevation.</p>
<p>An empty "servers" file, which should normally
contain hostnames of authorized backup servers, may allow
unauthorized backups to be made. Sensitive information can
be extracted from these backups.</p>
<p>When reverse DNS fails for the Legato client IP a weak
authorization scheme, containing a flaw that allows
unauthorized access, is used. This may allow unauthorized
access.</p>
</body>
</description>
<references>
<bid>3564</bid>
<bid>3840</bid>
<bid>3842</bid>
<cvename>CVE-2001-0910</cvename>
<cvename>CVE-2002-0113</cvename>
<cvename>CVE-2002-0114</cvename>
<url>http://portal1.legato.com/resources/bulletins/372.html</url>
</references>
<dates>
<discovery>2002-01-10</discovery>
<entry>2005-07-08</entry>
</dates>
</vuln>
<vuln vid="107692a1-ee6c-11d9-8310-0001020eed82">
<topic>acroread -- insecure temporary file creation</topic>
<affects>
<package>
<name>acroread4</name>
<name>acroread5</name>
<range><ge>0</ge></range>
</package>
<package>
<name>acroread</name>
<range><lt>7.0.0</lt></range>
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
<p>Secunia has discovered a security issue in Adobe Reader
for Linux, which can be exploited by malicious, local
users to gain knowledge of sensitive information.</p>
<p>The problem is caused due to temporary files being
created with permissions based on a user's umask in the
"/tmp" folder under certain circumstances when documents
are opened.</p>
<p>Successful exploitation allows an unprivileged user to
read arbitrary users' documents.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1912</cvename>
<url>http://secunia.com/secunia_research/2005-6/advisory/</url>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="d8e1aadd-ee68-11d9-8310-0001020eed82">
<topic>clamav -- cabinet file handling DoS vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.86</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20050620</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016">
<p>Remote exploitation of an input validation error in Clam
AntiVirus ClamAV allows attackers to cause a denial of
service condition.</p>
<p>The vulnerability specifically exists due to insufficient
validation on cabinet file header data. The
<code>ENSURE_BITS()</code> macro fails to check for zero
length reads, allowing a carefully constructed cabinet
file to cause an infinite loop.</p>
<p>ClamAV is used in a number of mail gateway
products. Successful exploitation requires an attacker to
send a specially constructed CAB file through a mail
gateway or personal anti-virus client utilizing the ClamAV
scanning engine. The infinate loop will cause the ClamAV
software to use all available processor resources,
resulting in a denial of service or severe degradation to
system performance. Remote exploitation can be achieved by
sending a malicious file in an e-mail message or during an
HTTP session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1923</cvename>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016</mlist>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="6d18fe19-ee67-11d9-8310-0001020eed82">
<topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.86</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20050620</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598">
<p>Remote exploitation of an input validation error in Clam
AntiVirus ClamAV allows attackers to cause a denial of
service condition.</p>
<p>The vulnerability specifically exists due to improper
behavior during exceptional conditions.</p>
<p>Successful exploitation allows attackers to exhaust file
descriptors pool and memory. Anti-virus detection
functionality will fail if there is no file descriptors
available with which to open files. Remote exploitation
can be achieved by sending a malicious file in an e-mail
message or during an HTTP session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1922</cvename>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598</mlist>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
<topic>zlib -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>zsync</name>
<range><lt>0.4.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_4</lt></range>
<range><ge>5.3</ge><lt>5.3_18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>An error in the handling of corrupt compressed data streams
can result in a buffer being overflowed.</p>
<h1>Impact</h1>
<p>By carefully crafting a corrupt compressed data stream, an
attacker can overwrite data structures in a zlib-using
application. This may cause the application to halt,
causing a denial of service; or it may result in the
attacker gaining elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2005-2096</cvename>
<freebsdsa>SA-05:16.zlib</freebsdsa>
</references>
<dates>
<discovery>2005-07-06</discovery>
<entry>2005-07-06</entry>
<modified>2005-10-01</modified>
</dates>
</vuln>
<vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
<topic>acroread -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>acroread4</name>
<name>acroread5</name>
<range><ge>0</ge></range>
</package>
<package>
<name>acroread</name>
<range><lt>7.0.0</lt></range>
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Adobe Security Advisory reports:</p>
<blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
<p>A vulnerability within Adobe Reader has been
identified. Under certain circumstances, remote
exploitation of a buffer overflow in Adobe Reader could
allow an attacker to execute arbitrary code.</p>
<p>If exploited, it could allow the execution of arbitrary
code under the privileges of the local user. Remote
exploitation is possible if the malicious PDF document is
sent as an email attachment or if the PDF document is
accessed via a web link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1625</cvename>
<url>http://www.adobe.com/support/techdocs/329083.html</url>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112059685332569</mlist>
</references>
<dates>
<discovery>2005-07-05</discovery>
<entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
<topic>net-snmp -- remote DoS vulnerability</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Net-SNMP release announcement reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328">
<p>A security vulnerability has been found in Net-SNMP
releases that could allow a denial of service attack
against Net-SNMP agent's which have opened a stream based
protocol (EG, TCP but not UDP; it should be noted that
Net-SNMP does not by default open a TCP port).</p>
</blockquote>
</body>
</description>
<references>
<bid>14168</bid>
<cvename>CVE-2005-2177</cvename>
<mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328</mlist>
</references>
<dates>
<discovery>2005-07-02</discovery>
<entry>2005-07-05</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6f</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory-032005.php">
<p>Wrongly implemented user input filters lead to multiple
SQL Injection vulnerabilities which can lead f.e. to
disclosure of the admin password hash.</p>
</blockquote>
<blockquote cite="http://www.hardened-php.net/advisory-042005.php">
<p>Wrongly implemented user input filters allows injection
of user input into executed commandline.</p>
<p>Alberto Trivero posted his Remote Command Execution
Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th
June. Having analysed his bug we come to the conclusion,
that the malfunctioning input filters, which were already
mentioned in the previous advisory are also responsible
for this bug still being exploitable.</p>
</blockquote>
<blockquote cite="http://www.hardened-php.net/advisory-052005.php">
<p>A HTTP headers bypass switch can also be used to
completely bypass the authentification system of Cacti. As
admin it is possible to execute shell commands with the
permission of the webserver.</p>
<p>While looking at the source of Cacti a HTTP headers
bypass switch was discovered, that also switches off a
call to <code>session_start()</code> and the manual
application of <code>addslashes()</code> in case of
<code>magic_quotes_gpc=Off</code>.</p>
<p>When register_globals is turned on* an attacker can use
this switch to disables Cacti's use of PHP's session
support and therefore supply the session variables on his
own through f.e. the URL. Additionally using the switch
renders several SQL statements vulnerable to SQL
Injections attacks, when magic_quotes_gpc is turned off,
which is the recommended setting.</p>
<p>Logged in as an admin it is possible to issue shell
commands.</p>
<p>(*) register_globals is turned off by default since PHP
4.2 but is activated on most servers because of older
scripts requiring it.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248</mlist>
<url>http://www.hardened-php.net/advisory-032005.php</url>
<url>http://www.hardened-php.net/advisory-042005.php</url>
<url>http://www.hardened-php.net/advisory-052005.php</url>
</references>
<dates>
<discovery>2005-06-22</discovery>
<entry>2005-07-05</entry>
</dates>
</vuln>
<vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>1.5.1.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GulfTech Security Research reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438">
<p>There are a number of vulnerabilities in WordPress that
may allow an attacker to ultimately run arbitrary code on
the vulnerable system. These vulnerabilities include SQL
Injection, Cross Site Scripting, and also issues that may
aid an attacker in social engineering.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2107</cvename>
<cvename>CVE-2005-2108</cvename>
<cvename>CVE-2005-2109</cvename>
<cvename>CVE-2005-2110</cvename>
<mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438</mlist>
</references>
<dates>
<discovery>2005-06-28</discovery>
<entry>2005-07-05</entry>
</dates>
</vuln>
<vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>1.5.1.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
<p>Due to a lack of input validation, WordPress is
vulnerable to SQL injection and XSS attacks.</p>
<p>An attacker could use the SQL injection vulnerabilities to
gain information from the database. Furthermore the
cross-site scripting issues give an attacker the ability
to inject and execute malicious script code or to steal
cookie-based authentication credentials, potentially
compromising the victim's browser.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1810</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
</references>
<dates>
<discovery>2005-04-12</discovery>
<entry>2005-07-05</entry>
</dates>
</vuln>
<vuln vid="4afacca1-eb9d-11d9-a8bd-000cf18bbe54">
<topic>phpbb -- remote PHP code execution vulnerability</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT Advisory reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
<p>A vulnerability was identified in phpBB, which
may be exploited by attackers to compromise a vulnerable
web server. This flaw is due to an input validation error
in the "viewtopic.php" script that does not properly filter
the "highlight" parameter before calling the "preg_replace()"
function, which may be exploited by remote attackers to execute
arbitrary PHP commands with the privileges of the web server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2086</cvename>
<url>http://www.frsirt.com/english/advisories/2005/0904</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
</references>
<dates>
<discovery>2005-06-28</discovery>
<entry>2005-07-03</entry>
<modified>2005-07-07</modified>
</dates>
</vuln>
<vuln vid="523fad14-eb9d-11d9-a8bd-000cf18bbe54">
<topic>pear-XML_RPC -- arbitrary remote code execution</topic>
<affects>
<package>
<name>pear-XML_RPC</name>
<range><lt>1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GulfTech Security Research Team reports:</p>
<blockquote cite="http://www.gulftech.org/?node=research&article_id=00087-07012005">
<p>PEAR XML_RPC is vulnerable to a very high risk php code
injection vulnerability due to unsanatized data being
passed into an eval() call.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1921</cvename>
<url>http://www.gulftech.org/?node=research&article_id=00087-07012005</url>
<url>http://www.hardened-php.net/advisory-022005.php</url>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-07-03</entry>
</dates>
</vuln>
<vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
<topic>kernel -- ipfw packet matching errors with address tables</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The ipfw tables lookup code caches the result of the last
query. The kernel may process multiple packets
concurrently, performing several concurrent table lookups.
Due to an insufficient locking, a cached result can become
corrupted that could cause some addresses to be incorrectly
matched against a lookup table.</p>
<h1>Impact</h1>
<p>When lookup tables are used with ipfw, packets may on very
rare occasions incorrectly match a lookup table. This could
result in a packet being treated contrary to the defined
packet filtering ruleset. For example, a packet may be
allowed to pass through when it should have been
discarded.</p>
<p>The problem can only occur on Symmetric Multi-Processor
(SMP) systems, or on Uni Processor (UP) systems with the
PREEMPTION kernel option enabled (not the default).</p>
<h1>Workaround</h1>
<p>a) Do not use lookup tables.</p>
<p>OR</p>
<p>b) Disable concurrent processing of packets in the network
stack by setting the "debug.mpsafenet=0" tunable:</p>
<p># echo "debug.mpsafenet=0" << /boot/loader.conf</p>
</body>
</description>
<references>
<cvename>CVE-2005-2019</cvename>
<freebsdsa>SA-05:13.ipfw</freebsdsa>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-06-29</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
<vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
<topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_3</lt></range>
<range><ge>5.0</ge><lt>5.3_17</lt></range>
<range><ge>4.11</ge><lt>4.11_11</lt></range>
<range><lt>4.10_16</lt></range>
</package>
<package>
<name>bzip2</name>
<range><lt>1.0.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Two problems have been discovered relating to the
extraction of bzip2-compressed files. First, a carefully
constructed invalid bzip2 archive can cause bzip2 to enter
an infinite loop. Second, when creating a new file, bzip2
closes the file before setting its permissions.</p>
<h1>Impact</h1>
<p>The first problem can cause bzip2 to extract a bzip2
archive to an infinitely large file. If bzip2 is used in
automated processing of untrusted files this could be
exploited by an attacker to create an denial-of-service
situation by exhausting disk space or by consuming all
available cpu time.</p>
<p>The second problem can allow a local attacker to change the
permissions of local files owned by the user executing bzip2
providing that they have write access to the directory in
which the file is being extracted.</p>
<h1>Workaround</h1>
<p>Do not uncompress bzip2 archives from untrusted sources and
do not uncompress files in directories where untrusted users
have write access.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0953</cvename>
<cvename>CVE-2005-1260</cvename>
<freebsdsa>SA-05:14.bzip2</freebsdsa>
<url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
</references>
<dates>
<discovery>2005-03-30</discovery>
<entry>2005-06-29</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="3ec8f43b-e8ef-11d9-b875-0001020eed82">
<topic>kernel -- TCP connection stall denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_3</lt></range>
<range><ge>5.0</ge><lt>5.3_17</lt></range>
<range><ge>4.11</ge><lt>4.11_11</lt></range>
<range><lt>4.10_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Two problems have been discovered in the FreeBSD TCP stack.</p>
<p>First, when a TCP packets containing a timestamp is
received, inadequate checking of sequence numbers is
performed, allowing an attacker to artificially increase the
internal "recent" timestamp for a connection.</p>
<p>Second, a TCP packet with the SYN flag set is accepted for
established connections, allowing an attacker to overwrite
certain TCP options.</p>
<h1>Impact</h1>
<p>Using either of the two problems an attacker with knowledge
of the local and remote IP and port numbers associated with
a connection can cause a denial of service situation by
stalling the TCP connection. The stalled TCP connection my
be closed after some time by the other host.</p>
<h1>Workaround</h1>
<p>In some cases it may be possible to defend against these
attacks by blocking the attack packets using a firewall.
Packets used to effect either of these attacks would have
spoofed source IP addresses.</p>
</body>
</description>
<references>
<certvu>637934</certvu>
<cvename>CVE-2005-0356</cvename>
<cvename>CVE-2005-2068</cvename>
<freebsdsa>SA-05:15.tcp</freebsdsa>
</references>
<dates>
<discovery>2005-06-29</discovery>
<entry>2005-06-29</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="76adaab0-e4e3-11d9-b875-0001020eed82">
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ethreal Security Advisories reports:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
<p>An aggressive testing program as well as independent
discovery has turned up a multitude of security issues</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<bid>13391</bid>
<bid>13504</bid>
<bid>13567</bid>
<cvename>CVE-2005-1281</cvename>
<cvename>CVE-2005-1456</cvename>
<cvename>CVE-2005-1457</cvename>
<cvename>CVE-2005-1458</cvename>
<cvename>CVE-2005-1459</cvename>
<cvename>CVE-2005-1460</cvename>
<cvename>CVE-2005-1461</cvename>
<cvename>CVE-2005-1462</cvename>
<cvename>CVE-2005-1463</cvename>
<cvename>CVE-2005-1464</cvename>
<cvename>CVE-2005-1465</cvename>
<cvename>CVE-2005-1466</cvename>
<cvename>CVE-2005-1467</cvename>
<cvename>CVE-2005-1468</cvename>
<cvename>CVE-2005-1469</cvename>
<cvename>CVE-2005-1470</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
</references>
<dates>
<discovery>2005-05-04</discovery>
<entry>2005-06-24</entry>
</dates>
</vuln>
<vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
<topic>tor -- information disclosure</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roger Dingledine reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
<p>The Tor 0.1.0.10 release from a few days ago
includes a fix for a bug that might allow an attacker
to read arbitrary memory (maybe even keys) from an exit
server's process space. We haven't heard any reports of
exploits yet, but hey.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
</references>
<dates>
<discovery>2005-06-16</discovery>
<entry>2005-06-24</entry>
</dates>
</vuln>
<vuln vid="95ee96f2-e488-11d9-bf22-080020c11455">
<topic>linux-realplayer -- RealText parsing heap overflow</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><le>10.0.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false">
<p>Remote exploitation of a heap-based buffer
overflow vulnerability in the RealText file format
parser within various versions of RealNetworks
Inc.'s RealPlayer could allow attackers to
execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1277</cvename>
<url>http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false</url>
<url>http://service.real.com/help/faq/security/050623_player/EN/</url>
</references>
<dates>
<discovery>2005-06-23</discovery>
<entry>2005-06-24</entry>
</dates>
</vuln>
<vuln vid="594eb447-e398-11d9-a8bd-000cf18bbe54">
<topic>ruby -- arbitrary command execution on XMLRPC server</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><gt>1.8.*</gt><lt>1.8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nobuhiro IMAI reports:</p>
<blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
<p>the default value modification on
Module#public_instance_methods (from false to true) breaks
s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
security protection.</p>
<p>This problem could allow a remote attacker to execute arbitrary
commands on XMLRPC server of libruby.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1992</cvename>
<url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
</references>
<dates>
<discovery>2005-06-22</discovery>
<entry>2005-06-23</entry>
<modified>2005-11-06</modified>
</dates>
</vuln>
<vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
<topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.6d</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDEFENSE security group disclosed potential SQL injection
attacks from unchecked user input and two security holes
regarding potential cross site scripting attacks</p>
</body>
</description>
<references>
<url>http://www.cacti.net/release_notes_0_8_6e.php</url>
</references>
<dates>
<discovery>2005-06-21</discovery>
<entry>2005-06-21</entry>
</dates>
</vuln>
<vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
<topic>opera -- XMLHttpRequest security bypass</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><gt>8.*</gt><lt>8.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15008/">
<p>Secunia Research has discovered a vulnerability in Opera,
which can be exploited by malicious people to steal
content or to perform actions on other web sites with the
privileges of the user.</p>
<p>Normally, it should not be possible for the
<code>XMLHttpRequest</code> object to access resources
from outside the domain of which the object was
opened. However, due to insufficient validation of server
side redirects, it is possible to circumvent this
restriction.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1475</cvename>
<url>http://secunia.com/advisories/15008/</url>
<url>http://secunia.com/secunia_research/2005-4/advisory/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
</references>
<dates>
<discovery>2005-06-16</discovery>
<entry>2005-06-20</entry>
</dates>
</vuln>
<vuln vid="40856a51-e1d9-11d9-b875-0001020eed82">
<topic>opera -- "javascript:" URL cross-site scripting vulnerability</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><lt>8.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15411/">
<p>Secunia Research has discovered a vulnerability in Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks and to read local files.</p>
<p>The vulnerability is caused due to Opera not properly
restricting the privileges of "javascript:" URLs when
opened in e.g. new windows or frames.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1669</cvename>
<url>http://secunia.com/advisories/15411/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
</references>
<dates>
<discovery>2005-06-16</discovery>
<entry>2005-06-20</entry>
</dates>
</vuln>
<vuln vid="985bfcf0-e1d7-11d9-b875-0001020eed82">
<topic>opera -- redirection cross-site scripting vulnerability</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera-devel</name>
<name>opera</name>
<range><gt>8.*</gt><lt>8.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15423/">
<p>Secunia Research has discovered a vulnerability in Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks against users.</p>
<p>The vulnerability is caused due to input not being
sanitised, when Opera generates a temporary page for
displaying a redirection when "Automatic redirection" is
disabled (not default setting).</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/15423/</url>
<url>http://secunia.com/secunia_research/2003-1/advisory/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
</references>
<dates>
<discovery>2005-06-16</discovery>
<entry>2005-06-20</entry>
</dates>
</vuln>
<vuln vid="3bf157fa-e1c6-11d9-b875-0001020eed82">
<topic>sudo -- local race condition vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.6.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376">
<p>A race condition in Sudo's command pathname handling
prior to Sudo version 1.6.8p9 that could allow a user with
Sudo privileges to run arbitrary commands.</p>
<p>Exploitation of the bug requires that the user be allowed
to run one or more commands via Sudo and be able to create
symbolic links in the filesystem. Furthermore, a sudoers
entry giving another user access to the ALL pseudo-command
must follow the user's sudoers entry for the race to
exist.</p>
</blockquote>
</body>
</description>
<references>
<bid>13993</bid>
<cvename>CVE-2005-1993</cvename>
<mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376</mlist>
</references>
<dates>
<discovery>2005-06-20</discovery>
<entry>2005-06-20</entry>
<modified>2005-11-14</modified>
</dates>
</vuln>
<vuln vid="b02c1d80-e1bb-11d9-b875-0001020eed82">
<topic>trac -- file upload/download vulnerability</topic>
<affects>
<package>
<name>trac</name>
<range><lt>0.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory-012005.php">
<p>Trac's wiki and ticket systems allows to add attachments
to wiki entries and bug tracker tickets. These attachments
are stored within directories that are determined by the
id of the corresponding ticket or wiki entry.</p>
<p>Due to a missing validation of the id parameter it is
possible for an attacker to supply arbitrary paths to the
upload and attachment viewer scripts. This means that a
potential attacker can retrieve any file accessible by the
webserver user.</p>
<p>Additionally it is possible to upload arbitrary files (up
to a configured file length) to any place the webserver
has write access too.</p>
<p>For obvious reasons this can lead to the execution of
arbitrary code if it possible to upload files to the
document root or it's subdirectories. One example of a
configuration would be f.e. running Trac and
s9y/wordpress with writeable content directories on the
same webserver.</p>
<p>Another potential usage of this exploit would be to abuse
Trac powered webservers as storage for f.e. torrent
files.</p>
</blockquote>
</body>
</description>
<references>
<bid>13990</bid>
<url>http://www.hardened-php.net/advisory-012005.php</url>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
</references>
<dates>
<discovery>2005-06-20</discovery>
<entry>2005-06-20</entry>
</dates>
</vuln>
<vuln vid="85069fb6-e15b-11d9-83cf-0010dc5df42d">
<topic>razor-agents -- denial of service vulnerability</topic>
<affects>
<package>
<name>razor-agents</name>
<range><le>2.71</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia security advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15739/">
<p>Two vulnerabilities have been reported in Razor-agents,
which can be exploited by malicious people to cause a DoS
(Denial of Service).</p>
<ol>
<li>An unspecified error in the preprocessing of certain
HTML messages can be exploited to crash the
application.</li>
<li>A bug in the discovery logic causes Razor-agents to go
into an infinite loop and consume a large amount of
memory when discovery fails.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/15739/</url>
</references>
<dates>
<discovery>2005-06-17</discovery>
<entry>2005-06-20</entry>
</dates>
</vuln>
<vuln vid="cc4ce06b-e01c-11d9-a8bd-000cf18bbe54">
<topic>p5-Mail-SpamAssassin -- denial of service vulnerability</topic>
<affects>
<package>
<name>p5-Mail-SpamAssassin</name>
<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache SpamAssassin Security Team reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
<p>Apache SpamAssassin 3.0.4 was recently released, and
fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
and 3.0.3. The vulnerability allows certain misformatted
long message headers to cause spam checking to
take a very long time.</p>
<p>While the exploit has yet to be seen in the wild,
we are concerned that there may be attempts to abuse
the vulnerability in the future. Therefore, we strongly
recommend all users of these versions upgrade to
Apache SpamAssassin 3.0.4 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1266</cvename>
<mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
</references>
<dates>
<discovery>2005-06-15</discovery>
<entry>2005-06-18</entry>
</dates>
</vuln>
<vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
<topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>squirrelmail</name>
<name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><le>1.4.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A SquirrelMail Security Advisory reports:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
<p>Several cross site scripting (XSS) vulnerabilities have been
discovered in SquirrelMail versions 1.4.0 - 1.4.4.</p>
<p>The vulnerabilities are in two categories: the majority can be
exploited through URL manipulation, and some by sending a specially
crafted email to a victim. When done very carefully,
this can cause the session of the user to be hijacked.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1769</cvename>
<url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
</references>
<dates>
<discovery>2005-06-15</discovery>
<entry>2005-06-18</entry>
</dates>
</vuln>
<vuln vid="02bc9b7c-e019-11d9-a8bd-000cf18bbe54">
<topic>acroread -- XML External Entity vulnerability</topic>
<affects>
<package>
<name>acroread7</name>
<name>ja-acroread</name>
<range><ge>7.0.0</ge><lt>7.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
and Adobe Reader.
Under certain circumstances, using XML scripts it is possible
to discover the existence of local files.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1306</cvename>
<url>http://shh.thathost.com/secadv/adobexxe/</url>
<url>http://www.adobe.com/support/techdocs/331710.html</url>
<url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
</references>
<dates>
<discovery>2005-06-15</discovery>
<entry>2005-06-18</entry>
<modified>2005-08-28</modified>
</dates>
</vuln>
<vuln vid="63bd4bad-dffe-11d9-b875-0001020eed82">
<topic>gzip -- directory traversal and permission race vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_2</lt></range>
<range><ge>5.0</ge><lt>5.3_16</lt></range>
<range><ge>4.11</ge><lt>4.11_10</lt></range>
<range><ge>4.10</ge><lt>4.10_15</lt></range>
<range><ge>4.9</ge><lt>4.9_18</lt></range>
<range><lt>4.8_33</lt></range>
</package>
<package>
<name>gzip</name>
<range><lt>1.3.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Two problems related to extraction of files exist in gzip:</p>
<p>The first problem is that gzip does not properly sanitize
filenames containing "/" when uncompressing files using the
-N command line option.</p>
<p>The second problem is that gzip does not set permissions on
newly extracted files until after the file has been created
and the file descriptor has been closed.</p>
<h1>Impact</h1>
<p>The first problem can allow an attacker to overwrite
arbitrary local files when uncompressing a file using the -N
command line option.</p>
<p>The second problem can allow a local attacker to change the
permissions of arbitrary local files, on the same partition
as the one the user is uncompressing a file on, by removing
the file the user is uncompressing and replacing it with a
hardlink before the uncompress operation is finished.</p>
<h1>Workaround</h1>
<p>Do not use the -N command line option on untrusted files
and do not uncompress files in directories where untrusted
users have write access.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0988</cvename>
<cvename>CVE-2005-1228</cvename>
<freebsdsa>SA-05:11.gzip</freebsdsa>
<mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210</mlist>
<mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477</mlist>
</references>
<dates>
<discovery>2005-04-20</discovery>
<entry>2005-06-18</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
<vuln vid="9fae0f1f-df82-11d9-b875-0001020eed82">
<topic>tcpdump -- infinite loops in protocol decoding</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_2</lt></range>
<range><ge>5.3</ge><lt>5.3_16</lt></range>
</package>
<package>
<name>tcpdump</name>
<range><lt>3.8.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Several tcpdump protocol decoders contain programming
errors which can cause them to go into infinite loops.</p>
<h1>Impact</h1>
<p>An attacker can inject specially crafted packets into the
network which, when processed by tcpdump, could lead to a
denial-of-service. After the attack, tcpdump would no
longer capture traffic, and would potentially use all
available processor time.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1267</cvename>
<cvename>CVE-2005-1278</cvename>
<cvename>CVE-2005-1279</cvename>
<cvename>CVE-2005-1280</cvename>
<freebsdsa>SA-05:10.tcpdump</freebsdsa>
<mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040</mlist>
<mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644</mlist>
<mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&m=111928309502304</mlist>
</references>
<dates>
<discovery>2005-06-09</discovery>
<entry>2005-06-18</entry>
<modified>2005-06-20</modified>
</dates>
</vuln>
<vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
<topic>gaim -- Yahoo! remote crash vulnerability</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jacopo Ottaviani reports that Gaim can be crashed by being
offered files with names containing non-ASCII
characters via the Yahoo! protocol.</p>
</body>
</description>
<references>
<bid>13931</bid>
<cvename>CVE-2005-1269</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=18</url>
</references>
<dates>
<discovery>2005-06-10</discovery>
<entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
<topic>gaim -- MSN Remote DoS vulnerability</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
<p>Remote attackers can cause a denial of service (crash)
via a malformed MSN message that leads to a memory
allocation of a large size, possibly due to an integer
signedness error.</p>
</blockquote>
</body>
</description>
<references>
<bid>13932</bid>
<cvename>CVE-2005-1934</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=19</url>
</references>
<dates>
<discovery>2005-06-10</discovery>
<entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="12b1a62d-6056-4d90-9e21-45fcde6abae4">
<topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
<affects>
<package>
<name>gallery</name>
<range><lt>1.4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A web server running Gallery can be exploited for arbitrary
PHP code execution through the use of a maliciously crafted
URL.</p>
</body>
</description>
<references>
<cvename>CVE-2004-2124</cvename>
<mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693</mlist>
</references>
<dates>
<discovery>2004-01-27</discovery>
<entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
<topic>gallery -- cross-site scripting</topic>
<affects>
<package>
<name>gallery</name>
<range><lt>1.4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gallery includes several cross-site scripting vulnerabilities
that could allow malicious content to be injected.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1106</cvename>
<cvename>CVE-2005-0219</cvename>
<cvename>CVE-2005-0220</cvename>
<cvename>CVE-2005-0221</cvename>
<cvename>CVE-2005-0222</cvename>
<bid>11602</bid>
<url>http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147</url>
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=110608459222364</url>
</references>
<dates>
<discovery>2005-01-26</discovery>
<entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="0512b761-70fb-40d3-9954-aa4565528fa8">
<topic>kstars -- exploitable set-user-ID application fliccd</topic>
<affects>
<package>
<name>kdeedu</name>
<range><lt>3.3.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A KDE Security Advisory explains:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
<h1>Overview</h1>
<p>KStars includes support for the Instrument Neutral
Distributed Interface (INDI). The build system of this
extra 3rd party software contained an installation hook to
install fliccd (part of INDI) as SUID root
application.</p>
<p>Erik Sjölund discovered that the code contains several
vulnerabilities that allow stack based buffer
overflows.</p>
<h1>Impact</h1>
<p>If the fliccd binary is installed as suid root, it
enables root privilege escalation for local users, or, if
the daemon is actually running (which it does not by
default) and is running as root, remote root privilege
escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0011</cvename>
<url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
</references>
<dates>
<discovery>2005-01-05</discovery>
<entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="4c005a5e-2541-4d95-80a0-00c76919aa66">
<topic>fd_set -- bitmap index overflow in multiple applications</topic>
<affects>
<package>
<name>gatekeeper</name>
<range><lt>2.2.1</lt></range>
</package>
<package>
<name>citadel</name>
<range><lt>6.29</lt></range>
</package>
<package>
<name>3proxy</name>
<range><lt>0.5.b</lt></range>
</package>
<package>
<name>jabber</name>
<range><lt>1.4.3.1_1,1</lt></range>
<range><eq>1.4.4</eq></range>
</package>
<package>
<name>bnc</name>
<range><lt>2.9.3</lt></range>
</package>
<package>
<name>rinetd</name>
<range><lt>0.62_1</lt></range>
</package>
<package>
<name>dante</name>
<range><lt>1.1.15</lt></range>
</package>
<package>
<name>bld</name>
<range><lt>0.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>3APA3A reports:</p>
<blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
<p>If programmer fails to check socket number before using
select() or fd_set macros, it's possible to overwrite
memory behind fd_set structure. Very few select() based
application actually check FD_SETSIZE value. <em>[...]</em></p>
<p>Depending on vulnerable application it's possible to
overwrite portions of memory. Impact is close to
off-by-one overflows, code execution doesn't seems
exploitable.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.gotbnc.com/changes.html#2.9.3</url>
<url>http://www.security.nnov.ru/advisories/sockets.asp</url>
<mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&m=110660879328901</mlist>
</references>
<dates>
<discovery>2004-12-12</discovery>
<entry>2005-06-17</entry>
<modified>2006-09-03</modified>
</dates>
</vuln>
<vuln vid="b5ffaa2a-ee50-4498-af99-61bc1b163c00">
<topic>leafnode -- denial of service vulnerability</topic>
<affects>
<package>
<name>leafnode</name>
<range><lt>1.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
<p>A vulnerability was found in the fetchnews program (the NNTP
client) that may under some circumstances cause a wait for input
that never arrives, fetchnews "hangs". [...]</p>
<p>As only one fetchnews program can run at a time, subsequently
started fetchnews and texpire programs will terminate. [...]</p>
<p>Upgrade your leafnode package to version 1.11.3.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1911</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
<freebsdpr>ports/82056</freebsdpr>
<mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&m=111827180929063</mlist>
</references>
<dates>
<discovery>2005-06-08</discovery>
<entry>2005-06-09</entry>
</dates>
</vuln>
<vuln vid="fe903533-ff96-4c7a-bd3e-4d40efa71897">
<topic>gforge -- directory traversal vulnerability</topic>
<affects>
<package>
<name>gforge</name>
<range><lt>4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An STG Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963">
<p>GForge CVS module made by Dragos Moinescu and another
module made by Ronald Petty have a directory traversal
vulnerability. [...] malicious attackers can read
arbitrary directory lists.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0299</cvename>
<bid>12318</bid>
<mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963</mlist>
</references>
<dates>
<discovery>2005-01-20</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
<topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
<affects>
<package>
<name>imap-uw</name>
<range><lt>2004b,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CRAM-MD5 authentication support of the University of
Washington IMAP and POP3 servers contains a vulnerability that
may allow an attacker to bypass authentication and impersonate
arbitrary users. Only installations with CRAM-MD5 support
configured are affected.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0198</cvename>
<certvu>702777</certvu>
</references>
<dates>
<discovery>2005-01-04</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="5bf1a715-cc57-440f-b0a5-6406961c54a7">
<topic>squid -- denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Squid team reported several denial-of-service
vulnerabilities related to the handling of DNS responses and
NT Lan Manager messages. These may allow an attacker to crash
the Squid cache.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0446</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
<cvename>CVE-2005-0096</cvename>
<cvename>CVE-2005-0097</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
</references>
<dates>
<discovery>2005-01-16</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
<topic>racoon -- remote denial-of-service</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20050510a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer discovered that the racoon ISAKMP daemon
could be crashed with a maliciously crafted UDP packet. No
authentication is required in order to perform the attack.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0398</cvename>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000</mlist>
<url>http://xforce.iss.net/xforce/xfdb/19707</url>
<url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view</url>
</references>
<dates>
<discovery>2005-03-12</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
<topic>xli -- integer overflows in image size calculations</topic>
<affects>
<package>
<name>xli</name>
<range><le>1.17.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy discovered several integer overflows in xli's
image size handling. A maliciously crafted image may be able
to cause a heap buffer overflow and execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0639</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
<url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
</references>
<dates>
<discovery>2005-02-08</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
<topic>xloadimage -- arbitrary command execution when handling compressed files</topic>
<affects>
<package>
<name>xli</name>
<range><le>1.17.0_1</le></range>
</package>
<package>
<name>xloadimage</name>
<range><le>4.1.10</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy discovered that xli and xloadimage attempt to
decompress images by piping them through <code>gunzip</code>
or similar decompression tools. Unfortunately, the
unsanitized file name is included as part of the command.
This is dangerous, as in some situations, such as mailcap
processing, an attacker may control the input file name. As a
result, an attacker may be able to cause arbitrary command
execution.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0638</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
</references>
<dates>
<discovery>2005-02-18</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="8c1da77d-d3e9-11d9-8ffb-00061bc2ad93">
<topic>xloadimage -- buffer overflow in FACES image handling</topic>
<affects>
<package>
<name>xli</name>
<range><le>1.17.0_1</le></range>
</package>
<package>
<name>xloadimage</name>
<range><lt>4.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In 2001, zen-parse discovered a buffer overflow in
xloadimage's FACES image loader. A maliciously crafted image
could cause xloadimage to execute arbitrary code. A published
exploit exists for this vulnerability.</p>
<p>In 2005, Rob Holland discovered that the same vulnerability
was present in xli.</p>
</body>
</description>
<references>
<cvename>CVE-2001-0775</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=99477230306845</mlist>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
</references>
<dates>
<discovery>2000-02-19</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93">
<topic>yamt -- buffer overflow and directory traversal issues</topic>
<affects>
<package>
<name>yamt</name>
<range><lt>0.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stanislav Brabec discovered errors in yamt's path name
handling that lead to buffer overflows and directory traversal
issues. When processing a file with a maliciously crafted ID3
tag, yamt might overwrite arbitrary files or possibly execute
arbitrary code.</p>
<p>The SuSE package ChangeLog contains:</p>
<blockquote>
<ul>
<li>Several security fixes (#49337):</li>
<li>directory traversal in rename</li>
<li>directory traversal in sort</li>
<li>buffer overflow in sort</li>
<li>buffer overflow in rename</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1846</cvename>
<cvename>CVE-2005-1847</cvename>
<url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
<url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
</references>
<dates>
<discovery>2005-01-20</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d">
<topic>xview -- multiple buffer overflows in xv_parse_one</topic>
<affects>
<package>
<name>xview</name>
<range><lt>3.2.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Security Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-672">
<p>Erik Sjölund discovered that programs linked against xview
are vulnerable to a number of buffer overflows in the XView
library. When the overflow is triggered in a program which
is installed setuid root a malicious user could perhaps
execute arbitrary code as privileged user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0076</cvename>
<url>http://www.debian.org/security/2005/dsa-672</url>
<url>http://xforce.iss.net/xforce/xfdb/19271</url>
</references>
<dates>
<discovery>2005-02-09</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
<topic>xtrlock -- X display locking bypass</topic>
<affects>
<package>
<name>xtrlock</name>
<range><lt>2.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The X display locking program <code>xtrlock</code> contains
an integer overflow bug. It is possible for an attacker with
physical access to the system to bypass the display lock.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0079</cvename>
<url>http://www.debian.org/security/2005/dsa-649</url>
<url>http://xforce.iss.net/xforce/xfdb/18991</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
</references>
<dates>
<discovery>2004-10-25</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="bf2e7483-d3fa-440d-8c6e-8f1f2f018818">
<topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
<affects>
<package>
<name>linux_base</name>
<range><lt>7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Trevor Johnson reported that the Red Hat Linux RPMs used
by linux_base contained multiple older vulnerabilities, such
as a DNS resolver issue and critical bugs in X font handling
and XPM image handling.</p>
</body>
</description>
<references>
<url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
<cvename>CVE-2002-0029</cvename>
<cvename>CVE-2004-0083</cvename>
<cvename>CVE-2004-0084</cvename>
<cvename>CVE-2004-0106</cvename>
<cvename>CVE-2004-0687</cvename>
<cvename>CVE-2004-0688</cvename>
<cvename>CVE-2004-0692</cvename>
<cvename>CVE-2004-0914</cvename>
</references>
<dates>
<discovery>2004-09-27</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
<topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
<affects>
<package>
<name>squirrelmail</name>
<name>ja-squirrelmail</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A SquirrelMail Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662">
<p>SquirrelMail 1.4.4 has been released to resolve a number of
security issues disclosed below. It is strongly recommended
that all running SquirrelMail prior to 1.4.4 upgrade to the
latest release.</p>
<h1>Remote File Inclusion</h1>
<p>Manoel Zaninetti reported an issue in src/webmail.php which
would allow a crafted URL to include a remote web page.
This was assigned CAN-2005-0103 by the Common
Vulnerabilities and Exposures.</p>
<h1>Cross Site Scripting Issues</h1>
<p>A possible cross site scripting issue exists in
src/webmail.php that is only accessible when the PHP
installation is running with register_globals set to On.
This issue was uncovered internally by the SquirrelMail
Development team. This isssue was assigned CAN-2005-0104 by
the Common Vulnerabilities and Exposures.</p>
<p>A second issue which was resolved in the 1.4.4-rc1 release
was uncovered and assigned CAN-2004-1036 by the Common
Vulnerabilities and Exposures. This issue could allow a
remote user to send a specially crafted header and cause
execution of script (such as javascript) in the client
browser.</p>
<h1>Local File Inclusion</h1>
<p>A possible local file inclusion issue was uncovered by one
of our developers involving custom preference handlers.
This issue is only active if the PHP installation is running
with register_globals set to On.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1036</cvename>
<cvename>CVE-2005-0075</cvename>
<cvename>CVE-2005-0103</cvename>
<cvename>CVE-2005-0104</cvename>
<mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662</mlist>
<url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
<url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
<url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
</references>
<dates>
<discovery>2005-01-29</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
<topic>sympa -- buffer overflow in "queue"</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>4.1.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Sjölund discovered a vulnerability in Sympa. The
<code>queue</code> application processes messages received via
aliases. It contains a buffer overflow in the usage of
<code>sprintf</code>. In some configurations, it may allow an
attacker to execute arbitrary code as the <code>sympa</code>
user.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0073</cvename>
<url>http://www.debian.org/security/2005/dsa-677</url>
</references>
<dates>
<discovery>2005-02-11</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="b3cd00f7-c0c5-452d-87bc-086c5635333e">
<topic>mailman -- generated passwords are poor quality</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer wrote:</p>
<blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
<p>Mailman 2.1.5 uses weak auto-generated passwords for new
subscribers. These passwords are assigned when members
subscribe without specifying their own password (either by
email or the web frontend). Knowledge of this password
allows an attacker to gain access to the list archive even
though she's not a member and the archive is restricted to
members only. [...]</p>
<p>This means that only about 5 million different passwords
are ever generated, a number that is in the range of brute
force attacks -- you only have to guess one subscriber
address (which is usually not that hard).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1143</cvename>
<mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
<mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
<topic>mailman -- password disclosure</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Barry Warsaw reports:</p>
<blockquote cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
<p>Today I am releasing Mailman 2.1.5, a bug fix release
[...] This version also contains a fix for an exploit that
could allow 3rd parties to retrieve member passwords. It is
thus highly recommended that all existing sites upgrade to
the latest version.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0412</cvename>
<mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
</references>
<dates>
<discovery>2004-05-15</discovery>
<entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="26a08c77-32da-4dd7-a884-a76fc49aa824">
<topic>tomcat -- Tomcat Manager cross-site scripting</topic>
<affects>
<package>
<name>jakarta-tomcat</name>
<range><ge>5.0.*</ge><lt>5.0.30_5</lt></range>
<range><ge>5.5.*</ge><lt>5.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oliver Karow discovered cross-site scripting issues in
the Apache Jakarta Tomcat manager. The developers refer to
the issues as <q>minor</q>.</p>
</body>
</description>
<references>
<url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
<mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
</references>
<dates>
<discovery>2005-01-03</discovery>
<entry>2005-06-01</entry>
<modified>2006-09-12</modified>
</dates>
</vuln>
<vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
<topic>fswiki -- XSS problem in file upload form</topic>
<affects>
<package>
<name>fswiki</name>
<range><le>3.5.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia security advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/15538">
<p>A vulnerability has been reported in FreeStyle Wiki and
FSWikiLite, which can be exploited by malicious people to
conduct script insertion attacks.</p>
<p>Input passed in uploaded attachments is not properly
sanitised before being used. This can be exploited to inject
arbitrary HTML and script code, which will be executed in a
user's browser session in context of an affected site when
the malicious attachment is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1799</cvename>
<url>http://secunia.com/advisories/15538</url>
<freebsdpr>ports/81520</freebsdpr>
<url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
<url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
</references>
<dates>
<discovery>2005-05-19</discovery>
<entry>2005-05-29</entry>
<modified>2005-06-01</modified>
</dates>
</vuln>
<vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
<topic>freeradius -- sql injection and denial of service vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<range><le>1.0.2_1</le></range>
</package>
<package>
<name>freeradius-devel</name>
<range><le>1.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
<p>The FreeRADIUS server is vulnerable to an SQL injection
attack and a buffer overflow, possibly resulting in
disclosure and modification of data and Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<bid>13540</bid>
<bid>13541</bid>
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
</references>
<dates>
<discovery>2005-05-17</discovery>
<entry>2005-05-22</entry>
<modified>2008-01-20</modified>
</dates>
</vuln>
<vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
<topic>ppxp -- local root exploit</topic>
<affects>
<package>
<name>ppxp</name>
<range><gt>0</gt></range>
</package>
<package>
<name>ja-ppxp</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-725">
<p>Jens Steube discovered that ppxp, yet another PPP program,
does not release root privileges when opening potentially
user supplied log files. This can be tricked into opening
a root shell.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0392</cvename>
<url>http://www.debian.org/security/2005/dsa-725</url>
</references>
<dates>
<discovery>2005-05-19</discovery>
<entry>2005-05-22</entry>
</dates>
</vuln>
<vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
<topic>oops -- format string vulnerability</topic>
<affects>
<package>
<name>oops</name>
<range><le>1.5.24</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A RST/GHC Advisory reports that there is an format string
vulnerability in oops. The vulnerability can be found in
the MySQL/PgSQL authentication module. Succesful
exploitation may allow execution of arbitrary code.</p>
</body>
</description>
<references>
<bid>13172</bid>
<cvename>CVE-2005-1121</cvename>
<url>http://rst.void.ru/papers/advisory24.txt</url>
</references>
<dates>
<discovery>2005-04-14</discovery>
<entry>2005-05-22</entry>
</dates>
</vuln>
<vuln vid="d51a7e6e-c546-11d9-9aed-000e0c2e438a">
<topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
<affects>
<package>
<name>cdrdao</name>
<range><lt>1.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The developers of cdrdao report that there is a potential
root exploit in the software. In order to be able to
succesfully exploit this vulnerability cdrdao must be
installed setuid root. When succesfully exploited a local
user might get escalated privileges. By default this port is
not installed setuid root.</p>
</body>
</description>
<references>
<url>http://secunia.com/advisories/15354/</url>
<url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
</references>
<dates>
<discovery>2005-05-13</discovery>
<entry>2005-05-19</entry>
</dates>
</vuln>
<vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
<topic>gaim -- MSN remote DoS vulnerability</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
<p>Potential remote denial of service bug resulting from not
checking a pointer for non-NULL before passing it to
strncmp, which results in a crash. This can be triggered
by a remote client sending an SLP message with an empty
body.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1262</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=17</url>
</references>
<dates>
<discovery>2005-05-10</discovery>
<entry>2005-05-14</entry>
</dates>
</vuln>
<vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
<topic>gaim -- remote crash on some protocols</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports that GAIM is vulnerable to a
denial-of-service vulnerability which can cause GAIM to
crash:</p>
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
<p>It is possible for a remote user to overflow a static
buffer by sending an IM containing a very large URL
(greater than 8192 bytes) to the Gaim user. This is not
possible on all protocols, due to message length
restrictions. Jabber are SILC are known to be
vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1261</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=16</url>
</references>
<dates>
<discovery>2005-05-10</discovery>
<entry>2005-05-14</entry>
</dates>
</vuln>
<vuln vid="180e9a38-060f-4c16-a6b7-49f3505ff22a">
<topic>kernel -- information disclosure when using HTT</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_1</lt></range>
<range><ge>5.0</ge><lt>5.3_15</lt></range>
<range><ge>4.11</ge><lt>4.11_9</lt></range>
<range><lt>4.10_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description and impact</h1>
<p>When running on processors supporting Hyper-Threading Technology, it
is possible for a malicious thread to monitor the execution of another
thread.</p>
<p>Information may be disclosed to local users, allowing in many
cases for privilege escalation. For example, on a multi-user
system, it may be possible to steal cryptographic keys used in
applications such as OpenSSH or SSL-enabled web servers.</p>
<p><strong>NOTE:</strong> Similar problems may exist in other
simultaneous multithreading implementations, or even some
systems in the absence of simultaneous multithreading.
However, current research has only demonstrated this flaw in
Hyper-Threading Technology, where shared memory caches are
used.</p>
<h1>Workaround</h1>
<p>Systems not using processors with Hyper-Threading Technology
support are not affected by this issue. On systems which are
affected, the security flaw can be eliminated by setting the
"machdep.hlt_logical_cpus" tunable:</p>
<pre># echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf</pre>
<p>The system must be rebooted in order for tunables to take effect.</p>
<p>Use of this workaround is not recommended on "dual-core" systems, as
this workaround will also disable one of the processor
cores.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0109</cvename>
<freebsdsa>SA-05:09.htt</freebsdsa>
<url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
</references>
<dates>
<discovery>2005-05-13</discovery>
<entry>2005-05-13</entry>
</dates>
</vuln>
<vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
<topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
<affects>
<package>
<name>leafnode</name>
<range><ge>1.9.48</ge><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When an upstream server aborts the transmission or stops sending
data after the fetchnews program has requested an article header
or body, fetchnews may crash, without querying further servers
that are configured. This can prevent articles from being fetched.
</p>
</body>
</description>
<references>
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
<cvename>CVE-2005-1453</cvename>
<freebsdpr>ports/80663</freebsdpr>
<bid>13489</bid>
<bid>13492</bid>
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&forum_id=10210</mlist>
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
<url>http://www.frsirt.com/english/advisories/2005/0468</url>
<url>http://secunia.com/advisories/15252</url>
</references>
<dates>
<discovery>2005-05-04</discovery>
<entry>2005-05-13</entry>
</dates>
</vuln>
<vuln vid="a6427195-c2c7-11d9-89f7-02061b08fc24">
<topic>mozilla -- privilege escalation via non-DOM property overrides</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.4</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.8</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
<p>Additional checks were added to make sure Javascript eval
and Script objects are run with the privileges of the
context that created them, not the potentially elevated
privilege of the context calling them in order to protect
against an additional variant of <a href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
2005-41</a>.</p>
</blockquote>
<p>The Mozilla Foundation Security Advisory MFSA 2005-41
reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
<p>moz_bug_r_a4 reported several exploits giving an attacker
the ability to install malicious code or steal data,
requiring only that the user do commonplace actions like
click on a link or open the context menu.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
</references>
<dates>
<discovery>2005-05-11</discovery>
<entry>2005-05-12</entry>
</dates>
</vuln>
<vuln vid="a81746a1-c2c7-11d9-89f7-02061b08fc24">
<topic>mozilla -- "Wrapped" javascript: urls bypass security checks</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.4</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.8</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
<p>Some security checks intended to prevent script injection
were incorrect and could be bypassed by wrapping a
javascript: url in the view-source:
pseudo-protocol. Michael Krax demonstrated that a variant
of his <a href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
exploit could still execute arbitrary code, and the same
technique could also be used to perform cross-site
scripting.</p>
<p>Georgi Guninski demonstrated the same flaw wrapping
javascript: urls with the jar: pseudo-protocol.</p>
<p>L. David Baron discovered a nested variant that defeated
checks in the script security manager.</p>
<p><strong>Workaround:</strong> Disable Javascript</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
</references>
<dates>
<discovery>2005-05-11</discovery>
<entry>2005-05-12</entry>
</dates>
</vuln>
<vuln vid="eca6195a-c233-11d9-804c-02061b08fc24">
<topic>mozilla -- code execution via javascript: IconURL vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.4</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.8</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
<p>Two vulnerabilities have been discovered in Firefox,
which can be exploited by malicious people to conduct
cross-site scripting attacks and compromise a user's
system.</p>
<ol>
<li>The problem is that "IFRAME" JavaScript URLs are not
properly protected from being executed in context of
another URL in the history list. This can be exploited
to execute arbitrary HTML and script code in a user's
browser session in context of an arbitrary site.</li>
<li>Input passed to the "IconURL" parameter in
"InstallTrigger.install()" is not properly verified
before being used. This can be exploited to execute
arbitrary JavaScript code with escalated privileges via
a specially crafted JavaScript URL.</li>
</ol>
<p>Successful exploitation requires that the site is allowed
to install software (default sites are
"update.mozilla.org" and "addons.mozilla.org").</p>
<p>A combination of vulnerability 1 and 2 can be exploited
to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1476</cvename>
<cvename>CVE-2005-1477</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
</references>
<dates>
<discovery>2005-05-08</discovery>
<entry>2005-05-11</entry>
</dates>
</vuln>
<vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
<topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
<affects>
<package>
<name>ja-groff</name>
<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The eqn2graph and pic2graph scripts in groff 1.18.1
allow local users to overwrite arbitrary files via
a symlink attack on temporary files.</p>
</body>
</description>
<references>
<freebsdpr>ports/80671</freebsdpr>
<bid>12058</bid>
<cvename>CVE-2004-1296</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
</references>
<dates>
<discovery>2004-12-20</discovery>
<entry>2005-05-09</entry>
</dates>
</vuln>
<vuln vid="169f422f-bd88-11d9-a281-02e018374e71">
<topic>groff -- groffer uses temporary files unsafely</topic>
<affects>
<package>
<name>ja-groff</name>
<range><ge>1.18</ge><lt>1.18.1_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The groffer script in the groff package 1.18 and later versions
allows local users to overwrite files via a symlink attack
on temporary files.</p>
</body>
</description>
<references>
<freebsdpr>ports/80671</freebsdpr>
<bid>11287</bid>
<cvename>CVE-2004-0969</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
</references>
<dates>
<discovery>2004-09-30</discovery>
<entry>2005-05-09</entry>
</dates>
</vuln>
<vuln vid="5f003a08-ba3c-11d9-837d-000e0c2e438a">
<topic>sharutils -- unshar insecure temporary file creation</topic>
<affects>
<package>
<name>sharutils</name>
<range><lt>4.3.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ubuntu Advisory reports:</p>
<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
<p>Joey Hess discovered that "unshar" created temporary files
in an insecure manner. This could allow a symbolic link
attack to create or overwrite arbitrary files with the
privileges of the user invoking the program.</p>
</blockquote>
</body>
</description>
<references>
<bid>12981</bid>
<cvename>CVE-2005-0990</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
</references>
<dates>
<discovery>2005-04-04</discovery>
<entry>2005-05-01</entry>
</dates>
</vuln>
<vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
<topic>rsnapshot -- local privilege escalation</topic>
<affects>
<package>
<name>rsnapshot</name>
<range><lt>1.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An rsnapshot Advisory reports:</p>
<blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
<p>The copy_symlink() subroutine in rsnapshot incorrectly
changes file ownership on the files pointed to by symlinks,
not on the symlinks themselves. This would allow, under
certain circumstances, an arbitrary user to take ownership
of a file on the main filesystem.</p>
</blockquote>
</body>
</description>
<references>
<bid>13095</bid>
<cvename>CVE-2005-1064</cvename>
<url>http://www.rsnapshot.org/security/2005/001.html</url>
</references>
<dates>
<discovery>2005-04-10</discovery>
<entry>2005-05-01</entry>
</dates>
</vuln>
<vuln vid="756db070-b9d4-11d9-ae81-000ae42e9b93">
<topic>coppermine -- IP spoofing and XSS vulnerability</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GHC team reports about coppermine</p>
<blockquote cite="http://www.securityfocus.com/archive/1/396080">
<p>The lack of sanitizing of user defined variables may
result in undesirable consequences such as IP spoofing
or XSS attack.</p>
<p>Generally users of Coppermine Gallery can post comments.
Remote address & x-forwarded-for variables are logged
for admin's eyes. X-Forwarded-for variable does not pass
throu any filtration before logging into database. User
can define/redefine this variable.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
<bid>13218</bid>
<cvename>CVE-2005-1172</cvename>
<url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
</references>
<dates>
<discovery>2005-04-18</discovery>
<entry>2005-05-01</entry>
</dates>
</vuln>
<vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
<topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Damian Put reports about ImageMagick:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869">
<p>Remote exploitation of a heap overflow vulnerability
could allow execution of arbitrary code or course denial
of service.</p>
<p>A heap overflow exists in ReadPNMImage() function, that
is used to decode a PNM image files.</p>
</blockquote>
</body>
</description>
<references>
<bid>13351</bid>
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869</url>
</references>
<dates>
<discovery>2005-04-25</discovery>
<entry>2005-04-27</entry>
</dates>
</vuln>
<vuln vid="91c606fc-b5d0-11d9-a788-0001020eed82">
<topic>mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.7</lt></range>
</package>
<package>
<name>libxine</name>
<range><ge>0.9.9</ge><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A xine security announcement reports:</p>
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
<p>By a user receiving data from a malicious network
streaming server, an attacker can overrun a heap buffer,
which can, on some systems, lead to or help in executing
attacker-chosen malicious code with the permissions of the
user running a xine-lib based media application.</p>
<p>Both the MMS and Real RTSP streaming client code made
some too-strong assumptions on the transferred
data. Several critical bounds checks were missing,
resulting in the possibility of heap overflows, should the
remote server not adhere to these assumptions. In the MMS
case, a remote server could present content with too many
individual streams; in the RTSP case, a remote server's
reply could have too many lines.</p>
<p>An attacker can set up a server delivering malicious data
to the users. This can be used to overflow a heap buffer,
which can, with certain implementations of heap
management, lead to attacker chosen data written to the
stack. This can cause attacker-chosen code being executed
with the permissions of the user running the
application. By tricking users to retrieve a stream, which
can be as easy as providing a link on a website, this
vulnerability can be exploited remotely.</p>
</blockquote>
</body>
</description>
<references>
<bid>13270</bid>
<bid>13271</bid>
<cvename>CVE-2005-1195</cvename>
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
<url>http://xinehq.de/index.php/security/XSA-2004-8</url>
</references>
<dates>
<discovery>2005-04-16</discovery>
<entry>2005-04-25</entry>
</dates>
</vuln>
<vuln vid="8b0e94cc-b5cd-11d9-a788-0001020eed82">
<topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports that GAIM is vulnerable to a
denial-of-service vulnerability which can cause GAIM to
freeze:</p>
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
<p>Certain malformed SNAC packets sent by other AIM or ICQ
users can trigger an infinite loop in Gaim when parsing
the SNAC. The remote user would need a custom client, able
to generate malformed SNACs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0472</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=10</url>
</references>
<dates>
<discovery>2005-02-17</discovery>
<entry>2005-04-25</entry>
</dates>
</vuln>
<vuln vid="142353df-b5cc-11d9-a788-0001020eed82">
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
<p>Receiving malformed HTML can result in an invalid memory
access causing Gaim to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0208</cvename>
<cvename>CVE-2005-0473</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=11</url>
<url>http://gaim.sourceforge.net/security/index.php?id=12</url>
</references>
<dates>
<discovery>2005-02-17</discovery>
<entry>2005-04-25</entry>
</dates>
</vuln>
<vuln vid="91f1adc7-b3e9-11d9-a788-0001020eed82">
<topic>kdewebdev -- kommander untrusted code execution vulnerability</topic>
<affects>
<package>
<name>kdewebdev</name>
<range><gt>3.2,2</gt><lt>3.4.0_1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
<p>Kommander executes without user confirmation data files
from possibly untrusted locations. As they contain
scripts, the user might accidentally run arbitrary
code.</p>
<p><strong>Impact:</strong> Remotly supplied kommander files
from untrusted sources are executed without
confirmation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0754</cvename>
<url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
</references>
<dates>
<discovery>2005-04-20</discovery>
<entry>2005-04-23</entry>
<modified>2008-08-04</modified>
</dates>
</vuln>
<vuln vid="97edf5ab-b319-11d9-837d-000e0c2e438a">
<topic>junkbuster -- heap corruption vulnerability and configuration modification vulnerability</topic>
<affects>
<package>
<name>junkbuster</name>
<range><lt>2.0.2_3</lt></range>
</package>
<package>
<name>junkbuster-zlib</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-713">
<p>James Ranson discovered that an attacker can modify the
referrer setting with a carefully crafted URL by accidently
overwriting a global variable.</p>
<p>Tavis Ormandy from the Gentoo Security Team discovered
several heap corruptions due to inconsistent use of an
internal function that can crash the daemon or possibly
lead to the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>13146</bid>
<bid>13147</bid>
<cvename>CVE-2005-1108</cvename>
<cvename>CVE-2005-1109</cvename>
<url>http://www.debian.org/security/2005/dsa-713</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
</references>
<dates>
<discovery>2005-04-13</discovery>
<entry>2005-04-22</entry>
</dates>
</vuln>
<vuln vid="06404241-b306-11d9-a788-0001020eed82">
<topic>kdelibs -- kimgio input validation errors</topic>
<affects>
<package>
<name>kdelibs</name>
<range><ge>3.2</ge><lt>3.4.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
<p>kimgio contains a PCX image file format reader that does
not properly perform input validation. A source code audit
performed by the KDE security team discovered several
vulnerabilities in the PCX and other image file format
readers, some of them exploitable to execute arbitrary
code.</p>
<p><strong>Impact:</strong> Remotely supplied, specially
crafted image files can be used to execute arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1046</cvename>
<url>http://bugs.kde.org/102328</url>
<url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
</references>
<dates>
<discovery>2005-04-21</discovery>
<entry>2005-04-22</entry>
</dates>
</vuln>
<vuln vid="6c2d4f29-af3e-11d9-837d-000e0c2e438a">
<topic>gld -- format string and buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>gld</name>
<range><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gld has been found vulnerable to multiple buffer overflows as
well as multiple format string vulnerabilities.</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880">
<p>An attacker could exploit this vulnerability to execute
arbitrary code with the permissions of the user running Gld,
the default user being root.</p>
</blockquote>
<p>The FreeBSD port defaults to running gld as the root user.
The risk of exploitation can be minimized by making gld
listen on the loopback address only, or configure it to only
accept connections from trusted smtp servers.</p>
</body>
</description>
<references>
<bid>13129</bid>
<bid>13133</bid>
<cvename>CVE-2005-1099</cvename>
<cvename>CVE-2005-1100</cvename>
<mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880</mlist>
<mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111342432325670</mlist>
</references>
<dates>
<discovery>2005-04-12</discovery>
<entry>2005-04-19</entry>
</dates>
</vuln>
<vuln vid="0163b498-af54-11d9-acd0-000854d03344">
<topic>axel -- remote buffer overflow</topic>
<affects>
<package>
<name>axel</name>
<range><lt>1.0a_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Security Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-706">
<p>Ulf Härnhammar from the Debian Security Audit Project
discovered a buffer overflow in axel, a light download
accelerator. When reading remote input the program did
not check if a part of the input can overflow a buffer
and maybe trigger the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>13059</bid>
<cvename>CVE-2005-0390</cvename>
<url>http://www.debian.org/security/2005/dsa-706</url>
</references>
<dates>
<discovery>2005-04-16</discovery>
<entry>2005-04-17</entry>
</dates>
</vuln>
<vuln vid="ce6ac624-aec8-11d9-a788-0001020eed82">
<topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
<p>When a webpage requires a plugin that is not installed
the user can click to launch the Plugin Finder Service
(PFS) to find an appropriate plugin. If the service does
not have an appropriate plugin the EMBED tag is checked
for a PLUGINSPAGE attribute, and if one is found the PFS
dialog will contain a "manual install" button that will
load the PLUGINSPAGE url.</p>
<p>Omar Khan reported that if the PLUGINSPAGE attribute
contains a javascript: url then pressing the button could
launch arbitrary code capable of stealing local data or
installing malicious code.</p>
<p>Doron Rosenberg reported a variant that injects script by
appending it to a malformed URL of any protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0752</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
</references>
<dates>
<discovery>2005-03-31</discovery>
<entry>2005-04-16</entry>
</dates>
</vuln>
<vuln vid="18e5428f-ae7c-11d9-837d-000e0c2e438a">
<topic>jdk -- jar directory traversal vulnerability</topic>
<affects>
<package>
<name>jdk</name>
<range><le>1.2.2p11_3</le></range>
<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
</package>
<package>
<name>linux-ibm-jdk</name>
<range><le>1.4.2_1</le></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><le>1.4.2.08_1</le></range>
<range><eq>1.5.0b1</eq></range>
<range><eq>1.5.0b1,1</eq></range>
<range><ge>1.5.0,2</ge><le>1.5.0.02,2</le></range>
</package>
<package>
<name>linux-blackdown-jdk</name>
<range><le>1.4.2_2</le></range>
</package>
<package>
<name>diablo-jdk</name>
<range><le>1.3.1.0_1</le></range>
</package>
<package>
<name>diablo-jdk-freebsd6</name>
<range><le>i386.1.5.0.07.00</le></range>
</package>
<package>
<name>linux-jdk</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pluf has discovered a vulnerability in Sun Java JDK/SDK,
which potentially can be exploited by malicious people to
compromise a user's system.</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508">
<p>The jar tool does not check properly if the files to be
extracted have the string "../" on its names, so it's
possible for an attacker to create a malicious jar file in
order to overwrite arbitrary files within the filesystem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1080</cvename>
<mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508</mlist>
<url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
<url>http://secunia.com/advisories/14902/</url>
</references>
<dates>
<discovery>2005-04-11</discovery>
<entry>2005-04-16</entry>
<modified>2006-09-12</modified>
</dates>
</vuln>
<vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
<topic>mozilla -- privilege escalation via DOM property overrides</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.7</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
<p>moz_bug_r_a4 reported several exploits giving an attacker
the ability to install malicious code or steal data,
requiring only that the user do commonplace actions like
click on a link or open the context menu. The common cause
in each case was privileged UI code ("chrome") being
overly trusting of DOM nodes from the content
window. Scripts in the web page can override properties
and methods of DOM nodes and shadow the native values,
unless steps are taken to get the true underlying values.</p>
<p>We found that most extensions also interacted with
content DOM in a natural, but unsafe, manner. Changes were
made so that chrome code using this natural DOM coding
style will now automatically use the native DOM value if
it exists without having to use cumbersome wrapper
objects.</p>
<p>Most of the specific exploits involved tricking the
privileged code into calling eval() on an
attacker-supplied script string, or the equivalent using
the Script() object. Checks were added in the security
manager to make sure eval and Script objects are run with
the privileges of the context that created them, not the
potentially elevated privileges of the context calling
them.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
</references>
<dates>
<discovery>2005-04-15</discovery>
<entry>2005-04-16</entry>
</dates>
</vuln>
<vuln vid="1989b511-ae62-11d9-a788-0001020eed82">
<topic>mozilla -- code execution through javascript: favicons</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.7</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
<p>Firefox and the Mozilla Suite support custom "favicons"
through the <LINK rel="icon"> tag. If a link tag is added
to the page programmatically and a javascript: url is
used, then script will run with elevated privileges and
could run or install malicious software.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
</references>
<dates>
<discovery>2005-04-12</discovery>
<entry>2005-04-16</entry>
</dates>
</vuln>
<vuln vid="45b75152-ae5f-11d9-a788-0001020eed82">
<topic>mozilla -- javascript "lambda" replace exposes memory contents</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.7</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
<p>A bug in javascript's regular expression string
replacement when using an anonymous function as the
replacement argument allows a malicious script to capture
blocks of memory allocated to the browser. A web site
could capture data and transmit it to a server without
user interaction or knowledge.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0989</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
</references>
<dates>
<discovery>2005-04-01</discovery>
<entry>2005-04-16</entry>
</dates>
</vuln>
<vuln vid="1f2fdcff-ae60-11d9-a788-0001020eed82">
<topic>firefox -- arbitrary code execution in sidebar panel</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
<p>Sites can use the _search target to open links in the
Firefox sidebar. Two missing security checks allow
malicious scripts to first open a privileged page (such as
about:config) and then inject script using a javascript:
url. This could be used to install malicious code or steal
data without user interaction.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
</references>
<dates>
<discovery>2005-04-12</discovery>
<entry>2005-04-16</entry>
</dates>
</vuln>
<vuln vid="b206dd82-ac67-11d9-a788-0001020eed82">
<topic>openoffice -- DOC document heap overflow vulnerability</topic>
<affects>
<package>
<name>openoffice</name>
<name>ar-openoffice</name>
<name>ca-openoffice</name>
<name>cs-openoffice</name>
<name>de-openoffice</name>
<name>dk-openoffice</name>
<name>el-openoffice</name>
<name>es-openoffice</name>
<name>et-openoffice</name>
<name>fi-openoffice</name>
<name>fr-openoffice</name>
<name>gr-openoffice</name>
<name>hu-openoffice</name>
<name>it-openoffice</name>
<name>ja-openoffice</name>
<name>ko-openoffice</name>
<name>nl-openoffice</name>
<name>pl-openoffice</name>
<name>pt-openoffice</name>
<name>pt_BR-openoffice</name>
<name>ru-openoffice</name>
<name>se-openoffice</name>
<name>sk-openoffice</name>
<name>sl-openoffice-SI</name>
<name>tr-openoffice</name>
<name>zh-openoffice-CN</name>
<name>zh-openoffice-TW</name>
<!-- Deprecated names -->
<name>jp-openoffice</name>
<name>kr-openoffice</name>
<name>sl-openoffice-SL</name>
<name>zh-openoffice</name>
<name>zh_TW-openoffice</name>
<range><lt>1.1.4_2</lt></range>
<range><gt>2.*</gt><le>2.0.20050406</le></range>
</package>
<package>
<name>openoffice</name>
<name>ja-openoffice</name>
<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
<range><ge>641c</ge><le>645</le></range>
<range><eq>1.1RC4</eq></range>
<range><eq>1.1rc5</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>AD-LAB reports that a heap-based buffer overflow
vulnerability exists in OpenOffice's handling of DOC
documents. When reading a DOC document 16 bit from a 32 bit
integer is used for memory allocation, but the full 32 bit
is used for further processing of the document. This can
allow an attacker to crash OpenOffice, or potentially
execute arbitrary code as the user running OpenOffice, by
tricking an user into opening a specially crafted DOC
document.</p>
</body>
</description>
<references>
<bid>13092</bid>
<cvename>CVE-2005-0941</cvename>
<mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111325305109137</mlist>
<url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
</references>
<dates>
<discovery>2005-04-11</discovery>
<entry>2005-04-13</entry>
<modified>2005-04-20</modified>
</dates>
</vuln>
<vuln vid="22f00553-a09d-11d9-a788-0001020eed82">
<topic>portupgrade -- insecure temporary file handling vulnerability</topic>
<affects>
<package>
<name>portupgrade</name>
<range><lt>20041226_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon L. Nielsen discovered that portupgrade handles
temporary files in an insecure manner. This could allow an
unprivileged local attacker to execute arbitrary commands or
overwrite arbitrary files with the permissions of the user
running portupgrade, typically root, by way of a symlink
attack.</p>
<p>The following issues exist where the temporary files are
created, by default in the world writeable directory
/var/tmp, with the permissions of the user running
portupgrade:</p>
<ul>
<li>pkg_fetch download packages with a predictable local
filename allowing a local attacker to overwrite arbitrary
local files or potentially replace the downloaded package
after download but before install with a package with
malicious content, allowing the attacker to run arbitrary
commands.</li>
<li>portupgrade will, when upgrading ports/packages, write
the old package to a predictable temporary file, allowing
an attacker to overwrite arbitrary files via a symlink
attack.</li>
<li>portupgrade will <q>touch</q> a temporary file
with a constant filename (pkgdb.fixme) allowing an
attacker to create arbitrary zero-byte files via a symlink
attack.</li>
</ul>
<p>A workaround for these issues is to set the
<code>PKG_TMPDIR</code> environment variable to a directory
only write-able by the user running portupgrade.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0610</cvename>
</references>
<dates>
<discovery>2005-04-12</discovery>
<entry>2005-04-12</entry>
</dates>
</vuln>
<vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
<topic>gaim -- jabber remote crash</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=15">
<p>A remote jabber user can cause Gaim to crash by sending a
specific file transfer request.</p>
</blockquote>
</body>
</description>
<references>
<bid>13004</bid>
<cvename>CVE-2005-0967</cvename>
<url>http://gaim.sourceforge.net/security/?id=15</url>
</references>
<dates>
<discovery>2005-04-04</discovery>
<entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
<topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=14">
<p>The IRC protocol plugin in Gaim 1.2.0, and possibly
earlier versions, allows (1) remote attackers to inject
arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
irc_msg_part, irc_msg_quit, (2) remote attackers to inject
arbitrary Pango markup and pop up empty dialog boxes via
irc_msg_invite, or (3) malicious IRC servers to cause a
denial of service (application crash) by injecting certain
Pango markup into irc_msg_badmode, irc_msg_banned,
irc_msg_unknown, irc_msg_nochan functions.</p>
</blockquote>
</body>
</description>
<references>
<bid>13003</bid>
<cvename>CVE-2005-0966</cvename>
<url>http://gaim.sourceforge.net/security/?id=14</url>
</references>
<dates>
<discovery>2005-04-02</discovery>
<entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="3fa2b372-a9f5-11d9-a788-0001020eed82">
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=13">
<p>The gaim_markup_strip_html function in Gaim 1.2.0, and
possibly earlier versions, allows remote attackers to
cause a denial of service (application crash) via a string
that contains malformed HTML, which causes an
out-of-bounds read.</p>
</blockquote>
</body>
</description>
<references>
<bid>12999</bid>
<cvename>CVE-2005-0965</cvename>
<url>http://gaim.sourceforge.net/security/?id=13</url>
</references>
<dates>
<discovery>2005-04-02</discovery>
<entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
<topic>php -- readfile() DoS vulnerability</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php4</name>
<range><lt>4.3.5_7</lt></range>
</package>
<package>
<name>mod_php</name>
<name>mod_php4</name>
<range><lt>4.3.5_7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A SUSE Security advisory reports:</p>
<blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
<p>A bug in the readfile() function of php4 could be used to
to crash the httpd running the php4 code when accessing
files with a multiple of the architectures page size
leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>12665</bid>
<cvename>CVE-2005-0596</cvename>
<url>http://bugs.php.net/bug.php?id=27037</url>
<url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
</references>
<dates>
<discovery>2004-01-25</discovery>
<entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="8dbf7894-a9a8-11d9-a788-0001020eed82">
<topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><le>2.5.7_12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
<p>An inconsistent state is entered on a failed PUT/POST
request making a high risk for segmentation faults or
other strange errors</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0718</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
</references>
<dates>
<discovery>2005-02-03</discovery>
<entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
<topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><gt>3.*</gt><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisory: SA14730</p>
<blockquote cite="http://secunia.com/advisories/14730">
<p>A vulnerability has been reported in Horde, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed when setting the parent frame's page title via
JavaScript is not properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.</p>
<p>The vulnerability has been reported in version 3.0.4-RC2. Prior
versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0961</cvename>
<mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h</url>
</references>
<dates>
<discovery>2005-03-29</discovery>
<entry>2005-04-05</entry>
</dates>
</vuln>
<vuln vid="ef410571-a541-11d9-a788-0001020eed82">
<topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
<affects>
<package>
<name>wu-ftpd</name>
<range><lt>2.6.2_6</lt></range>
</package>
<package>
<name>wu-ftpd+ipv6</name>
<range><lt>2.6.2_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939">
<p>Remote exploitation of an input validation vulnerability
in version 2.6.2 of WU-FPTD could allow for a denial of
service of the system by resource exhaustion.</p>
<p>The vulnerability specifically exists in the
<code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
pattern containing a '*' character is supplied as input,
the function calls itself recursively on a smaller
substring. By supplying a string which contains a large
number of '*' characters, the system will take a long time
to return the results, during which time it will be using
a large amount of CPU time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0256</cvename>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939</mlist>
</references>
<dates>
<discovery>2005-02-05</discovery>
<entry>2005-04-04</entry>
</dates>
</vuln>
<vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
<topic>hashcash -- format string vulnerability</topic>
<affects>
<package>
<name>hashcash</name>
<range><lt>1.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
identified a flaw in the Hashcash utility that an attacker
could expose by specifying a malformed reply address.</p>
<p>Successful exploitation would permit an attacker to disrupt
Hashcash users, and potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0687</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
</references>
<dates>
<discovery>2005-03-06</discovery>
<entry>2005-04-02</entry>
<modified>2005-04-03</modified>
</dates>
</vuln>
<vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
<topic>clamav -- zip handling DoS vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.81</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20050408</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The clamav daemon is vulnerable to a DoS vulnerability due
to insufficient handling of malformed zip files which can
crash the clamav daemon.</p>
</body>
</description>
<references>
<bid>12408</bid>
<cvename>CVE-2005-0133</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
</references>
<dates>
<discovery>2005-01-27</discovery>
<entry>2005-03-26</entry>
<modified>2005-04-09</modified>
</dates>
</vuln>
<vuln vid="48a59c96-9c6e-11d9-a040-000a95bc6fae">
<topic>wine -- information disclosure due to insecure temporary file handling</topic>
<affects>
<package>
<name>wine</name>
<range><lt>20050310</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to insecure temporary file creation in the Wine Windows
emulator, it is possible for any user to read potentially
sensitive information from temporary registry files.</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842">
<p>When a Win32 application is launched by wine, wine makes
a dump of the Windows registry in /tmp with name
regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
value of the current wine process and yyyy is an integer
value usually equal to zero.</p>
<p>regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
permissions. This could represent a security problem in a
multi-user environment. Indeed, any local user could
access to windows regstry's dump and get sensitive
information, like passwords and other private data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0787</cvename>
<mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842</mlist>
<url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
<url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
<url>http://www.zone-h.org/advisories/read/id=7300</url>
<url>http://www.securityfocus.com/bid/12791</url>
<url>http://xforce.iss.net/xforce/xfdb/19697</url>
</references>
<dates>
<discovery>2005-03-13</discovery>
<entry>2005-03-24</entry>
</dates>
</vuln>
<vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
<topic>firefox -- arbitrary code execution from sidebar panel</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory states:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
<p>If a user bookmarked a malicious page as a Firefox
sidebar panel that page could execute arbitrary programs
by opening a privileged page and injecting javascript into
it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0402</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
</references>
<dates>
<discovery>2005-03-03</discovery>
<entry>2005-03-24</entry>
</dates>
</vuln>
<vuln vid="7d2aac52-9c6b-11d9-99a7-000a95bc6fae">
<topic>mozilla -- heap buffer overflow in GIF image processing</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.2,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-firefox</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.6,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.6</lt></range>
<range><ge>1.8.*</ge></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory states:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
<p>An <em>(sic)</em> GIF processing error when parsing the
obsolete Netscape extension 2 can lead to an exploitable
heap overrun, allowing an attacker to run arbitrary code on
the user's machine.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0399</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
<url>http://xforce.iss.net/xforce/alerts/id/191</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
</references>
<dates>
<discovery>2005-03-10</discovery>
<entry>2005-03-24</entry>
</dates>
</vuln>
<vuln vid="f8536143-9bc4-11d9-b8b3-000a95bc6fae">
<topic>sylpheed -- buffer overflow in header processing</topic>
<affects>
<package>
<name>sylpheed</name>
<name>sylpheed-claws</name>
<name>sylpheed-gtk2</name>
<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sylpheed web site states:</p>
<blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
<p>A buffer overflow which occurred when replying to a
message with certain headers which contain non-ascii
characters was fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0667</cvename>
<url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
</references>
<dates>
<discovery>2005-03-07</discovery>
<entry>2005-03-23</entry>
</dates>
</vuln>
<vuln vid="a4bd3039-9a48-11d9-a256-0001020eed82">
<topic>xv -- filename handling format string vulnerability</topic>
<affects>
<package>
<name>xv</name>
<name>ja-xv</name>
<range><lt>3.10a_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
identified a flaw in the handling of image filenames by xv.</p>
<p>Successful exploitation would require a victim to process
a specially crafted image with a malformed filename,
potentially resulting in the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0665</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
</references>
<dates>
<discovery>2005-03-01</discovery>
<entry>2005-03-21</entry>
</dates>
</vuln>
<vuln vid="972697a7-9a42-11d9-a256-0001020eed82">
<topic>kdelibs -- local DCOP denial of service vulnerability</topic>
<affects>
<package>
<name>ja-kdelibs</name>
<name>kdelibs-nocups</name>
<name>kdelibs</name>
<range><lt>3.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
<p>Sebastian Krahmer of the SUSE LINUX Security Team
reported a local denial of service vulnerability in KDE's
Desktop Communication Protocol (DCOP) daemon better known
as dcopserver.</p>
<p>A local user can lock up the dcopserver of arbitrary
other users on the same machine. This can cause a
significant reduction in desktop functionality for the
affected users including, but not limited to, the
inability to browse the internet and the inability to
start new applications.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0396</cvename>
<url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
</references>
<dates>
<discovery>2005-03-16</discovery>
<entry>2005-03-21</entry>
</dates>
</vuln>
<vuln vid="6192ae3d-9595-11d9-a9e0-0001020eed82">
<topic>phpmyadmin -- increased privilege vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<name>phpMyAdmin</name>
<range><lt>2.6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
<p>Escaping of the "_" character was not properly done,
giving a wildcard privilege when editing db-specific
privileges with phpMyAdmin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0653</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1113788&group_id=23067&atid=377408</url>
</references>
<dates>
<discovery>2005-02-01</discovery>
<entry>2005-03-15</entry>
</dates>
</vuln>
<vuln vid="cb470368-94d2-11d9-a9e0-0001020eed82">
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ethreal Security Advisories reports:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
<p>Issues have been discovered in the following protocol
dissectors:</p>
<ul>
<li>Matevz Pustisek discovered a buffer overflow in the
Etheric dissector. CVE: CAN-2005-0704</li>
<li>The GPRS-LLC dissector could crash if the "ignore
cipher bit" option was enabled. CVE: CAN-2005-0705</li>
<li>Diego Giago discovered a buffer overflow in the 3GPP2
A11 dissector. This flaw was later reported by Leon
Juranic. CVE: CAN-2005-0699</li>
<li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
CVE: CAN-2005-0739</li>
<li>A bug in the JXTA dissector could make Ethereal crash.</li>
<li>A bug in the sFlow dissector could make Ethereal crash.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>12759</bid>
<cvename>CVE-2005-0699</cvename>
<cvename>CVE-2005-0704</cvename>
<cvename>CVE-2005-0705</cvename>
<cvename>CVE-2005-0739</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
</references>
<dates>
<discovery>2005-03-09</discovery>
<entry>2005-03-14</entry>
<modified>2005-06-24</modified>
</dates>
</vuln>
<vuln vid="bcf27002-94c3-11d9-a9e0-0001020eed82">
<topic>grip -- CDDB response multiple matches buffer overflow vulnerability</topic>
<affects>
<package>
<name>grip</name>
<range><lt>3.2.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joseph VanAndel reports that grip is vulnerability to a
buffer overflow vulnerability when receiving more than 16
CDDB responses. This could lead to a crash in grip and
potentially execution arbitrary code.</p>
<p>A workaround is to disable CDDB lookups.</p>
</body>
</description>
<references>
<bid>12770</bid>
<cvename>CVE-2005-0706</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714</url>
</references>
<dates>
<discovery>2003-11-02</discovery>
<entry>2005-03-14</entry>
<modified>2005-03-18</modified>
</dates>
</vuln>
<vuln vid="619ef337-949a-11d9-b813-00d05964249f">
<topic>mysql-server -- multiple remote vulnerabilities</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
<p>MySQL is reported prone to an insecure temporary file creation
vulnerability.</p>
<p>Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
privileges on an affected installation may leverage this
vulnerability to corrupt files with the privileges of the MySQL
process.</p>
<p>MySQL is reported prone to an input validation vulnerability that
can be exploited by remote users that have INSERT and DELETE
privileges on the 'mysql' administrative database.</p>
<p>Reports indicate that this issue may be leveraged to load an
execute a malicious library in the context of the MySQL process.</p>
<p>Finally, MySQL is reported prone to a remote arbitrary code
execution vulnerability. It is reported that the vulnerability may
be triggered by employing the 'CREATE FUNCTION' statement to
manipulate functions in order to control sensitive data
structures.</p>
<p>This issue may be exploited to execute arbitrary code in the
context of the database process.</p>
</blockquote>
</body>
</description>
<references>
<bid>12781</bid>
<cvename>CVE-2005-0709</cvename>
<cvename>CVE-2005-0710</cvename>
<cvename>CVE-2005-0711</cvename>
</references>
<dates>
<discovery>2005-03-11</discovery>
<entry>2005-03-14</entry>
</dates>
</vuln>
<vuln vid="d4bd4046-93a6-11d9-8378-000bdb1444a4">
<topic>rxvt-unicode -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>rxvt-unicode</name>
<range><lt>5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A rxvt-unicode changelog reports:</p>
<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
<p>Fix a bug that allowed to overflow a buffer via a long
escape sequence, which is probably exploitable (fix by
Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).</p>
</blockquote>
</body>
</description>
<references>
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
</references>
<dates>
<discovery>2005-03-13</discovery>
<entry>2005-03-13</entry>
</dates>
</vuln>
<vuln vid="a7062952-9023-11d9-a22c-0001020eed82">
<topic>phpmyadmin -- information disclosure vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<name>phpMyAdmin</name>
<range><lt>2.6.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way (especially scripts in the libraries
subdirectory), it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path
of the directory where phpMyAdmin is installed.</p>
<p><strong>Mitigation factor:</strong> This path disclosure
is possible on servers where the recommended setting of
the PHP configuration directive
<code>display_errors</code> is set to on, which is against
the recommendations given in the PHP manual.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0544</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
</references>
<dates>
<discovery>2005-02-22</discovery>
<entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
<topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<name>phpMyAdmin</name>
<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
<p>We received two bug reports by Maksymilian Arciemowicz
about those vulnerabilities and we wish to thank him for
his work. The vulnerabilities apply to those points:</p>
<ol>
<li>css/phpmyadmin.css.php was vulnerable against
<code>$cfg</code> and <code>GLOBALS</code> variable
injections. This way, a possible attacker could
manipulate any configuration parameter. Using
phpMyAdmin's theming mechanism, he was able to include
arbitrary files. This is especially dangerous if php is
not running in safe mode.</li>
<li>A possible attacker could manipulate phpMyAdmin's
localized strings via the URL and inject harmful
JavaScript code this way, which could be used for XSS
attacks.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>12644</bid>
<bid>12645</bid>
<cvename>CVE-2005-0543</cvename>
<cvename>CVE-2005-0567</cvename>
<mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110929725801154</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
</references>
<dates>
<discovery>2005-02-21</discovery>
<entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
<topic>libexif -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libexif</name>
<range><lt>0.6.10_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sylvain Defresne reports that libexif is vulnerable to a
buffer overflow vulnerability due to insufficient input
checking. This could lead crash of applications using
libexif.</p>
</body>
</description>
<references>
<bid>12744</bid>
<cvename>CVE-2005-0664</cvename>
<url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
</references>
<dates>
<discovery>2005-03-03</discovery>
<entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
<topic>phpbb -- Insuffient check against HTML code in usercp_register.php</topic>
<affects>
<package>
<name>phpbb</name>
<range><le>2.0.13</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Neo Security Team reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274">
<p>If we specify a variable in the html code (any type:
hidden, text, radio, check, etc) with the name allowhtml,
allowbbcode or allowsmilies, is going to be on the html,
bbcode and smilies in our signature.</p>
</blockquote>
<p>This is a low risk vulnerability that allows users to bypass
forum-wide configuration.</p>
</body>
</description>
<references>
<mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274</mlist>
<mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204</mlist>
</references>
<dates>
<discovery>2005-02-28</discovery>
<entry>2005-03-05</entry>
<modified>2005-03-07</modified>
</dates>
</vuln>
<vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
<topic>postnuke -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>postnuke</name>
<range><lt>0.760</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two separate SQL injection vulnerabilities have been
identified in the PostNuke PHP content management
system. An attacker can use this vulnerability to
potentially insert executable PHP code into the content
management system (to view all files within the PHP scope,
for instance). Various other SQL injection vulnerabilities
exist, which give attackers the ability to run SQL queries
on any tables within the database.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0617</cvename>
<cvename>CVE-2005-0615</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962710805864</mlist>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962819232255</mlist>
<url>http://news.postnuke.com/Article2669.html</url>
</references>
<dates>
<discovery>2005-02-28</discovery>
<entry>2005-03-04</entry>
</dates>
</vuln>
<vuln vid="7e580822-8cd8-11d9-8c81-000a95bc6fae">
<topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
<affects>
<package>
<name>postnuke</name>
<range><lt>0.760</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A cross-site scripting vulnerability is present in the
PostNuke PHP content management system. By passing data
injected through exploitable errors in input validation, an
attacker can insert code which will run on the machine of
anybody viewing the page. It is feasible that this attack
could be used to retrieve session information from cookies,
thereby allowing the attacker to gain administrative access
to the CMS.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0616</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962768300373</mlist>
<url>http://news.postnuke.com/Article2669.html</url>
</references>
<dates>
<discovery>2005-02-28</discovery>
<entry>2005-03-04</entry>
</dates>
</vuln>
<vuln vid="c73305ae-8cd7-11d9-9873-000a95bc6fae">
<topic>realplayer -- remote heap overflow</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><le>10.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two exploits have been identified in the Linux RealPlayer client.
RealNetworks states:</p>
<blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
<p>RealNetworks, Inc. has addressed recently discovered
security vulnerabilities that offered the potential for
an attacker to run arbitrary or malicious code on a
customer's machine. RealNetworks has received no reports
of machines compromised as a result of the now-remedied
vulnerabilities. RealNetworks takes all security
vulnerabilities very seriously.</p>
<p>The specific exploits were:</p>
<ul>
<li><strong>Exploit 1:</strong> To fashion a malicious WAV
file to cause a buffer overflow which could have allowed
an attacker to execute arbitrary code on a customer's
machine.</li>
<li><strong>Exploit 2:</strong> To fashion a malicious
SMIL file to cause a buffer overflow which could have
allowed an attacker to execute arbitrary code on a
customer's machine.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0611</cvename>
<mlist>http://marc.theaimsgroup.com/?l=vulnwatch&m=110977858619314</mlist>
<url>http://service.real.com/help/faq/security/050224_player/EN/</url>
</references>
<dates>
<discovery>2005-03-01</discovery>
<entry>2005-03-04</entry>
</dates>
</vuln>
<vuln vid="713c3913-8c2b-11d9-b58c-0001020eed82">
<topic>ImageMagick -- format string vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy reports:</p>
<blockquote>
<p>magemagick-6.2.0-3 fixes an potential issue handling
malformed filenames, the flaw may affect webapps or
scripts that use the imagemagick utilities for image
processing, or applications linked with libMagick.</p>
</blockquote>
<p>This vulnerability could crash ImageMagick or potentially
lead to the execution of arbitrary code with the permissions
of the user running ImageMagick.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0397</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
</references>
<dates>
<discovery>2005-03-02</discovery>
<entry>2005-03-03</entry>
</dates>
</vuln>
<vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
<topic>uim -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>ja-uim</name>
<range><lt>0.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The uim developers reports:</p>
<blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
<p>Takumi ASAKI discovered that uim always trusts environment
variables. But this is not correct behavior, sometimes environment
variables shouldn't be trusted. This bug causes privilege escalation
when libuim is linked against setuid/setgid application. Since GTK+
prohibits setuid/setgid applications, the bug appears only in
'immodule for Qt' enabled Qt. (Normal Qt is also safe.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0503</cvename>
<mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
<bid>12604</bid>
<url>http://secunia.com/advisories/13981</url>
</references>
<dates>
<discovery>2005-02-21</discovery>
<entry>2005-03-01</entry>
</dates>
</vuln>
<vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae">
<topic>lighttpd -- script source disclosure vulnerability</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The lighttpd website reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
<p>In lighttpd 1.3.7 and below it is possible to fetch the source
files which should be handled by CGI or FastCGI applications.</p>
</blockquote>
<p>The vulnerability is in the handling of urlencoded trailing
NUL bytes. Installations that do not use CGI or FastCGI are
not affected.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0453</cvename>
<mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
<url>http://www.lighttpd.net/news/</url>
<url>http://xforce.iss.net/xforce/xfdb/19350</url>
<bid>12567</bid>
</references>
<dates>
<discovery>2005-02-12</discovery>
<entry>2005-03-01</entry>
</dates>
</vuln>
<vuln vid="53e711ed-8972-11d9-9ff8-00306e01dda2">
<topic>phpbb -- privilege elevation and path disclosure</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpbb developer group reports:</p>
<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
<p>phpBB Group announces the release of phpBB 2.0.13, the
"Beware of the furries" edition. This release addresses two
recent security exploits, one of them critical. They were
reported a few days after .12 was released and no one is
more annoyed than us, having to release a new version ini
such a short period of time. Fortunately both fixes are
easy and in each case just one line needs to be edited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
<bid>12678</bid>
</references>
<dates>
<discovery>2005-02-27</discovery>
<entry>2005-02-28</entry>
<modified>2005-03-05</modified>
</dates>
</vuln>
<vuln vid="96df5fd0-8900-11d9-aa18-0001020eed82">
<topic>curl -- authentication buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two iDEFENSE Security Advisories reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592">
<p>An exploitable stack-based buffer overflow condition
exists when using NT Lan Manager (NTLM)
authentication. The problem specifically exists within
<code>Curl_input_ntlm()</code> defined in
lib/http_ntlm.c.</p>
<p>Successful exploitation allows remote attackers to
execute arbitrary code under the privileges of the target
user. Exploitation requires that an attacker either coerce
or force a target to connect to a malicious server using
NTLM authentication.</p>
</blockquote>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457">
<p>An exploitable stack-based buffer overflow condition
exists when using Kerberos authentication. The problem
specifically exists within the functions
<code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
defined in lib/krb4.c.</p>
<p>Successful exploitation allows remote attackers to
execute arbitrary code under the privileges of the target
user. Exploitation requires that an attacker either coerce
or force a target to connect to a malicious server using
Kerberos authentication.</p>
</blockquote>
</body>
</description>
<references>
<bid>12615</bid>
<bid>12616</bid>
<cvename>CVE-2005-0490</cvename>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457</mlist>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592</mlist>
</references>
<dates>
<discovery>2004-12-21</discovery>
<entry>2005-02-27</entry>
</dates>
</vuln>
<vuln vid="b2d248ad-88f6-11d9-aa18-0001020eed82">
<topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><lt>2.1.18</lt></range>
<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus IMAP Server ChangeLog states:</p>
<blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
<ul>
<li>Fix possible single byte overflow in mailbox handling
code.</li>
<li>Fix possible single byte overflows in the imapd
annotate extension.</li>
<li>Fix stack buffer overflows in fetchnews (exploitable
by peer news server), backend (exploitable by admin),
and in imapd (exploitable by users though only on
platforms where a filename may be larger than a mailbox
name).</li>
</ul>
</blockquote>
<p>The 2.1.X series are reportedly only affected by the second
issue.</p>
<p>These issues may lead to execution of arbitrary code with
the permissions of the user running the Cyrus IMAP
Server.</p>
</body>
</description>
<references>
<bid>12636</bid>
<cvename>CVE-2005-0546</cvename>
<url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
</references>
<dates>
<discovery>2005-02-14</discovery>
<entry>2005-02-27</entry>
<modified>2005-04-05</modified>
</dates>
</vuln>
<vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
<topic>sup -- format string vulnerability</topic>
<affects>
<package>
<name>sup</name>
<range><lt>2.0.20050226</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="http://www.securityfocus.com/advisories/6874">
<p>jaguar@felinemenace.org discovered a format string
vulnerability in sup, a set of programs to synchronize
collections of files across a number of machines,
whereby a remote attacker could potentially cause
arbitrary code to be executed with the privileges
of the supfilesrv process (this process does not run
automatically by default).</p>
</blockquote>
</body>
</description>
<references>
<bid>10571</bid>
<cvename>CVE-2004-0451</cvename>
<url>http://www.securityfocus.com/advisories/6874</url>
</references>
<dates>
<discovery>2004-06-19</discovery>
<entry>2005-02-27</entry>
</dates>
</vuln>
<vuln vid="d022754d-8839-11d9-aa18-0001020eed82">
<topic>mozilla -- insecure temporary directory vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.1,1</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.6,2</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.6</lt></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
<p>A predictable name is used for the plugin temporary
directory. A malicious local user could symlink this to
the victim's home directory and wait for the victim to run
Firefox. When Firefox shuts down the victim's directory
would be erased.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
</references>
<dates>
<discovery>2005-02-06</discovery>
<entry>2005-02-26</entry>
</dates>
</vuln>
<vuln vid="cbfde1cd-87eb-11d9-aa18-0001020eed82">
<topic>mozilla -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.1,1</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.6,2</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.6</lt></range>
</package>
<package>
<name>netscape7</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>de-netscape7</name>
<name>fr-linux-netscape</name>
<name>fr-netscape7</name>
<name>ja-linux-netscape</name>
<name>ja-netscape7</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk1</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<name>pt_BR-netscape7</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
<p>Plugins (such as flash) can be used to load privileged
content into a frame. Once loaded various spoofs can be
applied to get the user to interact with the privileged
content. Michael Krax's "Fireflashing" example
demonstrates that an attacker can open about:config in a
frame, hide it with an opacity setting, and if the
attacker can get the victim to click at a particular spot
(design some kind of simple game) you could toggle boolean
preferences, some of which would make further attacks
easier.</p>
<p>The "firescrolling" example demonstrates arbitrary code
execution (in this case downloading a file) by convincing
the user to scroll twice.</p>
</blockquote>
<p><strong>Workaround:</strong> Disable JavaScript.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0527</cvename>
<url>http://www.mikx.de/fireflashing/</url>
<url>http://www.mikx.de/firescrolling/</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
</references>
<dates>
<discovery>2005-02-24</discovery>
<entry>2005-02-26</entry>
</dates>
</vuln>
<vuln vid="32d4f0f1-85c3-11d9-b6dc-0007e900f747">
<topic>mkbold-mkitalic -- format string vulnerability</topic>
<affects>
<package>
<name>mkbold-mkitalic</name>
<range><lt>0.07</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The version 0.06_1 and prior
have a format string vulnerability which can be triggered
by using a carefully-crafted BDF font file.</p>
</body>
</description>
<references>
<url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
</references>
<dates>
<discovery>2005-02-23</discovery>
<entry>2005-02-24</entry>
</dates>
</vuln>
<vuln vid="03653079-8594-11d9-afa0-003048705d5a">
<topic>phpbb -- multiple information disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>psoTFX reports:</p>
<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423">
<p>phpBB Group are pleased to announce the release of phpBB
2.0.12 the "Horray for Furrywood" release. This release
addresses a number of bugs and a couple of potential
exploits. [...] one of the potential exploits addressed
in this release could be serious in certain situations and
thus we urge all users, as always, to upgrade to this
release as soon as possible. Mostly this release is
concerned with eliminating disclosures of information
which while useful in debug situations may allow third
parties to gain information which could be used to do harm
via unknown or unfixed exploits in this or other
applications.</p>
</blockquote>
<p>The ChangeLog for phpBB 2.0.12 states:</p>
<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
<ul>
<li>Prevented full path display on critical messages</li>
<li>Fixed full path disclosure in username handling caused
by a PHP 4.3.10 bug - <strong>AnthraX101</strong></li>
<li>Added exclude list to unsetting globals (if
register_globals is on) -
<strong>SpoofedExistence</strong></li>
<li>Fixed arbitrary file disclosure vulnerability in avatar
handling functions - <strong>AnthraX101</strong></li>
<li>Fixed arbitrary file unlink vulnerability in avatar
handling functions - <strong>AnthraX101</strong></li>
<li>Fixed path disclosure bug in search.php caused by a
PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
<li>Fixed path disclosure bug in viewtopic.php caused by
a PHP 4.3.10 bug - <strong>matrix_killer</strong></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423</url>
<freebsdpr>ports/77943</freebsdpr>
</references>
<dates>
<discovery>2005-02-22</discovery>
<entry>2005-02-23</entry>
<modified>2005-02-25</modified>
</dates>
</vuln>
<vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
<topic>unace -- multiple vulnerabilities</topic>
<affects>
<package>
<name>unace</name>
<range><lt>1.2b_2</lt></range>
</package>
<package>
<name>linux-unace</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reports:</p>
<ul>
<li>There are buffer overflows when extracting, testing or
listing specially prepared ACE archives.</li>
<li>There are directory traversal bugs when extracting ACE
archives.</li>
<li>There are also buffer overflows when dealing with long
(>17000 characters) command line arguments.</li>
</ul>
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/14359/">
<p>The vulnerabilities have been confirmed in version 1.2b.
One of the buffer overflow vulnerabilities have also been
reported in version 2.04, 2.2 and 2.5. Other versions may
also be affected.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<certvu>215006</certvu>
<cvename>CVE-2005-0160</cvename>
<cvename>CVE-2005-0161</cvename>
<mlist msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&m=110911451613135</mlist>
<url>http://secunia.com/advisories/14359/</url>
</references>
<dates>
<discovery>2005-02-14</discovery>
<entry>2005-02-22</entry>
<modified>2006-09-26</modified>
</dates>
</vuln>
<vuln vid="a413ed94-836e-11d9-a9e7-0001020eed82">
<topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
<p>This version fixes a security hole in previous versions
of PuTTY, which can allow a malicious SFTP server to
attack your client. If you use either PSCP or PSFTP, you
should upgrade. Users of the main PuTTY program are not
affected. (However, note that the server must have passed
host key verification before this attack can be launched,
so a man-in-the-middle shouldn't be able to attack you if
you're careful.)</p>
</blockquote>
</body>
</description>
<references>
<bid>12601</bid>
<cvename>CVE-2005-0467</cvename>
<mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
</references>
<dates>
<discovery>2005-02-20</discovery>
<entry>2005-02-20</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
<vuln vid="29dd0065-81fa-11d9-a9e7-0001020eed82">
<topic>kdelibs -- insecure temporary file creation</topic>
<affects>
<package>
<name>kdelibs</name>
<name>ja-kdelibs</name>
<range><lt>3.3.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Davide Madrisan reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757">
<p>The `dcopidlng' script in the KDE library package
(kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
files in a unsecure manner.</p>
</blockquote>
<p><strong>Note:</strong> dcopidlng is only used at build
time, so only users installing KDE are vulnerable, not users
already running KDE.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0365</cvename>
<url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
<mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757</mlist>
</references>
<dates>
<discovery>2005-01-21</discovery>
<entry>2005-02-18</entry>
<modified>2005-02-20</modified>
</dates>
</vuln>
<vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
<topic>bidwatcher -- format string vulnerability</topic>
<affects>
<package>
<name>bidwatcher</name>
<range><lt>1.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Security Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-687">
<p>Ulf Härnhammer from the Debian Security Audit Project
discovered a format string vulnerability in bidwatcher, a
tool for watching and bidding on eBay auctions. This
problem can be triggered remotely by a web server of eBay,
or someone pretending to be eBay, sending certain data
back.</p>
</blockquote>
</body>
</description>
<references>
<bid>12590</bid>
<cvename>CVE-2005-0158</cvename>
<url>http://www.debian.org/security/2005/dsa-687</url>
</references>
<dates>
<discovery>2005-02-18</discovery>
<entry>2005-02-18</entry>
</dates>
</vuln>
<vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
<topic>gftp -- directory traversal vulnerability</topic>
<affects>
<package>
<name>gftp</name>
<range><lt>2.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian Security Advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-686">
<p>Albert Puigsech Galicia discovered a directory traversal
vulnerability in a proprietary FTP client (CAN-2004-1376)
which is also present in gftp, a GTK+ FTP client. A
malicious server could provide a specially crafted
filename that could cause arbitrary files to be
overwritten or created by the client.</p>
</blockquote>
</body>
</description>
<references>
<bid>12539</bid>
<cvename>CVE-2005-0372</cvename>
<url>http://www.debian.org/security/2005/dsa-686</url>
<url>http://www.gftp.org/changelog.html</url>
</references>
<dates>
<discovery>2005-02-04</discovery>
<entry>2005-02-18</entry>
</dates>
</vuln>
<vuln vid="20c9bb14-81e6-11d9-a9e7-0001020eed82">
<topic>opera -- "data:" URI handler spoofing vulnerability</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>7.54.20050131</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/13818/">
<p>Michael Holzt has discovered a vulnerability in Opera,
which can be exploited by malicious people to trick users
into executing malicious files.</p>
<p>The vulnerability is caused due to an error in the
processing of "data:" URIs, causing wrong information to
be shown in a download dialog. This can be exploited by
e.g. a malicious website to trick users into executing a
malicious file by supplying a specially crafted "data:"
URI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0456</cvename>
<certvu>882926</certvu>
<url>http://secunia.com/advisories/13818/</url>
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
</references>
<dates>
<discovery>2005-01-12</discovery>
<entry>2005-02-18</entry>
</dates>
</vuln>
<vuln vid="d8e55d65-81d6-11d9-a9e7-0001020eed82">
<topic>opera -- kfmclient exec command execution vulnerability</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>7.54.20050131</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Giovanni Delvecchio reports:</p>
<blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
<p>Opera for linux uses "kfmclient exec" as "Default
Application" to handle saved files. This could be used by
malicious remote users to execute arbitrary shell commands
on a target system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1491</cvename>
<url>http://secunia.com/advisories/13447/</url>
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
<url>http://www.zone-h.org/advisories/read/id=6503</url>
</references>
<dates>
<discovery>2004-12-12</discovery>
<entry>2005-02-18</entry>
</dates>
</vuln>
<vuln vid="6b4b0b3f-8127-11d9-a9e7-0001020eed82">
<topic>postgresql -- multiple buffer overflows in PL/PgSQL parser</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><lt>7.3.9_1</lt></range>
<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PL/PgSQL parser in postgresql is vulnerable to several
buffer overflows. These could be exploited by a remote
attacker to execute arbitrary code with the permissions of
the postgresql server by running a specially crafted
query.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0247</cvename>
<url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
</references>
<dates>
<discovery>2005-02-07</discovery>
<entry>2005-02-17</entry>
<modified>2005-02-19</modified>
</dates>
</vuln>
<vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
<topic>awstats -- arbitrary command execution</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several input validation errors exist in AWStats that allow a
remote unauthenticated attacker to execute arbitrary commands
with the priviliges of the web server. These programming
errors involve CGI parameters including
<code>loadplugin</code>, <code>logfile</code>,
<code>pluginmode</code>, <code>update</code>, and possibly
others.</p>
<p>Additionally, the <code>debug</code> and other CGI parameters
may be used to cause AWStats to disclose AWStats and system
configuration information.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0362</cvename>
<cvename>CVE-2005-0363</cvename>
<cvename>CVE-2005-0435</cvename>
<cvename>CVE-2005-0436</cvename>
<cvename>CVE-2005-0437</cvename>
<cvename>CVE-2005-0438</cvename>
<bid>12543</bid>
<bid>12545</bid>
<mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124</mlist>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
<url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
</references>
<dates>
<discovery>2005-02-10</discovery>
<entry>2005-02-16</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
<vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
<topic>powerdns -- DoS vulnerability</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>2.9.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS is vulnerable to a temporary denial-of-service
vulnerability that can be triggered using a random stream of
bytes.</p>
</body>
</description>
<references>
<bid>12446</bid>
<url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
<url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
</references>
<dates>
<discovery>2004-09-18</discovery>
<entry>2005-02-14</entry>
</dates>
</vuln>
<vuln vid="3e3c860d-7dae-11d9-a9e7-0001020eed82">
<topic>emacs -- movemail format string vulnerability</topic>
<affects>
<package>
<name>movemail</name>
<range><le>1.0</le></range>
</package>
<package>
<name>zh-emacs</name>
<name>emacs</name>
<range><lt>20.7_4</lt></range>
<range><gt>21.*</gt><lt>21.3_4</lt></range>
</package>
<package>
<name>xemacs</name>
<name>xemacs-mule</name>
<name>zh-xemacs</name>
<name>zh-xemacs-mule</name>
<range><lt>21.4.17</lt></range>
</package>
<package>
<name>xemacs-devel</name>
<range><lt>21.5.b19,1</lt></range>
</package>
<package>
<name>xemacs-devel-21.5</name>
<range><eq>b11</eq></range>
</package>
<package>
<name>xemacs-devel-mule</name>
<range><lt>21.5.b19</lt></range>
</package>
<package>
<name>mule-common</name>
<name>hanemacs</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Max Vozeler discovered several format string
vulnerabilities in the movemail utility of Emacs. They can
be exploited when connecting to a malicious POP server and
can allow an attacker can execute arbitrary code under the
privileges of the user running Emacs.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0100</cvename>
<bid>12462</bid>
</references>
<dates>
<discovery>2005-01-31</discovery>
<entry>2005-02-14</entry>
</dates>
</vuln>
<vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
<topic>ngircd -- format string vulnerability</topic>
<affects>
<package>
<name>ngircd</name>
<range><lt>0.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A No System Group security advisory reports that ngircd is
vulnerable to a format string vulnerability in the
<code>Log_Resolver()</code> function of log.c, if IDENT
support is enabled. This could allow a remote attacker to
execute arbitrary code with the permissions of the ngircd
daemon, which is <q>root</q> by default.</p>
<p><strong>Note:</strong> By default the FreeBSD ngircd port
does not enable IDENT support.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0226</cvename>
<bid>12434</bid>
<mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183</mlist>
</references>
<dates>
<discovery>2005-02-03</discovery>
<entry>2005-02-13</entry>
</dates>
</vuln>
<vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
<topic>ngircd -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>ngircd</name>
<range><lt>0.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Westphal discovered a buffer overflow in ngircd
which can be used remotely crash the server and possibly
execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0199</cvename>
<bid>12397</bid>
<mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
</references>
<dates>
<discovery>2005-01-26</discovery>
<entry>2005-02-13</entry>
</dates>
</vuln>
<vuln vid="5192e7ca-7d4f-11d9-a9e7-0001020eed82">
<topic>mod_python -- information leakage vulnerability</topic>
<affects>
<package>
<name>mod_python</name>
<range><lt>2.7.11</lt></range>
<range><gt>3.*</gt><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark J Cox reports:</p>
<blockquote>
<p>Graham Dumpleton discovered a flaw which can affect
anyone using the publisher handle of the Apache Software
Foundation mod_python. The publisher handle lets you
publish objects inside modules to make them callable via
URL. The flaw allows a carefully crafted URL to obtain
extra information that should not be visible (information
leak).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0088</cvename>
</references>
<dates>
<discovery>2005-01-30</discovery>
<entry>2005-02-13</entry>
</dates>
</vuln>
<vuln vid="c7ccc33f-7d31-11d9-a9e7-0001020eed82">
<topic>mailman -- directory traversal vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<range><lt>2.1.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A directory traversal vulnerability in mailman allow remote
attackers to read arbitrary files due to inadequate input
sanitizing. This could, among other things, lead remote
attackers to gaining access to the mailman configuration
database (which contains subscriber email addresses and
passwords) or to the mail archives for private lists.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0202</cvename>
<mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&m=110797575304304</mlist>
</references>
<dates>
<discovery>2005-01-02</discovery>
<entry>2005-02-12</entry>
</dates>
</vuln>
<vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
<topic>enscript -- multiple vulnerabilities</topic>
<affects>
<package>
<name>enscript-a4</name>
<name>enscript-letter</name>
<name>enscript-letterdj</name>
<range><lt>1.6.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Sjölund discovered several issues in enscript:
it suffers from several buffer overflows, quotes and shell
escape characters are insufficiently sanitized in filenames,
and it supported taking input from an arbitrary command
pipe, with unwanted side effects.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1184</cvename>
<cvename>CVE-2004-1185</cvename>
<cvename>CVE-2004-1186</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
</references>
<dates>
<discovery>2005-02-02</discovery>
<entry>2005-02-11</entry>
</dates>
</vuln>
<vuln vid="5d425189-7a03-11d9-a9e7-0001020eed82">
<topic>postgresql -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><lt>7.3.9</lt></range>
<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
<range><gt>8.*</gt><lt>8.0.1</lt></range>
</package>
<package>
<name>postgresql-devel</name>
<range><le>8.0.1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>John Heasman and others disovered that non-privileged users
could use the <q>LOAD</q> extension to load arbitrary
libraries into the postgres server process space. This
could be used by non-privileged local users to execute
arbitrary code with the privileges of the postgresql
server.</p>
</body>
</description>
<references>
<bid>12411</bid>
<cvename>CVE-2005-0227</cvename>
<mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
<mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
</references>
<dates>
<discovery>2005-01-21</discovery>
<entry>2005-02-08</entry>
</dates>
</vuln>
<vuln vid="831a6a66-79fa-11d9-a9e7-0001020eed82">
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ethreal Security Advisories reports:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
<p>Issues have been discovered in the following protocol
dissectors:</p>
<ul>
<li>The COPS dissector could go into an infinite
loop. CVE: CAN-2005-0006</li>
<li>The DLSw dissector could cause an assertion. CVE:
CAN-2005-0007</li>
<li>The DNP dissector could cause memory corruption. CVE:
CAN-2005-0008</li>
<li>The Gnutella dissector could cuase an assertion. CVE:
CAN-2005-0009</li>
<li>The MMSE dissector could free statically-allocated
memory. CVE: CAN-2005-0010</li>
<li>The X11 dissector is vulnerable to a string buffer
overflow. CVE: CAN-2005-0084</li>
</ul>
<p>Impact: It may be possible to make Ethereal crash or run
arbitrary code by injecting a purposefully malformed
packet onto the wire or by convincing someone to read a
malformed packet trace file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0006</cvename>
<cvename>CVE-2005-0007</cvename>
<cvename>CVE-2005-0008</cvename>
<cvename>CVE-2005-0009</cvename>
<cvename>CVE-2005-0010</cvename>
<cvename>CVE-2005-0084</cvename>
<bid>12326</bid>
<url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
</references>
<dates>
<discovery>2005-01-18</discovery>
<entry>2005-02-08</entry>
</dates>
</vuln>
<vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
<topic>squid -- correct handling of oversized HTTP reply headers</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
<p>This patch addresses a HTTP protocol mismatch related to oversized
reply headers. In addition it enhances the cache.log reporting on
reply header parsing failures to make it easier to track down which
sites are malfunctioning.</p>
</blockquote>
<p>It is believed that this bug may lead to cache pollution or
allow access controls to be bypassed.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0241</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
<freebsdpr>ports/76967</freebsdpr>
<certvu>823350</certvu>
</references>
<dates>
<discovery>2005-01-31</discovery>
<entry>2005-02-08</entry>
</dates>
</vuln>
<vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
<topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
<affects>
<package>
<name>python</name>
<name>python+ipv6</name>
<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
<range><ge>2.4</ge><lt>2.4_1</lt></range>
<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to Python Security Advisory PSF-2005-001,</p>
<blockquote cite="http://www.python.org/security/PSF-2005-001/">
<p>The Python development team has discovered a flaw in
the <code>SimpleXMLRPCServer</code> library module which
can give remote attackers access to internals of the
registered object or its module or possibly other modules.
The flaw only affects Python XML-RPC servers that use the
<code>register_instance()</code> method to register an object
without a <code>_dispatch()</code> method. Servers using
only <code>register_function()</code> are not affected.</p>
<p>On vulnerable XML-RPC servers, a remote attacker may
be able to view or modify globals of the module(s)
containing the registered instance's class(es), potentially
leading to data loss or arbitrary code execution. If the
registered object is a module, the danger is particularly
serious. For example, if the registered module imports
the <code>os</code> module, an attacker could invoke the
<code>os.system()</code> function.</p>
</blockquote>
<p><strong>Note:</strong> This vulnerability affects your
system only if you're running
<code>SimpleXMLRPCServer</code>-based server. This isn't
harmful at all if you don't run any internet server written
in Python or your server doesn't serve in XML-RPC protocol.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0089</cvename>
<url>http://www.python.org/security/PSF-2005-001/</url>
</references>
<dates>
<discovery>2005-02-03</discovery>
<entry>2005-02-03</entry>
<modified>2006-10-08</modified>
</dates>
</vuln>
<vuln vid="a5eb760a-753c-11d9-a36f-000a95bc6fae">
<topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
<affects>
<package>
<name>perl</name>
<name>perl-threaded</name>
<range><ge>5.8</ge><lt>5.8.6_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin Finisterre discovered bugs in perl's I/O debug support:</p>
<ul>
<li>The environmental variable PERLIO_DEBUG is honored even
by the set-user-ID perl command (usually
named <code>sperl</code> or <code>suidperl</code>). As a
result, a local attacker may be able to gain elevated
privileges. <em>(CVE-2005-0155)</em></li>
<li>A buffer overflow may occur in threaded versions of perl
when the full pathname of the script being executed is
very long. <em>(CVE-2005-0156)</em>.</li>
</ul>
<p><strong>Note:</strong> By default, no set-user-ID perl
binary is installed. An administrator must enable it
manually at build time with the <code>ENABLE_SUIDPERL</code>
port flag.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0155</cvename>
<cvename>CVE-2005-0156</cvename>
</references>
<dates>
<discovery>2005-02-02</discovery>
<entry>2005-02-02</entry>
<modified>2007-11-07</modified>
</dates>
</vuln>
<vuln vid="cd7e260a-6bff-11d9-a5df-00065be4b5b6">
<topic>newsgrab -- insecure file and directory creation</topic>
<affects>
<package>
<name>newsgrab</name>
<range><le>0.4.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The newsgrab script uses insecure permissions during the
creation of the local output directory and downloaded files.</p>
<p>After a file is created, permissions on it are set using the mode
value of the newsgroup posting. This can potentially be a problem
when the mode is not restrictive enough. In addition, the output
directory is created with world writable permissions allowing other
users to drop symlinks or other files at that location.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
<cvename>CVE-2005-0154</cvename>
</references>
<dates>
<discovery>2005-01-18</discovery>
<entry>2005-02-01</entry>
</dates>
</vuln>
<vuln vid="35f6093c-73c3-11d9-8a93-00065be4b5b6">
<topic>newsgrab -- directory traversal vulnerability</topic>
<affects>
<package>
<name>newsgrab</name>
<range><le>0.4.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The newsgrab script creates files by using the names provided
in the newsgroup messages in a perl open() call. This is done
without performing any security checks to prevent a
directory traversal. A specially crafted newsgroup message
could cause newsgrab to drop an attachment anywhere on the
file system using the permissions of the user running the
script.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
<cvename>CVE-2005-0153</cvename>
</references>
<dates>
<discovery>2005-01-18</discovery>
<entry>2005-02-01</entry>
</dates>
</vuln>
<vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
<topic>newspost -- server response buffer overflow vulnerability</topic>
<affects>
<package>
<name>newspost</name>
<range><le>2.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The newspost program uses a function named socket_getline to read
server responses from the network socket. Unfortunately this function
does not check the length of the buffer in which the read data is stored
and only stops reading when a newline character is found.</p>
<p>A malicious NNTP server could use this bug to cause a buffer overflow
by sending an overly long response. Such an overflow allows arbitrary
code to be executed, with the privileges of the newspost process, on the
affected systems.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
<cvename>CVE-2005-0101</cvename>
</references>
<dates>
<discovery>2005-01-14</discovery>
<entry>2005-02-01</entry>
</dates>
</vuln>
<vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
<topic>newsfetch -- server response buffer overflow vulnerability</topic>
<affects>
<package>
<name>newsfetch</name>
<range><le>1.21_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The newsfetch program uses the sscanf function to read information
from server responses into static memory buffers. Unfortunately
this is done without any proper bounds checking. As a result long
server responses may cause an overflow when a newsgroup listing is
requested from an NNTP server.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
<cvename>CVE-2005-0132</cvename>
</references>
<dates>
<discovery>2005-01-18</discovery>
<entry>2005-02-01</entry>
</dates>
</vuln>
<vuln vid="23fb5a04-722b-11d9-9e1e-c296ac722cb3">
<topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to the Squid Proxy Cache Security Update Advisory
SQUID-2005:3,</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
<p>The WCCP recvfrom() call accepts more data than will fit in
the allocated buffer. An attacker may send a larger-than-normal
WCCP message to Squid and overflow this buffer.</p>
<p>Severity:</p>
<p>The bug is important because it allows remote attackers to crash
Squid, causing a disription in service. However, the bug is
exploitable only if you have configured Squid to send WCCP messages
to, and expect WCCP replies from, a router.</p>
<p>Sites that do not use WCCP are not vulnerable.</p>
</blockquote>
<p>Note that while the default configuration of the FreeBSD squid port
enables WCCP support in general, the default configuration
supplied does not actually configure squid to send and receive WCCP
messages.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0211</cvename>
<certvu>886006</certvu>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
</references>
<dates>
<discovery>2005-01-28</discovery>
<entry>2005-01-28</entry>
<modified>2005-02-13</modified>
</dates>
</vuln>
<vuln vid="f755545e-6fcd-11d9-abec-00061bd2d56f">
<topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.00_6</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.3.2_2</lt></range>
</package>
<package>
<name>gpdf</name>
<range><lt>2.8.3</lt></range>
</package>
<package>
<name>teTeX-base</name>
<range><lt>2.0.2_9</lt></range>
</package>
<package>
<name>cups-base</name>
<range><lt>1.1.23.0_3</lt></range>
</package>
<package>
<name>koffice</name>
<range><lt>1.3.5_2,1</lt></range>
</package>
<package>
<name>pdftohtml</name>
<range><lt>0.36_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554">
<p>Remote exploitation of a buffer overflow vulnerability in
the xpdf PDF viewer included in multiple Unix and Linux
distributions could allow for arbitrary code execution as
the user viewing a PDF file.</p>
<p>The vulnerability specifically exists due to insufficient
bounds checking while processing a PDF file that provides
malicious values in the /Encrypt /Length tag. The
offending code can be found in the
<code>Decrypt::makeFileKey2</code> function in the source
file xpdf/Decrypt.cc.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0064</cvename>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554</mlist>
<url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
</references>
<dates>
<discovery>2005-01-06</discovery>
<entry>2005-01-26</entry>
<modified>2005-02-03</modified>
</dates>
</vuln>
<vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
<topic>zhcon -- unauthorized file access</topic>
<affects>
<package>
<name>zhcon</name>
<name>zh-zhcon</name>
<range><lt>0.2.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin <q>Joey</q> Schulze reports:</p>
<blockquote>
<p>Erik Sjöund discovered that zhcon, a fast console CJK
system using the Linux framebuffer, accesses a
user-controlled configuration file with elevated
privileges. Thus, it is possible to read arbitrary files.</p>
</blockquote>
<p>When installed from the FreeBSD Ports Collection, zhcon is
installed set-user-ID root.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0072</cvename>
</references>
<dates>
<discovery>2005-01-25</discovery>
<entry>2005-01-25</entry>
</dates>
</vuln>
<vuln vid="b8943e61-6e68-11d9-a9e7-0001020eed82">
<topic>evolution -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>evolution</name>
<range><lt>2.0.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin <q>Joey</q> Schulze reports:</p>
<blockquote>
<p>Max Vozeler discovered an integer overflow in the helper
application camel-lock-helper which runs setuid root or
setgid mail inside of Evolution, a free groupware suite.
A local attacker can cause the setuid root helper to
execute arbitrary code with elevated privileges via a
malicious POP server.</p>
</blockquote>
</body>
</description>
<references>
<bid>12354</bid>
<cvename>CVE-2005-0102</cvename>
<url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&view=log#rev1.5.74.1</url>
</references>
<dates>
<discovery>2005-01-20</discovery>
<entry>2005-01-25</entry>
<modified>2005-02-02</modified>
</dates>
</vuln>
<vuln vid="88ff90f2-6e43-11d9-8c87-000a95bc6fae">
<topic>mod_dosevasive -- insecure temporary file creation</topic>
<affects>
<package>
<name>mod_dosevasive20</name>
<range><lt>1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An LSS Security Advisory reports:</p>
<blockquote cite="http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01">
<p>When a denial of service attack is detected,
mod_dosevasive will, among other things, create a
temporary file which it will use to trace actions from the
offensive IP address. This file is insecurely created in
/tmp and it's name is easily predictable.</p>
<p>It is then easy for an attacker to create arbitrary files
in any directory that the user under which apache runs has
privileges to write.</p>
<p><em>[...]</em> once the target file is opened, there is a
race attack (although difficult to exploit) which can lead
to mod_dosevasive overwriting any file that the user under
which apache runs has privileges to write.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/77513</freebsdpr>
<url>http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01</url>
</references>
<dates>
<discovery>2005-01-04</discovery>
<entry>2005-01-24</entry>
<modified>2005-02-22</modified>
</dates>
</vuln>
<vuln vid="b4d94fa0-6e38-11d9-9e1e-c296ac722cb3">
<topic>squid -- possible cache-poisoning via malformed HTTP responses</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
<p>This patch makes Squid considerably stricter while
parsing the HTTP protocol.</p>
<ol>
<li>A Content-length header should only appear once in a
valid request or response. Multiple Content-length
headers, in conjunction with specially crafted requests,
may allow Squid's cache to be poisoned with bad content
in certain situations.</li>
<li>CR characters is only allowed as part of the CR NL
line terminator, not alone. This to ensure that all
involved agrees on the structure of HTTP headers.</li>
<li>Rejects requests/responses that have whitespace in an
HTTP header name.</li>
</ol>
</blockquote>
<p>To enable these strict parsing rules, update to at least
squid-2.5.7_9 and specify <code>relaxed_header_parser
off</code> in squid.conf.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0174</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
<certvu>768702</certvu>
</references>
<dates>
<discovery>2005-01-24</discovery>
<entry>2005-01-24</entry>
<modified>2006-01-02</modified>
</dates>
</vuln>
<vuln vid="97c3a452-6e36-11d9-8324-000a95bc6fae">
<topic>bugzilla -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><lt>2.16.8</lt></range>
<range><ge>2.17.*</ge><lt>2.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla advisory states:</p>
<blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
<p>This advisory covers a single cross-site scripting issue
that has recently been discovered and fixed in the
Bugzilla code: If a malicious user links to a Bugzilla
site using a specially crafted URL, a script in the error
page generated by Bugzilla will display the URL unaltered
in the page, allowing scripts embedded in the URL to
execute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1061</cvename>
<url>http://www.bugzilla.org/security/2.16.7-nr/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
</references>
<dates>
<discovery>2004-12-01</discovery>
<entry>2005-01-24</entry>
</dates>
</vuln>
<vuln vid="b0911985-6e2a-11d9-9557-000a95bc6fae">
<topic>web browsers -- window injection vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.1,1</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.6,2</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.6</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<name>mozilla-gtk1</name>
<range><ge>0</ge></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<range><ge>0</ge></range>
</package>
<package>
<name>kdebase</name>
<name>kdelibs</name>
<range><lt>3.3.2</lt></range>
</package>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>7.54.20050131</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Research advisory reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
<p>Secunia Research has reported a vulnerability in multiple
browsers, which can be exploited by malicious people to
spoof the content of websites.</p>
<p>The problem is that a website can inject content into
another site's window if the target name of the window is
known. This can e.g. be exploited by a malicious website
to spoof the content of a pop-up window opened on a
trusted website.</p>
<p>Secunia has constructed a test, which can be used to
check if your browser is affected by this issue:
<a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
</blockquote>
<p>A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
for Mozilla-based browsers</a> is available.</p>
</body>
</description>
<references>
<url>http://secunia.com/secunia_research/2004-13/advisory/</url>
<url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
<!-- mozilla -->
<cvename>CVE-2004-1156</cvename>
<url>http://secunia.com/advisories/13129/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
<url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
<!-- opera -->
<cvename>CVE-2004-1157</cvename>
<url>http://secunia.com/advisories/13253/</url>
<!-- konqueror -->
<cvename>CVE-2004-1158</cvename>
<url>http://secunia.com/advisories/13254/</url>
<url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
<!-- netscape -->
<cvename>CVE-2004-1160</cvename>
<url>http://secunia.com/advisories/13402/</url>
</references>
<dates>
<discovery>2004-12-08</discovery>
<entry>2005-01-24</entry>
<modified>2005-02-26</modified>
</dates>
</vuln>
<vuln vid="d4a7054a-6d96-11d9-a9e7-0001020eed82">
<topic>yamt -- arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>yamt</name>
<range><lt>0.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manigandan Radhakrishnan discovered a security
vulnerability in YAMT which can lead to execution of
arbitrary commands with the privileges of the user running
YAMT when sorting based on MP3 tags. The problem exist in
the <code>id3tag_sort()</code> routine which does not
properly sanitize the artist tag from the MP3 file before
using it as an argument to the mv command.</p>
</body>
</description>
<references>
<bid>11999</bid>
<cvename>CVE-2004-1302</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-23</entry>
<modified>2005-01-25</modified>
</dates>
</vuln>
<vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
<topic>squid -- HTTP response splitting cache pollution attack</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a whitepaper published by Sanctum, Inc., it
is possible to mount cache poisoning attacks against, among others,
squid proxies by inserting false replies into the HTTP stream.</p>
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
<p>This patch additionally strengthens Squid from the HTTP response
attack described by Sanctum.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0175</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
<url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
<certvu>625878</certvu>
</references>
<dates>
<discovery>2004-03-01</discovery>
<entry>2005-01-22</entry>
<modified>2005-02-07</modified>
</dates>
</vuln>
<vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
<topic>horde -- XSS vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><gt>3.*</gt><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Hyperdose Security Advisory reports:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
<p>Horde contains two XSS attacks that can be exploited
through GET requests. Once exploited, these requests
could be used to execute any javascript commands in the
context of that user, potentially including but not
limited to reading and deleting email, and stealing auth
tokens.</p>
</blockquote>
</body>
</description>
<references>
<bid>12255</bid>
<mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110564059322774</mlist>
<mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
</references>
<dates>
<discovery>2005-01-04</discovery>
<entry>2005-01-22</entry>
</dates>
</vuln>
<vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
<topic>mc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mc</name>
<range><lt>4.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andrew V. Samoilov reported several vulnerabilities that
were corrected in MidnightCommand 4.6.0:</p>
<ul>
<li>Format string issues (CVE-2004-1004)</li>
<li>Buffer overflows (CVE-2004-1005)</li>
<li>Denial-of-service, infinite loop (CVE-2004-1009)</li>
<li>Denial-of-service, corrupted section header
(CVE-2004-1090)</li>
<li>Denial-of-service, null pointer dereference (CVE-2004-1091)</li>
<li>Freeing unallocated memory (CVE-2004-1092)</li>
<li>Using already freed memory (CVE-2004-1093)</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2004-1004</cvename>
<cvename>CVE-2004-1005</cvename>
<cvename>CVE-2004-1009</cvename>
<cvename>CVE-2004-1090</cvename>
<cvename>CVE-2004-1091</cvename>
<cvename>CVE-2004-1092</cvename>
<cvename>CVE-2004-1093</cvename>
</references>
<dates>
<discovery>2004-12-01</discovery>
<entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="c418d472-6bd1-11d9-93ca-000a95bc6fae">
<topic>perl -- File::Path insecure file/directory permissions</topic>
<affects>
<package>
<name>perl</name>
<name>perl-threaded</name>
<range><ge>0</ge><lt>5.6.2</lt></range>
<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeroen van Wolffelaar reports that the Perl module File::Path
contains a race condition wherein traversed directories and files
are temporarily made world-readable/writable.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0452</cvename>
<url>http://www.debian.org/security/2004/dsa-620</url>
<url>http://xforce.iss.net/xforce/xfdb/18650</url>
</references>
<dates>
<discovery>2004-12-30</discovery>
<entry>2005-01-21</entry>
<modified>2007-11-07</modified>
</dates>
</vuln>
<vuln vid="e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae">
<cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd"/>
</vuln>
<vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
<topic>opera -- multiple vulnerabilities in Java implementation</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>7.54.20041210</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Schoenefeld reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820">
<p>Opera 7.54 is vulnerable to leakage of the java sandbox,
allowing malicious applets to gain unacceptable
privileges. This allows them to be used for information
gathering (spying) of local identity information and
system configurations as well as causing annoying crash
effects.</p>
<p>Opera 754 <em>[sic]</em> which was released Aug 5,2004 is
vulnerable to the XSLT processor covert channel attack,
which was corrected with JRE 1.4.2_05 [released in July
04], but in disadvantage to the users the opera packaging
guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
<p>Internal pointer DoS exploitation: Opera.jar contains the
opera replacement of the java plugin. It therefore handles
communication between javascript and the Java VM via the
liveconnect protocol. The public class EcmaScriptObject
exposes a system memory pointer to the java address space,
by constructing a special variant of this type an internal
cache table can be polluted by false entries that infer
proper function of the JSObject class and in the following
proof-of-concept crash the browser.</p>
<p>Exposure of location of local java installation Sniffing
the URL classpath allows to retrieve the URLs of the
bootstrap class path and therefore the JDK installation
directory.</p>
<p>Exposure of local user name to an untrusted applet An
attacker could use the sun.security.krb5.Credentials class
to retrieve the name of the currently logged in user and
parse his home directory from the information which is
provided by the thrown
java.security.AccessControlException.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820</mlist>
</references>
<dates>
<discovery>2004-11-19</discovery>
<entry>2005-01-24</entry>
</dates>
</vuln>
<vuln vid="045944a0-6bca-11d9-aaa6-000a95bc6fae">
<topic>sudo -- environmental variable CDPATH is not cleared</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.6.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A sudo bug report says:</p>
<blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
<p>sudo doesn't unset the CDPATH variable, which leads to
possible security problems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
<mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2005-01-21</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
<topic>fcron -- multiple vulnerabilities</topic>
<affects>
<package>
<name>fcron</name>
<range><lt>2.9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory states:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false">
<p>Multiple vulnerabilities have been found in Fcron.</p>
<ol>
<li>File contents disclosure</li>
<li>Configuration Bypass Vulnerability</li>
<li>File Removal and Empty File Creation Vulnerability</li>
<li>Information Disclosure Vulnerability</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false</url>
<cvename>CVE-2004-1030</cvename>
<cvename>CVE-2004-1031</cvename>
<cvename>CVE-2004-1032</cvename>
<cvename>CVE-2004-1033</cvename>
</references>
<dates>
<discovery>2004-11-15</discovery>
<entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
<topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><lt>10.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An NGSSoftware Insight Security Research Advisory reports:</p>
<blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
<p>Two vulnerabilities have been discovered in RealPlayer
which may potentially be leveraged to allow remote code
execution, or may used in combination with the Real
Metadata Package File Deletion vulnerability to reliably
delete files from a users system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
<url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
<url>http://service.real.com/help/faq/security/040928_player/EN/</url>
</references>
<dates>
<discovery>2004-10-06</discovery>
<entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
<topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
<affects>
<package>
<name>imlib</name>
<range><lt>1.9.15_2</lt></range>
</package>
<package>
<name>imlib2</name>
<range><lt>1.1.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pavel Kankovsky reports:</p>
<blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
<p>Imlib affected by a variant of CAN-2004-0782 too.</p>
<p>I've discovered more vulnerabilities in Imlib
(1.9.13). In particular, it appears to be affected by a
variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
http://scary.beasts.org/security/CESA-2004-003.txt). Look
at the attached image, it kills ee on my 7.3.</p>
</blockquote>
<p>The flaws also affect imlib2.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1025</cvename>
<cvename>CVE-2004-1026</cvename>
<bid>11830</bid>
<url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
</references>
<dates>
<discovery>2004-12-06</discovery>
<entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="39953788-6bbb-11d9-8bc9-000a95bc6fae">
<topic>egroupware -- arbitrary file download in JiNN</topic>
<affects>
<package>
<name>eGroupWare</name>
<range><lt>1.0.0.006</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>eGroupWare contains a bug in the JiNN component that allows
a remote attacker to download arbitrary files.</p>
</body>
</description>
<references>
<url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&forum_id=35178</mlist>
</references>
<dates>
<discovery>2004-10-15</discovery>
<entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="2c25e762-6bb9-11d9-93db-000a95bc6fae">
<topic>quake2 -- multiple critical vulnerabilities</topic>
<affects>
<package>
<name>quake2forge</name>
<range><ge>0</ge></range>
</package>
<package>
<name>quake2lnx</name>
<range><lt>0.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by Richard Stanway describes numerous
critical vulnerabilities in the Quake II engine:</p>
<blockquote cite="http://secur1ty.net/advisories/001">
<p>Due to unchecked input at various stages in the server,
remote users are able to cause the server to crash, reveal
sensitive information or potentially execute arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secur1ty.net/advisories/001</url>
<mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&m=109892527321706</mlist>
</references>
<dates>
<discovery>2004-10-27</discovery>
<entry>2005-01-21</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="5c7bb4dd-6a56-11d9-97ec-000c6e8f12ef">
<topic>konversation -- shell script command injection</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Konversation comes with Perl scripts that do not properly escape
shell characters on executing a script. This makes it possible
to attack Konversation with shell script command injection.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0129</cvename>
<cvename>CVE-2005-0130</cvename>
<cvename>CVE-2005-0131</cvename>
<mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&m=110616016509114</mlist>
</references>
<dates>
<discovery>2005-01-19</discovery>
<entry>2005-01-19</entry>
<modified>2005-01-21</modified>
</dates>
</vuln>
<vuln vid="7a921e9e-68b1-11d9-9e1e-c296ac722cb3">
<topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The LDAP authentication helper did not strip
leading or trailing spaces from the login name.
According to the squid patches page:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
<p>LDAP is very forgiving about spaces in search
filters and this could be abused to log in
using several variants of the login name,
possibly bypassing explicit access controls
or confusing accounting.</p>
<p>Workaround: Block logins with spaces</p>
<pre>
acl login_with_spaces proxy_auth_regex [:space:]
http_access deny login_with_spaces
</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0173</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
<certvu>924198</certvu>
</references>
<dates>
<discovery>2005-01-10</discovery>
<entry>2005-01-19</entry>
<modified>2005-02-08</modified>
</dates>
</vuln>
<vuln vid="990cf07e-6988-11d9-a9e7-0001020eed82">
<topic>cups-base -- CUPS server remote DoS vulnerability</topic>
<affects>
<package>
<name>cups-base</name>
<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kenshi Muto discovered that the CUPS server would enter an
infinite loop when processing a URL containing
<q><code>/..</code></q>.</p>
</body>
</description>
<references>
<bid>12200</bid>
<cvename>CVE-2005-2874</cvename>
<url>http://www.cups.org/str.php?L1042</url>
</references>
<dates>
<discovery>2004-12-30</discovery>
<entry>2005-01-18</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
<vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
<topic>tiff -- divide-by-zero denial-of-service</topic>
<affects>
<package>
<name>tiff</name>
<name>linux-tiff</name>
<range><lt>3.6.0</lt></range>
</package>
<package>
<name>pdflib</name>
<name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
</package>
<package>
<name>gdal</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>ivtools</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>paraview</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>fractorama</name>
<range><lt>1.6.7_1</lt></range>
</package>
<package>
<name>iv</name>
<name>ja-iv</name>
<name>ja-libimg</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A US-CERT vulnerability note reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/555304">
<p>An Integer overflow in the LibTIFF library may allow a
remote attacker to cause a divide-by-zero error that results
in a denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0804</cvename>
<certvu>555304</certvu>
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
</references>
<dates>
<discovery>2002-03-27</discovery>
<entry>2005-01-18</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
<topic>zgv -- exploitable heap overflows</topic>
<affects>
<package>
<name>zgv</name>
<range><lt>5.8_1</lt></range>
</package>
<package>
<name>xzgv</name>
<range><lt>0.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>infamous41md reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781">
<p>zgv uses malloc() frequently to allocate memory for storing
image data. When calculating how much to allocate, user
supplied data from image headers is multiplied and/or added
without any checks for arithmetic overflows. We can
overflow numerous calculations, and cause small buffers to
be allocated. Then we can overflow the buffer, and
eventually execute code. There are a total of
11 overflows that are exploitable to execute arbitrary
code.</p>
</blockquote>
<p>These bugs exist in both zgv and xzgv.</p>
</body>
</description>
<references>
<mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781</mlist>
<mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&m=109898111915661</mlist>
<url>http://rus.members.beeb.net/xzgv.html</url>
<url>http://www.svgalib.org/rus/zgv/</url>
<cvename>CVE-2004-0994</cvename>
<url>http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false</url>
</references>
<dates>
<discovery>2004-10-26</discovery>
<entry>2005-01-18</entry>
<modified>2005-01-21</modified>
</dates>
</vuln>
<vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
<topic>mozilla -- insecure permissions for some downloaded files</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.9</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>firefox</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><lt>1.0.r2,1</lt></range>
</package>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><le>7.2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.5</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.5,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In a Mozilla bug report, Daniel Kleinsinger writes:</p>
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
<p>I was comparing treatment of attachments opened directly
from emails on different platforms. I discovered that Linux
builds save attachments in /tmp with world readable rights.
This doesn't seem like a good thing. Couldn't someone else
logged onto the same machine read your attachments?</p>
</blockquote>
<p>This could expose the contents of downloaded files or email
attachments to other users on a multi-user system.</p>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
<mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=109865078103911</mlist>
</references>
<dates>
<discovery>2004-07-13</discovery>
<entry>2005-01-18</entry>
</dates>
</vuln>
<vuln vid="0f5a2b4d-694b-11d9-a9e7-0001020eed82">
<topic>awstats -- remote command execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439">
<p>Remote exploitation of an input validation vulnerability
in AWStats allows attackers to execute arbitrary commands
under the privileges of the web server.</p>
<p>The problem specifically exists when the application is
running as a CGI script on a web server. The "configdir"
parameter contains unfiltered user-supplied data that is
utilized in a call to the Perl routine open()...</p>
<p>Successful exploitation allows remote attackers to
execute arbitrary commands under the privileges of the web
server. This can lead to further compromise as it provides
remote attackers with local access.</p>
</blockquote>
</body>
</description>
<references>
<bid>12270</bid>
<cvename>CVE-2005-0116</cvename>
<certvu>272296</certvu>
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439</mlist>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
<url>http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false</url>
</references>
<dates>
<discovery>2004-10-21</discovery>
<entry>2005-01-18</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
<vuln vid="597e2bee-68ea-11d9-a9e7-0001020eed82">
<topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.1.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities">
<p>Remote exploitation of a buffer overflow vulnerability in
The ImageMagick's Project's ImageMagick PSD image-decoding
module could allow an attacker to execute arbitrary
code.</p>
<p>Exploitation may allow attackers to run arbitrary code on
a victim's computer if the victim opens a specially
formatted image. Such images could be delivered by e-mail
or HTML, in some cases, and would likely not raise
suspicion on the victim's part. Exploitation is also
possible when a web-based application uses ImageMagick to
process user-uploaded image files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0005</cvename>
<url>http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-12-21</discovery>
<entry>2005-01-18</entry>
</dates>
</vuln>
<vuln vid="7850a238-680a-11d9-a9e7-0001020eed82">
<topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
<affects>
<package>
<name>cups-lpr</name>
<name>fr-cups-lpr</name>
<range><lt>1.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>D. J. Bernstein reports that Bartlomiej Sieka has
discovered several security vulnerabilities in lppasswd,
which is part of CUPS. In the following excerpt from
Bernstein's email, CVE names have been added for each issue:</p>
<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
<p>First, lppasswd blithely ignores write errors in
fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
and in fprintf(...) at line 346. An attacker who fills up
the disk at the right moment can arrange for
/usr/local/etc/cups/passwd to be truncated.
<em>(CAN-2004-1268)</em></p>
<p>Second, if lppasswd bumps into a file-size resource limit
while writing passwd.new, it leaves passwd.new in place,
disabling all subsequent invocations of lppasswd. Any
local user can thus disable lppasswd...
<em>(CAN-2004-1269)</em></p>
<p>Third, line 306 of lppasswd.c prints an error message to
stderr but does not exit. This is not a problem on systems
that ensure that file descriptors 0, 1, and 2 are open for
setuid programs, but it is a problem on other systems;
lppasswd does not check that passwd.new is different from
stderr, so it ends up writing a user-controlled error
message to passwd if the user closes file descriptor
2. <em>(CAN-2004-1270)</em></p>
</blockquote>
<p><strong>Note:</strong> The third issue, CVE-2004-1270, does
not affect FreeBSD 4.6-RELEASE or later systems, as these
systems ensure that the file descriptors 0, 1, and 2 are
always open for set-user-ID and set-group-ID programs.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1268</cvename>
<cvename>CVE-2004-1269</cvename>
<cvename>CVE-2004-1270</cvename>
<bid>12007</bid>
<bid>12004</bid>
<url>http://www.cups.org/str.php?L1023</url>
<url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
</references>
<dates>
<discovery>2004-12-11</discovery>
<entry>2005-01-17</entry>
</dates>
</vuln>
<vuln vid="40a3bca2-6809-11d9-a9e7-0001020eed82">
<topic>cups-base -- HPGL buffer overflow vulnerability</topic>
<affects>
<package>
<name>cups-base</name>
<name>fr-cups-base</name>
<range><lt>1.1.22.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ariel Berkman has discovered a buffer overflow
vulnerability in CUPS's HPGL input driver. This
vulnerability could be exploited to execute arbitrary code
with the permission of the CUPS server by printing a
specially crated HPGL file.</p>
</body>
</description>
<references>
<bid>11968</bid>
<cvename>CVE-2004-1267</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
<url>http://www.cups.org/str.php?L1024</url>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-17</entry>
</dates>
</vuln>
<vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
<topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
<affects>
<package>
<name>mysql-scripts</name>
<range><lt>3.23.58_2</lt></range>
<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian Security Team reports:</p>
<blockquote>
<p>Javier Fernández-Sanguino Peña from the Debian Security
Audit Project discovered a temporary file vulnerability in
the mysqlaccess script of MySQL that could allow an
unprivileged user to let root overwrite arbitrary files
via a symlink attack and could also could unveil the
contents of a temporary file which might contain sensitive
information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0004</cvename>
<url>http://lists.mysql.com/internals/20600</url>
</references>
<dates>
<discovery>2005-01-12</discovery>
<entry>2005-01-16</entry>
<modified>2005-01-17</modified>
</dates>
</vuln>
<vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
<topic>unrtf -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>unrtf</name>
<range><lt>0.19.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yosef Klein and Limin Wang have found a buffer overflow
vulnerability in unrtf that can allow an attacker to execute
arbitrary code with the permissions of the user running
unrtf, by running unrtf on a specially crafted rtf
document.</p>
</body>
</description>
<references>
<bid>12030</bid>
<cvename>CVE-2004-1297</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-16</entry>
<modified>2005-02-11</modified>
</dates>
</vuln>
<vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
<topic>mozilla -- heap overflow in NNTP handler</topic>
<affects>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><gt>0</gt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.5</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.5,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maurycy Prodeus reports a critical vulnerability in
Mozilla-based browsers:</p>
<blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
<p>Mozilla browser supports NNTP urls. Remote side is able to
trigger news:// connection to any server. I found a flaw in
NNTP handling code which may cause heap overflow and allow
remote attacker to execute arbitrary code on client
machine.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1316</cvename>
<url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
<mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&m=110436284718949</mlist>
</references>
<dates>
<discovery>2004-12-29</discovery>
<entry>2005-01-13</entry>
</dates>
</vuln>
<vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
<topic>mpg123 -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>mpg123</name>
<name>mpg123-nas</name>
<name>mpg123-esound</name>
<range><lt>0.59r_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yuri D'Elia has found a buffer overflow vulnerability in
mpg123's parsing of frame headers in input streams. This
vulnerability can potentially lead to execution of arbitrary
code with the permissions of the user running mpg123, if the
user runs mpg123 on a specially crafted MP2 or MP3 file.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0991</cvename>
</references>
<dates>
<discovery>2005-01-01</discovery>
<entry>2005-01-13</entry>
</dates>
</vuln>
<vuln vid="5fe7e27a-64cb-11d9-9e1e-c296ac722cb3">
<topic>squid -- denial of service with forged WCCP messages</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
<p>WCCP_I_SEE_YOU messages contain a 'number of caches'
field which should be between 1 and 32. Values outside
that range may crash Squid if WCCP is enabled, and if an
attacker can spoof UDP packets with the WCCP router's IP
address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0095</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
</references>
<dates>
<discovery>2005-01-07</discovery>
<entry>2005-01-12</entry>
<modified>2005-01-22</modified>
</dates>
</vuln>
<vuln vid="184ab9e0-64cd-11d9-9e1e-c296ac722cb3">
<topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
<p>A malicious gopher server may return a response with very
long lines that cause a buffer overflow in Squid.</p>
<p>Workaround: Since gopher is very obscure these days, do
not allow Squid to any gopher servers. Use an ACL rule
like:</p>
<pre>acl Gopher proto gopher
http_access deny Gopher</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0094</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
</references>
<dates>
<discovery>2005-01-11</discovery>
<entry>2005-01-12</entry>
<modified>2005-01-22</modified>
</dates>
</vuln>
<vuln vid="131bd7c4-64a3-11d9-829a-000a95bc6fae">
<topic>libxine -- DVD subpicture decoder heap overflow</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.0.r6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A xine security announcement states:</p>
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
<p>A heap overflow has been found in the DVD subpicture
decoder of xine-lib. This can be used for a remote heap
overflow exploit, which can, on some systems, lead to or
help in executing malicious code with the permissions of the
user running a xine-lib based media application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1379</cvename>
<url>http://xinehq.de/index.php/security/XSA-2004-5</url>
</references>
<dates>
<discovery>2004-09-06</discovery>
<entry>2005-01-12</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
<topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
<affects>
<package>
<name>libxine</name>
<range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A xine security announcement states:</p>
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
<p>Several string overflows on the stack have been fixed in
xine-lib, some of them can be used for remote buffer
overflow exploits leading to the execution of arbitrary code
with the permissions of the user running a xine-lib based
media application.</p>
<p>Stack-based string overflows have been found:</p>
<ol>
<li>in the code which handles VideoCD MRLs</li>
<li>in VideoCD code reading the disc label</li>
<li>in the code which parses text subtitles and prepares
them for display</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://xinehq.de/index.php/security/XSA-2004-4</url>
</references>
<dates>
<discovery>2004-09-07</discovery>
<entry>2005-01-12</entry>
</dates>
</vuln>
<vuln vid="1b70bef4-649f-11d9-a30e-000a95bc6fae">
<topic>libxine -- multiple buffer overflows in RTSP</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.4</lt></range>
</package>
<package>
<name>libxine</name>
<range><lt>1.0.r4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A xine security announcement states:</p>
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
<p>Multiple vulnerabilities have been found and fixed in the
Real-Time Streaming Protocol (RTSP) client for RealNetworks
servers, including a series of potentially remotely
exploitable buffer overflows. This is a joint advisory by
the MPlayer and xine teams as the code in question is common
to these projects.</p>
<p>Severity: High (arbitrary remote code execution under the
user ID running the player) when playing Real RTSP streams.
At this time, there is no known exploit for these
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0433</cvename>
<url>http://xinehq.de/index.php/security/XSA-2004-3</url>
<url>http://xforce.iss.net/xforce/xfdb/16019</url>
<bid>10245</bid>
</references>
<dates>
<discovery>2004-05-25</discovery>
<entry>2005-01-12</entry>
</dates>
</vuln>
<vuln vid="8eabaad9-641f-11d9-92a7-000a95bc6fae">
<topic>hylafax -- unauthorized login vulnerability</topic>
<affects>
<package>
<name>hylafax</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw in HylaFAX may allow an attacker to bypass normal
authentication by spoofing their DNS PTR records.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1182</cvename>
<mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110546971307585</mlist>
</references>
<dates>
<discovery>2005-01-11</discovery>
<entry>2005-01-11</entry>
</dates>
</vuln>
<vuln vid="56971fa6-641c-11d9-a097-000854d03344">
<topic>xshisen -- local buffer overflows</topic>
<affects>
<package>
<name>xshisen</name>
<range><lt>1.36_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Kemp has found buffer overflows in the handling
of the command line flag -KCONV and the XSHISENLIB environment
variable. Ulf Härnhammer has detected an unbounded copy from
the GECOS field to a char array. All overflows can be exploited
to gain group games privileges.</p>
</body>
</description>
<references>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
<cvename>CVE-2003-1053</cvename>
<cvename>CVE-2005-0117</cvename>
</references>
<dates>
<discovery>2005-01-11</discovery>
<entry>2005-01-11</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
<topic>helvis -- arbitrary file deletion problem</topic>
<affects>
<package>
<name>ko-helvis</name>
<range><le>1.8h2_1</le></range>
</package>
<package>
<name>helvis</name>
<range><le>1.8h2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The setuid root elvprsv utility, used to preserve
recovery helvis files, can be abused by local users to delete
with root privileges.</p>
<p>The problem is that elvprsv deletes files when it thinks they
have become corrupt. When elvprsv is pointed to a normal file then
it will almost always think the file is corrupt and deletes it.
This behavior may be exploited by local attackers to delete critical
files.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0120</cvename>
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
</references>
<dates>
<discovery>2004-11-24</discovery>
<entry>2005-01-10</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="bb99f803-5fde-11d9-b721-00065be4b5b6">
<topic>helvis -- information leak vulnerabilities</topic>
<affects>
<package>
<name>ko-helvis</name>
<range><le>1.8h2_1</le></range>
</package>
<package>
<name>helvis</name>
<range><le>1.8h2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Once a recovery file has been preserved by the setuid root elvprsv
utility it is placed in a worldreadable directory with worldreadable
permissions. This possibly allows sensitive information to leak.</p>
<p>In addition to this information leak, it is possible for users
to recover files that belong to other users by using elvrec, another
setuid root binary.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0118</cvename>
<cvename>CVE-2005-0119</cvename>
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
</references>
<dates>
<discovery>2004-11-24</discovery>
<entry>2005-01-10</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
<topic>dillo -- format string vulnerability</topic>
<affects>
<package>
<name>dillo</name>
<range><lt>0.8.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>dillo contains a format string vulnerability which could
lead to execution of arbitrary code simply by viewing a web
page or opening a HTML file.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0012</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
</references>
<dates>
<discovery>2005-01-04</discovery>
<entry>2005-01-08</entry>
</dates>
</vuln>
<vuln vid="f92e1bbc-5e18-11d9-839a-0050da134090">
<topic>tnftp -- mget does not check for directory escapes</topic>
<affects>
<package>
<name>tnftp</name>
<range><lt>20050103</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When downloading a batch of files from an FTP server the
mget command does not check for directory escapes. A
specially crafted file on the FTP server could then
potentially overwrite an existing file of the user.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1294</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
<url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&content-type=text/x-cvsweb-markup</url>
<url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-07</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="8f86d8b5-6025-11d9-a9e7-0001020eed82">
<topic>tiff -- tiffdump integer overflow vulnerability</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.7.1_2</lt></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dmitry V. Levin found a potential integer overflow in the
tiffdump utility which could lead to execution of arbitrary
code. This could be exploited by tricking an user into
executing tiffdump on a specially crafted tiff image.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1183</cvename>
</references>
<dates>
<discovery>2005-01-06</discovery>
<entry>2005-01-06</entry>
<modified>2005-03-01</modified>
</dates>
</vuln>
<vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
<topic>tiff -- directory entry count integer overflow vulnerability</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.7.1</lt></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.6.1_1</lt></range>
</package>
<package>
<name>pdflib</name>
<name>pdflib-perl</name>
<range><lt>6.0.1_1</lt></range>
</package>
<package>
<name>gdal</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>ivtools</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>paraview</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>fractorama</name>
<range><lt>1.6.7_1</lt></range>
</package>
<package>
<name>iv</name>
<name>ja-iv</name>
<name>ja-libimg</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In an iDEFENSE Security Advisory infamous41md reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities">
<p>Remote exploitation of a heap-based buffer overflow
vulnerability within the LibTIFF package could allow
attackers to execute arbitrary code.</p>
<p>The vulnerability specifically exists due to insufficient
validation of user-supplied data when calculating the size
of a directory entry. A TIFF file includes a number of
directory entry header fields that describe the data in
the file. Included in these entries is an entry count and
offset value that are calculated to determine the size and
location of the data for that entry.</p>
</blockquote>
</body>
</description>
<references>
<bid>12075</bid>
<cvename>CVE-2004-1308</cvename>
<url>http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities</url>
<certvu>125598</certvu>
</references>
<dates>
<discovery>2004-12-17</discovery>
<entry>2005-01-06</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="14e8f315-600e-11d9-a9e7-0001020eed82">
<cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad"/>
</vuln>
<vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
<topic>vim -- vulnerabilities in modeline handling</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim+ruby</name>
<range><lt>6.3.45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ciaran McCreesh discovered news ways in which a VIM modeline
can be used to trojan a text file. The patch by Bram
Moolenaar reads:</p>
<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
<p>Problem: Unusual characters in an option value may cause
unexpected behavior, especially for a modeline. (Ciaran
McCreesh)</p>
<p>Solution: Don't allow setting termcap options or
'printdevice' or 'titleold' in a modeline. Don't list
options for "termcap" and "all" in a modeline. Don't allow
unusual characters in 'filetype', 'syntax', 'backupext',
'keymap', 'patchmode' and 'langmenu'.</p>
</blockquote>
<p><strong>Note:</strong> It is generally recommended that VIM
users use <code>set nomodeline</code> in
<code>~/.vimrc</code> to avoid the possibility of trojaned
text files.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1138</cvename>
<url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
<mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
</references>
<dates>
<discovery>2004-12-09</discovery>
<entry>2005-01-06</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
<topic>pcal -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>pcal</name>
<range><lt>4.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Danny Lungstrom has found two buffer overflow
vulnerabilities in pcal which can lead to execution of
arbitrary code by making a user run pcal on a specially
crafted calendar file.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1289</cvename>
<bid>12035</bid>
<bid>12036</bid>
<mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-06</entry>
</dates>
</vuln>
<vuln vid="ca9ce879-5ebb-11d9-a01c-0050569f0001">
<topic>exim -- two buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>exim</name>
<name>exim-ldap</name>
<name>exim-ldap2</name>
<name>exim-mysql</name>
<name>exim-postgresql</name>
<name>exim-sa-exim</name>
<range><lt>4.43+28_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>1. The function host_aton() can overflow a buffer
if it is presented with an illegal IPv6 address
that has more than 8 components.</p>
<p>2. The second report described a buffer overflow
in the function spa_base64_to_bits(), which is part
of the code for SPA authentication.</p>
</body>
</description>
<references>
<mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110573573800377</mlist>
<cvename>CVE-2005-0021</cvename>
<cvename>CVE-2005-0022</cvename>
<bid>12185</bid>
<bid>12188</bid>
<bid>12268</bid>
</references>
<dates>
<discovery>2005-01-05</discovery>
<entry>2005-01-05</entry>
<modified>2005-01-18</modified>
</dates>
</vuln>
<vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
<topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
<affects>
<package>
<name>mpg123</name>
<name>mpg123-nas</name>
<name>mpg123-esound</name>
<range><le>0.59r_15</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow vulnerability exists in the playlist
processing of mpg123. A specially crafted playlist entry
can cause a stack overflow that can be used to inject
arbitrary code into the mpg123 process.</p>
<p>Note that a malicious playlist, demonstrating this
vulnerability, was released by the bug finder and may be
used as a template by attackers.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1284</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
<url>http://secunia.com/advisories/13511/</url>
<url>http://xforce.iss.net/xforce/xfdb/18626</url>
<bid>11958</bid>
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-03</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
<topic>greed -- insecure GRX file processing</topic>
<affects>
<package>
<name>greed</name>
<range><le>0.81p</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow vulnerability has been detected in the greed
URL handling code. This bug can especially be a problem when greed is
used to process GRX (GetRight) files that originate from untrusted
sources.</p>
<p>The bug finder, Manigandan Radhakrishnan, gave the following
description:</p>
<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/greed.txt">
<p>Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
to copy an input filename to the end of a 128-byte COMMAND array.
Second, DownloadLoop() passes the input filename to system() without
checking for special characters such as semicolons.</p></blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1273</cvename>
<cvename>CVE-2004-1274</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
<url>http://secunia.com/advisories/13534/</url>
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2005-01-03</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="949c470e-528f-11d9-ac20-00065be4b5b6">
<topic>golddig -- local buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>golddig</name>
<range><le>2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two buffer overflow vulnerabilities where detected. Both issues can
be used by local users to gain group games privileges on affected
systems.</p>
<p>The first overflow exists in the map name handling and can be
triggered when a very long name is given to the program during
command-line execution</p>
<p>The second overflow exists in the username processing while writing
the players score to disk. Excessivly long usernames, set via the USER
environment variable, are stored without any length checks in a memory
buffer.</p>
</body>
</description>
<references>
<cvename>CVE-2005-0121</cvename>
<mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2005-01-03</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
<topic>up-imapproxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>up-imapproxy</name>
<range><lt>1.2.4</lt></range>
</package>
<package>
<name>pop3proxy</name>
<range><le>1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773">
<p>There are various bugs in up-imapproxy which can crash
it. Since up-imapproxy runs in a single process with each
connection handled in a separate thread, any crash kills
all the connections and stops listening for new ones.</p>
<p>In 64bit systems it might be possible to make it leak
data (mails, passwords, ..) from other connections to
attacker's connection. However I don't think up-imapproxy
actually works in any 64bit system so this is just a
theoretical problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1035</cvename>
<bid>11630</bid>
<mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773</mlist>
</references>
<dates>
<discovery>2004-11-17</discovery>
<entry>2005-01-02</entry>
<modified>2008-02-27</modified>
</dates>
</vuln>
<vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
<topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
<affects>
<package>
<name>ja-kdelibs</name>
<name>kdelibs</name>
<range><lt>3.3.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Puigsech Galicia reports that Konqueror (more
specifically kio_ftp) and Microsoft Internet Explorer are
vulnerable to a FTP command injection vulnerability which
can be exploited by tricking an user into clicking a
specially crafted FTP URI.</p>
<p>It is also reported by Ian Gulliver and Emanuele Balla that
this vulnerability can be used to tricking a client into
sending out emails without user interaction.</p>
</body>
</description>
<references>
<bid>11827</bid>
<cvename>CVE-2004-1165</cvename>
<mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110245752232681</mlist>
<mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=110387390226693</mlist>
<mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=110390734925183</mlist>
<url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
</references>
<dates>
<discovery>2004-12-01</discovery>
<entry>2005-01-01</entry>
<modified>2005-01-04</modified>
</dates>
</vuln>
<vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
<topic>squid -- possible abuse of cachemgr.cgi</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
<p>This patch adds access controls to the cachemgr.cgi script,
preventing it from being abused to reach other servers than
allowed in a local configuration file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-1999-0710</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
</references>
<dates>
<discovery>1999-07-29</discovery>
<entry>2005-05-19</entry>
</dates>
</vuln>
<vuln vid="7e97b288-c7ca-11d9-9e1e-c296ac722cb3">
<topic>squid -- DNS lookup spoofing vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
<p>Malicious users may spoof DNS lookups if the DNS client UDP port
(random, assigned by OS as startup) is unfiltered and your network
is not protected from IP spoofing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-1519</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
<url>http://secunia.com/advisories/15294</url>
</references>
<dates>
<discovery>2005-05-11</discovery>
<entry>2005-05-19</entry>
</dates>
</vuln>
<vuln vid="55041d37-ff62-11d9-a9a5-000ae4641456">
<topic>jabberd -- 3 buffer overflows</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There are 3 buffer overflows in jid.c that are triggered
during parsing of JID strings when components (user, host or
resource) are too long.</p>
<ol>
<li>jid.c, line 103: overflow in `str' buffer through
<code>strcpy()</code> when "user" part is too long.</li>
<li>jid.c, line 115: overflow in `str' buffer through
<code>strcpy()</code> when "host" part is too long.</li>
<li>jid.c, line 127: overflow in `str' buffer through
<code>strcpy()</code> when "resource" part is too
long.</li>
</ol>
<p>These overflows can be used to perform a DoS attack on the
server (sm process segfaults) and can possible be used for
arbitrary code execution.</p>
</body>
</description>
<references>
<url>http://j2.openaether.org/bugzilla/show_bug.cgi?id=99</url>
</references>
<dates>
<discovery>2005-07-25</discovery>
<entry>2005-07-30</entry>
</dates>
</vuln>
<vuln vid="44e7764c-2614-11da-9e1e-c296ac722cb3">
<topic>squid -- possible denial of service condition regarding NTLM authentication</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.10_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
<p>Squid may crash with the above error [FATAL: Incorrect scheme in
auth header] when given certain request sentences.</p>
<p>Workaround: disable NTLM authentication.</p>
</blockquote>
</body>
</description>
<references>
<bid>14977</bid>
<cvename>CVE-2005-2917</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1391</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert</url>
<url>http://secunia.com/advisories/16992/</url>
</references>
<dates>
<discovery>2005-09-12</discovery>
<entry>2005-09-15</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
<vuln vid="c6b9aee8-3071-11da-af18-000ae4641456">
<topic>phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If magic quotes are off there's a SQL injection when
sending a forgotten password. It's possible to overwrite
the admin password and to take over the whole system. In
some files in the admin section there are some cross site
scripting vulnerabilities. In the public frontend it's
possible to include arbitrary php files.</p>
</body>
</description>
<references>
<bid>14927</bid>
<bid>14928</bid>
<bid>14929</bid>
<bid>14930</bid>
<cvename>CVE-2005-3046</cvename>
<cvename>CVE-2005-3047</cvename>
<cvename>CVE-2005-3048</cvename>
<cvename>CVE-2005-3049</cvename>
<cvename>CVE-2005-3050</cvename>
<url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url>
</references>
<dates>
<discovery>2005-09-23</discovery>
<entry>2005-09-29</entry>
</dates>
</vuln>
<vuln vid="9168253c-5a6d-11d9-a9e7-0001020eed82">
<topic>a2ps -- insecure temporary file creation</topic>
<affects>
<package>
<name>a2ps-a4</name>
<name>a2ps-letter</name>
<name>a2ps-letterdj</name>
<range><lt>4.13b_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Security Advisory reports that Javier
Fernández-Sanguino Peña has found temporary file
creation vulnerabilities in the fixps and psmandup scripts
which are part of a2ps. These vulnerabilities could lead to
an attacker overwriting arbitrary files with the credentials
of the user running the vulnerable scripts.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1377</cvename>
<bid>12108</bid>
<bid>12109</bid>
<url>http://secunia.com/advisories/13641/</url>
</references>
<dates>
<discovery>2004-12-27</discovery>
<entry>2004-12-30</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="64c8cc2a-59b1-11d9-8a99-000c6e8f12ef">
<topic>libxine -- buffer-overflow vulnerability in aiff support</topic>
<affects>
<package>
<name>libxine</name>
<range><le>1.0.r5_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a buffer overflow in the open_aiff_file function in
demux_aiff.c, a remote attacker is able to execute arbitrary
code via a modified AIFF file.</p></body>
</description>
<references>
<cvename>CVE-2004-1300</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt</url>
<url>http://xinehq.de/index.php/security/XSA-2004-7</url>
</references>
<dates>
<discovery>2004-12-15</discovery>
<entry>2004-12-29</entry>
<modified>2005-01-12</modified>
</dates>
</vuln>
<vuln vid="2e25d38b-54d1-11d9-b612-000c6e8f12ef">
<topic>jabberd -- denial-of-service vulnerability</topic>
<affects>
<package>
<name>jabber</name>
<range><lt>1.4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>José Antonio Calvo discovered a bug in the Jabber 1.x server.
According to Matthias Wimmer:</p>
<blockquote cite="http://devel.amessage.info/jabberd14/README.html">
<p>Without this patch, it is possible to remotly crash
jabberd14, if there is access to one of the following types
of network sockets:</p>
<ul>
<li>Socket accepting client connections</li>
<li>Socket accepting connections from other servers</li>
<li>Socket connecting to an other Jabber server</li>
<li>Socket accepting connections from server components</li>
<li>Socket connecting to server components</li>
</ul>
<p>This is any socket on which the jabberd server parses
XML!</p>
<p>The problem existed in the included expat XML parser code.
This patch removes the included expat code from jabberd14
and links jabberd against an installed version of expat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1378</cvename>
<url>http://devel.amessage.info/jabberd14/README.html</url>
<url>http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</url>
</references>
<dates>
<discovery>2004-09-19</discovery>
<entry>2004-12-26</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="a30e5e44-5440-11d9-9e1e-c296ac722cb3">
<topic>squid -- confusing results on empty acl declarations</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applying an empty ACL list results in unexpected behavior:
anything will match an empty ACL list. For example,</p>
<blockquote cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
<p>The meaning of the configuration gets very confusing when
we encounter empty ACLs such as</p>
<p><code>acl something src "/path/to/empty_file.txt"<br/>
http_access allow something somewhere</code></p>
<p>gets parsed (with warnings) as</p>
<p><code>http_access allow somewhere</code></p>
<p>And similarily if you are using proxy_auth acls without
having any auth schemes defined.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0194</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1166</url>
</references>
<dates>
<discovery>2004-12-21</discovery>
<entry>2004-12-23</entry>
<modified>2005-02-08</modified>
</dates>
</vuln>
<vuln vid="efa1344b-5477-11d9-a9e7-0001020eed82">
<topic>ethereal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><lt>0.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An Ethreal Security Advisories reports:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
<p>Issues have been discovered in the following protocol
dissectors:</p>
<ul>
<li>Matthew Bing discovered a bug in DICOM dissection that
could make Ethereal crash.</li>
<li>An invalid RTP timestamp could make Ethereal hang and
create a large temporary file, possibly filling
available disk space.</li>
<li>The HTTP dissector could access previously-freed
memory, causing a crash.</li>
<li>Brian Caswell discovered that an improperly formatted
SMB packet could make Ethereal hang, maximizing CPU
utilization.</li>
</ul>
<p>Impact: It may be possible to make Ethereal crash or run
arbitrary code by injecting a purposefully malformed
packet onto the wire or by convincing someone to read a
malformed packet trace file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1139</cvename>
<cvename>CVE-2004-1140</cvename>
<cvename>CVE-2004-1141</cvename>
<cvename>CVE-2004-1142</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00016.html</url>
</references>
<dates>
<discovery>2004-12-14</discovery>
<entry>2004-12-23</entry>
</dates>
</vuln>
<vuln vid="e3e266e9-5473-11d9-a9e7-0001020eed82">
<topic>xpdf -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.00_5</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.3.2_1</lt></range>
</package>
<package>
<name>gpdf</name>
<range><le>2.8.1</le></range>
</package>
<package>
<name>teTeX-base</name>
<range><le>2.0.2_6</le></range>
</package>
<package>
<name>cups-base</name>
<range><le>1.1.22.0</le></range>
</package>
<package>
<name>koffice</name>
<range><le>1.3.5,1</le></range>
</package>
<package>
<name>pdftohtml</name>
<range><lt>0.36_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities">
<p>Remote exploitation of a buffer overflow vulnerability in
the xpdf PDF viewer, as included in multiple Linux
distributions, could allow attackers to execute arbitrary
code as the user viewing a PDF file. The offending code
can be found in the Gfx::doImage() function in the source
file xpdf/Gfx.cc.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1125</cvename>
<url>http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-11-23</discovery>
<entry>2004-12-23</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="28e93883-539f-11d9-a9e7-0001020eed82">
<topic>acroread5 -- mailListIsPdf() buffer overflow vulnerability</topic>
<affects>
<package>
<name>acroread</name>
<name>acroread4</name>
<name>acroread5</name>
<range><lt>5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE Security Advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities">
<p>Remote exploitation of a buffer overflow in version 5.09
of Adobe Acrobat Reader for Unix could allow for execution
of arbitrary code.</p>
<p>The vulnerability specifically exists in a the function
mailListIsPdf(). This function checks if the input file
is an email message containing a PDF. It unsafely copies
user supplied data using strcat into a fixed sized
buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1152</cvename>
<certvu>253024</certvu>
<url>http://www.adobe.com/support/techdocs/331153.html</url>
<url>http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-10-14</discovery>
<entry>2004-12-21</entry>
<modified>2005-01-06</modified>
</dates>
</vuln>
<vuln vid="be543d74-539a-11d9-a9e7-0001020eed82">
<topic>ecartis -- unauthorised access to admin interface</topic>
<affects>
<package>
<name>ecartis</name>
<range><lt>1.0.0.s20031228_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Debian security advisory reports:</p>
<blockquote cite="http://www.debian.org/security/2004/dsa-572">
<p>A problem has been discovered in ecartis, a mailing-list
manager, which allows an attacker in the same domain as
the list admin to gain administrator privileges and alter
list settings.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0913</cvename>
<url>http://www.debian.org/security/2004/dsa-572</url>
<url>http://secunia.com/advisories/12918/</url>
</references>
<dates>
<discovery>2004-10-12</discovery>
<entry>2004-12-21</entry>
</dates>
</vuln>
<vuln vid="85d76f02-5380-11d9-a9e7-0001020eed82">
<topic>mplayer -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.5_5</lt></range>
</package>
<package>
<name>libxine</name>
<range><le>1.0.r5_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDEFENSE and the MPlayer Team have found multiple
vulnerabilities in MPlayer:</p>
<ul>
<li>Potential heap overflow in Real RTSP streaming code</li>
<li>Potential stack overflow in MMST streaming code</li>
<li>Multiple buffer overflows in BMP demuxer</li>
<li>Potential heap overflow in pnm streaming code</li>
<li>Potential buffer overflow in mp3lib</li>
</ul>
<p>These vulnerabilities could allow a remote attacker to
execute arbitrary code as the user running MPlayer. The
problem in the pnm streaming code also affects xine.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1187</cvename>
<cvename>CVE-2004-1188</cvename>
<url>http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2</url>
<mlist msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110322526210300</mlist>
<url>http://www.idefense.com/application/poi/display?id=166</url>
<mlist msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110322829807443</mlist>
<url>http://www.idefense.com/application/poi/display?id=167</url>
<mlist msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110323022605345</mlist>
<url>http://www.idefense.com/application/poi/display?id=168</url>
<url>http://xinehq.de/index.php/security/XSA-2004-6</url>
</references>
<dates>
<discovery>2004-12-10</discovery>
<entry>2004-12-21</entry>
<modified>2005-01-12</modified>
</dates>
</vuln>
<vuln vid="0bb7677d-52f3-11d9-a9e7-0001020eed82">
<topic>krb5 -- heap buffer overflow vulnerability in libkadm5srv</topic>
<affects>
<package>
<name>krb5</name>
<name>krb5-beta</name>
<range><lt>1.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A MIT krb5 Security Advisory reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
<p>The MIT Kerberos 5 administration library (libkadm5srv)
contains a heap buffer overflow in password history
handling code which could be exploited to execute
arbitrary code on a Key Distribution Center (KDC)
host. The overflow occurs during a password change of a
principal with a certain password history state. An
administrator must have performed a certain password
policy change in order to create the vulnerable state.</p>
<p>An authenticated user, not necessarily one with
administrative privileges, could execute arbitrary code on
the KDC host, compromising an entire Kerberos realm.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1189</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt</url>
</references>
<dates>
<discovery>2004-12-06</discovery>
<entry>2004-12-21</entry>
</dates>
</vuln>
<vuln vid="3b3676be-52e1-11d9-a9e7-0001020eed82">
<topic>samba -- integer overflow vulnerability</topic>
<affects>
<package>
<name>samba</name>
<range><lt>3.0.10</lt></range>
<range><gt>*,1</gt><lt>3.0.10,1</lt></range>
</package>
<package>
<name>ja-samba</name>
<range><lt>2.2.12.j1.0beta1_2</lt></range>
<range><gt>3.*</gt><lt>3.0.10</lt></range>
<range><gt>3.*,1</gt><lt>3.0.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Greg MacManus, iDEFENSE Labs reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
<p>Remote exploitation of an integer overflow vulnerability
in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
and Samba 3.0.x prior to and including 3.0.9 could allow
an attacker to cause controllable heap corruption, leading
to execution of arbitrary commands with root
privileges.</p>
<p>Successful remote exploitation allows an attacker to gain
root privileges on a vulnerable system. In order to
exploit this vulnerability an attacker must possess
credentials that allow access to a share on the Samba
server. Unsuccessful exploitation attempts will cause the
process serving the request to crash with signal 11, and
may leave evidence of an attack in logs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1154</cvename>
<url>http://www.idefense.com/application/poi/display?id=165&type=vulnerabilities</url>
<url>http://www.samba.org/samba/security/CAN-2004-1154.html</url>
</references>
<dates>
<discovery>2004-12-02</discovery>
<entry>2004-12-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="d47e9d19-5016-11d9-9b5f-0050569f0001">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php4</name>
<range><lt>4.3.10</lt></range>
</package>
<package>
<name>mod_php</name>
<name>mod_php4</name>
<range><ge>4</ge><lt>4.3.10,1</lt></range>
</package>
<package>
<name>php5</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<range><lt>5.0.3</lt></range>
</package>
<package>
<name>mod_php5</name>
<range><lt>5.0.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/13481/">
<p>Multiple vulnerabilities have been reported in PHP,
which can be exploited to gain escalated privileges,
bypass certain security restrictions, gain knowledge
of sensitive information, or compromise a vulnerable
system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/13481/</url>
<cvename>CVE-2004-1019</cvename>
<cvename>CVE-2004-1065</cvename>
<url>http://www.php.net/release_4_3_10.php</url>
<url>http://www.hardened-php.net/advisories/012004.txt</url>
</references>
<dates>
<discovery>2004-12-16</discovery>
<entry>2004-12-17</entry>
<modified>2004-12-18</modified>
</dates>
</vuln>
<vuln vid="01c231cd-4393-11d9-8bb9-00065be4b5b6">
<topic>mysql -- GRANT access restriction problem</topic>
<affects>
<package>
<name>mysql-server</name>
<range><le>3.23.58_3</le></range>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When a user is granted access to a database with a name containing
an underscore and the underscore is not escaped then that user might
also be able to access other, similarly named, databases on the
affected system.</p>
<p>The problem is that the underscore is seen as a wildcard by MySQL
and therefore it is possible that an admin might accidently GRANT a
user access to multiple databases.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0957</cvename>
<bid>11435</bid>
<url>http://bugs.mysql.com/bug.php?id=3933</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
<url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
</references>
<dates>
<discovery>2004-03-29</discovery>
<entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="06a6b2cf-484b-11d9-813c-00065be4b5b6">
<topic>mysql -- ALTER MERGE denial of service vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><le>3.23.58_3</le></range>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
<range><ge>4.1.*</ge><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dean Ellis reported a denial of service vulnerability in the MySQL
server:</p>
<blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
<p> Multiple threads ALTERing the same (or different) MERGE tables to
change the UNION eventually crash the server or hang the individual
threads.</p>
</blockquote>
<p>Note that a script demonstrating the problem is included in the
MySQL bug report. Attackers that have control of a MySQL account can
easily use a modified version of that script during an attack.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0837</cvename>
<bid>11357</bid>
<url>http://bugs.mysql.com/bug.php?id=2408</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
</references>
<dates>
<discovery>2004-01-15</discovery>
<entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="29edd807-438d-11d9-8bb9-00065be4b5b6">
<topic>mysql -- FTS request denial of service vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A special crafted MySQL FTS request can cause the server to crash.
Malicious MySQL users can abuse this bug in a denial of service
attack against systems running an affected MySQL daemon.</p>
<p>Note that because this bug is related to the parsing of requests,
it may happen that this bug is triggered accidently by a user when he
or she makes a typo.</p>
</body>
</description>
<references>
<url>http://bugs.mysql.com/bug.php?id=3870</url>
<cvename>CVE-2004-0956</cvename>
<bid>11432</bid>
</references>
<dates>
<discovery>2004-03-23</discovery>
<entry>2004-12-16</entry>
</dates>
</vuln>
<vuln vid="835256b8-46ed-11d9-8ce0-00065be4b5b6">
<topic>mysql -- mysql_real_connect buffer overflow vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><le>3.23.58_3</le></range>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
<package>
<name>mysql-client</name>
<range><le>3.23.58_3</le></range>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mysql_real_connect function doesn't properly handle DNS replies
by copying the IP address into a buffer without any length checking.
A specially crafted DNS reply may therefore be used to cause a buffer
overflow on affected systems.</p>
<p>Note that whether this issue can be exploitable depends on the
system library responsible for the gethostbyname function. The bug
finder, Lukasz Wojtow, explaines this with the following words:</p>
<blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
<p>In glibc there is a limitation for an IP address to have only 4
bytes (obviously), but generally speaking the length of the address
comes with a response for dns query (i know it sounds funny but
read rfc1035 if you don't believe). This bug can occur on libraries
where gethostbyname function takes length from dns's response</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0836</cvename>
<bid>10981</bid>
<url>http://bugs.mysql.com/bug.php?id=4017</url>
<url>http://lists.mysql.com/internals/14726</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
<url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
</references>
<dates>
<discovery>2004-06-04</discovery>
<entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="035d17b2-484a-11d9-813c-00065be4b5b6">
<topic>mysql -- erroneous access restrictions applied to table renames</topic>
<affects>
<package>
<name>mysql-server</name>
<range><le>3.23.58_3</le></range>
<range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Red Hat advisory reports:</p>
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
<p>Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
the CREATE/INSERT rights of the old table instead of the new
one.</p>
</blockquote>
<p>Table access restrictions, on the affected MySQL servers, may
accidently or intentially be bypassed due to this bug.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0835</cvename>
<bid>11357</bid>
<url>http://bugs.mysql.com/bug.php?id=3270</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
<url>http://xforce.iss.net/xforce/xfdb/17666</url>
</references>
<dates>
<discovery>2004-03-23</discovery>
<entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="0ff0e9a6-4ee0-11d9-a9e7-0001020eed82">
<topic>phpmyadmin -- command execution vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>2.6.0.2</ge><lt>2.6.1.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
<p>Command execution: since phpMyAdmin 2.6.0-pl2, on a
system where external MIME-based transformations are
activated, an attacker can put into MySQL data an
offensive value that starts a shell command when
browsed.</p>
</blockquote>
<p>Enabling <q>PHP safe mode</q> on the server can be used as
a workaround for this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1147</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
</references>
<dates>
<discovery>2004-12-13</discovery>
<entry>2004-12-15</entry>
<modified>2004-12-19</modified>
</dates>
</vuln>
<vuln vid="9f0a405e-4edd-11d9-a9e7-0001020eed82">
<topic>phpmyadmin -- file disclosure vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.6.1.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A phpMyAdmin security announcement reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
<p>File disclosure: on systems where the UploadDir mecanism
is active, read_dump.php can be called with a crafted
form; using the fact that the sql_localfile variable is
not sanitized can lead to a file disclosure.</p>
</blockquote>
<p>Enabling <q>PHP safe mode</q> on the server can be used as
a workaround for this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1148</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
</references>
<dates>
<discovery>2004-12-13</discovery>
<entry>2004-12-15</entry>
<modified>2004-12-19</modified>
</dates>
</vuln>
<vuln vid="06f142ff-4df3-11d9-a9e7-0001020eed82">
<topic>wget -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wget</name>
<name>wget-devel</name>
<range><lt>1.10.a1</lt></range>
</package>
<package>
<name>wgetpro</name>
<name>wget+ipv6</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Minar reports that there exists multiple
vulnerabilities in wget:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384">
<p>Wget erroneously thinks that the current directory is a
fair game, and will happily write in any file in and below
it. Malicious HTTP response or malicious HTML file can
redirect wget to a file that is vital to the system, and
wget will create/append/overwrite it.</p>
<p>Wget apparently has at least two methods of
``sanitizing'' the potentially malicious data it receives
from the HTTP stream, therefore a malicious redirects can
pass the check. We haven't find a way to trick wget into
writing above the parent directory, which doesn't mean
it's not possible.</p>
<p>Malicious HTTP response can overwrite parts of the
terminal so that the user will not notice anything wrong,
or will believe the error was not fatal.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1487</cvename>
<cvename>CVE-2004-1488</cvename>
<bid>11871</bid>
<mlist msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384</mlist>
<url>http://bugs.debian.org/261755</url>
</references>
<dates>
<discovery>2004-12-09</discovery>
<entry>2004-12-14</entry>
<modified>2005-04-15</modified>
</dates>
</vuln>
<vuln vid="4593cb09-4c81-11d9-983e-000c6e8f12ef">
<topic>konqueror -- Password Disclosure for SMB Shares</topic>
<affects>
<package>
<name>kdebase</name>
<name>kdelibs</name>
<range><ge>3.2.0</ge><le>3.3.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When browsing SMB shares with Konqueror, shares with
authentication show up with hidden password in the browser
bar. It is possible to store the URL as a shortcut on the
desktop where the password is then available in plain text.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1171</cvename>
<certvu>305294</certvu>
<url>http://www.kde.org/info/security/advisory-20041209-1.txt</url>
<mlist msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110178786809694</mlist>
</references>
<dates>
<discovery>2004-10-06</discovery>
<entry>2004-12-12</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="af747389-42ba-11d9-bd37-00065be4b5b6">
<topic>mod_access_referer -- null pointer dereference vulnerability</topic>
<affects>
<package>
<name>mod_access_referer</name>
<range><lt>1.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malformed <q>Referer</q> header field causes the Apache
ap_parse_uri_components function to discard it with the
result that a pointer is not initialized. The
mod_access_referer module does not take this into account
with the result that it may use such a pointer.</p>
<p>The null pointer vulnerability may possibly be used in a
remote denial of service attack against affected Apache
servers.</p>
</body>
</description>
<references>
<cvename>CVE-2003-1054</cvename>
<bid>7375</bid>
<url>http://secunia.com/advisories/8612/</url>
<mlist>http://marc.theaimsgroup.com/?l=full-disclosure&m=105053485515811</mlist>
</references>
<dates>
<discovery>2003-04-16</discovery>
<entry>2004-12-11</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="f0db930b-496b-11d9-bf86-0050569f0001">
<topic>squid -- possible information disclosure</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid-2.5 patches pages notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
<p>In certain conditions Squid returns random data as error messages
in response to malformed host name, possibly leaking random
internal information which may come from other requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost</url>
</references>
<dates>
<discovery>2004-11-23</discovery>
<entry>2004-12-09</entry>
</dates>
</vuln>
<vuln vid="323784cf-48a6-11d9-a9e7-0001020eed82">
<topic>viewcvs -- information leakage</topic>
<affects>
<package>
<name>viewcvs</name>
<range><lt>0.9.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The <code>hide_cvsroot</code> and <code>forbidden</code>
configuration options are not properly honored by viewcvs
when exporting to a tar file which can lead to information
leakage.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0915</cvename>
<bid>11819</bid>
</references>
<dates>
<discovery>2004-11-25</discovery>
<entry>2004-12-08</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="a7bfd423-484f-11d9-a9e7-0001020eed82">
<topic>cscope -- symlink attack vulnerability</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cscope is vulnerable to a symlink attack which could lead
to an attacker overwriting arbitrary files with the
permissions of the user running cscope.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0996</cvename>
<bid>11697</bid>
<mlist msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110133485519690</mlist>
<mlist msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110072752707293</mlist>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1062807&group_id=4664&atid=104664</url>
</references>
<dates>
<discovery>2003-04-03</discovery>
<entry>2004-12-07</entry>
</dates>
</vuln>
<vuln vid="9be819c6-4633-11d9-a9e7-0001020eed82">
<topic>bnc -- remotely exploitable buffer overflow in getnickuserhost</topic>
<affects>
<package>
<name>bnc</name>
<range><lt>2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A LSS Security Advisory reports:</p>
<blockquote cite="http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03">
<p>There is a buffer overflow vulnerability in
getnickuserhost() function that is called when BNC is
processing response from IRC server.</p>
<p>Vulnerability can be exploited if attacker tricks user to
connect to his fake IRC server that will exploit this
vulnerability. If the attacker has access to BNC proxy
server, this vulnerability can be used to gain shell
access on machine where BNC proxy server is set.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1052</cvename>
<mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839</mlist>
<url>http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03</url>
<url>http://www.gotbnc.com/changes.html</url>
</references>
<dates>
<discovery>2004-11-10</discovery>
<entry>2004-12-04</entry>
<modified>2005-02-22</modified>
</dates>
</vuln>
<vuln vid="f11b219a-44b6-11d9-ae2f-021106004fd6">
<topic>rssh & scponly -- arbitrary command execution</topic>
<affects>
<package>
<name>rssh</name>
<range><le>2.2.2</le></range>
</package>
<package>
<name>scponly</name>
<range><lt>4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Wies identified both rssh & scponly have a vulnerability
that allows arbitrary command execution. He reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273">
<p>The problem is compounded when you recognize that the main use of
rssh and scponly is to allow file transfers, which in turn allows a
malicious user to transfer and execute entire custom scripts on the
remote machine.</p>
</blockquote>
</body>
</description>
<references>
<bid>11791</bid>
<bid>11792</bid>
<freebsdpr>ports/74633</freebsdpr>
<mlist msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273</mlist>
</references>
<dates>
<discovery>2004-11-28</discovery>
<entry>2004-12-02</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="2b4d5288-447e-11d9-9ebb-000854d03344">
<topic>rockdodger -- buffer overflows</topic>
<affects>
<package>
<name>rockdodger</name>
<range><lt>0.6_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The environment variable HOME is copied without regard
to buffer size, which can be used to gain elevated privilege
if the binary is installed setgid games, and a string is
read from the high score file without bounds check.</p>
<p>The port installs the binary without setgid, but with a
world-writable high score file.</p>
</body>
</description>
<references>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878</url>
</references>
<dates>
<discovery>2004-10-29</discovery>
<entry>2004-12-02</entry>
</dates>
</vuln>
<vuln vid="40549bbf-43b5-11d9-a9e7-0001020eed82">
<topic>zip -- long path buffer overflow</topic>
<affects>
<package>
<name>zip</name>
<range><lt>2.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A HexView security advisory reports:</p>
<blockquote cite="http://www.hexview.com/docs/20041103-1.txt">
<p>When zip performs recursive folder compression, it does
not check for the length of resulting path. If the path is
too long, a buffer overflow occurs leading to stack
corruption and segmentation fault. It is possible to
exploit this vulnerability by embedding a shellcode in
directory or file name. While the issue is not of primary
concern for regular users, it can be critical for
environments where zip archives are re-compressed
automatically using Info-Zip application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1010</cvename>
<bid>11603</bid>
<url>http://www.hexview.com/docs/20041103-1.txt</url>
</references>
<dates>
<discovery>2004-10-03</discovery>
<entry>2004-12-01</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="85edfb6a-43a5-11d9-a9e7-0001020eed82">
<topic>sudoscript -- signal delivery vulnerability</topic>
<affects>
<package>
<name>sudoscript</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If non-root access is enabled in sudoscript, any member of
the ssers group can send a SIGHUP signal to any process.</p>
</body>
</description>
<references>
<url>http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html</url>
</references>
<dates>
<discovery>2004-11-14</discovery>
<entry>2004-12-01</entry>
</dates>
</vuln>
<vuln vid="553224e7-4325-11d9-a3d5-000c6e8f12ef">
<topic>jabberd -- remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><ge>2.*</ge><le>2.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper bounds-checking of username
and password in the C2S module, it is possible
for an attacker to cause a remote buffer overflow.
The server directly handles the userinput with
SQL backend functions - malicious input may lead
to buffer overflow.</p>
</body>
</description>
<references>
<mlist msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110144303826709</mlist>
</references>
<dates>
<discovery>2004-11-24</discovery>
<entry>2004-11-30</entry>
</dates>
</vuln>
<vuln vid="cdf14b68-3ff9-11d9-8405-00065be4b5b6">
<topic>Open DC Hub -- remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>opendchub</name>
<range><lt>0.7.14_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Donato Ferrante reported an exploitable buffer overflow in
this software package. Any user that can login with 'admin'
privileges can abuse it, trough the $RedirectAll command,
to execute arbitrary code.</p>
</body>
</description>
<references>
<mlist msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110144606411674</mlist>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml</url>
</references>
<dates>
<discovery>2004-11-24</discovery>
<entry>2004-11-27</entry>
<modified>2005-02-13</modified>
</dates>
</vuln>
<vuln vid="a163baff-3fe1-11d9-a9e7-0001020eed82">
<topic>unarj -- long filename buffer overflow</topic>
<affects>
<package>
<name>unarj</name>
<range><lt>2.43_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludwig Nussel has discovered a buffer overflow
vulnerability in unarj's handling of long filenames which
could potentially lead to execution of arbitrary code with
the permissions of the user running unarj.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0947</cvename>
<bid>11665</bid>
</references>
<dates>
<discovery>2004-11-09</discovery>
<entry>2004-11-26</entry>
</dates>
</vuln>
<vuln vid="1f922de0-3fe5-11d9-a9e7-0001020eed82">
<topic>unarj -- directory traversal vulnerability</topic>
<affects>
<package>
<name>unarj</name>
<range><lt>2.43_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>unarj has insufficient checks for filenames that contain
<q>..</q>. This can allow an attacker to overwrite
arbitrary files with the permissions of the user running
unarj.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1027</cvename>
<bid>11436</bid>
<mlist msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109748984030292</mlist>
</references>
<dates>
<discovery>2004-10-10</discovery>
<entry>2004-11-26</entry>
</dates>
</vuln>
<vuln vid="ac619d06-3ef8-11d9-8741-c942c075aa41">
<topic>jdk/jre -- Security Vulnerability With Java Plugin</topic>
<affects>
<package>
<name>jdk</name>
<range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
<range><ge>1.3.0</ge><le>1.3.1p9_5</le></range>
</package>
<package>
<name>linux-jdk</name>
<name>linux-sun-jdk</name>
<range><ge>1.4.0</ge><le>1.4.2.05</le></range>
<range><ge>1.3.0</ge><le>1.3.1.13</le></range>
</package>
<package>
<name>linux-blackdown-jdk</name>
<range><ge>1.3.0</ge><le>1.4.2</le></range>
</package>
<package>
<name>linux-ibm-jdk</name>
<range><ge>1.3.0</ge><le>1.4.2</le></range>
</package>
<package>
<name>diablo-jdk</name>
<name>diablo-jre</name>
<range><ge>1.3.1.0</ge><le>1.3.1.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sun Java Plugin capability in Java 2 Runtime Environment
(JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does
not properly restrict access between Javascript and Java
applets during data transfer, which allows remote attackers to
load unsafe classes and execute arbitrary code.</p>
</body>
</description>
<references>
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&searchclause=%22category:security%22%20%22availability,%20security%22</url>
<url>http://www.securityfocus.com/archive/1/382072</url>
<cvename>CVE-2004-1029</cvename>
<mlist msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&m=110125046627909</mlist>
</references>
<dates>
<discovery>2004-11-24</discovery>
<entry>2004-11-25</entry>
<modified>2005-04-27</modified>
</dates>
</vuln>
<vuln vid="1a32e8ee-3edb-11d9-8699-00065be4b5b6">
<topic>ProZilla -- server response buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>prozilla</name>
<range><le>1.3.6_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Buffer overflow vulnerabilities have been reported to exist
in this software package. The vulnerabilities can be triggered by
a remote server and can be used to inject malicious code in the
ProZilla process.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1120</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml</url>
<url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url>
<mlist msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110136626320497</mlist>
</references>
<dates>
<discovery>2004-11-23</discovery>
<entry>2004-11-25</entry>
<modified>2005-10-01</modified>
</dates>
</vuln>
<vuln vid="31952117-3d17-11d9-8818-008088034841">
<topic>Cyrus IMAPd -- APPEND command uses undefined programming construct</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><ge>2.2.7</ge><le>2.2.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>To support MULTIAPPENDS the cmd_append handler uses the
global stage array. This array is one of the things that gets
destructed when the fatal() function is triggered. When the
Cyrus IMAP code adds new entries to this array this is done
with the help of the postfix increment operator in combination
with memory allocation functions. The increment is performed
on a global variable counting the number of allocated
stages. Because the memory allocation function can fail and
therefore internally call fatal() this construct is undefined
arcording to ANSI C. This means that it is not clearly defined
if the numstage counter is already increased when fatal() is
called or not. While older gcc versions increase the counter
after the memory allocation function has returned, on newer
gcc versions (3.x) the counter gets actually increased
before. In such a case the stage destructing process will try
to free an uninitialised and maybe attacker supplied
pointer. Which again could lead to remote code
execution. (Because it is hard for an attacker to let the
memory allocation functions fail in the right moment no PoC
code for this problem was designed)</p>
</body>
</description>
<references>
<url>http://security.e-matters.de/advisories/152004.html</url>
</references>
<dates>
<discovery>2004-11-06</discovery>
<entry>2004-11-22</entry>
</dates>
</vuln>
<vuln vid="c0a269d5-3d16-11d9-8818-008088034841">
<topic>Cyrus IMAPd -- FETCH command out of bounds memory corruption</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><lt>2.1.17</lt></range>
<range><ge>2.2.*</ge><le>2.2.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The argument parser of the fetch command suffers a bug very
similiar to the partial command problem. Arguments like
"body[p", "binary[p" or "binary[p" will be wrongly detected
and the bufferposition can point outside of the allocated
buffer for the rest of the parsing process. When the parser
triggers the PARSE_PARTIAL macro after such a malformed
argument was received this can lead to a similiar one byte
memory corruption and allows remote code execution, when the
heap layout was successfully controlled by the attacker.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1013</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
</references>
<dates>
<discovery>2004-11-06</discovery>
<entry>2004-11-22</entry>
<modified>2004-11-24</modified>
</dates>
</vuln>
<vuln vid="114d70f3-3d16-11d9-8818-008088034841">
<topic>Cyrus IMAPd -- PARTIAL command out of bounds memory corruption</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><lt>2.1.17</lt></range>
<range><ge>2.2.*</ge><le>2.2.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a bug within the argument parser of the partial
command an argument like "body[p" will be wrongly detected as
"body.peek". Because of this the bufferposition gets increased
by 10 instead of 5 and could therefore point outside the
allocated memory buffer for the rest of the parsing
process. In imapd versions prior to 2.2.7 the handling of
"body" or "bodypeek" arguments was broken so that the
terminating ']' got overwritten by a '\0'. Combined the two
problems allow a potential attacker to overwrite a single byte
of malloc() control structures, which leads to remote code
execution if the attacker successfully controls the heap
layout.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1012</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
</references>
<dates>
<discovery>2004-11-06</discovery>
<entry>2004-11-22</entry>
<modified>2004-11-24</modified>
</dates>
</vuln>
<vuln vid="816fdd8b-3d14-11d9-8818-008088034841">
<topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><ge>2.2.4</ge><le>2.2.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When the option imapmagicplus is activated on a server the
PROXY and LOGIN commands suffer a standard stack overflow,
because the username is not checked against a maximum length
when it is copied into a temporary stack buffer. This bug is
especially dangerous because it can be triggered before any
kind of authentification took place.</p>
</body>
</description>
<references>
<cvename>CVE-2004-1011</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
</references>
<dates>
<discovery>2004-11-06</discovery>
<entry>2004-11-22</entry>
</dates>
</vuln>
<vuln vid="6a33477e-3a9c-11d9-84ad-000c6e8f12ef">
<topic>phpMyAdmin -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><le>2.6.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple cross-site scripting vulnerabilities, caused
by improper input parameter sanitizing, were
detected in phpMyAdmin, which may enable an attacker
to do cross-site scripting attacks.</p>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3</url>
</references>
<dates>
<discovery>2004-11-18</discovery>
<entry>2004-11-20</entry>
</dates>
</vuln>
<vuln vid="759b8dfe-3972-11d9-a9e7-0001020eed82">
<topic>Overflow error in fetch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.3</ge><lt>5.3_1</lt></range>
<range><ge>5.2.1</ge><lt>5.2.1_12</lt></range>
<range><ge>5.1</ge><lt>5.1_18</lt></range>
<range><ge>5.0</ge><lt>5.0_22</lt></range>
<range><ge>4.10</ge><lt>4.10_4</lt></range>
<range><ge>4.9</ge><lt>4.9_13</lt></range>
<range><ge>4.8</ge><lt>4.8_26</lt></range>
<range><lt>4.7_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An integer overflow condition in <a href="http://www.freebsd.org/cgi/man.cgi?query=fetch">fetch(1)</a>
in the processing of HTTP headers can result in a buffer
overflow.</p>
<p>A malicious server or CGI script can respond to an HTTP or
HTTPS request in such a manner as to cause arbitrary
portions of the client's memory to be overwritten, allowing
for arbitrary code execution.</p>
</body>
</description>
<references>
<freebsdsa>SA-04:16.fetch</freebsdsa>
<cvename>CVE-2004-1053</cvename>
<bid>11702</bid>
</references>
<dates>
<discovery>2004-11-14</discovery>
<entry>2004-11-18</entry>
</dates>
</vuln>
<vuln vid="f3d3f621-38d8-11d9-8fff-000c6e8f12ef">
<topic>smbd -- buffer-overrun vulnerability</topic>
<affects>
<package>
<name>samba</name>
<range><ge>3.*</ge><lt>3.0.8</lt></range>
<range><ge>3.*,1</ge><lt>3.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper bounds checking of certain trans2
requests, there is a possible buffer overrun in smbd.
The attacker needs to be able to create files with
very specific Unicode filenames on the share to take
advantage of this issue.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0882</cvename>
<bid>11678</bid>
<mlist msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110055646329581</mlist>
</references>
<dates>
<discovery>2004-11-15</discovery>
<entry>2004-11-17</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="b4af3ede-36e9-11d9-a9e7-0001020eed82">
<topic>twiki -- arbitrary shell command execution</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>20040902</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hans Ulrich Niedermann reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456">
<p>The TWiki search function uses a user supplied search
string to compose a command line executed by the Perl
backtick (``) operator.</p>
<p>The search string is not checked properly for shell
metacharacters and is thus vulnerable to search string
containing quotes and shell commands.</p>
<p>IMPACT: An attacker is able to execute arbitrary shell
commands with the privileges of the TWiki process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1037</cvename>
<mlist msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456</mlist>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch</url>
</references>
<dates>
<discovery>2004-11-12</discovery>
<entry>2004-11-15</entry>
<modified>2004-11-23</modified>
</dates>
</vuln>
<vuln vid="50744596-368f-11d9-a9e7-0001020eed82">
<topic>proxytunnel -- format string vulnerability</topic>
<affects>
<package>
<name>proxytunnel</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Gentoo Linux Security Advisory reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
<p>Florian Schilhabel of the Gentoo Linux Security Audit
project found a format string vulnerability in
Proxytunnel. When the program is started in daemon mode
(-a [port]), it improperly logs invalid proxy answers to
syslog.</p>
<p>A malicious remote server could send specially-crafted
invalid answers to exploit the format string
vulnerability, potentially allowing the execution of
arbitrary code on the tunnelling host with the rights of
the Proxytunnel process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0992</cvename>
<url>http://proxytunnel.sourceforge.net/news.html</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml</url>
</references>
<dates>
<discovery>2004-11-01</discovery>
<entry>2004-11-15</entry>
</dates>
</vuln>
<vuln vid="bdd1537b-354c-11d9-a9e7-0001020eed82">
<topic>sudo -- privilege escalation with bash scripts</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.6.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Sudo Security Alerts reports:</p>
<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
<p>A flaw in exists in sudo's environment sanitizing prior
to sudo version 1.6.8p2 that could allow a malicious user
with permission to run a shell script that utilized the
bash shell to run arbitrary commands.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.courtesan.com/sudo/alerts/bash_functions.html</url>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2004-11-13</entry>
</dates>
</vuln>
<vuln vid="d656296b-33ff-11d9-a9e7-0001020eed82">
<topic>ruby -- CGI DoS</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby_r</name>
<range><gt>1.7.*</gt><lt>1.8.2.p2_2</lt></range>
<range><lt>1.6.8.2004.07.28_1</lt></range>
</package>
<package>
<name>ruby-1.7.0</name>
<range><ge>a2001.05.12</ge><le>a2001.05.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ruby CGI.rb module contains a bug which can cause the
CGI module to go into an infinite loop, thereby causing a
denial-of-service situation on the web server by using all
available CPU time.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0983</cvename>
<url>http://www.debian.org/security/2004/dsa-586</url>
</references>
<dates>
<discovery>2004-11-06</discovery>
<entry>2004-11-13</entry>
<modified>2004-11-25</modified>
</dates>
</vuln>
<vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad">
<topic>samba -- potential remote DoS vulnerability</topic>
<affects>
<package>
<name>samba</name>
<range><gt>3.*</gt><lt>3.0.8</lt></range>
<range><gt>3.*,1</gt><lt>3.0.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Karol Wiesek at iDEFENSE reports:</p>
<blockquote cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
<p>A remote attacker could cause an smbd process to consume
abnormal amounts of system resources due to an input
validation error when matching filenames containing
wildcard characters.</p>
</blockquote>
<p>Although samba.org classifies this as a DoS vulnerability,
several members of the security community believe it may be
exploitable for arbitrary code execution.</p>
</body>
</description>
<references>
<freebsdpr>ports/73701</freebsdpr>
<cvename>CVE-2004-0930</cvename>
<url>http://us4.samba.org/samba/security/CAN-2004-0930.html</url>
</references>
<dates>
<discovery>2004-09-30</discovery>
<entry>2004-11-12</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="fc99c736-3499-11d9-98a7-0090962cff2a">
<topic>gnats -- format string vulnerability</topic>
<affects>
<package>
<name>gnats</name>
<range><ge>4.*</ge><le>4.0_2</le></range>
<range><le>3.113.1_9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gnats suffers from a format string bug, which may enable an
attacker to execute arbitary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0623</cvename>
<mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108820000823191</mlist>
</references>
<dates>
<discovery>2004-06-21</discovery>
<entry>2004-11-12</entry>
</dates>
</vuln>
<vuln vid="7fbfe159-3438-11d9-a9e7-0001020eed82">
<topic>squirrelmail -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>ja-squirrelmail</name>
<range><lt>1.4.3a_4,2</lt></range>
</package>
<package>
<name>squirrelmail</name>
<range><lt>1.4.3a_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A SquirrelMail Security Notice reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004">
<p>There is a cross site scripting issue in the decoding of
encoded text in certain headers. SquirrelMail correctly
decodes the specially crafted header, but doesn't sanitize
the decoded strings.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004</mlist>
</references>
<dates>
<discovery>2004-11-03</discovery>
<entry>2004-11-12</entry>
</dates>
</vuln>
<vuln vid="1f8dea68-3436-11d9-952f-000c6e8f12ef">
<cancelled superseded="9be819c6-4633-11d9-a9e7-0001020eed82"/>
</vuln>
<vuln vid="027380b7-3404-11d9-ac1b-000d614f7fad">
<topic>hafiye -- lack of terminal escape sequence filtering</topic>
<affects>
<package>
<name>hafiye</name>
<range><lt>1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A siyahsapka.org advisory reads:</p>
<blockquote cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
<p>Hafiye-1.0 doesnt filter the payload when printing it to
the terminal. A malicious attacker can send packets with
escape sequence payloads to exploit this vulnerability.</p>
<p>If Hafiye has been started with -n packet count option ,
the vulnerability could allow remote code execution. For
remote code execution the victim must press Enter after
program exit.</p>
</blockquote>
<p>Note that it appears that this bug can only be exploited in
conjunction with a terminal emulator that honors the
appropriate escape sequences.</p>
</body>
</description>
<references>
<freebsdpr>ports/70978</freebsdpr>
<url>http://deicide.siyahsapka.org/hafiye_esc.txt</url>
<url>http://www.enderunix.org/hafiye/</url>
</references>
<dates>
<discovery>2004-08-23</discovery>
<entry>2004-11-11</entry>
</dates>
</vuln>
<vuln vid="e69ba632-326f-11d9-b5b7-000854d03344">
<topic>ez-ipupdate -- format string vulnerability</topic>
<affects>
<package>
<name>ez-ipupdate</name>
<range><lt>3.0.11b8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Data supplied by a remote server is used as the format string
instead of as parameters in a syslog() call. This may lead
to crashes or potential running of arbitrary code. It is
only a problem when running in daemon mode (very common) and
when using some service types.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0980</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2004-11-11</entry>
</dates>
</vuln>
<vuln vid="eeb1c128-33e7-11d9-a9e7-0001020eed82">
<topic>ImageMagick -- EXIF parser buffer overflow</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There exists a buffer overflow vulnerability in
ImageMagick's EXIF parsing code which may lead to execution
of arbitrary code.</p>
</body>
</description>
<references>
<bid>11548</bid>
<cvename>CVE-2004-0981</cvename>
<url>http://secunia.com/advisories/12995/</url>
<url>http://www.imagemagick.org/www/Changelog.html</url>
</references>
<dates>
<discovery>2004-10-25</discovery>
<entry>2004-11-11</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="282dfea0-3378-11d9-b404-000c6e8f12ef">
<topic>apache2 multiple space header denial-of-service vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.*</gt><le>2.0.52_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It is possible for remote attackers to cause a denial-of-service
scenario on Apache 2.0.52 and earlier by sending an HTTP GET
request with a MIME header containing multiple lines full of
whitespaces.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0942</cvename>
<mlist msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109930632317208</mlist>
</references>
<dates>
<discovery>2004-11-01</discovery>
<entry>2004-11-10</entry>
<modified>2004-11-11</modified>
</dates>
</vuln>
<vuln vid="f3017ce1-32a4-11d9-a9e7-0001020eed82">
<topic>socat -- format string vulnerability</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Socat Security Advisory 1 states:</p>
<blockquote cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
<p>socat up to version 1.4.0.2 contains a syslog() based
format string vulnerability. This issue was originally
reported by CoKi on 19 Oct.2004 <a href="http://www.nosystem.com.ar/advisories/advisory-07.txt">http://www.nosystem.com.ar/advisories/advisory-07.txt</a>.
Further investigation showed that this vulnerability could
under some circumstances lead to local or remote execution
of arbitrary code with the privileges of the socat
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dest-unreach.org/socat/advisory/socat-adv-1.html</url>
<url>http://www.nosystem.com.ar/advisories/advisory-07.txt</url>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2004-11-10</entry>
</dates>
</vuln>
<vuln vid="9ff4c91e-328c-11d9-a9e7-0001020eed82">
<topic>libxml -- remote buffer overflows</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_3</lt></range>
</package>
<package>
<name>libxml2</name>
<range><lt>2.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p><q>infamous41md</q> reports that libxml contains multiple
buffer overflows in the URL parsing and DNS name resolving
functions. These vulnerabilities could lead to execution of
arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0989</cvename>
<bid>11526</bid>
<mlist msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109880813013482</mlist>
<url>http://www.debian.org/security/2004/dsa-582</url>
</references>
<dates>
<discovery>2004-10-26</discovery>
<entry>2004-11-09</entry>
<modified>2004-11-10</modified>
</dates>
</vuln>
<vuln vid="a5742055-300a-11d9-a9e7-0001020eed82">
<topic>p5-Archive-Zip -- virus detection evasion</topic>
<affects>
<package>
<name>p5-Archive-Zip</name>
<range><lt>1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An AMaViS Security Announcement reports that a
vulnerability exist in the Archive::Zip Perl module which
may lead to bypass of malicious code in anti-virus programs
by creating specially crafted ZIP files.</p>
</body>
</description>
<references>
<url>http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities</url>
<url>http://www.amavis.org/security/asa-2004-6.txt</url>
<url>http://rt.cpan.org/NoAuth/Bug.html?id=8077</url>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2004-11-08</entry>
</dates>
</vuln>
<vuln vid="6e6a6b8a-2fde-11d9-b3a2-0050fc56d258">
<topic>apache mod_include buffer overflow vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.33</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.32+2.8.21_1</lt></range>
</package>
<package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.32+2.8.21_1</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><le>1.3.31</le></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.33</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><le>1.3.29.1.55</le></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.33+30.21</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.33+30.21+2.8.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a buffer overflow in a function used by mod_include
that may enable a local user to gain privileges of a httpd
child. Only users that are able to create SSI documents can
take advantage of that vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0940</cvename>
<url>http://www.securitylab.ru/48807.html</url>
</references>
<dates>
<discovery>2004-10-22</discovery>
<entry>2004-11-06</entry>
</dates>
</vuln>
<vuln vid="6a164d84-2f7f-11d9-a9e7-0001020eed82">
<topic>postgresql-contrib -- insecure temporary file creation</topic>
<affects>
<package>
<name>postgresql-contrib</name>
<range><lt>7.2.6</lt></range>
<range><gt>7.3.*</gt><lt>7.3.8</lt></range>
<range><gt>7.4.*</gt><lt>7.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The make_oidjoins_check script in the PostgreSQL RDBMS has
insecure handling of temporary files, which could lead to an
attacker overwriting arbitrary files with the credentials of
the user running the make_oidjoins_check script.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0977</cvename>
<bid>11295</bid>
<url>http://www.postgresql.org/news/234.html</url>
<url>http://www.trustix.net/errata/2004/0050/</url>
</references>
<dates>
<discovery>2004-09-10</discovery>
<entry>2004-11-06</entry>
</dates>
</vuln>
<vuln vid="62239968-2f2a-11d9-a9e7-0001020eed82">
<topic>gd -- integer overflow</topic>
<affects>
<package>
<name>gd</name>
<name>uk-gd</name>
<name>ja-gd</name>
<range><lt>2.0.29,1</lt></range>
<range><gt>1.*,2</gt><lt>2.*,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>infamous41md reports about the GD Graphics Library:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099">
<p>There is an integer overflow when allocating memory in
the routine that handles loading PNG image files. This
later leads to heap data structures being overwritten. If
an attacker tricked a user into loading a malicious PNG
image, they could leverage this into executing arbitrary
code in the context of the user opening image.</p>
</blockquote>
</body>
</description>
<references>
<bid>11523</bid>
<cvename>CVE-2004-0990</cvename>
<mlist msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099</mlist>
<url>http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29</url>
</references>
<dates>
<discovery>2004-10-26</discovery>
<entry>2004-11-05</entry>
</dates>
</vuln>
<vuln vid="19518d22-2d05-11d9-8943-0050fc56d258">
<topic>putty -- buffer overflow vulnerability in ssh2 support</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a bug in SSH2 support that allows a server to execute
malicious code on a connecting PuTTY client.
This attack can be performed before host key verification happens,
so a different machine -- man in the middle attack -- could fake
the machine you are connecting to.</p>
</body>
</description>
<references>
<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207</mlist>
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html</url>
</references>
<dates>
<discovery>2004-10-26</discovery>
<entry>2004-11-04</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="e0070221-2dd8-11d9-a9e7-0001020eed82">
<topic>wzdftpd -- remote DoS</topic>
<affects>
<package>
<name>wzdftpd</name>
<range><lt>0.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wzdftpd contains a potential remote Denial-of-Service.</p>
</body>
</description>
<references>
<url>http://sourceforge.net/project/shownotes.php?release_id=263573</url>
</references>
<dates>
<discovery>2004-10-28</discovery>
<entry>2004-11-03</entry>
</dates>
</vuln>
<vuln vid="1f826757-26be-11d9-ad2d-0050fc56d258">
<topic>rssh -- format string vulnerability</topic>
<affects>
<package>
<name>rssh</name>
<range><le>2.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a format string bug in rssh that enables an attacker
to execute arbitrary code from an account configured to use
rssh. On FreeBSD it is only possible to compromise the rssh
running account, not root.</p>
</body>
</description>
<references>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
<mlist msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&m=109855982425122</mlist>
</references>
<dates>
<discovery>2004-10-23</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="ed1d404d-2784-11d9-b954-000bdb1444a4">
<topic>horde -- cross-site scripting vulnerability in help window</topic>
<affects>
<package>
<name>horde</name>
<name>horde-devel</name>
<range><lt>2.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Horde Team announcement states that a potential cross-site
scripting vulnerability in the help window has been
corrected. The vulnerability appears to involve the handling
of the <code>topic</code> and <code>module</code> parameters
of the help window template.</p>
</body>
</description>
<references>
<mlist msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&m=109879164718625</mlist>
</references>
<dates>
<discovery>2004-10-06</discovery>
<entry>2004-10-27</entry>
</dates>
</vuln>
<vuln vid="f4428842-a583-4a4c-89b7-297c3459a1c3">
<topic>bogofilter -- RFC 2047 decoder denial-of-service vulnerability</topic>
<affects>
<package>
<name>bogofilter</name>
<name>bogofilter-qdbm</name>
<name>bogofilter-tdb</name>
<name>ru-bogofilter</name>
<range><ge>0.17.4</ge><lt>0.92.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The bogofilter team has been provided with a test case of a
malformatted (non-conformant) RFC-2047 encoded word that can cause
bogofilter versions 0.92.7 and prior to try to write a NUL byte into
a memory location that is either one byte past the end of a flex
buffer or to a location that is the negative of the encoded word's
start of payload data, causing a segmentation fault.</p>
</body>
</description>
<references>
<freebsdpr>ports/73144</freebsdpr>
<cvename>CVE-2004-1007</cvename>
<mlist msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
<mlist msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
<url>http://bugs.debian.org/275373</url>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01</url>
</references>
<dates>
<discovery>2004-10-09</discovery>
<entry>2004-10-26</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="ad2f3337-26bf-11d9-9289-000c41e2cdad">
<topic>xpdf -- integer overflow vulnerabilities</topic>
<affects>
<package>
<name>gpdf</name>
<name>cups-base</name>
<range><lt>1.1.22.0</lt></range>
</package>
<package>
<name>xpdf</name>
<range><lt>3.00_4</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.3.0_1</lt></range>
</package>
<package>
<name>koffice</name>
<range><lt>1.3.2_1,1</lt></range>
</package>
<package>
<name>teTeX-base</name>
<range><lt>2.0.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans discovered several integer arithmetic overflows
in the xpdf 2 and xpdf 3 code bases. The flaws have impacts
ranging from denial-of-service to arbitrary code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0888</cvename>
<cvename>CVE-2004-0889</cvename>
<url>http://scary.beasts.org/security/CESA-2004-002.txt</url>
<url>http://scary.beasts.org/security/CESA-2004-007.txt</url>
<url>http://www.kde.org/info/security/advisory-20041021-1.txt</url>
</references>
<dates>
<discovery>2004-10-21</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="f2d6a5e1-26b9-11d9-9289-000c41e2cdad">
<topic>gaim -- MSN denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gaim team discovered denial-of-service vulnerabilities in
the MSN protocol handler:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=7">
<p>After accepting a file transfer request, Gaim will attempt
to allocate a buffer of a size equal to the entire filesize,
this allocation attempt will cause Gaim to crash if the size
exceeds the amount of available memory.</p>
</blockquote>
<blockquote cite="http://gaim.sourceforge.net/security/?id=8">
<p>Gaim allocates a buffer for the payload of each message
received based on the size field in the header of the
message. A malicious peer could specify an invalid size that
exceeds the amount of available memory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://gaim.sourceforge.net/security/?id=7</url>
<url>http://gaim.sourceforge.net/security/?id=8</url>
</references>
<dates>
<discovery>2004-10-19</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="ad61657d-26b9-11d9-9289-000c41e2cdad">
<topic>gaim -- Content-Length header denial-of-service vulnerability</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.82</lt></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sean <q>infamous42md</q> reports:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=6">
<p>When a remote server provides a large "content-length"
header value, Gaim will attempt to allocate a buffer to
store the content, however this allocation attempt will
cause Gaim to crash if the length exceeds the amount of
possible memory. This happens when reading profile
information on some protocols. It also happens when smiley
themes are installed via drag and drop.</p>
</blockquote>
</body>
</description>
<references>
<url>http://gaim.sourceforge.net/security/?id=6</url>
</references>
<dates>
<discovery>2004-08-26</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="4260eacb-26b8-11d9-9289-000c41e2cdad">
<topic>gaim -- multiple buffer overflows</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.82</lt></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sean <q>infamous42md</q> reports several situations in gaim
that may result in exploitable buffer overflows:</p>
<ul>
<li>Rich Text Format (RTF) messages in Novell GroupWise
protocol</li>
<li>Unsafe use of gethostbyname in zephyr protocol</li>
<li>URLs which are over 2048 bytes long once decoded</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2004-0785</cvename>
<url>http://gaim.sourceforge.net/security/?id=3</url>
<url>http://gaim.sourceforge.net/security/?id=4</url>
<url>http://gaim.sourceforge.net/security/?id=5</url>
</references>
<dates>
<discovery>2004-08-26</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="e16293f0-26b7-11d9-9289-000c41e2cdad">
<topic>gaim -- heap overflow exploitable by malicious GroupWise server</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.82</lt></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sean <q>infamous42md</q> reports that a malicious GroupWise
messaging server may be able to exploit a heap buffer
overflow in gaim, leading to arbitrary code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0754</cvename>
<url>http://gaim.sourceforge.net/security/?id=2</url>
</references>
<dates>
<discovery>2004-08-26</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="635bf5f4-26b7-11d9-9289-000c41e2cdad">
<topic>gaim -- malicious smiley themes</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.82</lt></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gaim Security Issues page documents a problem with
installing smiley themes from an untrusted source:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=1">
<p>To install a new smiley theme, a user can drag a tarball
from a graphical file manager, or a hypertext link to one
from a web browser. When a tarball is dragged, Gaim executes
a shell command to untar it. However, it does not escape the
filename before sending it to the shell. Thus, a specially
crafted filename could execute arbitrary commands if the
user could be convinced to drag a file into the smiley theme
selector.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0784</cvename>
<url>http://gaim.sourceforge.net/security/?id=1</url>
</references>
<dates>
<discovery>2004-08-22</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="1e6c4008-245f-11d9-b584-0050fc56d258">
<topic>gaim -- buffer overflow in MSN protocol support</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ru-gaim</name>
<range><ge>0.79</ge><le>1.0.1</le></range>
</package>
<package>
<name>gaim</name>
<range><gt>20030000</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a buffer overflow in the MSN protocol support for
gaim 0.79 to 1.0.1, it is possible for remote clients to do a
denial-of-service attack on the application.
This is caused by an unbounded copy operation, which writes
to the wrong buffer.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0891</cvename>
<url>http://gaim.sourceforge.net/security/?id=9</url>
</references>
<dates>
<discovery>2004-10-19</discovery>
<entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="4238151d-207a-11d9-bfe2-0090962cff2a">
<topic>mod_ssl -- SSLCipherSuite bypass</topic>
<affects>
<package>
<name>ru-apache+mod_ssl</name>
<range><le>1.3.31+30.20+2.8.18</le></range>
</package>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.31+2.8.20</lt></range>
</package>
<package>
<name>apache+mod_ssl+ipv6</name>
<range><le>1.3.31+2.8.18_4</le></range>
</package>
<package>
<name>apache2</name>
<range><le>2.0.52_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It is possible for clients to use any cipher suite configured by
the virtual host, whether or not a certain cipher suite is selected
for a specific directory. This might result in clients using a
weaker encryption than originally configured.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0885</cvename>
<mlist msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&m=109724918128044</mlist>
<url>http://issues.apache.org/bugzilla/show_bug.cgi?id=31505</url>
</references>
<dates>
<discovery>2004-10-01</discovery>
<entry>2004-10-23</entry>
</dates>
</vuln>
<vuln vid="20d16518-2477-11d9-814e-0001020eed82">
<topic>mpg123 -- buffer overflow in URL handling</topic>
<affects>
<package>
<name>mpg123</name>
<name>mpg123-nas</name>
<name>mpg123-esound</name>
<range><lt>0.59r_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Carlos Barros reports that mpg123 contains two buffer
overflows. These vulnerabilities can potentially lead to
execution of arbitrary code.</p>
<p>The first buffer overflow can occur when mpg123 parses a
URL with a user-name/password field that is more than 256
characters long. This problem can be triggered either
locally or remotely via a specially crafted play list. The
second potential buffer overflow may be triggered locally by
a specially crafted symlink to the mpg123 binary. This
problem is not as serious, since mpg123 is not installed
setuid by default.</p>
</body>
</description>
<references>
<bid>11468</bid>
<cvename>CVE-2004-0982</cvename>
<mlist msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109834486312407</mlist>
</references>
<dates>
<discovery>2004-10-02</discovery>
<entry>2004-10-23</entry>
<modified>2004-12-30</modified>
</dates>
</vuln>
<vuln vid="7b81fc47-239f-11d9-814e-0001020eed82">
<topic>apache2 -- SSL remote DoS</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.0</gt><lt>2.0.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache HTTP Server 2.0.51 release notes report that the
following issues have been fixed:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322">
<p>A segfault in mod_ssl which can be triggered by a
malicious remote server, if proxying to SSL servers has
been configured. [CAN-2004-0751]</p>
<p>A potential infinite loop in mod_ssl which could be
triggered given particular timing of a connection
abort. [CAN-2004-0748]</p>
</blockquote>
</body>
</description>
<references>
<bid>11094</bid>
<bid>11154</bid>
<cvename>CVE-2004-0748</cvename>
<cvename>CVE-2004-0751</cvename>
<mlist msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322</mlist>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964</url>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134</url>
</references>
<dates>
<discovery>2004-07-07</discovery>
<entry>2004-10-21</entry>
</dates>
</vuln>
<vuln vid="fc07c9ca-22ce-11d9-814e-0001020eed82">
<topic>phpmyadmin -- remote command execution vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpmyadmin</name>
<range><lt>2.6.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the phpMyAdmin 2.6.0p2 release notes:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
<p>If PHP is not running in safe mode, a problem in the
MIME-based transformation system (with an "external"
transformation) allows to execute any command with the
privileges of the web server's user.</p>
</blockquote>
</body>
</description>
<references>
<bid>11391</bid>
<url>http://sourceforge.net/project/shownotes.php?release_id=274709</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1044864&group_id=23067&atid=377408</url>
</references>
<dates>
<discovery>2004-10-11</discovery>
<entry>2004-10-20</entry>
</dates>
</vuln>
<vuln vid="61480a9a-22b2-11d9-814e-0001020eed82">
<topic>cabextract -- insecure directory handling</topic>
<affects>
<package>
<name>cabextract</name>
<range><lt>1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cabextract has insufficient checks for file names that
contain <q>../</q>. This can cause files to be extracted to
the parent directory.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0916</cvename>
<url>http://www.kyz.uklinux.net/cabextract.php#changes</url>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2004-10-20</entry>
<modified>2004-10-22</modified>
</dates>
</vuln>
<vuln vid="8091fcea-f35e-11d8-81b0-000347a4fa7d">
<topic>a2ps -- insecure command line argument handling</topic>
<affects>
<package>
<name>a2ps-a4</name>
<range><lt>4.13b_2</lt></range>
</package>
<package>
<name>a2ps-letter</name>
<range><lt>4.13b_2</lt></range>
</package>
<package>
<name>a2ps-letterdj</name>
<range><lt>4.13b_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rudolf Polzer reports:</p>
<blockquote>
<p>a2ps builds a command line for file() containing an
unescaped version of the file name, thus might call
external programs described by the file name. Running a
cronjob over a public writable directory a2ps-ing all
files in it - or simply typing "a2ps *.txt" in /tmp - is
therefore dangerous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1170</cvename>
<freebsdpr>ports/70618</freebsdpr>
<bid>11025</bid>
<url>http://www.osvdb.org/9176</url>
<mlist msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109334851517137</mlist>
</references>
<dates>
<discovery>2004-08-18</discovery>
<entry>2004-10-20</entry>
<modified>2004-12-30</modified>
</dates>
</vuln>
<vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad">
<topic>ifmail -- unsafe set-user-ID application</topic>
<affects>
<package>
<name>ifmail</name>
<range><le>2.15_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Niels Heinen reports that ifmail allows one to specify
a configuration file. Since ifmail runs set-user-ID `news',
this may allow a local attacker to write to arbitrary files
or execute arbitrary commands as the `news' user.</p>
</body>
</description>
<references>
<url>https://svnweb.freebsd.org/changeset/ports/120295</url>
</references>
<dates>
<discovery>2004-08-23</discovery>
<entry>2004-10-19</entry>
<modified>2015-05-01</modified>
</dates>
</vuln>
<vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad">
<topic>imwheel -- insecure handling of PID file</topic>
<affects>
<package>
<name>imwheel</name>
<range><lt>1.0.0.p12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Computer Academic Underground advisory describes the
consequences of imwheel's handling of the process ID file (PID
file):</p>
<blockquote cite="http://www.caughq.org/advisories/CAU-2004-0002.txt">
<p>imwheel exclusively uses a predictably named PID file for
management of multiple imwheel processes. A race condition
exists when the -k command-line option is used to kill
existing imwheel processes. This race condition may be
used by a local user to Denial of Service another user
using imwheel, lead to resource exhaustion of the host
system, or append data to arbitrary files.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.caughq.org/advisories/CAU-2004-0002.txt</url>
<url>http://imwheel.sourceforge.net/files/DEVELOPMENT.txt</url>
</references>
<dates>
<discovery>2004-08-20</discovery>
<entry>2004-10-19</entry>
</dates>
</vuln>
<vuln vid="064225c5-1f53-11d9-836a-0090962cff2a">
<topic>squid -- NTLM authentication denial-of-service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker is able to cause a denial-of-service
situation, when NTLM authentication is enabled in squid.
NTLM authentication uses two functions which lack correct
offset checking.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0832</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1045</url>
</references>
<dates>
<discovery>2004-08-18</discovery>
<entry>2004-10-18</entry>
</dates>
</vuln>
<vuln vid="ca543e06-207a-11d9-814e-0001020eed82">
<topic>cacti -- SQL injection</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fernando Quintero reports that Cacti 0.8.5a suffers from a
SQL injection attack where an attacker can change the
password for any Cacti user. This attack is not possible if
the PHP option magic_quotes_gpc is set to On, which is the
default for PHP in FreeBSD.</p>
</body>
</description>
<references>
<mlist msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&m=109269427427368</mlist>
</references>
<dates>
<discovery>2004-08-16</discovery>
<entry>2004-10-17</entry>
</dates>
</vuln>
<vuln vid="18974c8a-1fbd-11d9-814e-0001020eed82">
<topic>apache13-modssl -- format string vulnerability in proxy support</topic>
<affects>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.31+2.8.19</lt></range>
</package>
<package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.31+2.8.19</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.31+30.20+2.8.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A OpenPKG Security Advisory reports:</p>
<blockquote cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
<p>Triggered by a report to Packet Storm from Virulent, a
format string vulnerability was found in mod_ssl, the
Apache SSL/TLS interface to OpenSSL, version (up to and
including) 2.8.18 for Apache 1.3. The mod_ssl in Apache
2.x is not affected. The vulnerability could be
exploitable if Apache is used as a proxy for HTTPS URLs
and the attacker established a own specially prepared DNS
and origin server environment.</p>
</blockquote>
</body>
</description>
<references>
<bid>10736</bid>
<certvu>303448</certvu>
<cvename>CVE-2004-0700</cvename>
<url>http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html</url>
<url>http://packetstormsecurity.org/0407-advisories/modsslFormat.txt</url>
<mlist msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749</mlist>
</references>
<dates>
<discovery>2004-07-16</discovery>
<entry>2004-10-17</entry>
</dates>
</vuln>
<vuln vid="8e2e6ad8-1720-11d9-9fb9-00902788733b">
<topic>tor -- remote DoS and loss of anonymity</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.0.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tor has various remote crashes which could lead to a remote
denial-of-service and be used to defeat clients anonymity.
It is not expected that these vulnerabilities are
exploitable for arbitrary code execution.</p>
</body>
</description>
<references>
<mlist>http://archives.seul.org/or/announce/Aug-2004/msg00001.html</mlist>
<mlist>http://archives.seul.org/or/announce/Oct-2004/msg00000.html</mlist>
</references>
<dates>
<discovery>2004-08-25</discovery>
<entry>2004-10-15</entry>
</dates>
</vuln>
<vuln vid="b2cfb400-1df0-11d9-a859-0050fc56d258">
<topic>icecast -- Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
<name>icecast</name>
<range><lt>1.3.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper filtering of HTML code in the
status display, it is possible for a remote user
to execute scripting code in the target user's
browser.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0781</cvename>
<url>http://www.securitytracker.com/alerts/2004/Aug/1011047.html</url>
</references>
<dates>
<discovery>2004-08-24</discovery>
<entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="741c3957-1d69-11d9-a804-0050fc56d258">
<topic>icecast -- HTTP header overflow</topic>
<affects>
<package>
<name>icecast2</name>
<range><lt>2.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It is possible to execute remote code simply using
HTTP request plus 31 headers followed by a shellcode that will be
executed directly.</p>
</body>
</description>
<references>
<mlist msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&m=109646043512722</mlist>
</references>
<dates>
<discovery>2004-09-29</discovery>
<entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="20dfd134-1d39-11d9-9be9-000c6e8f12ef">
<topic>freeradius -- denial-of-service vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>0.8.0</ge><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker may be able to crash the freeRADIUS Server
due to three independant bugs in the function which does
improper checking values while processing RADIUS
attributes.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0938</cvename>
<cvename>CVE-2004-0960</cvename>
<cvename>CVE-2004-0961</cvename>
<url>http://www.securitytracker.com/alerts/2004/Sep/1011364.html</url>
<certvu>541574</certvu>
<bid>11222</bid>
</references>
<dates>
<discovery>2004-09-20</discovery>
<entry>2004-10-13</entry>
<modified>2004-10-19</modified>
</dates>
</vuln>
<vuln vid="76301302-1d59-11d9-814e-0001020eed82">
<topic>xerces-c2 -- Attribute blowup denial-of-service</topic>
<affects>
<package>
<name>xerces-c2</name>
<range><lt>2.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Amit Klein reports about Xerces-C++:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645">
<p>An attacker can craft a malicious XML document, which
uses XML attributes in a way that inflicts a denial of
service condition on the target machine (XML parser). The
result of this attack is that the XML parser consumes all
the CPU.</p>
</blockquote>
</body>
</description>
<references>
<bid>11312</bid>
<mlist msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645</mlist>
</references>
<dates>
<discovery>2004-10-02</discovery>
<entry>2004-10-13</entry>
<modified>2004-10-14</modified>
</dates>
</vuln>
<vuln vid="12b7b4cf-1d53-11d9-814e-0001020eed82">
<topic>wordpress -- XSS in administration panel</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pages in the administration panel of Wordpress are
vulnerable for XSS attacks.</p>
</body>
</description>
<references>
<url>http://wordpress.org/development/2004/10/wp-121/</url>
<mlist msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109641484723194</mlist>
</references>
<dates>
<discovery>2004-09-27</discovery>
<entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="3897a2f8-1d57-11d9-bc4a-000c41e2cdad">
<topic>tiff -- multiple integer overflows</topic>
<affects>
<package>
<name>tiff</name>
<range><le>3.6.1_2</le></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>pdflib</name>
<name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
</package>
<package>
<name>gdal</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>ivtools</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>paraview</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>fractorama</name>
<range><lt>1.6.7_1</lt></range>
</package>
<package>
<name>iv</name>
<name>ja-iv</name>
<name>ja-libimg</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dmitry V. Levin discovered numerous integer overflow bugs in
libtiff. Most of these bugs are related to memory management,
and are believed to be exploitable for arbitrary code
execution.</p>
</body>
</description>
<references>
<certvu>687568</certvu>
<cvename>CVE-2004-0886</cvename>
<url>http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-10-13</discovery>
<entry>2004-10-13</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="30cea6be-1d0c-11d9-814e-0001020eed82">
<topic>CUPS -- local information disclosure</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.1.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Certain methods of authenticated remote printing in CUPS
can disclose user names and passwords in the log files.</p>
<p>A workaround for this problem is to set more strict
access permissions on the CUPS logfiles.</p>
</body>
</description>
<references>
<url>http://docs.info.apple.com/article.html?artnum=61798</url>
<url>http://secunia.com/advisories/12690/</url>
<url>http://www.cups.org/str.php?L920</url>
<cvename>CVE-2004-0923</cvename>
<certvu>557062</certvu>
</references>
<dates>
<discovery>2004-09-23</discovery>
<entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="30cf9485-1c2c-11d9-9ecb-000c6e8f12ef">
<topic>zinf -- potential buffer overflow playlist support</topic>
<affects>
<package>
<name>zinf</name>
<range><lt>2.2.5</lt></range>
</package>
<package>
<name>freeamp</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The audio player Zinf is vulnerable to a buffer-overflow
bug in the management of the playlist files.</p>
</body>
</description>
<references>
<mlist msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&m=109608092609200</mlist>
</references>
<dates>
<discovery>2004-09-24</discovery>
<entry>2004-10-12</entry>
</dates>
</vuln>
<vuln vid="f6680c03-0bd8-11d9-8a8a-000c41e2cdad">
<topic>tiff -- RLE decoder heap overflows</topic>
<affects>
<package>
<name>tiff</name>
<range><le>3.6.1_1</le></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>pdflib</name>
<name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
</package>
<package>
<name>gdal</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>ivtools</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>paraview</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>fractorama</name>
<range><lt>1.6.7_1</lt></range>
</package>
<package>
<name>iv</name>
<name>ja-iv</name>
<name>ja-libimg</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans discovered several heap buffer overflows in
libtiff's RLE decoder. These overflows could be triggered
by a specially-crafted TIFF image file, resulting in an
application crash and possibly arbitrary code execution.</p>
</body>
</description>
<references>
<certvu>948752</certvu>
<cvename>CVE-2004-0803</cvename>
<url>http://scary.beasts.org/security/CESA-2004-006.txt</url>
</references>
<dates>
<discovery>2004-10-13</discovery>
<entry>2004-10-13</entry>
<modified>2006-06-08</modified>
</dates>
</vuln>
<vuln vid="26c9e8c6-1c99-11d9-814e-0001020eed82">
<topic>sharutils -- buffer overflows</topic>
<affects>
<package>
<name>sharutils</name>
<range><lt>4.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From Gentoo advisory GLSA 200410-01:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
<p>sharutils contains two buffer overflows. Ulf Harnhammar
discovered a buffer overflow in shar.c, where the length
of data returned by the wc command is not checked.
Florian Schilhabel discovered another buffer overflow in
unshar.c.</p>
<p>An attacker could exploit these vulnerabilities to
execute arbitrary code as the user running one of the
sharutils programs.</p>
</blockquote>
</body>
</description>
<references>
<bid>11298</bid>
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904</url>
</references>
<dates>
<discovery>2004-08-15</discovery>
<entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="3030ae22-1c7f-11d9-81a4-0050fc56d258">
<topic>mail-notification -- denial-of-service vulnerability</topic>
<affects>
<package>
<name>mail-notification</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by an untested return value, and a resulting
null pointer dereference, it is possible for an attacker
to crash the application. However, the attacker must first
hijack the connection between Mail Notification and the
Gmail or IMAP server.</p>
</body>
</description>
<references>
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc</url>
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc</url>
</references>
<dates>
<discovery>2004-10-06</discovery>
<entry>2004-10-12</entry>
</dates>
</vuln>
<vuln vid="65e99f52-1c5f-11d9-bc4a-000c41e2cdad">
<topic>squid -- SNMP module denial-of-service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.7</lt></range>
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Squid-2.5 patches page notes:</p>
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
<p>If a certain malformed SNMP request is received squid
restarts with a Segmentation Fault error.</p>
</blockquote>
<p>This only affects squid installations where SNMP is
explicitly enabled via "make config". As a workaround,
SNMP can be disabled by defining "snmp_port 0" in
squid.conf.</p>
<p>Squid security advisory SQUID-2008:1 explains that Squid-3 versions
up to and including Squid-3.0.STABLE6 are affected by this error,
too.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0918</cvename>
<url>http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2004_3.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2008_1.txt</url>
</references>
<dates>
<discovery>2004-09-29</discovery>
<entry>2004-10-12</entry>
<modified>2008-06-28</modified>
</dates>
</vuln>
<vuln vid="0c592c4a-1bcc-11d9-a3ec-00061bd2d56f">
<topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><ge>2.*</ge><lt>2.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus SASL DIGEST-MD5 plugin contains a potential
buffer overflow when quoting is required in the output.</p>
</body>
</description>
<references>
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171</url>
</references>
<dates>
<discovery>2004-07-06</discovery>
<entry>2004-10-12</entry>
</dates>
</vuln>
<vuln vid="92268205-1947-11d9-bc4a-000c41e2cdad">
<topic>cyrus-sasl -- dynamic library loading and set-user-ID applications</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><le>1.5.28_3</le></range>
<range><ge>2.*</ge><le>2.1.19</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus SASL library, libsasl, contains functions which
may load dynamic libraries. These libraries may be loaded
from the path specified by the environmental variable
SASL_PATH, which in some situations may be fully controlled
by a local attacker. Thus, if a set-user-ID application
(such as chsh) utilizes libsasl, it may be possible for a
local attacker to gain superuser privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0884</cvename>
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104</url>
</references>
<dates>
<discovery>2004-09-22</discovery>
<entry>2004-10-08</entry>
</dates>
</vuln>
<vuln vid="efc4819b-0b2d-11d9-bfe1-000bdb1444a4">
<topic>imp3 -- XSS hole in the HTML viewer</topic>
<affects>
<package>
<name>imp</name>
<range><lt>3.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The script vulnerabilities can only be exposed with
certain browsers and allow XSS attacks when viewing
HTML messages with the HTML MIME viewer</p>
</body>
</description>
<references>
<url>http://thread.gmane.org/gmane.comp.horde.imp/15488</url>
<url>http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&r2=1.389.2.111&ty=h</url>
</references>
<dates>
<discovery>2004-08-20</discovery>
<entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="938f357c-16dd-11d9-bc4a-000c41e2cdad">
<topic>bmon -- unsafe set-user-ID application</topic>
<affects>
<package>
<name>bmon</name>
<range><lt>1.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Nistor reported that the FreeBSD port of bmon was
installed set-user-ID root, and executes commands using
relative paths. This could allow local user to easily obtain
root privileges.</p>
</body>
</description>
<references>
<freebsdpr>ports/67340</freebsdpr>
</references>
<dates>
<discovery>2004-05-29</discovery>
<entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="84ab58cf-e4ac-11d8-9b0a-000347a4fa7d">
<topic>gnutls -- certificate chain verification DoS</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>1.0.17</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><ge>1.1.*</ge><lt>1.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Patric Hornik reports on a problem in the certificate chain
verification procedures of GnuTLS that may result in a
denial-of-service vulnerability:</p>
<blockquote cite="http://www.hornik.sk/SA/SA-20040802.txt">
<p>The certificate chain should be verified from last root
certificate to the first certificate. Otherwise a lot
of unauthorized CPU processing can be forced to check
certificate signatures signed with arbitrary RSA/DSA keys
chosen by attacker.</p>
<p>In GnuTLS the signatures are checked from first to last
certificate, there is no limit on size of keys and no
limit on length of certificate chain.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hornik.sk/SA/SA-20040802.txt</url>
<url>http://secunia.com/advisories/12156</url>
</references>
<dates>
<discovery>2004-08-02</discovery>
<entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="562a3fdf-16d6-11d9-bc4a-000c41e2cdad">
<topic>php -- vulnerability in RFC 1867 file upload processing</topic>
<affects>
<package>
<name>php4</name>
<name>php4-cgi</name>
<range><le>4.3.8_2</le></range>
</package>
<package>
<name>mod_php4</name>
<range><le>4.3.8_2,1</le></range>
</package>
<package>
<name>php5</name>
<name>php5-cgi</name>
<range><le>5.0.1</le></range>
</package>
<package>
<name>mod_php5</name>
<range><le>5.0.1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefano Di Paola discovered an issue with PHP that
could allow someone to upload a file to any directory
writeable by the httpd process. Any sanitizing performed on
the prepended directory path is ignored. This bug can only
be triggered if the $_FILES element name contains an
underscore.</p>
</body>
</description>
<references>
<mlist msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109534848430404</mlist>
<mlist msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109648426331965</mlist>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
<modified>2004-10-12</modified>
</dates>
</vuln>
<vuln vid="ad74a1bd-16d2-11d9-bc4a-000c41e2cdad">
<topic>php -- php_variables memory disclosure</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php4</name>
<range><le>4.3.8_2</le></range>
</package>
<package>
<name>mod_php</name>
<name>mod_php4</name>
<range><ge>4</ge><le>4.3.8_2,1</le></range>
</package>
<package>
<name>php5</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<range><le>5.0.1</le></range>
</package>
<package>
<name>mod_php5</name>
<range><le>5.0.1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefano Di Paola reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492">
<p>Bad array parsing in php_variables.c could lead to show
arbitrary memory content such as pieces of php code
and other data. This affects all GET, POST or COOKIES
variables.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492</mlist>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="fffacc93-16cb-11d9-bc4a-000c41e2cdad">
<topic>xv -- exploitable buffer overflows</topic>
<affects>
<package>
<name>xv</name>
<name>xv-m17n</name>
<range><lt>3.10a_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In a Bugtraq posting, infamous41md(at)hotpop.com reported:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092">
<p>there are at least 5 exploitable buffer and heap
overflows in the image handling code. this allows someone
to craft a malicious image, trick a user into viewing the
file in xv, and upon viewing that image execute arbitrary
code under privileges of the user viewing image. note
the AT LEAST part of the above sentence. there is such a
plethora of bad code that I just stopped reading after
a while. there are at least 100 calls to sprintf() and
strcpy() with no regards for bounds of buffers. 95% of
these deal with program arguments or filenames, so they
are of no interest to exploit. however I just got sick of
reading this code after not too long. so im sure there are
still other overflows in the image handling code for other
image types.</p>
</blockquote>
<p>The posting also included an exploit.</p>
</body>
</description>
<references>
<mlist msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092</mlist>
</references>
<dates>
<discovery>2004-08-20</discovery>
<entry>2004-10-05</entry>
<modified>2004-10-12</modified>
</dates>
</vuln>
<vuln vid="8c33b299-163b-11d9-ac1b-000d614f7fad">
<topic>getmail -- symlink vulnerability during maildir delivery</topic>
<affects>
<package>
<name>getmail</name>
<range><lt>3.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Watson reports a symlink vulnerability in getmail.
If run as root (not the recommended mode of operation), a
local user may be able to cause getmail to write files in
arbitrary directories via a symlink attack on subdirectories
of the maildir.</p>
</body>
</description>
<references>
<mlist msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&m=109571883130372</mlist>
<cvename>CVE-2004-0881</cvename>
<bid>11224</bid>
</references>
<dates>
<discovery>2004-09-19</discovery>
<entry>2004-10-04</entry>
</dates>
</vuln>
<vuln vid="67710833-1626-11d9-bc4a-000c41e2cdad">
<topic>Boundary checking errors in syscons</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.0</ge><lt>5.2.1_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The syscons CONS_SCRSHOT <a href="http://www.freebsd.org/cgi/man.cgi?query=ioctl">ioctl(2)</a>
does insufficient validation of its input arguments. In
particular, negative coordinates or large coordinates may
cause unexpected behavior.</p>
<p>It may be possible to cause the CONS_SCRSHOT ioctl to
return portions of kernel memory. Such memory might
contain sensitive information, such as portions of the
file cache or terminal buffers. This information might be
directly useful, or it might be leveraged to obtain elevated
privileges in some way. For example, a terminal buffer
might include a user-entered password.</p>
<p>This bug may be exploitable by users who have access to the
physical console or can otherwise open a /dev/ttyv* device
node.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0919</cvename>
<freebsdsa>SA-04:15.syscons</freebsdsa>
<url>https://svnweb.freebsd.org/changeset/base/135942</url>
</references>
<dates>
<discovery>2004-09-30</discovery>
<entry>2004-10-04</entry>
</dates>
</vuln>
<vuln vid="2328adef-157c-11d9-8402-000d93664d5c">
<topic>racoon -- improper certificate handling</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20040818a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Walpuski noted when OpenSSL would detect an error
condition for a peer certificate, racoon mistakenly ignored
the error. This could allow five invalid certificate states
to properly be used for authentication.</p>
</body>
</description>
<references>
<mlist msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&m=108726102304507</mlist>
<url>http://www.kame.net/racoon/racoon-ml/msg00517.html</url>
</references>
<dates>
<discovery>2004-01-31</discovery>
<entry>2004-10-03</entry>
</dates>
</vuln>
<vuln vid="e8d4800f-1547-11d9-90a3-00010327614a">
<topic>distcc -- incorrect parsing of IP access control rules</topic>
<affects>
<package>
<name>distcc</name>
<range><lt>2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
<p>Fix bug that might cause IP-based access control rules not to
be interpreted correctly on 64-bit platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0601</cvename>
<url>http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS</url>
</references>
<dates>
<discovery>2004-06-23</discovery>
<entry>2004-10-03</entry>
</dates>
</vuln>
<vuln vid="b2e6d1d6-1339-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- scripting vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.8</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>firefox</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><lt>1.p</lt></range>
</package>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><le>7.2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.3,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several scripting vulnerabilities were discovered and
corrected in Mozilla:</p>
<dl>
<dt>CVE-2004-0905</dt>
<dd>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>javascript; links dragged onto another frame or
page allows an attacker to steal or modify sensitive
information from other sites. The user could be convinced
to drag obscurred links in the context of a game or even a
fake scrollbar. If the user could be convinced to drag two
links in sequence into a separate window (not frame) the
attacker would be able to run arbitrary programs.</p>
</blockquote>
</dd>
<dt>CVE-2004-0908</dt>
<dd>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>Untrusted javascript code can read and write to the
clipboard, stealing any sensitive data the user might
have copied. <strong>Workaround:</strong> disable
javascript</p>
</blockquote>
</dd>
<dt>CVE-2004-0909</dt>
<dd>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>Signed scripts requesting enhanced abilities could
construct the request in a way that led to a confusing
grant dialog, possibly fooling the user into thinking
the privilege requested was inconsequential while
actually obtaining explicit permission to run and
install software. <strong>Workaround:</strong> Never
grant enhanced abilities of any kind to untrusted web
pages.</p>
</blockquote>
</dd>
</dl>
</body>
</description>
<references>
<cvename>CVE-2004-0905</cvename>
<cvename>CVE-2004-0908</cvename>
<cvename>CVE-2004-0909</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250862</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257523</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253942</url>
</references>
<dates>
<discovery>2004-09-13</discovery>
<entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="a7e0d783-131b-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- users may be lured into bypassing security dialogs</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.7</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>firefox</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.2</lt></range>
</package>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><le>7.2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to the Mozilla project:</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>An attacker who could lure users into clicking in
particular places, or typing specific text, could cause a
security permission or software installation dialog to pop
up under the user's mouse click, clicking on the grant (or
install) button.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0762</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=162020</url>
</references>
<dates>
<discovery>2004-06-05</discovery>
<entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="5360a659-131c-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- hostname spoofing bug</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.7</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>firefox</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.2</lt></range>
</package>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><le>7.2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<name>linux-netscape</name>
<name>linux-phoenix</name>
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk2</name>
<name>mozilla-gtk</name>
<name>mozilla-thunderbird</name>
<name>phoenix</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When processing URIs that contain an unqualified host name--
specifically, a domain name of only one component--
Mozilla will perform matching against the first component
of the domain name in SSL certificates. In other words, in
some situations, a certificate issued to "www.example.com"
will be accepted as matching "www".</p>
</body>
</description>
<references>
<cvename>CVE-2004-0765</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=234058</url>
</references>
<dates>
<discovery>2004-02-12</discovery>
<entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="de16b056-132e-11d9-bc4a-000c41e2cdad">
<topic>samba -- remote file disclosure</topic>
<affects>
<package>
<name>samba</name>
<range><lt>2.2.12</lt></range>
<range><gt>3.*</gt><le>3.0.2a</le></range>
<range><gt>3.*,1</gt><le>3.0.2a_1,1</le></range>
</package>
<package>
<name>ja-samba</name>
<range><lt>2.2.11.j1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a Samba Team security notice:</p>
<blockquote cite="http://www.samba.org/samba/news/#security_2.2.12">
<p>A security vulnerability has been located in Samba
2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote
attacker may be able to gain access to files which exist
outside of the share's defined path. Such files must still
be readable by the account used for the connection.</p>
</blockquote>
<blockquote cite="http://www.samba.org/samba/news/#errata_05oct">
<p>The original notice for CAN-2004-0815 indicated that
Samba 3.0.x <= 3.0.5 was vulnerable to the security
issue. After further research, Samba developers have
confirmed that only Samba 3.0.2a and earlier releases
contain the exploitable code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0815</cvename>
<url>http://www.samba.org/samba/news/#security_2.2.12</url>
</references>
<dates>
<discovery>2004-09-30</discovery>
<entry>2004-09-30</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="ab9c559e-115a-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- BMP decoder vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.7.3_1</lt></range>
</package>
<package>
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
<name>firefox</name>
<name>ja-linux-mozillafirebird-gtk1</name>
<name>ja-mozillafirebird-gtk2</name>
<name>linux-mozillafirebird</name>
<name>linux-phoenix</name>
<name>phoenix</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
<name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.3_1</lt></range>
</package>
<package>
<name>de-netscape7</name>
<name>fr-netscape7</name>
<name>ja-netscape7</name>
<name>netscape7</name>
<name>pt_BR-netscape7</name>
<range><le>7.2</le></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2_3</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
</package>
<package>
<!-- These package names are obsolete. -->
<name>mozilla+ipv6</name>
<name>mozilla-embedded</name>
<name>mozilla-firebird</name>
<name>mozilla-gtk</name>
<name>mozilla-gtk2</name>
<name>mozilla-thunderbird</name>
<name>linux-netscape</name>
<name>de-linux-netscape</name>
<name>fr-linux-netscape</name>
<name>ja-linux-netscape</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gael Delalleau discovered several integer overflows in
Mozilla's BMP decoder that can result in denial-of-service or
arbitrary code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0904</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=255067</url>
<uscertta>TA04-261A</uscertta>
<certvu>847200</certvu>
</references>
<dates>
<discovery>2004-09-13</discovery>
<entry>2004-09-28</entry>
<modified>2004-09-30</modified>
</dates>
</vuln>
<vuln vid="da690355-1159-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- vCard stack buffer overflow</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.7.3_1</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2_3</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski discovered a stack buffer overflow which
may be triggered when viewing email messages with vCard
attachments.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0903</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257314</url>
<uscertta>TA04-261A</uscertta>
<certvu>414240</certvu>
</references>
<dates>
<discovery>2004-09-13</discovery>
<entry>2004-09-28</entry>
<modified>2004-09-30</modified>
</dates>
</vuln>
<vuln vid="93d6162f-1153-11d9-bc4a-000c41e2cdad">
<topic>mozilla -- multiple heap buffer overflows</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>0.7.3_1</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>0.9.3_1</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2_3</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>linux-mozillafirebird</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several heap buffer overflows were discovered and fixed in the
most recent versions of Mozilla, Firefox, and Thunderbird.
These overflows may occur when:</p>
<ul>
<li>Using the "Send Page" function.</li>
<li>Checking mail on a malicious POP3 server.</li>
<li>Processing non-ASCII URLs.</li>
</ul>
<p>Each of these vulnerabilities may be exploited for remote
code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0902</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=258005</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=245066</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=226669</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=256316</url>
<uscertta>TA04-261A</uscertta>
</references>
<dates>
<discovery>2004-09-13</discovery>
<entry>2004-09-28</entry>
</dates>
</vuln>
<vuln vid="edf61c61-0f07-11d9-8393-000103ccf9d6">
<topic>php -- strip_tags cross-site scripting vulnerability</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<range><le>4.3.7_3</le></range>
</package>
<package>
<name>mod_php4</name>
<range><le>4.3.7_3,1</le></range>
</package>
<package>
<name>php5</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<range><le>5.0.0.r3_2</le></range>
</package>
<package>
<name>mod_php5</name>
<range><le>5.0.0.r3_2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters discovered that PHP's strip_tags()
function would ignore certain characters during parsing of tags,
allowing these tags to pass through. Select browsers could then
parse these tags, possibly allowing cross-site scripting attacks.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0595</cvename>
<mlist msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&m=108981589117423</mlist>
<url>http://security.e-matters.de/advisories/122004.html</url>
<bid>10724</bid>
</references>
<dates>
<discovery>2004-07-07</discovery>
<entry>2004-09-27</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad">
<topic>php -- memory_limit related vulnerability</topic>
<affects>
<package>
<name>mod_php4-twig</name>
<name>php4</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<range><le>4.3.7_3</le></range>
</package>
<package>
<name>mod_php4</name>
<range><le>4.3.7_3,1</le></range>
</package>
<package>
<name>php5</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<range><le>5.0.0.r3_2</le></range>
</package>
<package>
<name>mod_php5</name>
<range><le>5.0.0.r3_2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters discovered a condition within PHP
that may lead to remote execution of arbitrary code. The
memory_limit facility is used to notify functions when memory
contraints have been met. Under certain conditions, the entry
into this facility is able to interrupt functions such as
zend_hash_init() at locations not suitable for interruption.
The result would leave these functions in a vulnerable state.</p>
<blockquote cite="http://security.e-matters.de/advisories/112004.html">
<p>An attacker that is able to trigger the memory_limit abort
within zend_hash_init() and is additionally able to control
the heap before the HashTable itself is allocated, is able to
supply his own HashTable destructor pointer. [...]</p>
<p>All mentioned places outside of the extensions are quite easy
to exploit, because the memory allocation up to those places
is deterministic and quite static throughout different PHP
versions. [...]</p>
<p>Because the exploit itself consist of supplying an arbitrary
destructor pointer this bug is exploitable on any platform.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0594</cvename>
<mlist msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&m=108981780109154</mlist>
<url>http://security.e-matters.de/advisories/112004.html</url>
<bid>10725</bid>
</references>
<dates>
<discovery>2004-07-07</discovery>
<entry>2004-09-27</entry>
<modified>2004-10-02</modified>
</dates>
</vuln>
<vuln vid="184f5d0b-0fe8-11d9-8a8a-000c41e2cdad">
<topic>subversion -- WebDAV fails to protect metadata</topic>
<affects>
<package>
<name>subversion</name>
<name>subversion-perl</name>
<name>subversion-python</name>
<range><lt>1.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In some situations, subversion metadata may be unexpectedly
disclosed via WebDAV. A subversion advisory states:</p>
<blockquote cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
<p>mod_authz_svn, the Apache httpd module which does path-based
authorization on Subversion repositories, is not correctly
protecting all metadata on unreadable paths.</p>
<p>This security issue is not about revealing the contents
of protected files: it only reveals metadata about
protected areas such as paths and log messages. This may
or may not be important to your organization, depending
on how you're using path-based authorization, and the
sensitivity of the metadata.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0749</cvename>
<url>http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt</url>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-26</entry>
</dates>
</vuln>
<vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
<topic>lha -- numerous vulnerabilities when extracting archives</topic>
<affects>
<package>
<name>lha</name>
<range><lt>1.14i_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Source code reviews of lha by Lukasz Wojtow, Thomas Biege,
and others uncovered a number of vulnerabilities affecting
lha:</p>
<ul>
<li>Buffer overflows when handling archives and filenames.
(CVE-2004-0694)</li>
<li>Possible command execution via shell meta-characters when
built with NOMKDIR. (CVE-2004-0745)</li>
<li>Buffer overflow resulting in arbitrary code execution when
handling long pathnames in LHZ archives. (CVE-2004-0769)</li>
<li>Buffer overflow in the extract_one. (CVE-2004-0771)</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2004-0694</cvename>
<cvename>CVE-2004-0745</cvename>
<cvename>CVE-2004-0769</cvename>
<cvename>CVE-2004-0771</cvename>
<mlist msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108464470103227</mlist>
<mlist msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153</mlist>
<url>http://bugs.gentoo.org/show_bug.cgi?id=51285</url>
<url>http://xforce.iss.net/xforce/xfdb/16196</url>
<bid>10354</bid>
</references>
<dates>
<discovery>2004-05-17</discovery>
<entry>2004-09-23</entry>
</dates>
</vuln>
<vuln vid="77420ebb-0cf4-11d9-8a8a-000c41e2cdad">
<topic>mysql -- heap buffer overflow with prepared statements</topic>
<affects>
<package>
<name>mysql-server</name>
<name>mysql-client</name>
<range><ge>4.1.0</ge><le>4.1.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a buffer overflow in the prepared statements API
(libmysqlclient) when a statement containing thousands of
placeholders is executed.</p>
</body>
</description>
<references>
<url>http://bugs.mysql.com/bug.php?id=5194</url>
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.5.html</url>
<url>http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4</url>
</references>
<dates>
<discovery>2004-09-08</discovery>
<entry>2004-09-23</entry>
</dates>
</vuln>
<vuln vid="e9f9d232-0cb2-11d9-8a8a-000c41e2cdad">
<topic>mozilla -- security icon spoofing</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>0.9</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Under certain situations it is possible for the security icon
which Mozilla displays when connected to a site using SSL to
be spoofed. This could be used to make so-called "phishing
attacks" more difficult to detect.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0761</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=240053</url>
</references>
<dates>
<discovery>2004-04-08</discovery>
<entry>2004-09-22</entry>
</dates>
</vuln>
<vuln vid="7c188c55-0cb0-11d9-8a8a-000c41e2cdad">
<topic>mozilla -- NULL bytes in FTP URLs</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>0.9.3</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2,2</lt></range>
<range><ge>1.8.a,2</ge></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When handling FTP URLs containing NULL bytes, Mozilla will
interpret the file content as HTML. This may allow unexpected
execution of Javascript when viewing plain text or other file
types via FTP.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0760</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250906</url>
</references>
<dates>
<discovery>2004-07-11</discovery>
<entry>2004-09-22</entry>
<modified>2004-09-24</modified>
</dates>
</vuln>
<vuln vid="6e740881-0cae-11d9-8a8a-000c41e2cdad">
<topic>mozilla -- automated file upload</topic>
<affects>
<package>
<name>mozilla</name>
<range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a2,2</lt></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><ge>1.7.a</ge><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malicious web page can cause an automated file upload
from the victim's machine when viewed with Mozilla with
Javascript enabled. This is due to a bug permitting
default values for type="file" <input> elements in
certain situations.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0759</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=241924</url>
</references>
<dates>
<discovery>2004-04-28</discovery>
<entry>2004-09-22</entry>
<modified>2004-09-26</modified>
</dates>
</vuln>
<vuln vid="8d823883-0ca9-11d9-8a8a-000c41e2cdad">
<topic>mozilla -- built-in CA certificates may be overridden</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>0.9.3</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2,2</lt></range>
<range><ge>1.8.a,2</ge></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Under some situations, Mozilla will automatically import
a certificate from an email message or web site. This
behavior can be used as a denial-of-service attack: if the
certificate has a distinguished name (DN) identical to one
of the built-in Certificate Authorities (CAs), then Mozilla
will no longer be able to certify sites with certificates
issued from that CA.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0758</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=249004</url>
<certvu>160360</certvu>
<url>http://banquo.inf.ethz.ch:8080/</url>
</references>
<dates>
<discovery>2004-06-29</discovery>
<entry>2004-09-22</entry>
</dates>
</vuln>
<vuln vid="a4815970-c5cc-11d8-8898-000d6111a684">
<topic>rssh -- file name disclosure bug</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rssh expands command line paramters before invoking chroot.
This could result in the disclosure to the client of file
names outside of the chroot directory. A posting by the rssh
author explains:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844">
<p>The cause of the problem identified by Mr. McCaw is that
rssh expanded command-line arguments prior to entering
the chroot jail. This bug DOES NOT allow a user to
access any of the files outside the jail, but can allow
them to discover what files are in a directory which is
outside the jail, if their credentials on the server would
normally allow them read/execute access in the specified
directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0609</cvename>
<mlist msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844</mlist>
<bid>10574</bid>
<url>http://www.osvdb.org/7239</url>
</references>
<dates>
<discovery>2004-06-19</discovery>
<entry>2004-09-21</entry>
</dates>
</vuln>
<vuln vid="e6f0edd8-0b40-11d9-8a8a-000c41e2cdad">
<topic>gnu-radius -- SNMP-related denial-of-service</topic>
<affects>
<package>
<name>gnu-radius</name>
<range><lt>1.2.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE security advisory reports:</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities">
<p>Remote exploitation of an input validation error in
version 1.2 of GNU radiusd could allow a denial of
service.</p>
<p>The vulnerability specifically exists within
the asn_decode_string() function defined in
snmplib/asn1.c. When a very large unsigned number is
supplied, it is possible that an integer overflow will
occur in the bounds-checking code. The daemon will then
attempt to reference unallocated memory, resulting in an
access violation that causes the process to terminate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0849</cvename>
<url>http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-20</entry>
<modified>2005-05-03</modified>
</dates>
</vuln>
<vuln vid="a268ef4a-0b35-11d9-8a8a-000c41e2cdad">
<topic>sudo -- sudoedit information disclosure</topic>
<affects>
<package>
<name>sudo</name>
<range><eq>1.6.8</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A new feature of sudo 1.6.8 called "sudoedit" (a safe
editing facility) may allow users to read files to which
they normally have no access.</p>
</body>
</description>
<references>
<url>http://www.sudo.ws/sudo/alerts/sudoedit.html</url>
</references>
<dates>
<discovery>2004-09-18</discovery>
<entry>2004-09-20</entry>
</dates>
</vuln>
<vuln vid="ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93">
<topic>apache -- heap overflow in mod_proxy</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.31_1</lt></range>
</package>
<package>
<name>apache13-ssl</name>
<range><le>1.3.29.1.53_2</le></range>
</package>
<package>
<name>apache13-modssl</name>
<range><lt>1.3.31+2.8.18_4</lt></range>
</package>
<package>
<name>apache13+ipv6</name>
<range><le>1.3.29_2</le></range>
</package>
<package>
<name>apache13-modperl</name>
<range><le>1.3.31</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in mod_proxy which may
allow an attacker to launch local DoS attacks
and possibly execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0492</cvename>
<url>http://www.guninski.com/modproxy1.html</url>
</references>
<dates>
<discovery>2004-06-10</discovery>
<entry>2004-09-19</entry>
<modified>2004-10-05</modified>
</dates>
</vuln>
<vuln vid="d2102505-f03d-11d8-81b0-000347a4fa7d">
<topic>cvs -- numerous vulnerabilities</topic>
<affects>
<package>
<name>cvs+ipv6</name>
<range><lt>1.11.17</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2.1_10</lt></range>
<range><ge>4.10</ge><lt>4.10_3</lt></range>
<range><ge>4.9</ge><lt>4.9_12</lt></range>
<range><ge>4.8</ge><lt>4.8_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A number of vulnerabilities were discovered in CVS by
Stefan Esser, Sebastian Krahmer, and Derek Price.</p>
<ul>
<li>Insufficient input validation while processing "Entry"
lines. (CVE-2004-0414)</li>
<li>A double-free resulting from erroneous state handling while
processing "Argumentx" commands. (CVE-2004-0416)</li>
<li>Integer overflow while processing "Max-dotdot" commands.
(CVE-2004-0417)</li>
<li>Erroneous handling of empty entries handled while processing
"Notify" commands. (CVE-2004-0418)</li>
<li>A format string bug while processing CVS wrappers.</li>
<li>Single-byte buffer underflows while processing configuration files
from CVSROOT.</li>
<li>Various other integer overflows.</li>
</ul>
<p>Additionally, iDEFENSE reports an undocumented command-line
flag used in debugging does not perform input validation on
the given path names.</p>
<p>CVS servers ("cvs server" or :pserver: modes) are
affected by these vulnerabilities. They vary in impact
but include information disclosure (the iDEFENSE-reported
bug), denial-of-service (CVE-2004-0414, CVE-2004-0416,
CVE-2004-0417 and other bugs), or possibly arbitrary code
execution (CVE-2004-0418). In very special situations where
the attacker may somehow influence the contents of CVS
configuration files in CVSROOT, additional attacks may be
possible.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0414</cvename>
<cvename>CVE-2004-0416</cvename>
<cvename>CVE-2004-0417</cvename>
<cvename>CVE-2004-0418</cvename>
<cvename>CVE-2004-0778</cvename>
<url>http://secunia.com/advisories/11817</url>
<url>http://secunia.com/advisories/12309</url>
<url>http://security.e-matters.de/advisories/092004.html</url>
<url>http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false</url>
<url>https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104</url>
<url>http://www.osvdb.org/6830</url>
<url>http://www.osvdb.org/6831</url>
<url>http://www.osvdb.org/6832</url>
<url>http://www.osvdb.org/6833</url>
<url>http://www.osvdb.org/6834</url>
<url>http://www.osvdb.org/6835</url>
<url>http://www.osvdb.org/6836</url>
<bid>10499</bid>
<freebsdsa>SA-04:14.cvs</freebsdsa>
</references>
<dates>
<discovery>2004-05-20</discovery>
<entry>2004-08-17</entry>
<modified>2004-09-19</modified>
</dates>
</vuln>
<vuln vid="3d1e9267-073f-11d9-b45d-000c41e2cdad">
<topic>gdk-pixbuf -- image decoding vulnerabilities</topic>
<affects>
<package>
<name>linux-gdk-pixbuf</name>
<range><lt>0.22.0.11.3.5</lt></range>
</package>
<package>
<name>gtk</name>
<range><ge>2.0</ge><lt>2.4.9_1</lt></range>
</package>
<package>
<name>gdk-pixbuf</name>
<range><lt>0.22.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans discovered several flaws in the gdk-pixbuf
XPM image decoder:</p>
<ul>
<li>Heap-based overflow in pixbuf_create_from_xpm</li>
<li>Stack-based overflow in xpm_extract_color</li>
<li>Integer overflows in io-ico.c</li>
</ul>
<p>Some of these flaws are believed to be exploitable.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0782</cvename>
<cvename>CVE-2004-0783</cvename>
<cvename>CVE-2004-0788</cvename>
<url>http://scary.beasts.org/security/CESA-2004-005.txt</url>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
<modified>2004-11-09</modified>
</dates>
</vuln>
<vuln vid="ef253f8b-0727-11d9-b45d-000c41e2cdad">
<topic>xpm -- image decoding vulnerabilities</topic>
<affects>
<package>
<name>agenda-snow-libs</name>
<name>linux_base</name>
<name>mupad</name>
<name>zh-cle_base</name>
<range><ge>0</ge></range>
</package>
<package>
<name>open-motif-devel</name>
<range><lt>2022.08.05</lt></range>
</package>
<package>
<name>libXpm</name>
<range><lt>3.5.1_1</lt></range>
</package>
<package>
<name>XFree86-libraries</name>
<range><lt>4.4.0_1</lt></range>
</package>
<package>
<name>xorg-libraries</name>
<range><lt>6.7.0_2</lt></range>
</package>
<package>
<name>lesstif</name>
<range><lt>0.93.96,2</lt></range>
</package>
<package>
<name>xpm</name>
<range><lt>3.4k_1</lt></range>
</package>
<package>
<name>linux-openmotif</name>
<range><lt>2.2.4</lt></range>
</package>
<package>
<name>open-motif</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans discovered several vulnerabilities in the libXpm
image decoder:</p>
<ul>
<li>A stack-based buffer overflow in xpmParseColors</li>
<li>An integer overflow in xpmParseColors</li>
<li>A stack-based buffer overflow in ParsePixels and
ParseAndPutPixels</li>
</ul>
<p>The X11R6.8.1 release announcement reads:</p>
<blockquote cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
<p>This version is purely a security release, addressing
multiple integer and stack overflows in libXpm, the X
Pixmap library; all known versions of X (both XFree86
and X.Org) are affected, so all users of X are strongly
encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0687</cvename>
<cvename>CVE-2004-0688</cvename>
<url>http://freedesktop.org/pipermail/xorg/2004-September/003172.html</url>
<url>http://scary.beasts.org/security/CESA-2004-003.txt</url>
<certvu>537878</certvu>
<certvu>882750</certvu>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
<modified>2005-01-03</modified>
</dates>
</vuln>
<vuln vid="05dcf751-0733-11d9-b45d-000c41e2cdad">
<topic>cups -- print queue browser denial-of-service</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.1.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If the CUPS server (cupsd) receives a zero-length UDP
message, it will disable its print queue browser service.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0558</cvename>
<url>http://www.cups.org/str.php?L863</url>
</references>
<dates>
<discovery>2004-08-23</discovery>
<entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="762d1c6d-0722-11d9-b45d-000c41e2cdad">
<topic>apache -- apr_uri_parse IPv6 address handling vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation Security Team discovered a
programming error in the apr-util library function apr_uri_parse.
When parsing IPv6 literal addresses, it is possible that a
length is incorrectly calculated to be negative, and this
value is passed to memcpy. This may result in an exploitable
vulnerability on some platforms, including FreeBSD.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0786</cvename>
<url>http://httpd.apache.org</url>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="013fa252-0724-11d9-b45d-000c41e2cdad">
<topic>mod_dav -- lock related denial-of-service</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
</package>
<package>
<name>mod_dav</name>
<range><le>1.0.3_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malicious user with DAV write privileges can trigger a null
pointer dereference in the Apache mod_dav module. This
could cause the server to become unavailable.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0809</cvename>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183</url>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="4d49f4ba-071f-11d9-b45d-000c41e2cdad">
<topic>apache -- ap_resolve_env buffer overflow</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SITIC discovered a vulnerability in Apache 2's handling of
environmental variable settings in the httpd configuration
files (the main `httpd.conf' and `.htaccess' files).
According to a SITIC advisory:</p>
<blockquote cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
<p>The buffer overflow occurs when expanding ${ENVVAR}
constructs in .htaccess or httpd.conf files. The function
ap_resolve_env() in server/util.c copies data from
environment variables to the character array tmp with
strcat(3), leading to a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0747</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html</mlist>
</references>
<dates>
<discovery>2004-09-15</discovery>
<entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="ae7b7f65-05c7-11d9-b45d-000c41e2cdad">
<topic>webmin -- insecure temporary file creation at installation time</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.150_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webmin developers documented a security issue in the
release notes for version 1.160:</p>
<blockquote cite="http://www.webmin.com/changes-1.160.html">
<p>Fixed a security hole in the maketemp.pl script, used
to create the /tmp/.webmin directory at install time. If
an un-trusted user creates this directory before Webmin
is installed, he could create in it a symbolic link
pointing to a critical file on the system, which would be
overwritten when Webmin writes to the link filename.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0559</cvename>
<url>http://www.webmin.com/changes-1.160.html</url>
</references>
<dates>
<discovery>2004-09-05</discovery>
<entry>2004-09-14</entry>
<modified>2004-09-15</modified>
</dates>
</vuln>
<vuln vid="a711de5c-05fa-11d9-a9b2-00061bc2ad93">
<topic>samba3 DoS attack</topic>
<affects>
<package>
<name>samba3</name>
<range><lt>3.0.7</lt></range>
<range><gt>*,1</gt><lt>3.0.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Code found in nmbd and smbd may allow a remote attacker
to effectively crash the nmbd server or use the smbd
server to exhaust the system memory.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0807</cvename>
<cvename>CVE-2004-0808</cvename>
<url>http://www.idefense.com/application/poi/display?id=139&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-09-02</discovery>
<entry>2004-09-14</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="c1d97a8b-05ed-11d9-b45d-000c41e2cdad">
<topic>mozilla -- POP client heap overflow</topic>
<affects>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>netscape7</name>
<range><lt>7.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zen-parse discovered a heap buffer overflow in Mozilla's
POP client implementation. A malicious POP server
could exploit this vulnerability to cause Mozilla to execute
arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0757</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=229374</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=157644</url>
</references>
<dates>
<discovery>2004-07-22</discovery>
<entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="a4fd8f53-05eb-11d9-b45d-000c41e2cdad">
<topic>mozilla -- SOAPParameter integer overflow</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>0.9</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<name>mozilla-gtk1</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<name>netscape7</name>
<range><lt>7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zen-parse discovered and iDEFENSE reported an exploitable
integer overflow in a scriptable Mozilla component
`SOAPParameter':</p>
<blockquote cite="http://www.idefense.com/application/poi/display?id=117&type=vulnerabilities">
<p>Improper input validation to the SOAPParameter object
constructor in Netscape and Mozilla allows execution of
arbitrary code. The SOAPParameter object's constructor
contains an integer overflow which allows controllable
heap corruption. A web page can be constructed to
leverage this into remote execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0722</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=236618</url>
</references>
<dates>
<discovery>2004-08-02</discovery>
<entry>2004-09-14</entry>
<modified>2004-09-22</modified>
</dates>
</vuln>
<vuln vid="c62dc69f-05c8-11d9-b45d-000c41e2cdad">
<topic>openoffice -- document disclosure</topic>
<affects>
<package>
<name>openoffice</name>
<name>ar-openoffice</name>
<name>ca-openoffice</name>
<name>cs-openoffice</name>
<name>de-openoffice</name>
<name>dk-openoffice</name>
<name>el-openoffice</name>
<name>es-openoffice</name>
<name>et-openoffice</name>
<name>fi-openoffice</name>
<name>fr-openoffice</name>
<name>gr-openoffice</name>
<name>hu-openoffice</name>
<name>it-openoffice</name>
<name>ja-openoffice</name>
<name>ko-openoffice</name>
<name>nl-openoffice</name>
<name>pl-openoffice</name>
<name>pt-openoffice</name>
<name>pt_BR-openoffice</name>
<name>ru-openoffice</name>
<name>se-openoffice</name>
<name>sk-openoffice</name>
<name>sl-openoffice-SI</name>
<name>tr-openoffice</name>
<name>zh-openoffice-CN</name>
<name>zh-openoffice-TW</name>
<range><lt>1.1.2_1</lt></range>
<range><ge>2.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenOffice creates a working directory in /tmp on startup,
and uses this directory to temporarily store document
content. However, the permissions of the created directory
may allow other user on the system to read these files,
potentially exposing information the user likely assumed was
inaccessible.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0752</cvename>
<url>http://www.openoffice.org/issues/show_bug.cgi?id=33357</url>
<url>http://securitytracker.com/alerts/2004/Sep/1011205.html</url>
<mlist msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109483308421566</mlist>
</references>
<dates>
<discovery>2004-08-24</discovery>
<entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="15e0e963-02ed-11d9-a209-00061bc2ad93">
<topic>mpg123 buffer overflow</topic>
<affects>
<package>
<name>mpg123</name>
<name>mpg123-nas</name>
<name>mpg123-esound</name>
<range><le>0.59r</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mpg123 software version 0.59r contains a
buffer overflow vulnerability which may permit
the execution of arbitrary code as the owner of
the mpg123 process.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0805</cvename>
<url>http://www.alighieri.org/advisories/advisory-mpg123.txt</url>
</references>
<dates>
<discovery>2003-08-16</discovery>
<entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="b6cad7f3-fb59-11d8-9837-000c41e2cdad">
<topic>ImageMagick -- BMP decoder buffer overflow</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.0.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marcus Meissner discovered that ImageMagick's BMP decoder would
crash when loading the test BMP file created by Chris Evans
for testing the previous Qt vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0827</cvename>
<url>http://www.imagemagick.org/www/Changelog.html</url>
</references>
<dates>
<discovery>2004-08-25</discovery>
<entry>2004-08-31</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
<vuln vid="641859e8-eca1-11d8-b913-000c41e2cdad">
<topic>Mutiple browser frame injection vulnerability</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>3.2.3_3</lt></range>
</package>
<package>
<name>kdebase</name>
<range><lt>3.2.3_1</lt></range>
</package>
<package>
<name>linux-opera</name>
<name>opera</name>
<range><ge>7.50</ge><lt>7.52</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>0.9</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<name>mozilla-gtk1</name>
<range><lt>1.7</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7,2</lt></range>
</package>
<package>
<name>netscape7</name>
<range><lt>7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A class of bugs affecting many web browsers in the same way
was discovered. A Secunia advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/11978">
<p>The problem is that the browsers don't check if a target
frame belongs to a website containing a malicious link,
which therefore doesn't prevent one browser window from
loading content in a named frame in another window.</p>
<p>Successful exploitation allows a malicious website to load
arbitrary content in an arbitrary frame in another browser
window owned by e.g. a trusted site.</p>
</blockquote>
<p>A KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
<p>A malicious website could abuse Konqueror to insert
its own frames into the page of an otherwise trusted
website. As a result the user may unknowingly send
confidential information intended for the trusted website
to the malicious website.</p>
</blockquote>
<p>Secunia has provided a demonstration of the vulnerability at <a href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0717</cvename>
<cvename>CVE-2004-0718</cvename>
<cvename>CVE-2004-0721</cvename>
<url>http://secunia.com/advisories/11978/</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=246448</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch</url>
</references>
<dates>
<discovery>2004-08-11</discovery>
<entry>2004-08-12</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
<vuln vid="b7cb488c-8349-11d8-a41f-0020ed76ef5a">
<topic>isakmpd payload handling denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>isakmpd</name>
<range><le>20030903</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Numerous errors in isakmpd's input packet validation lead to
denial-of-service vulnerabilities. From the Rapid7 advisory:</p>
<blockquote cite="http://www.rapid7.com/advisories/R7-0018.html">
<p>The ISAKMP packet processing functions in OpenBSD's
isakmpd daemon contain multiple payload handling flaws
that allow a remote attacker to launch a denial of
service attack against the daemon.</p>
<p>Carefully crafted ISAKMP packets will cause the isakmpd
daemon to attempt out-of-bounds reads, exhaust available
memory, or loop endlessly (consuming 100% of the CPU).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0218</cvename>
<cvename>CVE-2004-0219</cvename>
<cvename>CVE-2004-0220</cvename>
<cvename>CVE-2004-0221</cvename>
<cvename>CVE-2004-0222</cvename>
<url>http://www.rapid7.com/advisories/R7-0018.html</url>
<url>http://www.openbsd.org/errata34.html</url>
</references>
<dates>
<discovery>2004-03-17</discovery>
<entry>2004-03-31</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
<vuln vid="00644f03-fb58-11d8-9837-000c41e2cdad">
<topic>imlib -- BMP decoder heap buffer overflow</topic>
<affects>
<package>
<name>imlib</name>
<range><lt>1.9.14_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marcus Meissner discovered that imlib's BMP decoder would
crash when loading the test BMP file created by Chris Evans
for testing the previous Qt vulnerability. It is believed
that this bug could be exploited for arbitrary code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0817</cvename>
<url>http://bugzilla.gnome.org/show_bug.cgi?id=151034</url>
</references>
<dates>
<discovery>2004-08-25</discovery>
<entry>2004-08-31</entry>
<modified>2004-09-02</modified>
</dates>
</vuln>
<vuln vid="86a98b57-fb8e-11d8-9343-000a95bc6fae">
<topic>krb5 -- double-free vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.3.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
<p>The MIT Kerberos 5 implementation's Key Distribution Center
(KDC) program contains a double-free vulnerability that
potentially allows a remote attacker to execute arbitrary code.
Compromise of a KDC host compromises the security of the entire
authentication realm served by the KDC. Additionally, double-free
vulnerabilities exist in MIT Kerberos 5 library code, making
client programs and application servers vulnerable.</p>
</blockquote>
<p>Double-free vulnerabilities of this type are not believed to be
exploitable for code execution on FreeBSD systems. However,
the potential for other ill effects may exist.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0642</cvename>
<cvename>CVE-2004-0643</cvename>
<cvename>CVE-2004-0772</cvename>
<certvu>795632</certvu>
<certvu>866472</certvu>
<certvu>350792</certvu>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt</url>
</references>
<dates>
<discovery>2004-08-31</discovery>
<entry>2004-08-31</entry>
</dates>
</vuln>
<vuln vid="bd60922b-fb8d-11d8-a13e-000a95bc6fae">
<topic>krb5 -- ASN.1 decoder denial-of-service vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.2.2</ge><le>1.3.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
<p>The ASN.1 decoder library in the MIT Kerberos 5 distribution
is vulnerable to a denial-of-service attack causing an infinite
loop in the decoder. The KDC is vulnerable to this attack.</p>
<p>An unauthenticated remote attacker can cause a KDC or application
server to hang inside an infinite loop.</p>
<p>An attacker impersonating a legitimate KDC or application
server may cause a client program to hang inside an infinite
loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0644</cvename>
<certvu>550464</certvu>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt</url>
</references>
<dates>
<discovery>2004-08-31</discovery>
<entry>2004-08-31</entry>
</dates>
</vuln>
<vuln vid="ba005226-fb5b-11d8-9837-000c41e2cdad">
<topic>imlib2 -- BMP decoder buffer overflow</topic>
<affects>
<package>
<name>imlib2</name>
<range><le>1.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marcus Meissner discovered that imlib2's BMP decoder would
crash when loading the test BMP file created by Chris Evans
for testing the previous Qt vulnerability. There appears to
be both a stack-based and a heap-based buffer overflow that
are believed to be exploitable for arbitrary code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0802</cvename>
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup</url>
</references>
<dates>
<discovery>2004-08-31</discovery>
<entry>2004-08-31</entry>
</dates>
</vuln>
<vuln vid="0d3a5148-f512-11d8-9837-000c41e2cdad">
<topic>SpamAssassin -- denial-of-service in tokenize_headers</topic>
<affects>
<package>
<name>p5-Mail-SpamAssassin</name>
<range><lt>2.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to the SpamAssassin 2.64 release announcement:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767">
<p>Security fix prevents a denial of service attack open
to certain malformed messages; this DoS affects all
SpamAssassin 2.5x and 2.6x versions to date.</p>
</blockquote>
<p>The issue appears to be triggered by overly long message
headers.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0796</cvename>
<bid>10957</bid>
<mlist>http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767</mlist>
<url>http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes</url>
</references>
<dates>
<discovery>2004-08-04</discovery>
<entry>2004-08-23</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
<vuln vid="c4b025bb-f05d-11d8-9837-000c41e2cdad">
<topic>tnftpd -- remotely exploitable vulnerability</topic>
<affects>
<package>
<name>tnftpd</name>
<range><lt>20040810</lt></range>
</package>
<package>
<name>lukemftpd</name>
<range><ge>0</ge></range>
</package>
<package>
<name>FreeBSD</name>
<range><le>4.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lukemftpd(8) is an enhanced BSD FTP server produced
within the NetBSD project. The sources for lukemftpd are
shipped with some versions of FreeBSD, however it is not
built or installed by default. The build system option
WANT_LUKEMFTPD must be set to build and install lukemftpd.
[<strong>NOTE</strong>: An exception is FreeBSD 4.7-RELEASE,
wherein lukemftpd was installed, but not enabled, by
default.]</p>
<p>Przemyslaw Frasunek discovered several vulnerabilities
in lukemftpd arising from races in the out-of-band signal
handling code used to implement the ABOR command. As a
result of these races, the internal state of the FTP server
may be manipulated in unexpected ways.</p>
<p>A remote attacker may be able to cause FTP commands to
be executed with the privileges of the running lukemftpd
process. This may be a low-privilege `ftp' user if the `-r'
command line option is specified, or it may be superuser
privileges if `-r' is *not* specified.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0794</cvename>
<bid>10967</bid>
<url>http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158</url>
<url>ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc</url>
<mlist msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
</references>
<dates>
<discovery>2004-08-17</discovery>
<entry>2004-08-17</entry>
<modified>2016-08-11</modified>
</dates>
</vuln>
<vuln vid="e5e2883d-ceb9-11d8-8898-000d6111a684">
<topic>MySQL authentication bypass / buffer overflow</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>4.1</ge><lt>4.1.3</lt></range>
<range><ge>5</ge><le>5.0.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>By submitting a carefully crafted authentication packet, it is
possible for an attacker to bypass password authentication in MySQL
4.1. Using a similar method, a stack buffer used in the authentication
mechanism can be overflowed.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0627</cvename>
<cvename>CVE-2004-0628</cvename>
<certvu>184030</certvu>
<certvu>645326</certvu>
<url>http://www.nextgenss.com/advisories/mysql-authbypass.txt</url>
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.3.html</url>
<url>http://secunia.com/advisories/12020</url>
<url>http://www.osvdb.org/7475</url>
<url>http://www.osvdb.org/7476</url>
<mlist msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
</references>
<dates>
<discovery>2004-07-01</discovery>
<entry>2004-07-05</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
<vuln vid="e811aaf1-f015-11d8-876f-00902714cc7c">
<topic>Ruby insecure file permissions in the CGI session management</topic>
<affects>
<package>
<name>ruby</name>
<range><lt>1.6.8.2004.07.26</lt></range>
<range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a Debian Security Advisory:</p>
<blockquote cite="http://www.debian.org/security/2004/dsa-537">
<p>Andres Salomon noticed a problem in the CGI session
management of Ruby, an object-oriented scripting language.
CGI::Session's FileStore (and presumably PStore [...])
implementations store session information insecurely.
They simply create files, ignoring permission issues.
This can lead an attacker who has also shell access to the
webserver to take over a session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0755</cvename>
<url>http://xforce.iss.net/xforce/xfdb/16996</url>
<url>http://www.debian.org/security/2004/dsa-537</url>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=109267579822250&w=2</mlist>
</references>
<dates>
<discovery>2004-08-16</discovery>
<entry>2004-08-16</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
<vuln vid="207f8ff3-f697-11d8-81b0-000347a4fa7d">
<topic>nss -- exploitable buffer overflow in SSLv2 protocol handler</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISS X-Force reports that a remotely exploitable buffer
overflow exists in the Netscape Security Services (NSS)
library's implementation of SSLv2. From their advisory:</p>
<blockquote cite="http://xforce.iss.net/xforce/alerts/id/180">
<p>The NSS library contains a flaw in SSLv2 record parsing
that may lead to remote compromise. When parsing the
first record in an SSLv2 negotiation, the client hello
message, the server fails to validate the length of a
record field. As a result, it is possible for an attacker
to trigger a heap-based overflow of arbitrary length.</p>
</blockquote>
<p>Note that the vulnerable NSS library is also present in
Mozilla-based browsers. However, it is not believed that
browsers are affected, as the vulnerability is present only in
code used by SSLv2 *servers*.</p>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/alerts/id/180</url>
<url>http://www.osvdb.org/9116</url>
<url>http://secunia.com/advisories/12362</url>
<bid>11015</bid>
</references>
<dates>
<discovery>2004-08-23</discovery>
<entry>2004-08-27</entry>
</dates>
</vuln>
<vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
<topic>ripMIME -- decoding bug allowing content filter bypass</topic>
<affects>
<package>
<name>ripmime</name>
<range><lt>1.3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ripMIME may prematurely terminate decoding Base64 encoded
messages when it encounters multiple blank lines or other
non-standard Base64 constructs. Virus scanning and content
filtering tools that use ripMIME may therefore be
bypassed.</p>
<p>The ripMIME CHANGELOG file says:</p>
<blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
<p>There's viruses going around exploiting the ability to
hide the majority of their data in an attachment by using
blank lines and other tricks to make scanning systems
prematurely terminate their base64 decoding.</p>
</blockquote>
</body>
</description>
<references>
<bid>10848</bid>
<url>http://www.osvdb.org/8287</url>
<url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
<url>http://secunia.com/advisories/12201</url>
<url>http://xforce.iss.net/xforce/xfdb/16867</url>
</references>
<dates>
<discovery>2004-07-30</discovery>
<entry>2004-08-27</entry>
</dates>
</vuln>
<vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
<topic>moinmoin -- ACL group bypass</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The moinmoin package contains two bugs with ACLs and anonymous
users. Both bugs may permit anonymous users to gain access to
administrative functions; for example the delete function.</p>
<p>There is no known workaround, the vulnerability exists regardless
if a site is using ACLs or not.</p>
</body>
</description>
<references>
<url>http://www.osvdb.org/8194</url>
<url>http://www.osvdb.org/8195</url>
<url>http://security.gentoo.org/glsa/glsa-200408-25.xml</url>
<url>http://secunia.com/advisories/11832</url>
<bid>10805</bid>
<bid>10801</bid>
</references>
<dates>
<discovery>2004-07-21</discovery>
<entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="2689f4cb-ec4c-11d8-9440-000347a4fa7d">
<topic>rsync -- path sanitizing vulnerability</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>2.6.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An rsync security advisory reports:</p>
<blockquote cite="http://samba.org/rsync/#security_aug04">
<p>There is a path-sanitizing bug that affects daemon mode in
all recent rsync versions (including 2.6.2) but only if
chroot is disabled.</p>
</blockquote>
<p>The bug may allow a remote user to access files outside
of an rsync module's configured path with the privileges
configured for that module.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0792</cvename>
<url>http://samba.org/rsync/#security_aug04</url>
<mlist>http://lists.samba.org/archive/rsync-announce/2004/000017.html</mlist>
<url>http://secunia.com/advisories/12294</url>
<url>http://www.osvdb.org/8829</url>
</references>
<dates>
<discovery>2004-08-12</discovery>
<entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="7884d56f-f7a1-11d8-9837-000c41e2cdad">
<topic>gnomevfs -- unsafe URI handling</topic>
<affects>
<package>
<name>gnomevfs2</name>
<range><lt>2.6.2_1</lt></range>
</package>
<package>
<name>gnomevfs</name>
<range><lt>1.0.5_6</lt></range>
</package>
<package>
<name>mc</name>
<range><le>4.6.0_12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Larsson reports that some versions of gnome-vfs and
MidnightCommander contain a number of `extfs' scripts that do not
properly validate user input. If an attacker can cause her
victim to process a specially-crafted URI, arbitrary commands
can be executed with the privileges of the victim.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0494</cvename>
<bid>10864</bid>
<url>http://www.ciac.org/ciac/bulletins/o-194.shtml</url>
<url>http://xforce.iss.net/xforce/xfdb/16897</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263</url>
</references>
<dates>
<discovery>2004-08-04</discovery>
<entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="3e4ffe76-e0d4-11d8-9b0a-000347a4fa7d">
<topic>SoX buffer overflows when handling .WAV files</topic>
<affects>
<package>
<name>sox</name>
<range><gt>12.17.1</gt><le>12.17.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered a pair of buffer overflows in the
WAV file handling code of SoX. If an attacker can cause her
victim to process a specially-crafted WAV file with SoX (e.g.
through social engineering or through some other program that
relies on SoX), arbitrary code can be executed with the
privileges of the victim.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0557</cvename>
<mlist msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
<url>http://secunia.com/advisories/12175</url>
<url>http://www.osvdb.org/8267</url>
</references>
<dates>
<discovery>2004-07-28</discovery>
<entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="2797b27a-f55b-11d8-81b0-000347a4fa7d">
<topic>kdelibs -- konqueror cross-domain cookie injection</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>3.2.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a KDE Security Advisory:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
<p>WESTPOINT internet reconnaissance services alerted the
KDE security team that the KDE web browser Konqueror
allows websites to set cookies for certain country
specific secondary top level domains.</p>
<p>Web sites operating under the affected domains can
set HTTP cookies in such a way that the Konqueror web
browser will send them to all other web sites operating
under the same domain. A malicious website can use
this as part of a session fixation attack. See e.g.
http://www.acros.si/papers/session_fixation.pdf</p>
<p>Affected are all country specific secondary top level
domains that use more than 2 characters in the secondary
part of the domain name and that use a secondary part other
than com, net, mil, org, gov, edu or int. Examples of
affected domains are .ltd.uk, .plc.uk and .firm.in</p>
<p>It should be noted that popular domains such as .co.uk, .co.in
and .com are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0746</cvename>
<url>http://www.kde.org/info/security/advisory-20040823-1.txt</url>
<url>http://www.osvdb.org/9117</url>
<url>http://secunia.com/advisories/12341</url>
<url>http://www.acros.si/papers/session_fixation.pdf</url>
<bid>10991</bid>
</references>
<dates>
<discovery>2004-08-23</discovery>
<entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="bef4515b-eaa9-11d8-9440-000347a4fa7d">
<cancelled superseded="b6939d5b-64a1-11d9-9106-000a95bc6fae"/>
</vuln>
<vuln vid="3243e839-f489-11d8-9837-000c41e2cdad">
<topic>fidogate -- write files as `news' user</topic>
<affects>
<package>
<name>fidogate</name>
<range><lt>4.4.9_3</lt></range>
</package>
<package>
<name>fidogate-ds</name>
<range><lt>5.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Neils Heinen reports that the setuid `news' binaries
installed as part of fidogate may be used to create files or
append to file with the privileges of the `news' user by
setting the LOGFILE environmental variable.</p>
</body>
</description>
<references>
<url>http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&view=markup</url>
</references>
<dates>
<discovery>2004-08-21</discovery>
<entry>2004-08-22</entry>
<modified>2004-08-23</modified>
</dates>
</vuln>
<vuln vid="65a17a3f-ed6e-11d8-aff1-00061bc2ad93">
<topic>Arbitrary code execution via a format string vulnerability in jftpgw</topic>
<affects>
<package>
<name>jftpgw</name>
<range><lt>0.13.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The log functions in jftpgw may allow
remotely authenticated user to execute
arbitrary code via the format string
specifiers in certain syslog messages.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0448</cvename>
<url>http://www.debian.org/security/2004/dsa-510</url>
<bid>10438</bid>
<url>http://xforce.iss.net/xforce/xfdb/16271</url>
</references>
<dates>
<discovery>2004-05-30</discovery>
<entry>2004-08-13</entry>
<modified>2004-08-23</modified>
</dates>
</vuln>
<vuln vid="ebffe27a-f48c-11d8-9837-000c41e2cdad">
<topic>qt -- image loader vulnerabilities</topic>
<affects>
<package>
<name>qt</name>
<range><lt>3.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qt contains several vulnerabilities related to image
loading, including possible crashes when loading corrupt
GIF, BMP, or JPEG images. Most seriously, Chris Evans
reports that the BMP crash is actually due to a heap
buffer overflow. It is believed that an attacker may be
able to construct a BMP image that could cause a Qt-using
application to execute arbitrary code when it is loaded.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0691</cvename>
<cvename>CVE-2004-0692</cvename>
<cvename>CVE-2004-0693</cvename>
<url>http://www.trolltech.com/developer/changes/changes-3.3.3.html</url>
<url>http://scary.beasts.org/security/CESA-2004-004.txt</url>
</references>
<dates>
<discovery>2004-08-11</discovery>
<entry>2004-08-22</entry>
</dates>
</vuln>
<vuln vid="616cf823-f48b-11d8-9837-000c41e2cdad">
<topic>courier-imap -- format string vulnerability in debug mode</topic>
<affects>
<package>
<name>courier-imap</name>
<range><lt>3.0.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE security advisory describes a format string
vulnerability that could be exploited when Courier-IMAP is run
in debug mode (DEBUG_LOGIN set).</p>
</body>
</description>
<references>
<cvename>CVE-2004-0777</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html</mlist>
<url>http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=false</url>
<bid>10976</bid>
</references>
<dates>
<discovery>2004-08-18</discovery>
<entry>2004-08-22</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="0c4d5973-f2ab-11d8-9837-000c41e2cdad">
<topic>mysql -- mysqlhotcopy insecure temporary file creation</topic>
<affects>
<package>
<name>mysql-scripts</name>
<range><le>3.23.58</le></range>
<range><gt>4</gt><le>4.0.20</le></range>
<range><gt>4.1</gt><le>4.1.3</le></range>
<range><gt>5</gt><le>5.0.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to Christian Hammers:</p>
<blockquote cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
<p>[mysqlhotcopy created] temporary files in /tmp which
had predictable filenames and such could be used for a
tempfile run attack.</p>
</blockquote>
<p>Jeroen van Wolffelaar is credited with discovering the issue.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0457</cvename>
<url>http://www.debian.org/security/2004/dsa-540</url>
<mlist>http://lists.mysql.com/internals/15185</mlist>
</references>
<dates>
<discovery>2004-08-18</discovery>
<entry>2004-08-22</entry>
</dates>
</vuln>
<vuln vid="2de14f7a-dad9-11d8-b59a-00061bc2ad93">
<topic>Multiple Potential Buffer Overruns in Samba</topic>
<affects>
<package>
<name>samba</name>
<range><gt>3.*</gt><lt>3.0.5</lt></range>
<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
<range><lt>2.2.10</lt></range>
</package>
<package>
<name>ja-samba</name>
<range><lt>2.2.10.j1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Evgeny Demidov discovered that the Samba server has a
buffer overflow in the Samba Web Administration Tool (SWAT)
on decoding Base64 data during HTTP Basic Authentication.
Versions 3.0.2 through 3.0.4 are affected.</p>
<p>Another buffer overflow bug has been found in the code
used to support the "mangling method = hash" smb.conf
option. The default setting for this parameter is "mangling
method = hash2" and therefore not vulnerable. Versions
between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0600</cvename>
<cvename>CVE-2004-0686</cvename>
<mlist msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
<mlist msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
<url>http://www.samba.org/samba/whatsnew/samba-3.0.5.html</url>
<url>http://www.samba.org/samba/whatsnew/samba-2.2.10.html</url>
<url>http://www.osvdb.org/8190</url>
<url>http://www.osvdb.org/8191</url>
<url>http://secunia.com/advisories/12130</url>
</references>
<dates>
<discovery>2004-07-14</discovery>
<entry>2004-07-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="730db824-e216-11d8-9b0a-000347a4fa7d">
<topic>Mozilla / Firefox user interface spoofing vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><le>0.9.1_1</le></range>
</package>
<package>
<name>linux-mozilla</name>
<range><le>1.7.1</le></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><le>1.7.1</le></range>
</package>
<package>
<name>mozilla</name>
<range><le>1.7.1,2</le></range>
<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><le>1.7.1_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla project's family of browsers contain a design
flaw that can allow a website to spoof almost perfectly any
part of the Mozilla user interface, including spoofing web
sites for phishing or internal elements such as the "Master
Password" dialog box. This achieved by manipulating "chrome"
through remote XUL content. Recent versions of Mozilla have
been fixed to not allow untrusted documents to utilize
"chrome" in this way.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0764</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=22183</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=244965</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=252198</url>
<url>http://www.nd.edu/~jsmith30/xul/test/spoof.html</url>
<url>http://secunia.com/advisories/12188</url>
<bid>10832</bid>
</references>
<dates>
<discovery>2004-07-19</discovery>
<entry>2004-07-30</entry>
<modified>2004-08-15</modified>
</dates>
</vuln>
<vuln vid="f9e3e60b-e650-11d8-9b0a-000347a4fa7d">
<topic>libpng stack-based buffer overflow and other code concerns</topic>
<affects>
<package>
<name>png</name>
<range><le>1.2.5_7</le></range>
</package>
<package>
<name>linux-png</name>
<range><le>1.0.14_3</le></range>
<range><ge>1.2</ge><le>1.2.2</le></range>
</package>
<package>
<name>firefox</name>
<range><lt>0.9.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>0.7.3</lt></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2,2</lt></range>
<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>netscape-communicator</name>
<name>netscape-navigator</name>
<range><le>4.78</le></range>
</package>
<package>
<name>linux-netscape-communicator</name>
<name>linux-netscape-navigator</name>
<name>ko-netscape-navigator-linux</name>
<name>ko-netscape-communicator-linux</name>
<name>ja-netscape-communicator-linux</name>
<name>ja-netscape-navigator-linux</name>
<range><le>4.8</le></range>
</package>
<package>
<name>netscape7</name>
<name>ja-netscape7</name>
<range><le>7.1</le></range>
</package>
<package>
<name>pt_BR-netscape7</name>
<name>fr-netscape7</name>
<name>de-netscape7</name>
<range><le>7.02</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans has discovered multiple vulnerabilities in libpng,
which can be exploited by malicious people to compromise a
vulnerable system or cause a DoS (Denial of Service).</p>
</body>
</description>
<references>
<mlist msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
<url>http://scary.beasts.org/security/CESA-2004-001.txt</url>
<url>http://www.osvdb.org/8312</url>
<url>http://www.osvdb.org/8313</url>
<url>http://www.osvdb.org/8314</url>
<url>http://www.osvdb.org/8315</url>
<url>http://www.osvdb.org/8316</url>
<cvename>CVE-2004-0597</cvename>
<cvename>CVE-2004-0598</cvename>
<cvename>CVE-2004-0599</cvename>
<certvu>388984</certvu>
<certvu>236656</certvu>
<certvu>160448</certvu>
<certvu>477512</certvu>
<certvu>817368</certvu>
<certvu>286464</certvu>
<url>http://secunia.com/advisories/12219</url>
<url>http://secunia.com/advisories/12232</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=251381</url>
<uscertta>TA04-217A</uscertta>
<url>http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt</url>
</references>
<dates>
<discovery>2004-08-04</discovery>
<entry>2004-08-04</entry>
<modified>2004-08-15</modified>
</dates>
</vuln>
<vuln vid="603fe36d-ec9d-11d8-b913-000c41e2cdad">
<topic>kdelibs insecure temporary file handling</topic>
<affects>
<package>
<name>kdelibs</name>
<range><le>3.2.3_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a KDE Security Advisory, KDE may sometimes
create temporary files without properly checking the ownership
and type of the target path. This could allow a local
attacker to cause KDE applications to overwrite arbitrary
files.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0689</cvename>
<cvename>CVE-2004-0690</cvename>
<url>http://www.kde.org/info/security/advisory-20040811-1.txt</url>
<url>http://www.kde.org/info/security/advisory-20040811-2.txt</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch</url>
</references>
<dates>
<discovery>2004-08-11</discovery>
<entry>2004-08-12</entry>
</dates>
</vuln>
<vuln vid="5b8f9a02-ec93-11d8-b913-000c41e2cdad">
<topic>gaim remotely exploitable vulnerabilities in MSN component</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.81_1</lt></range>
</package>
<package>
<name>gaim</name>
<range><ge>20030000</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer discovered several remotely exploitable
buffer overflow vulnerabilities in the MSN component of
gaim.</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=0">
<p>In two places in the MSN protocol plugins (object.c and
slp.c), strncpy was used incorrectly; the size of the array
was not checked before copying to it. Both bugs affect MSN's
MSNSLP protocol, which is peer-to-peer, so this could
potentially be easy to exploit.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0500</cvename>
<url>http://gaim.sourceforge.net/security/?id=0</url>
</references>
<dates>
<discovery>2004-08-12</discovery>
<entry>2004-08-12</entry>
<modified>2004-10-25</modified>
</dates>
</vuln>
<vuln vid="78348ea2-ec91-11d8-b913-000c41e2cdad">
<topic>acroread uudecoder input validation error</topic>
<affects>
<package>
<name>acroread</name>
<name>acroread4</name>
<name>acroread5</name>
<range><lt>5.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE security advisory reports:</p>
<blockquote cite="www.idefense.com/application/poi/display?id=124&type=vulnerabilities">
<p>Remote exploitation of an input validation error in the
uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
allows an attacker to execute arbitrary code.</p>
<p>The Unix and Linux versions of Adobe Acrobat Reader 5.0
automatically attempt to convert uuencoded documents
back into their original format. The vulnerability
specifically exists in the failure of Acrobat Reader to
check for the backtick shell metacharacter in the filename
before executing a command with a shell. This allows a
maliciously constructed filename to execute arbitrary
programs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0630</cvename>
<url>http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-08-12</discovery>
<entry>2004-08-12</entry>
<modified>2005-01-06</modified>
</dates>
</vuln>
<vuln vid="12c7b7ae-ec90-11d8-b913-000c41e2cdad">
<topic>popfile file disclosure</topic>
<affects>
<package>
<name>popfile</name>
<range><le>0.21.1_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>John Graham-Cumming reports that certain configurations of
POPFile may allow the retrieval of any files with the
extensions .gif, .png, .ico, .css, as well as some files with
the extension .html.</p>
</body>
</description>
<references>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&forum_id=12356</mlist>
</references>
<dates>
<discovery>2004-08-02</discovery>
<entry>2004-08-12</entry>
</dates>
</vuln>
<vuln vid="7a9d5dfe-c507-11d8-8898-000d6111a684">
<topic>isc-dhcp3-server buffer overflow in logging mechanism</topic>
<affects>
<package>
<name>isc-dhcp3-relay</name>
<name>isc-dhcp3-server</name>
<range><ge>3.0.1.r12</ge><lt>3.0.1.r14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in the logging functionality
of the DHCP daemon which could lead to Denial of Service
attacks and has the potential to allow attackers to
execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0460</cvename>
<url>http://www.osvdb.org/7237</url>
<uscertta>TA04-174A</uscertta>
<certvu>317350</certvu>
<mlist msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
<mlist msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
</references>
<dates>
<discovery>2004-06-22</discovery>
<entry>2004-06-25</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="3a408f6f-9c52-11d8-9366-0020ed76ef5a">
<topic>libpng denial-of-service</topic>
<affects>
<package>
<name>linux-png</name>
<range><le>1.0.14_3</le></range>
<range><ge>1.2</ge><le>1.2.2</le></range>
</package>
<package>
<name>png</name>
<range><lt>1.2.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Grubb reports a buffer read overrun in
libpng's png_format_buffer function. A specially
constructed PNG image processed by an application using
libpng may trigger the buffer read overrun and possibly
result in an application crash.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0421</cvename>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-181.html</url>
<url>http://secunia.com/advisories/11505</url>
<url>http://www.osvdb.org/5726</url>
<bid>10244</bid>
</references>
<dates>
<discovery>2004-04-29</discovery>
<entry>2004-05-02</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="4764cfd6-d630-11d8-b479-02e0185c0b53">
<cancelled superseded="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad"/>
</vuln>
<vuln vid="abe47a5a-e23c-11d8-9b0a-000347a4fa7d">
<topic>Mozilla certificate spoofing</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>0.9.1</ge><le>0.9.2</le></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><lt>1.7.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.2,2</lt></range>
<range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
</package>
<package>
<name>mozilla-gtk1</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla and Mozilla Firefox contains a flaw that may
allow a malicious user to spoof SSL certification.</p>
</body>
</description>
<references>
<mlist msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
<url>http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory</url>
<url>http://secunia.com/advisories/12160</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253121</url>
<url>http://www.osvdb.org/8238</url>
<bid>10796</bid>
<cvename>CVE-2004-0763</cvename>
</references>
<dates>
<discovery>2004-07-25</discovery>
<entry>2004-07-30</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="a713c0f9-ec54-11d8-9440-000347a4fa7d">
<topic>ImageMagick png vulnerability fix</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.0.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Glenn Randers-Pehrson has contributed a fix for the png
vulnerabilities discovered by Chris Evans.</p>
</body>
</description>
<references>
<url>http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html</url>
<url>http://freshmeat.net/releases/169228</url>
<url>http://secunia.com/advisories/12236</url>
<url>http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html</url>
</references>
<dates>
<discovery>2004-08-04</discovery>
<entry>2004-08-04</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="98bd69c3-834b-11d8-a41f-0020ed76ef5a">
<topic>Courier mail services: remotely exploitable buffer overflows</topic>
<affects>
<package>
<name>courier</name>
<range><lt>0.45</lt></range>
</package>
<package>
<name>courier-imap</name>
<range><lt>3.0,1</lt></range>
</package>
<package>
<name>sqwebmail</name>
<range><lt>4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Courier set of mail services use a common Unicode
library. This library contains buffer overflows in the
converters for two popular Japanese character encodings.
These overflows may be remotely exploitable, triggered by
a maliciously formatted email message that is later processed
by one of the Courier mail services.
From the release notes for the corrected versions of the
Courier set of mail services:</p>
<blockquote>
<p>iso2022jp.c: Converters became (upper-)compatible with
ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and
ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability
(when Unicode character is out of BMP range) has been
closed. Convert error handling was implemented.</p>
<p>shiftjis.c: Broken SHIFT_JIS converters has been fixed
and became (upper-)compatible with Shifted Encoding Method
(JIS X 0208:1997 Annex 1). Buffer overflow vulnerability
(when Unicode character is out of BMP range) has been
closed. Convert error handling was implemented.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0224</cvename>
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&view=markup</url>
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&view=markup</url>
<bid>9845</bid>
<url>http://secunia.com/advisories/11087</url>
<url>http://www.osvdb.org/4194</url>
<url>http://www.osvdb.org/6927</url>
</references>
<dates>
<discovery>2004-02-01</discovery>
<entry>2004-03-31</entry>
<modified>2004-07-16</modified>
</dates>
</vuln>
<vuln vid="cdf18ed9-7f4a-11d8-9645-0020ed76ef5a">
<topic>multiple vulnerabilities in ethereal</topic>
<affects>
<package>
<name>ethereal</name>
<name>tethereal</name>
<range><lt>0.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters Security discovered a baker's dozen
of buffer overflows in Ethereal's decoders, including:</p>
<ul>
<li>NetFlow</li>
<li>IGAP</li>
<li>EIGRP</li>
<li>PGM</li>
<li>IRDA</li>
<li>BGP</li>
<li>ISUP</li>
<li>TCAP</li>
<li>UCP</li>
</ul>
<p>In addition, a vulnerability in the RADIUS decoder was found
by Jonathan Heusser.</p>
<p>Finally, there is one uncredited vulnerability described by the
Ethereal team as:</p>
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
<p>A zero-length Presentation protocol selector could make
Ethereal crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00013.html</url>
<cvename>CVE-2004-0176</cvename>
<cvename>CVE-2004-0365</cvename>
<cvename>CVE-2004-0367</cvename>
<certvu>119876</certvu>
<certvu>124454</certvu>
<certvu>125156</certvu>
<certvu>433596</certvu>
<certvu>591820</certvu>
<certvu>644886</certvu>
<certvu>659140</certvu>
<certvu>695486</certvu>
<certvu>740188</certvu>
<certvu>792286</certvu>
<certvu>864884</certvu>
<certvu>931588</certvu>
<url>http://security.e-matters.de/advisories/032004.html</url>
<url>http://secunia.com/advisories/11185</url>
<bid>9952</bid>
<url>http://www.osvdb.org/4462</url>
<url>http://www.osvdb.org/4463</url>
<url>http://www.osvdb.org/4464</url>
</references>
<dates>
<discovery>2004-03-23</discovery>
<entry>2004-03-26</entry>
<modified>2004-07-11</modified>
</dates>
</vuln>
<vuln vid="74d06b67-d2cf-11d8-b479-02e0185c0b53">
<topic>multiple vulnerabilities in ethereal</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><lt>0.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Issues have been discovered in multiple protocol dissectors.</p>
</body>
</description>
<references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00014.html</url>
<cvename>CVE-2004-0504</cvename>
<cvename>CVE-2004-0505</cvename>
<cvename>CVE-2004-0506</cvename>
<cvename>CVE-2004-0507</cvename>
<url>http://secunia.com/advisories/11608</url>
<bid>10347</bid>
<url>http://www.osvdb.org/6131</url>
<url>http://www.osvdb.org/6132</url>
<url>http://www.osvdb.org/6133</url>
<url>http://www.osvdb.org/6134</url>
</references>
<dates>
<discovery>2004-05-13</discovery>
<entry>2004-07-11</entry>
</dates>
</vuln>
<vuln vid="265c8b00-d2d0-11d8-b479-02e0185c0b53">
<topic>multiple vulnerabilities in ethereal</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><lt>0.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Issues have been discovered in multiple protocol dissectors.</p>
</body>
</description>
<references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00015.html</url>
<cvename>CVE-2004-0633</cvename>
<cvename>CVE-2004-0634</cvename>
<cvename>CVE-2004-0635</cvename>
<url>http://secunia.com/advisories/12024</url>
<bid>10672</bid>
<url>http://www.osvdb.org/7536</url>
<url>http://www.osvdb.org/7537</url>
<url>http://www.osvdb.org/7538</url>
</references>
<dates>
<discovery>2004-07-06</discovery>
<entry>2004-07-11</entry>
</dates>
</vuln>
<vuln vid="4aec9d58-ce7b-11d8-858d-000d610a3b12">
<topic>Format string vulnerability in SSLtelnet</topic>
<affects>
<package>
<name>SSLtelnet</name>
<range><le>0.13_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SSLtelnet contains a format string vulnerability that could
allow remote code execution and privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0640</cvename>
<url>http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities</url>
</references>
<dates>
<discovery>2003-04-03</discovery>
<entry>2004-07-05</entry>
</dates>
</vuln>
<vuln vid="c5519420-cec2-11d8-8898-000d6111a684">
<topic>"Content-Type" XSS vulnerability affecting other webmail systems</topic>
<affects>
<package>
<name>openwebmail</name>
<range><le>2.32</le></range>
</package>
<package>
<name>ilohamail</name>
<range><lt>0.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roman Medina-Heigl Hernandez did a survey which other webmail systems
where vulnerable to a bug he discovered in SquirrelMail. This advisory
summarizes the results.</p>
</body>
</description>
<references>
<url>http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt</url>
<url>http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html</url>
<url>http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html</url>
<url>http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html</url>
<cvename>CVE-2004-0519</cvename>
</references>
<dates>
<discovery>2004-05-29</discovery>
<entry>2004-07-05</entry>
</dates>
</vuln>
<vuln vid="76904dce-ccf3-11d8-babb-000854d03344">
<topic>Pavuk HTTP Location header overflow</topic>
<affects>
<package>
<name>pavuk</name>
<range><lt>0.9.28_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When pavuk sends a request to a web server and the server
sends back the HTTP status code 305 (Use Proxy), pavuk
copies data from the HTTP Location header in an unsafe
manner. This leads to a stack-based buffer overflow with
control over EIP.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0456</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html</mlist>
<url>http://www.osvdb.org/7319</url>
</references>
<dates>
<discovery>2004-06-30</discovery>
<entry>2004-07-03</entry>
</dates>
</vuln>
<vuln vid="33ab4a47-bfc1-11d8-b00e-000347a4fa7d">
<topic>Several vulnerabilities found in PHPNuke</topic>
<affects>
<package>
<name>phpnuke</name>
<range><lt>7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janek Vind "waraxe" reports that several issues in the
PHPNuke software may be exploited via carefully crafted
URL requests. These URLs will permit the injection of
SQL code, cookie theft, and the readability of the
PHPNuke administrator account.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0279</cvename>
<cvename>CVE-2003-0318</cvename>
<cvename>CVE-2004-0266</cvename>
<cvename>CVE-2004-0269</cvename>
<url>http://www.waraxe.us/index.php?modname=sa&id=27</url>
<url>http://secunia.com/advisories/11920</url>
</references>
<dates>
<discovery>2004-05-05</discovery>
<entry>2004-07-03</entry>
<modified>2004-09-28</modified>
</dates>
</vuln>
<vuln vid="0d4c31ac-cb91-11d8-8898-000d6111a684">
<topic>Remote code injection in phpMyAdmin</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.5.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>This vulnerability would allow remote user to inject PHP code
to be executed by eval() function. This vulnerability is only
exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in
file config.inc.php).</p>
</body>
</description>
<references>
<url>http://sf.net/forum/forum.php?forum_id=387635</url>
<mlist msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
<url>http://secunia.com/advisories/11974</url>
<url>http://eagle.kecapi.com/sec/fd/phpMyAdmin.html</url>
</references>
<dates>
<discovery>2004-06-29</discovery>
<entry>2004-07-02</entry>
<modified>2004-09-28</modified>
</dates>
</vuln>
<vuln vid="4d837296-cc28-11d8-a54c-02e0185c0b53">
<topic>GNATS local privilege elevation</topic>
<affects>
<package>
<name>gnats</name>
<range><le>3.113.1_9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNATS 3.113.1 contains multiple buffer overflows, through which a
local attacker could gain elevated privileges on the system.</p>
</body>
</description>
<references>
<freebsdpr>ports/56006</freebsdpr>
<mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
<url>http://www.securiteam.com/unixfocus/5CP0N0UAAA.html</url>
<url>http://secunia.com/advisories/9096</url>
<url>http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt</url>
<url>http://www.gnu.org/software/gnats/gnats.html</url>
<url>http://www.osvdb.org/2190</url>
<url>http://www.osvdb.org/4600</url>
<url>http://www.osvdb.org/4601</url>
<url>http://www.osvdb.org/4607</url>
</references>
<dates>
<discovery>2003-06-21</discovery>
<entry>2004-07-02</entry>
</dates>
</vuln>
<vuln vid="8ecaaca2-cc07-11d8-858d-000d610a3b12">
<topic>Linux binary compatibility mode input validation error</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.9</ge><lt>4.9_10</lt></range>
<range><ge>4.8</ge><lt>4.8_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error in the handling of some Linux system
calls may result in memory locations being accessed without
proper validation.</p>
<p>It may be possible for a local attacker to read and/or
overwrite portions of kernel memory, resulting in disclosure
of sensitive information or potential privilege escalation.
A local attacker can cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0602</cvename>
<freebsdsa>SA-04:13.linux</freebsdsa>
</references>
<dates>
<discovery>2004-06-18</discovery>
<entry>2004-06-30</entry>
</dates>
</vuln>
<vuln vid="1f738bda-c6ac-11d8-8898-000d6111a684">
<topic>Remote Denial of Service of HTTP server and client</topic>
<affects>
<package>
<name>giFT-FastTrack</name>
<range><lt>0.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>giFT-FastTrack is susceptible to a remote
Denial of Service attack which could allow
a remote attacker to render HTTP services
unusable. According to the developers, no
code execution is possible; however, they
recommend an immediate upgrade.</p>
</body>
</description>
<references>
<url>http://developer.berlios.de/forum/forum.php?forum_id=5814</url>
<url>http://www.osvdb.org/7266</url>
<url>http://secunia.com/advisories/11941</url>
<bid>10604</bid>
</references>
<dates>
<discovery>2004-06-19</discovery>
<entry>2004-06-25</entry>
<modified>2004-06-29</modified>
</dates>
</vuln>
<vuln vid="ff00f2ce-c54c-11d8-b708-00061bc2ad93">
<topic>XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0</topic>
<affects>
<package>
<name>xorg-clients</name>
<range><eq>6.7.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When the IPv6 code was added to xdm a critical
test to disable xdmcp was accidentally removed. This
caused xdm to create the chooser socket regardless if
DisplayManager.requestPort was disabled in xdm-config
or not.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0419</cvename>
<url>http://bugs.xfree86.org/show_bug.cgi?id=1376</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900</url>
</references>
<dates>
<discovery>2004-05-19</discovery>
<entry>2004-06-28</entry>
<modified>2004-06-28</modified>
</dates>
</vuln>
<vuln vid="da9e6438-bfc0-11d8-b00e-000347a4fa7d">
<topic>MoinMoin administrative group name privilege escalation vulnerability</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A serious flaw exists in the MoinMoin software
which may allow a malicious user to gain access to
unauthorized privileges.</p>
</body>
</description>
<references>
<url>http://www.osvdb.org/6704</url>
<cvename>CVE-2004-0708</cvename>
<bid>10568</bid>
<url>http://secunia.com/advisories/11807</url>
</references>
<dates>
<discovery>2004-05-04</discovery>
<entry>2004-06-28</entry>
</dates>
</vuln>
<vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a">
<topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic>
<affects>
<package>
<name>cyrus-imapd</name>
<range><lt>2.0.17</lt></range>
<range><ge>2.1</ge><lt>2.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In December 2002, Timo Sirainen reported:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605">
<p>Cyrus IMAP server has a remotely exploitable pre-login
buffer overflow. [...] Note that you don't have to log in
before exploiting this, and since Cyrus
runs everything under one UID, it's possible to read every
user's mail in the system.</p>
</blockquote>
<p>It is unknown whether this vulnerability is exploitable for code
execution on FreeBSD systems.</p>
</body>
</description>
<references>
<cvename>CVE-2002-1580</cvename>
<bid>6298</bid>
<certvu>740169</certvu>
<mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605</mlist>
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=19349</mlist>
</references>
<dates>
<discovery>2002-12-02</discovery>
<entry>2004-05-12</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="700d43b4-a42a-11d8-9c6d-0020ed76ef5a">
<topic>Cyrus IMSPd multiple vulnerabilities</topic>
<affects>
<package>
<name>cyrus-imspd</name>
<range><lt>1.6a5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus team reported multiple vulnerabilities in older
versions of Cyrus IMSPd:</p>
<blockquote cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25">
<p>These releases correct a recently discovered buffer
overflow vulnerability, as well as clean up a significant
amount of buffer handling throughout the code.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25</mlist>
</references>
<dates>
<discovery>2004-05-12</discovery>
<entry>2004-09-20</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="5e7f58c3-b3f8-4258-aeb8-795e5e940ff8">
<topic>mplayer heap overflow in http requests</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<range><lt>0.92.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remotely exploitable heap buffer overflow vulnerability was
found in MPlayer's URL decoding code. If an attacker can
cause MPlayer to visit a specially crafted URL, arbitrary code
execution with the privileges of the user running MPlayer may
occur. A `visit' might be caused by social engineering, or a
malicious web server could use HTTP redirects which MPlayer
would then process.</p>
</body>
</description>
<references>
<url>http://www.mplayerhq.hu/homepage/design6/news.html</url>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108066964709058</mlist>
<freebsdpr>ports/64974</freebsdpr>
</references>
<dates>
<discovery>2004-03-30</discovery>
<entry>2004-03-31</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="3e9be8c4-8192-11d8-9645-0020ed76ef5a">
<topic>ecartis buffer overflows and input validation bugs</topic>
<affects>
<package>
<name>ecartis</name>
<range><lt>1.0.0.s20030814,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports multiple buffer overflows that may be
triggered while parsing messages, as well as input validation
errors that could result in disclosure of mailing list
passwords.</p>
<p>These bugs were resolved in the August 2003 snapshot of
ecartis.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0781</cvename>
<cvename>CVE-2003-0782</cvename>
<url>http://www.securiteam.com/unixfocus/5YP0H2AAUY.html</url>
<freebsdpr>ports/57082</freebsdpr>
</references>
<dates>
<discovery>2003-08-14</discovery>
<entry>2004-03-29</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="c2e10368-77ab-11d8-b9e8-00e04ccb0a62">
<topic>ModSecurity for Apache 2.x remote off-by-one overflow</topic>
<affects>
<package>
<name>mod_security</name>
<range><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When the directive "SecFilterScanPost" is enabled,
the Apache 2.x version of ModSecurity is vulnerable
to an off-by-one overflow</p>
</body>
</description>
<references>
<url>http://www.s-quadra.com/advisories/Adv-20040315.txt</url>
<bid>9885</bid>
<url>http://secunia.com/advisories/11138</url>
<certvu>779438</certvu>
</references>
<dates>
<discovery>2004-02-09</discovery>
<entry>2004-03-17</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="74a9541d-5d6c-11d8-80e3-0020ed76ef5a">
<topic>clamav remote denial-of-service</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.65_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>clamav will exit when a programming
assertion is not met. A malformed uuencoded message can
trigger this assertion, allowing an attacker to trivially
crash clamd or other components of clamav.</p>
</body>
</description>
<references>
<freebsdpr>ports/62586</freebsdpr>
<mlist msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
<url>http://www.osvdb.org/3894</url>
<bid>9610</bid>
<url>http://secunia.com/advisories/10826</url>
<cvename>CVE-2004-0270</cvename>
<url>http://xforce.iss.net/xforce/xfdb/15077</url>
</references>
<dates>
<discovery>2004-02-09</discovery>
<entry>2004-02-12</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="8d075001-a9ce-11d8-9c6d-0020ed76ef5a">
<topic>neon date parsing vulnerability</topic>
<affects>
<package>
<name>neon</name>
<range><lt>0.24.5_1</lt></range>
</package>
<package>
<name>sitecopy</name>
<range><le>0.13.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://security.e-matters.de/advisories/062004.html">
<p>A vulnerability within a libneon date parsing function
could cause a heap overflow which could lead to remote
code execution, depending on the application using
libneon.</p>
</blockquote>
<p>The vulnerability is in the function ne_rfc1036_parse,
which is in turn used by the function ne_httpdate_parse.
Applications using either of these neon functions may be
vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0398</cvename>
<url>http://security.e-matters.de/advisories/062004.html</url>
<url>http://secunia.com/advisories/11785</url>
</references>
<dates>
<discovery>2004-05-19</discovery>
<entry>2004-05-19</entry>
<modified>2004-06-25</modified>
</dates>
</vuln>
<vuln vid="84237895-8f39-11d8-8b29-0020ed76ef5a">
<topic>neon format string vulnerabilities</topic>
<affects>
<package>
<name>neon</name>
<range><lt>0.24.5</lt></range>
</package>
<package>
<name>tla</name>
<range><lt>1.2_1</lt></range>
</package>
<package>
<name>sitecopy</name>
<range><le>0.13.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Greuff reports that the neon WebDAV client library contains
several format string bugs within error reporting code. A
malicious server may exploit these bugs by sending specially
crafted PROPFIND or PROPPATCH responses.</p>
<p>Although several applications include neon, such as cadaver and
subversion, the FreeBSD Ports of these applications are not
impacted. They are specifically configured to NOT use the
included neon. Only packages listed as affected in this
notice are believed to be impacted.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0179</cvename>
<url>http://www.webdav.org/neon/</url>
<url>http://secunia.com/advisories/11785</url>
</references>
<dates>
<discovery>2004-04-14</discovery>
<entry>2004-04-15</entry>
<modified>2004-06-25</modified>
</dates>
</vuln>
<vuln vid="253ea131-bd12-11d8-b071-00e08110b673">
<topic>Gallery 1.4.3 and ealier user authentication bypass</topic>
<affects>
<package>
<name>gallery</name>
<range><lt>1.4.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw exists in Gallery versions previous to
1.4.3-pl1 and post 1.2 which may give an attacker
the potential to log in under the "admin" account.
Data outside of the gallery is unaffected and the
attacker cannot modify any data other than the
photos or photo albums.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0522</cvename>
<url>http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=123</url>
<url>http://secunia.com/advisories/11752</url>
</references>
<dates>
<discovery>2004-06-01</discovery>
<entry>2004-06-24</entry>
</dates>
</vuln>
<vuln vid="0c6f3fde-9c51-11d8-9366-0020ed76ef5a">
<topic>Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling</topic>
<affects>
<package>
<name>mc</name>
<range><lt>4.6.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Jelinek reports several security related bugs in
Midnight Commander, including:</p>
<ul>
<li>Multiple buffer overflows (CVE-2004-0226)</li>
<li>Insecure temporary file handling (CVE-2004-0231)</li>
<li>Format string bug (CVE-2004-0232)</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2004-0226</cvename>
<cvename>CVE-2004-0231</cvename>
<cvename>CVE-2004-0232</cvename>
</references>
<dates>
<discovery>2004-04-29</discovery>
<entry>2004-05-02</entry>
<modified>2004-06-14</modified>
</dates>
</vuln>
<vuln vid="6f955451-ba54-11d8-b88c-000d610a3b12">
<topic>Buffer overflow in Squid NTLM authentication helper</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.5_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Remote exploitation of a buffer overflow vulnerability in
the NTLM authentication helper routine of the Squid Web
Proxy Cache could allow a remote attacker to execute
arbitrary code. A remote attacker can compromise a target
system if the Squid Proxy is configured to use the NTLM
authentication helper. The attacker can send an overly long
password to overflow the buffer and execute arbitrary
code.</p>
</body>
</description>
<references>
<url>http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false</url>
<cvename>CVE-2004-0541</cvename>
<url>http://www.osvdb.org/6791</url>
<url>http://secunia.com/advisories/11804</url>
<bid>10500</bid>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=998</url>
</references>
<dates>
<discovery>2004-05-20</discovery>
<entry>2004-06-09</entry>
</dates>
</vuln>
<vuln vid="27c331d5-64c7-11d8-80e3-0020ed76ef5a">
<topic>Vulnerabilities in H.323 implementations</topic>
<affects>
<package>
<name>pwlib</name>
<range><lt>1.5.0_5</lt></range>
</package>
<package>
<name>asterisk</name>
<range><le>0.7.2</le></range>
</package>
<package>
<name>openh323</name>
<range><lt>1.12.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The <a href="http://www.niscc.gov.uk/">NISCC</a> and the <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
developed a test suite for the H.323 protocol. This test
suite has uncovered vulnerabilities in several H.323
implementations with impacts ranging from denial-of-service
to arbitrary code execution.</p>
<p>In the FreeBSD Ports Collection, `pwlib' is directly
affected. Other applications such as `asterisk' and
`openh323' incorporate `pwlib' statically and so are also
independently affected.</p>
</body>
</description>
<references>
<!-- General references -->
<url>http://www.uniras.gov.uk/vuls/2004/006489/h323.htm</url>
<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html</url>
<certsa>CA-2004-01</certsa>
<certvu>749342</certvu>
<!-- pwlib and pwlib-using applications -->
<cvename>CVE-2004-0097</cvename>
<url>http://www.southeren.com/blog/archives/000055.html</url>
</references>
<dates>
<discovery>2004-01-13</discovery>
<entry>2004-02-22</entry>
<modified>2004-06-08</modified>
</dates>
</vuln>
<vuln vid="fb5e227e-b8c6-11d8-b88c-000d610a3b12">
<topic>jailed processes can manipulate host routing tables</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.9</ge><lt>4.9_10</lt></range>
<range><ge>4.8</ge><lt>4.8_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error resulting in a failure to verify that
an attempt to manipulate routing tables originated from a
non-jailed process.</p>
<p>Jailed processes running with superuser privileges could
modify host routing tables. This could result in a variety
of consequences including packets being sent via an
incorrect network interface and packets being discarded
entirely.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0125</cvename>
<freebsdsa>SA-04:12.jailroute</freebsdsa>
</references>
<dates>
<discovery>2004-02-03</discovery>
<entry>2004-06-07</entry>
</dates>
</vuln>
<vuln vid="1db1ed59-af07-11d8-acb9-000d610a3b12">
<topic>buffer cache invalidation implementation issues</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.0</ge><lt>5.2_8</lt></range>
<range><ge>4.9</ge><lt>4.9_9</lt></range>
<range><ge>4.0</ge><lt>4.8_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Programming errors in the implementation of the msync(2)
system call involving the MS_INVALIDATE operation lead to
cache consistency problems between the virtual memory system
and on-disk contents.</p>
<p>In some situations, a user with read access to a file may
be able to prevent changes to that file from being committed
to disk.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0435</cvename>
<freebsdsa>SA-04:11.msync</freebsdsa>
</references>
<dates>
<discovery>2004-04-24</discovery>
<entry>2004-05-26</entry>
</dates>
</vuln>
<vuln vid="f7a3b18c-624c-4703-9756-b6b27429e5b0">
<topic>leafnode denial-of-service triggered by article request</topic>
<affects>
<package>
<name>leafnode</name>
<range><ge>1.9.20</ge><lt>1.9.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The leafnode NNTP server may go into an unterminated loop with 100%
CPU use when an article is requested by Message-ID that has been
crossposted to several news groups when one of the group names is the
prefix of another group name that the article was cross-posted
to. Found by Jan Knutar.</p>
</body>
</description>
<references>
<url>http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt</url>
<cvename>CVE-2002-1661</cvename>
<mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
<mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
<bid>6490</bid>
<freebsdpr>ports/46613</freebsdpr>
</references>
<dates>
<discovery>2002-11-06</discovery>
<entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
<vuln vid="7b0208ff-3f65-4e16-8d4d-48fd9851f085">
<topic>leafnode fetchnews denial-of-service triggered by missing header</topic>
<affects>
<package>
<name>leafnode</name>
<range><ge>1.9.3</ge><le>1.9.41</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fetchnews could hang when a news article to be downloaded lacked one
of the mandatory headers. Found by Joshua Crawford.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0744</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt</url>
<mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
<mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
<bid>8541</bid>
<freebsdpr>ports/53838</freebsdpr>
</references>
<dates>
<discovery>2003-06-20</discovery>
<entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
<vuln vid="a051a4ec-3aa1-4dd1-9bdc-a61eb5700153">
<topic>leafnode fetchnews denial-of-service triggered by truncated transmission</topic>
<affects>
<package>
<name>leafnode</name>
<range><le>1.9.47</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When a downloaded news article ends prematurely, i. e. when the
server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may
wait indefinitely for data that never arrives. Workaround: configure
"minlines=1" (or use a bigger value) in the configuration file. Found
by Toni Viemerö.</p>
</body>
</description>
<references>
<cvename>CVE-2004-2068</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349</url>
<mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
<mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
<freebsdpr>ports/61105</freebsdpr>
</references>
<dates>
<discovery>2004-01-08</discovery>
<entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
<vuln vid="2e129846-8fbb-11d8-8b29-0020ed76ef5a">
<topic>MySQL insecure temporary file creation (mysqlbug)</topic>
<affects>
<package>
<name>mysql-client</name>
<range><ge>4.0</ge><lt>4.0.20</lt></range>
<range><ge>4.1</ge><lt>4.1.1_2</lt></range>
<range><ge>5.0</ge><lt>5.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shaun Colley reports that the script `mysqlbug' included
with MySQL sometimes creates temporary files in an unsafe
manner. As a result, an attacker may create a symlink in
/tmp so that if another user invokes `mysqlbug' and <em>quits
without making <strong>any</strong> changes</em>, an
arbitrary file may be overwritten with the bug report
template.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2</mlist>
<url>http://bugs.mysql.com/bug.php?id=3284</url>
<bid>9976</bid>
<cvename>CVE-2004-0381</cvename>
</references>
<dates>
<discovery>2004-03-25</discovery>
<entry>2004-04-16</entry>
<modified>2004-05-21</modified>
</dates>
</vuln>
<vuln vid="5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a">
<topic>subversion date parsing vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><lt>1.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://security.e-matters.de/advisories/082004.html">
<p>Subversion versions up to 1.0.2 are vulnerable to a date
parsing vulnerability which can be abused to allow remote
code execution on Subversion servers and therefore could
lead to a repository compromise.</p>
</blockquote>
<p><em>NOTE:</em> This vulnerability is similar to the date
parsing issue that affected neon. However, it is a different
and distinct bug.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0397</cvename>
<url>http://security.e-matters.de/advisories/082004.html</url>
</references>
<dates>
<discovery>2004-05-19</discovery>
<entry>2004-05-19</entry>
</dates>
</vuln>
<vuln vid="f93be979-a992-11d8-aecc-000d610a3b12">
<topic>cvs pserver remote heap buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2_7</lt></range>
<range><ge>5.1</ge><lt>5.1_17</lt></range>
<range><ge>5.0</ge><lt>5.0_21</lt></range>
<range><ge>4.9</ge><lt>4.9_8</lt></range>
<range><ge>4.8</ge><lt>4.8_21</lt></range>
<range><ge>4.0</ge><lt>4.7_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a programming error in code used to parse data
received from the client, malformed data can cause a heap
buffer to overflow, allowing the client to overwrite
arbitrary portions of the server's memory.</p>
<p>A malicious CVS client can exploit this to run arbitrary
code on the server at the privilege level of the CVS server
software.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0396</cvename>
<freebsdsa>SA-04:10.cvs</freebsdsa>
</references>
<dates>
<discovery>2004-05-02</discovery>
<entry>2004-05-19</entry>
</dates>
</vuln>
<vuln vid="492f8896-70fa-11d8-873f-0020ed76ef5a">
<topic>Apache 2 mod_ssl denial-of-service</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.0</ge><le>2.0.48_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joe Orton reports a memory leak in Apache 2's mod_ssl.
A remote attacker may issue HTTP requests on an HTTPS
port, causing an error. Due to a bug in processing this
condition, memory associated with the connection is
not freed. Repeated requests can result in consuming
all available memory resources, probably resulting in
termination of the Apache process.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0113</cvename>
<url>http://www.apacheweek.com/features/security-20</url>
<url>http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&r2=1.100.2.12</url>
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&m=107869699329638</mlist>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106</url>
<bid>9826</bid>
</references>
<dates>
<discovery>2004-02-20</discovery>
<entry>2004-03-08</entry>
<modified>2004-05-19</modified>
</dates>
</vuln>
<vuln vid="df333ede-a8ce-11d8-9c6d-0020ed76ef5a">
<topic>URI handler vulnerabilities in several browsers</topic>
<affects>
<package>
<name>linux-opera</name>
<name>opera</name>
<range><lt>7.50</lt></range>
</package>
<package>
<name>kdelibs</name>
<range><lt>3.2.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Karol Wiesek and Greg MacManus reported via iDEFENSE that the
Opera web browser contains a flaw in the handling of
certain URIs. When presented with these URIs, Opera would
invoke external commands to process them after some
validation. However, if the hostname component of a URI
begins with a `-', it may be treated as an option by an external
command. This could have undesirable side-effects, from
denial-of-service to code execution. The impact is very
dependent on local configuration.</p>
<p>After the iDEFENSE advisory was published, the KDE team
discovered similar problems in KDE's URI handlers.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0411</cvename>
<url>http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities</url>
<url>http://www.kde.org/info/security/advisory-20040517-1.txt</url>
<url>http://freebsd.kde.org/index.php#n20040517</url>
</references>
<dates>
<discovery>2004-05-12</discovery>
<entry>2004-05-18</entry>
</dates>
</vuln>
<vuln vid="20be2982-4aae-11d8-96f2-0020ed76ef5a">
<topic>fsp buffer overflow and directory traversal vulnerabilities</topic>
<affects>
<package>
<name>fspd</name>
<range><lt>2.8.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The <a href="http://www.debian.org/security">Debian
security team</a> reported a pair of vulnerabilities in
fsp:</p>
<blockquote cite="http://www.debian.org/security/2004/dsa-416">
<p>A vulnerability was discovered in fsp, client utilities
for File Service Protocol (FSP), whereby a remote user could
both escape from the FSP root directory (CAN-2003-1022), and
also overflow a fixed-length buffer to execute arbitrary
code (CAN-2004-0011).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-1022</cvename>
<cvename>CVE-2004-0011</cvename>
<url>http://www.debian.org/security/2004/dsa-416</url>
</references>
<dates>
<discovery>2004-01-06</discovery>
<entry>2004-01-19</entry>
<modified>2004-05-17</modified>
</dates>
</vuln>
<vuln vid="cb6c6c29-9c4f-11d8-9366-0020ed76ef5a">
<topic>proftpd IP address access control list breakage</topic>
<affects>
<package>
<name>proftpd</name>
<range><ge>1.2.9</ge><lt>1.2.10.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jindrich Makovicka reports a regression in proftpd's
handling of IP address access control lists (IP ACLs). Due
to this regression, some IP ACLs are treated as ``allow
all''.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0432</cvename>
<url>http://bugs.proftpd.org/show_bug.cgi?id=2267</url>
</references>
<dates>
<discovery>2003-11-04</discovery>
<entry>2004-05-02</entry>
<modified>2004-05-15</modified>
</dates>
</vuln>
<vuln vid="fde53204-7ea6-11d8-9645-0020ed76ef5a">
<topic>insecure temporary file creation in xine-check, xine-bugreport</topic>
<affects>
<package>
<name>xine</name>
<range><lt>0.9.23_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Some scripts installed with xine create temporary files
insecurely. It is recommended that these scripts (xine-check,
xine-bugreport) not be used. They are not needed for normal
operation.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=107997911025558</mlist>
<bid>9939</bid>
</references>
<dates>
<discovery>2004-03-20</discovery>
<entry>2004-03-26</entry>
<modified>2004-05-09</modified>
</dates>
</vuln>
<vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673">
<topic>exim buffer overflow when verify = header_syntax is used</topic>
<affects>
<package>
<name>exim</name>
<name>exim-ldap2</name>
<name>exim-mysql</name>
<name>exim-postgresql</name>
<range><lt>4.33+20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote exploitable buffer overflow has been discovered
in exim when verify = header_syntax is used in the
configuration file. This does not affect the default
configuration.</p>
</body>
</description>
<references>
<url>http://www.guninski.com/exim1.html</url>
<cvename>CVE-2004-0400</cvename>
</references>
<dates>
<discovery>2004-05-06</discovery>
<entry>2004-05-06</entry>
</dates>
</vuln>
<vuln vid="a56a72bb-9f72-11d8-9585-0020ed76ef5a">
<topic>phpBB session table exhaustion</topic>
<affects>
<package>
<name>phpbb</name>
<range><le>2.0.8_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The includes/sessions.php unnecessarily adds session item into
session table and therefore vulnerable to a denial-of-service
attack.</p>
</body>
</description>
<references>
<mlist msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&m=108256462710010</mlist>
</references>
<dates>
<discovery>2004-03-05</discovery>
<entry>2004-05-06</entry>
</dates>
</vuln>
<vuln vid="446dbecb-9edc-11d8-9366-0020ed76ef5a">
<topic>heimdal kadmind remote heap buffer overflow</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>0.6.1_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>4.9</ge><lt>4.9_7</lt></range>
<range><ge>4.0</ge><lt>4.8_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An input validation error was discovered in the kadmind
code that handles the framing of Kerberos 4 compatibility
administration requests. The code assumed that the length
given in the framing was always two or more bytes. Smaller
lengths will cause kadmind to read an arbitrary amount of
data into a minimally-sized buffer on the heap.</p>
<p>A remote attacker may send a specially formatted message
to kadmind, causing it to crash or possibly resulting in
arbitrary code execution.</p>
<p>The kadmind daemon is part of Kerberos 5 support. However,
this bug will only be present if kadmind was built with
additional Kerberos 4 support. Thus, only systems that have
*both* Heimdal Kerberos 5 and Kerberos 4 installed might
be affected.</p>
<p><em>NOTE:</em> On FreeBSD 4 systems, `kadmind' may be
installed as `k5admind'.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0434</cvename>
<freebsdsa>SA-04:09.kadmind</freebsdsa>
</references>
<dates>
<discovery>2004-05-05</discovery>
<entry>2004-05-05</entry>
</dates>
</vuln>
<vuln vid="0792e7a7-8e37-11d8-90d1-0020ed76ef5a">
<topic>CVS path validation errors</topic>
<affects>
<package>
<name>cvs+ipv6</name>
<range><le>1.11.5_1</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2.1_5</lt></range>
<range><ge>4.9</ge><lt>4.9_5</lt></range>
<range><ge>4.8</ge><lt>4.8_18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two programming errors were discovered in which path names
handled by CVS were not properly validated. In one case,
the CVS client accepts absolute path names from the server
when determining which files to update. In another case,
the CVS server accepts relative path names from the client
when determining which files to transmit, including those
containing references to parent directories (`../').</p>
<p>These programming errors generally only have a security
impact when dealing with remote CVS repositories.</p>
<p>A malicious CVS server may cause a CVS client to overwrite
arbitrary files on the client's system.</p>
<p>A CVS client may request RCS files from a remote system
other than those in the repository specified by $CVSROOT.
These RCS files need not be part of any CVS repository
themselves.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0180</cvename>
<cvename>CVE-2004-0405</cvename>
<url>http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102</url>
<freebsdsa>SA-04:07.cvs</freebsdsa>
</references>
<dates>
<discovery>2004-04-14</discovery>
<entry>2004-04-14</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="7229d900-88af-11d8-90d1-0020ed76ef5a">
<topic>mksnap_ffs clears file system options</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2_1</lt></range>
<range><ge>5.1</ge><lt>5.1_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The kernel interface for creating a snapshot of a
filesystem is the same as that for changing the flags on
that filesystem. Due to an oversight, the <a href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
command called that interface with only the snapshot flag
set, causing all other flags to be reset to the default
value.</p>
<p>A regularly scheduled backup of a live filesystem, or
any other process that uses the mksnap_ffs command
(for instance, to provide a rough undelete functionality
on a file server), will clear any flags in effect on the
filesystem being snapshot. Possible consequences depend
on local usage, but can include disabling extended access
control lists or enabling the use of setuid executables
stored on an untrusted filesystem.</p>
<p>The mksnap_ffs command is normally only available to
the superuser and members of the `operator' group. There
is therefore no risk of a user gaining elevated privileges
directly through use of the mksnap_ffs command unless
it has been intentionally made available to unprivileged
users.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0099</cvename>
<freebsdsa>SA-04:01.mksnap_ffs</freebsdsa>
</references>
<dates>
<discovery>2004-01-30</discovery>
<entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="f95a9005-88ae-11d8-90d1-0020ed76ef5a">
<topic>shmat reference counting bug</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2_2</lt></range>
<range><ge>5.1</ge><lt>5.1_14</lt></range>
<range><ge>5.0</ge><lt>5.0_20</lt></range>
<range><ge>4.9</ge><lt>4.9_2</lt></range>
<range><ge>4.8</ge><lt>4.8_15</lt></range>
<range><lt>4.7_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error in the <a href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a> system call can result
in a shared memory segment's reference count being erroneously
incremented.</p>
<p>It may be possible to cause a shared memory segment to
reference unallocated kernel memory, but remain valid.
This could allow a local attacker to gain read or write
access to a portion of kernel memory, resulting in sensitive
information disclosure, bypass of access control mechanisms,
or privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0114</cvename>
<freebsdsa>SA-04:02.shmat</freebsdsa>
<url>http://www.pine.nl/press/pine-cert-20040201.txt</url>
</references>
<dates>
<discovery>2004-02-01</discovery>
<entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="9082a85a-88ae-11d8-90d1-0020ed76ef5a">
<topic>jailed processes can attach to other jails</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.1</ge><lt>5.1_14</lt></range>
<range><ge>5.2</ge><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error has been found in the <a href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
system call which affects the way that system call verifies
the privilege level of the calling process. Instead of
failing immediately if the calling process was already
jailed, the jail_attach system call would fail only after
changing the calling process's root directory.</p>
<p>A process with superuser privileges inside a jail could
change its root directory to that of a different jail,
and thus gain full read and write access to files and
directories within the target jail.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0126</cvename>
<freebsdsa>SA-04:03.jail</freebsdsa>
</references>
<dates>
<discovery>2004-02-19</discovery>
<entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="e289f7fd-88ac-11d8-90d1-0020ed76ef5a">
<topic>many out-of-sequence TCP packets denial-of-service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2.1_2</lt></range>
<range><ge>5.0</ge><lt>5.1_15</lt></range>
<range><ge>4.9</ge><lt>4.9_3</lt></range>
<range><ge>4.8</ge><lt>4.8_16</lt></range>
<range><lt>4.7_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FreeBSD does not limit the number of TCP segments that
may be held in a reassembly queue. A remote attacker may
conduct a low-bandwidth denial-of-service attack against
a machine providing services based on TCP (there are many
such services, including HTTP, SMTP, and FTP). By sending
many out-of-sequence TCP segments, the attacker can cause
the target machine to consume all available memory buffers
(``mbufs''), likely leading to a system crash.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0171</cvename>
<freebsdsa>SA-04:04.tcp</freebsdsa>
<url>http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities</url>
</references>
<dates>
<discovery>2004-02-18</discovery>
<entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="2c6acefd-8194-11d8-9645-0020ed76ef5a">
<topic>setsockopt(2) IPv6 sockets input validation error</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.2</ge><lt>5.2.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the FreeBSD Security Advisory:</p>
<blockquote>
<p>A programming error in the handling of some IPv6 socket
options within the <a href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a> system call may result
in memory locations being accessed without proper
validation.</p>
<p>It may be possible for a local attacker to read portions
of kernel memory, resulting in disclosure of sensitive
information. A local attacker can cause a system
panic.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0370</cvename>
<freebsdsa>SA-04:06.ipv6</freebsdsa>
</references>
<dates>
<discovery>2004-03-29</discovery>
<entry>2004-03-29</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="68233cba-7774-11d8-89ed-0020ed76ef5a">
<topic>OpenSSL ChangeCipherSpec denial-of-service vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<name>openssl-beta</name>
<range><lt>0.9.7d</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>4.0</ge><lt>4.8_17</lt></range>
<range><ge>4.9</ge><lt>4.9_4</lt></range>
<range><ge>5.0</ge><lt>5.1_16</lt></range>
<range><ge>5.2</ge><lt>5.2.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker could cause an application using OpenSSL to
crash by performing a specially crafted SSL/TLS handshake.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0079</cvename>
<url>http://www.openssl.org/news/secadv_20040317.txt</url>
<freebsdsa>SA-04:05.openssl</freebsdsa>
<certvu>288574</certvu>
<bid>9899</bid>
</references>
<dates>
<discovery>2004-03-17</discovery>
<entry>2004-03-17</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="bfb36941-84fa-11d8-a41f-0020ed76ef5a">
<topic>Incorrect cross-realm trust handling in Heimdal</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>0.6.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.0</ge><lt>5.2_6</lt></range>
<range><ge>4.9</ge><lt>4.9_6</lt></range>
<range><ge>4.0</ge><lt>4.8_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Heimdal does not correctly validate the `transited' field of
Kerberos tickets when computing the authentication path. This
could allow a rogue KDC with which cross-realm relationships
have been established to impersonate any KDC in the
authentication path.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0371</cvename>
<freebsdsa>SA-04:08.heimdal</freebsdsa>
<url>http://www.pdc.kth.se/heimdal/advisory/2004-04-01/</url>
</references>
<dates>
<discovery>2004-04-01</discovery>
<entry>2004-04-02</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="a2ffb627-9c53-11d8-9366-0020ed76ef5a">
<topic>lha buffer overflows and path traversal issues</topic>
<affects>
<package>
<name>lha</name>
<range><lt>1.14i_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered several vulnerabilities in
LHa for UNIX's path name handling code. Specially constructed
archive files may cause LHa to overwrite files or
execute arbitrary code with the privileges of the user
invoking LHa. This could be particularly harmful for
automated systems that might handle archives such as
virus scanning processes.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0234</cvename>
<cvename>CVE-2004-0235</cvename>
</references>
<dates>
<discovery>2004-04-29</discovery>
<entry>2004-05-02</entry>
<modified>2004-05-03</modified>
</dates>
</vuln>
<vuln vid="8338a20f-9573-11d8-9366-0020ed76ef5a">
<topic>xchat remotely exploitable buffer overflow (Socks5)</topic>
<affects>
<package>
<name>xchat2</name>
<range><ge>1.8</ge><lt>2.0.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A straightforward stack buffer overflow exists in XChat's
Socks5 proxy support.</p>
<p>The XChat developers report that `tsifra' discovered this
issue.</p>
<p>NOTE: XChat Socks5 support is disabled by support in the
FreeBSD Ports Collection.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0409</cvename>
<url>http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff</url>
<mlist msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&m=108114935507357</mlist>
</references>
<dates>
<discovery>2004-04-05</discovery>
<entry>2004-04-23</entry>
<modified>2004-05-03</modified>
</dates>
</vuln>
<vuln vid="73ea0706-9c57-11d8-9366-0020ed76ef5a">
<topic>rsync path traversal issue</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When running rsync in daemon mode, no checks were made
to prevent clients from writing outside of a module's
`path' setting.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0426</cvename>
<url>http://rsync.samba.org/#security_apr04</url>
</references>
<dates>
<discovery>2004-04-26</discovery>
<entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="e50b04e8-9c55-11d8-9366-0020ed76ef5a">
<topic>xine-lib arbitrary file overwrite</topic>
<affects>
<package>
<name>libxine</name>
<range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the xinehq advisory:</p>
<blockquote cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
<p>By opening a malicious MRL in any xine-lib based media
player, an attacker can write arbitrary content to an
arbitrary file, only restricted by the permissions of the
user running the application.</p>
</blockquote>
<p>The flaw is a result of a feature that allows MRLs (media
resource locator URIs) to specify arbitrary configuration
options.</p>
</body>
</description>
<references>
<bid>10193</bid>
<url>http://www.xinehq.de/index.php/security/XSA-2004-1</url>
</references>
<dates>
<discovery>2004-04-20</discovery>
<entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="fb521119-9bc4-11d8-9366-0020ed76ef5a">
<topic>pound remotely exploitable vulnerability</topic>
<affects>
<package>
<name>pound</name>
<range><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An unknown remotely exploitable vulnerability was disclosed.
Robert Segall writes:</p>
<blockquote cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
<p>a security vulnerability was brought to my attention
(many thanks to Akira Higuchi). Everyone running any
previous version should upgrade to 1.6 immediately - the
vulnerability may allow a remote exploit. No exploits are
currently known and none have been observed in the wild
till now. The danger is minimised if you run Pound in a
root jail and/or you run Pound as non-root user.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000</mlist>
</references>
<dates>
<discovery>2003-12-01</discovery>
<entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="cfe17ca6-6858-4805-ba1d-a60a61ec9b4d">
<topic>phpBB IP address spoofing</topic>
<affects>
<package>
<name>phpbb</name>
<range><le>2.0.8_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The common.php script always trusts the `X-Forwarded-For'
header in the client's HTTP request. A remote user could
forge this header in order to bypass any IP address access
control lists (ACLs).</p>
</body>
</description>
<references>
<mlist msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108239864203144</mlist>
</references>
<dates>
<discovery>2004-04-18</discovery>
<entry>2004-04-23</entry>
</dates>
</vuln>
<vuln vid="c7705712-92e6-11d8-8b29-0020ed76ef5a">
<cancelled superseded="729c4a9f-6007-11e6-a6c3-14dae9d210b8"/>
</vuln>
<vuln vid="99230277-8fb4-11d8-8b29-0020ed76ef5a">
<topic>ident2 double byte buffer overflow</topic>
<affects>
<package>
<name>ident2</name>
<range><le>1.04</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jack of RaptureSecurity reported a double byte buffer
overflow in ident2. The bug may allow a remote attacker to
execute arbitrary code within the context of the ident2
daemon. The daemon typically runs as user-ID `nobody', but
with group-ID `wheel'.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0408</cvename>
</references>
<dates>
<discovery>2004-04-15</discovery>
<entry>2004-04-23</entry>
</dates>
</vuln>
<vuln vid="da6f265b-8f3d-11d8-8b29-0020ed76ef5a">
<topic>kdepim exploitable buffer overflow in VCF reader</topic>
<affects>
<package>
<name>kdepim</name>
<range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow is present in some versions of the KDE
personal information manager (kdepim) which may be triggered
when processing a specially crafted VCF file.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0988</cvename>
<url>http://www.kde.org/info/security/advisory-20040114-1.txt</url>
</references>
<dates>
<discovery>2004-01-14</discovery>
<entry>2004-04-15</entry>
</dates>
</vuln>
<vuln vid="ccd698df-8e20-11d8-90d1-0020ed76ef5a">
<topic>racoon remote denial of service vulnerability (ISAKMP header length field)</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20040408a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When racoon receives an ISAKMP header, it will attempt to
allocate sufficient memory for the entire ISAKMP message
according to the header's length field. If an attacker
crafts an ISAKMP header with a ridiculously large value
in the length field, racoon may exceed operating system
resource limits and be terminated, resulting in a denial of
service.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0403</cvename>
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181</url>
</references>
<dates>
<discovery>2004-03-31</discovery>
<entry>2004-04-14</entry>
</dates>
</vuln>
<vuln vid="40fcf20f-8891-11d8-90d1-0020ed76ef5a">
<topic>racoon remote denial of service vulnerability (IKE Generic Payload Header)</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20040407b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When racoon receives an IKE message with an incorrectly
constructed Generic Payload Header, it may behave erratically,
going into a tight loop and dropping connections.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0392</cvename>
<url>http://orange.kame.net/dev/query-pr.cgi?pr=555</url>
</references>
<dates>
<discovery>2003-12-03</discovery>
<entry>2004-04-07</entry>
<modified>2004-04-14</modified>
</dates>
</vuln>
<vuln vid="f8551668-de09-4d7b-9720-f1360929df07">
<topic>tcpdump ISAKMP payload handling remote denial-of-service</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>3.8.3</lt></range>
</package>
<package>
<name>racoon</name>
<range><lt>20040408a</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chad Loder has discovered vulnerabilities in tcpdump's
ISAKMP protocol handler. During an audit to repair these
issues, Bill Fenner discovered some related problems.</p>
<p>These vulnerabilities may be used by an attacker to crash a
running `tcpdump' process. They can only be triggered if
the `-v' command line option is being used.</p>
<p>NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP
protocol handler from tcpdump, and so is also affected by
this issue.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108067265931525</mlist>
<url>http://www.rapid7.com/advisories/R7-0017.html</url>
<cvename>CVE-2004-0183</cvename>
<cvename>CVE-2004-0184</cvename>
</references>
<dates>
<discovery>2004-03-12</discovery>
<entry>2004-03-31</entry>
<modified>2016-08-11</modified>
</dates>
</vuln>
<vuln vid="322d4ff6-85c3-11d8-a41f-0020ed76ef5a">
<topic>Midnight Commander buffer overflow during symlink resolution</topic>
<affects>
<package>
<name>mc</name>
<range><lt>4.6.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Midnight Commander uses a fixed sized stack buffer while
resolving symbolic links within file archives (tar or cpio).
If an attacker can cause a user to process a specially
crafted file archive with Midnight Commander,
the attacker may be able to obtain the privileges of the
target user.</p>
</body>
</description>
<references>
<cvename>CVE-2003-1023</cvename>
<mlist msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&m=106399528518704</mlist>
<bid>8658</bid>
</references>
<dates>
<discovery>2003-09-19</discovery>
<entry>2004-04-03</entry>
<modified>2004-04-13</modified>
</dates>
</vuln>
<vuln vid="d8769838-8814-11d8-90d1-0020ed76ef5a">
<topic>racoon fails to verify signature during Phase 1</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20040407b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ralf Spenneberg discovered a serious flaw in racoon.
When using Phase 1 main or aggressive mode, racoon does
not verify the client's RSA signature. Any installations
using <em>X.509 authentication</em> are <strong>strongly
urged</strong> to upgrade.</p>
<p>Installations using <em>pre-shared keys</em> are believed
to be unaffected.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0155</cvename>
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup</url>
</references>
<dates>
<discovery>2004-04-05</discovery>
<entry>2004-04-07</entry>
</dates>
</vuln>
<vuln vid="6fd02439-5d70-11d8-80e3-0020ed76ef5a">
<topic>Several remotely exploitable buffer overflows in gaim</topic>
<affects>
<package>
<name>gaim</name>
<name>ja-gaim</name>
<name>ko-gaim</name>
<name>ru-gaim</name>
<range><lt>0.75_3</lt></range>
<range><eq>0.75_5</eq></range>
<range><eq>0.76</eq></range>
</package>
<package>
<name>gaim</name>
<range><ge>20030000</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters found almost a dozen remotely
exploitable vulnerabilities in Gaim. From the e-matters
advisory:</p>
<blockquote cite="http://security.e-matters.de/advisories/012004.txt">
<p>While developing a custom add-on, an integer overflow
in the handling of AIM DirectIM packets was revealed that
could lead to a remote compromise of the IM client. After
disclosing this bug to the vendor, they had to make a
hurried release because of a change in the Yahoo connection
procedure that rendered GAIM useless. Unfourtunately at the
same time a closer look onto the sourcecode revealed 11 more
vulnerabilities.</p>
<p>The 12 identified problems range from simple standard
stack overflows, over heap overflows to an integer overflow
that can be abused to cause a heap overflow. Due to the
nature of instant messaging many of these bugs require
man-in-the-middle attacks between client and server. But the
underlying protocols are easy to implement and MIM attacks
on ordinary TCP sessions is a fairly simple task.</p>
<p>In combination with the latest kernel vulnerabilities or
the habit of users to work as root/administrator these bugs
can result in remote root compromises.</p>
</blockquote>
</body>
</description>
<references>
<url>http://security.e-matters.de/advisories/012004.txt</url>
<cvename>CVE-2004-0005</cvename>
<cvename>CVE-2004-0006</cvename>
<cvename>CVE-2004-0007</cvename>
<cvename>CVE-2004-0008</cvename>
</references>
<dates>
<discovery>2004-01-26</discovery>
<entry>2004-02-12</entry>
<modified>2004-10-25</modified>
</dates>
</vuln>
<vuln vid="290d81b9-80f1-11d8-9645-0020ed76ef5a">
<topic>oftpd denial-of-service vulnerability (PORT command)</topic>
<affects>
<package>
<name>oftpd</name>
<range><lt>0.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philippe Oechslin reported a denial-of-service vulnerability
in oftpd. The oftpd server can be crashed by sending a PORT
command containing an integer over 8 bits long (over 255).</p>
</body>
</description>
<references>
<url>http://www.time-travellers.org/oftpd/oftpd-dos.html</url>
<bid>9980</bid>
<cvename>CVE-2004-0376</cvename>
</references>
<dates>
<discovery>2004-03-04</discovery>
<entry>2004-03-28</entry>
<modified>2004-04-05</modified>
</dates>
</vuln>
<vuln vid="705e003a-7f36-11d8-9645-0020ed76ef5a">
<topic>squid ACL bypass due to URL decoding bug</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Squid advisory:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
<p>Squid versions 2.5.STABLE4 and earlier contain a bug
in the "%xx" URL decoding function. It may insert a NUL
character into decoded URLs, which may allow users to bypass
url_regex ACLs.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2004_1.txt</url>
<cvename>CVE-2004-0189</cvename>
</references>
<dates>
<discovery>2004-02-29</discovery>
<entry>2004-03-26</entry>
<modified>2015-05-01</modified>
</dates>
</vuln>
<vuln vid="cad045c0-81a5-11d8-9645-0020ed76ef5a">
<topic>zebra/quagga denial of service vulnerability</topic>
<affects>
<package>
<name>zebra</name>
<range><lt>0.93b_7</lt></range>
</package>
<package>
<name>quagga</name>
<range><lt>0.96.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker could cause zebra/quagga to crash by
sending a malformed telnet command to their management
port.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0858</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2003-305.html</url>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140</url>
<mlist>http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html</mlist>
</references>
<dates>
<discovery>2003-11-20</discovery>
<entry>2004-03-29</entry>
</dates>
</vuln>
<vuln vid="c551ae17-7f00-11d8-868e-000347dd607f">
<topic>multiple vulnerabilities in phpBB</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Users with admin rights can severly damage an phpBB installation,
potentially triggered by viewing a page with a malicious link sent
by an attacker.</p>
</body>
</description>
<references>
<url>http://www.gulftech.org/03202004.php</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=183982</url>
<bid>9942</bid>
</references>
<dates>
<discovery>2004-03-20</discovery>
<entry>2004-03-26</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="c480eb5e-7f00-11d8-868e-000347dd607f">
<topic>ezbounce remote format string vulnerability</topic>
<affects>
<package>
<name>ezbounce</name>
<range><lt>1.04.a_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A security hole exists that can be used to crash the proxy and
execute arbitrary code. An exploit is circulating that takes
advantage of this, and in some cases succeeds in obtaining a login
shell on the machine.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0510</cvename>
<url>http://ezbounce.dc-team.com/</url>
<bid>8071</bid>
</references>
<dates>
<discovery>2003-07-01</discovery>
<entry>2004-03-26</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="739bb51d-7e82-11d8-9645-0020ed76ef5a">
<topic>racoon security association deletion vulnerability</topic>
<affects>
<package>
<name>racoon</name>
<range><lt>20040116a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker may use specially crafted IKE/ISAKMP
messages to cause racoon to delete security associations.
This could result in denial-of-service or possibly cause
sensitive traffic to be transmitted in plaintext, depending
upon configuration.</p>
</body>
</description>
<references>
<mlist msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
<bid>9416</bid>
<bid>9417</bid>
<cvename>CVE-2004-0164</cvename>
</references>
<dates>
<discovery>2004-01-13</discovery>
<entry>2004-03-25</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="3b7c7f6c-7102-11d8-873f-0020ed76ef5a">
<topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed</topic>
<affects>
<package>
<name>wu-ftpd</name>
<range><le>2.6.2_3</le></range>
</package>
<package>
<name>wu-ftpd+ipv6</name>
<range><le>2.6.2_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Glenn Stewart reports a bug in wu-ftpd's ftpaccess
`restricted-uid'/`restricted-gid' directives:</p>
<blockquote>
<p>Users can get around the restriction to their home
directory by issuing a simple chmod command on their home
directory. On the next ftp log in, the user will have '/'
as their root directory.</p>
</blockquote>
<p>Matt Zimmerman discovered that the cause of the bug was a
missing check for a restricted user within a code path that
is executed only when a certain error is encountered.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0148</cvename>
<bid>9832</bid>
</references>
<dates>
<discovery>2004-02-17</discovery>
<entry>2004-03-08</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="8471bb85-6fb0-11d8-873f-0020ed76ef5a">
<topic>GNU Anubis buffer overflows and format string vulnerabilities</topic>
<affects>
<package>
<name>anubis</name>
<range><le>3.6.2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered several vulnerabilities in GNU
Anubis.</p>
<ul>
<li>Unsafe uses of `sscanf'. The `%s' format specifier is
used, which allows a classical buffer overflow. (auth.c)</li>
<li>Format string bugs invoking `syslog'. (log.c, errs.c,
ssl.c)</li>
</ul>
<p>Ulf notes that these vulnerabilities can be exploited by a
malicious IDENT server as a denial-of-service attack.</p>
</body>
</description>
<references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html</mlist>
<bid>9772</bid>
<cvename>CVE-2004-0353</cvename>
<cvename>CVE-2004-0354</cvename>
</references>
<dates>
<discovery>2004-03-04</discovery>
<entry>2004-03-06</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="3837f462-5d6b-11d8-80e3-0020ed76ef5a">
<topic>Buffer overflows in XFree86 servers</topic>
<affects>
<package>
<name>XFree86-Server</name>
<range><le>4.3.0_13</le></range>
<range><ge>4.3.99</ge><le>4.3.99.15_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A number of buffer overflows were recently discovered in
XFree86, prompted by initial discoveries by iDEFENSE. These
buffer overflows are present in the font alias handling. An
attacker with authenticated access to a running X server may
exploit these vulnerabilities to obtain root privileges on
the machine running the X server.</p>
</body>
</description>
<references>
<url>http://www.idefense.com/application/poi/display?id=72</url>
<url>http://www.idefense.com/application/poi/display?id=73</url>
<cvename>CVE-2004-0083</cvename>
<cvename>CVE-2004-0084</cvename>
<cvename>CVE-2004-0106</cvename>
<bid>9636</bid>
<bid>9652</bid>
<bid>9655</bid>
</references>
<dates>
<discovery>2004-02-10</discovery>
<entry>2004-02-12</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="e25566d5-6d3f-11d8-83a4-000a95bc6fae">
<topic>multiple buffer overflows in xboing</topic>
<affects>
<package>
<name>xboing</name>
<range><lt>2.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Kemp reports (in a Debian bug submission):</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
<p>Due to improper bounds checking it is possible for a
malicious user to gain a shell with membership group
'games'. (The binary is installed setgid games).</p>
<p>Environmental variables are used without being bounds-checked
in any way, from the source code:</p>
<pre>
highscore.c:
/* Use the environment variable if it exists */
if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
strcpy(filename, str);
else
strcpy(filename, HIGH_SCORE_FILE);
misc.c:
if ((ptr = getenv("HOME")) != NULL)
(void) strcpy(dest, ptr);
</pre>
<p>Neither of these checks are boundschecked, and will allow
arbitary shell code to be run.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-0149</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924</url>
<bid>9764</bid>
</references>
<dates>
<discovery>2003-01-01</discovery>
<entry>2004-03-05</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="a20082c3-6255-11d8-80e3-0020ed76ef5a">
<topic>metamail format string bugs and buffer overflows</topic>
<affects>
<package>
<name>metamail</name>
<range><lt>2.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reported four bugs in metamail: two are format
string bugs and two are buffer overflows. The bugs are in
SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().</p>
<p>These vulnerabilities could be triggered by a maliciously
formatted email message if `metamail' or `splitmail' is used
to process it, possibly resulting in arbitrary code execution
with the privileges of the user reading mail.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0104</cvename>
<cvename>CVE-2004-0105</cvename>
<bid>9692</bid>
</references>
<dates>
<discovery>2004-02-18</discovery>
<entry>2004-02-18</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="ce46b93a-80f2-11d8-9645-0020ed76ef5a">
<topic>Buffer overflows and format string bugs in Emil</topic>
<affects>
<package>
<name>emil</name>
<range><le>2.1b9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reports multiple buffer overflows in
Emil, some of which are triggered during the parsing
of attachment filenames. In addition, some format string bugs
are present in the error reporting code.</p>
<p>Depending upon local configuration, these vulnerabilities
may be exploited using specially crafted messages in order
to execute arbitrary code running with the privileges of
the user invoking Emil.</p>
</body>
</description>
<references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html</mlist>
<url>http://www.debian.org/security/2004/dsa-468</url>
<cvename>CVE-2004-0152</cvename>
<cvename>CVE-2004-0153</cvename>
</references>
<dates>
<discovery>2004-03-24</discovery>
<entry>2004-03-28</entry>
</dates>
</vuln>
<vuln vid="70f5b3c6-80f0-11d8-9645-0020ed76ef5a">
<topic>Critical SQL injection in phpBB</topic>
<affects>
<package>
<name>phpbb</name>
<range><le>2.0.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Anyone can get admin's username and password's md5 hash via a
single web request.
A working example is provided in the advisory.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108032454818873</mlist>
<bid>9984</bid>
</references>
<dates>
<discovery>2004-03-26</discovery>
<entry>2004-03-28</entry>
</dates>
</vuln>
<vuln vid="6c7661ff-7912-11d8-9645-0020ed76ef5a">
<topic>uudeview buffer overflows</topic>
<affects>
<package>
<name>uulib</name>
<name>uudeview</name>
<name>xdeview</name>
<range><lt>0.5.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The authors of UUDeview report repairing two buffer
overflows in their software.</p>
</body>
</description>
<references>
<url>http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt</url>
</references>
<dates>
<discovery>2004-03-01</discovery>
<entry>2004-03-18</entry>
<modified>2004-03-25</modified>
</dates>
</vuln>
<vuln vid="09d418db-70fd-11d8-873f-0020ed76ef5a">
<topic>Apache 1.3 IP address access control failure on some 64-bit platforms</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.29_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.29+2.8.16_1</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><lt>1.3.29.1.53_1</lt></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.29+30.19_1</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.29+30.19+2.8.16_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Henning Brauer discovered a programming error in Apache
1.3's mod_access that results in the netmasks in IP address
access control rules being interpreted incorrectly on
64-bit, big-endian platforms. In some cases, this could
cause a `deny from' IP address access control rule including
a netmask to fail.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0993</cvename>
<url>http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47</url>
<url>http://www.apacheweek.com/features/security-13</url>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850</url>
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722</mlist>
<bid>9829</bid>
</references>
<dates>
<discovery>2004-03-07</discovery>
<entry>2004-03-08</entry>
<modified>2004-03-12</modified>
</dates>
</vuln>
<vuln vid="1a448eb7-6988-11d8-873f-0020ed76ef5a">
<topic>mod_python denial-of-service vulnerability in parse_qs</topic>
<affects>
<package>
<name>mod_python</name>
<range><ge>2.7</ge><lt>2.7.10</lt></range>
<range><ge>3.0</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker may cause Apache with mod_python to crash
by using a specially constructed query string.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0973</cvename>
<bid>9129</bid>
<url>http://www.modpython.org/pipermail/mod_python/2003-November/014532.html</url>
<url>http://www.modpython.org/pipermail/mod_python/2004-January/014879.html</url>
</references>
<dates>
<discovery>2003-11-28</discovery>
<entry>2004-03-03</entry>
<modified>2004-03-11</modified>
</dates>
</vuln>
<vuln vid="9fccad5a-7096-11d8-873f-0020ed76ef5a">
<topic>mpg123 vulnerabilities</topic>
<affects>
<package>
<name>mpg123</name>
<name>mpg123-nas</name>
<name>mpg123-esound</name>
<range><le>0.59r_12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In 2003, two vulnerabilities were discovered in mpg123
that could result in remote code execution when using
untrusted input or streaming from an untrusted server.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0577</cvename>
<cvename>CVE-2003-0865</cvename>
<bid>6629</bid>
<bid>8680</bid>
</references>
<dates>
<discovery>2003-01-16</discovery>
<entry>2004-03-07</entry>
</dates>
</vuln>
<vuln vid="ac4b9d18-67a9-11d8-80e3-0020ed76ef5a">
<topic>fetchmail -- denial-of-service vulnerability</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dave Jones discovered a denial-of-service vulnerability
in fetchmail. An email message containing a very long line
could cause fetchmail to segfault due to missing NUL
termination in transact.c.</p>
<p>Eric Raymond decided not to mention this issue in the
release notes for fetchmail 6.2.5, but it was fixed
there.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0792</cvename>
<bid>8843</bid>
<url>http://xforce.iss.net/xforce/xfdb/13450</url>
<url>http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1</url>
</references>
<dates>
<discovery>2003-10-16</discovery>
<entry>2004-02-25</entry>
<modified>2012-09-04</modified>
</dates>
</vuln>
<vuln vid="b0e76877-67a8-11d8-80e3-0020ed76ef5a">
<topic>mailman denial-of-service vulnerability in MailCommandHandler</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malformed message could cause mailman to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0991</cvename>
<url>http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt</url>
</references>
<dates>
<discovery>2003-11-18</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="3cb88bb2-67a6-11d8-80e3-0020ed76ef5a">
<topic>mailman XSS in admin script</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dirk Mueller reports:</p>
<blockquote><p>I've found a cross-site scripting
vulnerability in the admin interface of mailman 2.1.3 that
allows, under certain circumstances, for anyone to retrieve
the (valid) session cookie.</p></blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0965</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html</url>
<url>http://xforce.iss.net/xforce/xfdb/14121</url>
</references>
<dates>
<discovery>2003-12-31</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="429249d2-67a7-11d8-80e3-0020ed76ef5a">
<topic>mailman XSS in create script</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the 2.1.3 release notes:</p>
<blockquote><p>Closed a cross-site scripting exploit in the
create cgi script.</p></blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0992</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html</url>
</references>
<dates>
<discovery>2003-09-28</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="00263aa3-67a8-11d8-80e3-0020ed76ef5a">
<topic>mailman XSS in user options page</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the 2.1.1 release notes:</p>
<blockquote><p>Closed a cross-site scripting vulnerability in
the user options page.</p></blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0038</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html</url>
</references>
<dates>
<discovery>2003-02-08</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="75770425-67a2-11d8-80e3-0020ed76ef5a">
<topic>SQL injection vulnerability in phpnuke</topic>
<affects>
<package>
<name>phpnuke</name>
<range><le>6.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple researchers have discovered multiple SQL injection
vulnerabilities in some versions of Php-Nuke. These
vulnerabilities may lead to information disclosure, compromise
of the Php-Nuke site, or compromise of the back-end
database.</p>
</body>
</description>
<references>
<url>http://security.nnov.ru/search/document.asp?docid=5748</url>
<mlist>http://www.securityfocus.com/archive/1/348375</mlist>
<url>http://www.security-corporation.com/advisories-027.html</url>
<mlist>http://www.securityfocus.com/archive/1/353201</mlist>
</references>
<dates>
<discovery>2003-12-12</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="ad4f6ca4-6720-11d8-9fb5-000a95bc6fae">
<topic>lbreakout2 vulnerability in environment variable handling</topic>
<affects>
<package>
<name>lbreakout2</name>
<range><le>2.2.2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered an exploitable vulnerability in
lbreakout2's environmental variable handling. In several
instances, the contents of the HOME environmental variable
are copied to a stack or global buffer without range
checking. A local attacker may use this vulnerability to
acquire group-ID `games' privileges.</p>
<p>An exploit for this vulnerability has been published by
``Li0n7 voila fr''.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0158</cvename>
<url>http://www.debian.org/security/2004/dsa-445</url>
<mlist>http://www.securityfocus.com/archive/1/354760</mlist>
</references>
<dates>
<discovery>2004-02-21</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="316e1c9b-671c-11d8-9aad-000a95bc6fae">
<topic>hsftp format string vulnerabilities</topic>
<affects>
<package>
<name>hsftp</name>
<range><lt>1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered a format string bug in hsftp's file
listing code may allow a malicious server to cause arbitrary
code execution by the client.</p>
</body>
</description>
<references>
<mlist>http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html</mlist>
</references>
<dates>
<discovery>2004-02-22</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="c7cad0f0-671a-11d8-bdeb-000a95bc6fae">
<topic>Darwin Streaming Server denial-of-service vulnerability</topic>
<affects>
<package>
<name>DarwinStreamingServer</name>
<range><le>4.1.3g</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker can cause an assertion to trigger by sending
a long User-Agent field in a request.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0169</cvename>
<url>http://www.idefense.com/application/poi/display?id=75</url>
</references>
<dates>
<discovery>2004-02-23</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="847ade05-6717-11d8-b321-000a95bc6fae">
<topic>libxml2 stack buffer overflow in URI parsing</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yuuichi Teranishi reported a crash in libxml2's URI handling
when a long URL is supplied. The implementation in nanohttp.c
and nanoftp.c uses a 4K stack buffer, and longer URLs will
overwrite the stack. This could result in denial-of-service
or arbitrary code execution in applications using libxml2
to parse documents.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0110</cvename>
<url>http://www.xmlsoft.org/news.html</url>
<url>http://mail.gnome.org/archives/xml/2004-February/msg00070.html</url>
</references>
<dates>
<discovery>2004-02-08</discovery>
<entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="cc0fb686-6550-11d8-80e3-0020ed76ef5a">
<topic>file disclosure in phpMyAdmin</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><le>2.5.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lack of proper input validation in phpMyAdmin may allow an
attacker to obtain the contents of any file on the target
system that is readable by the web server.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0129</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=107582619125932&w=2</mlist>
<url>http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1</url>
</references>
<dates>
<discovery>2004-02-17</discovery>
<entry>2004-02-22</entry>
</dates>
</vuln>
<vuln vid="87cc48fd-5fdd-11d8-80e3-0020ed76ef5a">
<topic>mnGoSearch buffer overflow in UdmDocToTextBuf()</topic>
<affects>
<package>
<name>mnogosearch</name>
<range><ge>3.2.*</ge><lt>3.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jedi/Sector One <j@pureftpd.org> reported the following
on the full-disclosure list:</p>
<blockquote>
<p>Every document is stored in multiple parts according to
its sections (description, body, etc) in databases. And
when the content has to be sent to the client,
UdmDocToTextBuf() concatenates those parts together and
skips metadata.</p>
<p>Unfortunately, that function lacks bounds checking and
a buffer overflow can be triggered by indexing a large
enough document.</p>
<p>'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c
. S->val length depends on the length of the original
document and on the indexer settings (the sample
configuration file has low limits that work around the
bug, though).</p>
<p>Exploitation should be easy, moreover textbuf points to
the stack.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html</mlist>
</references>
<dates>
<discovery>2004-02-15</discovery>
<entry>2004-02-15</entry>
</dates>
</vuln>
<vuln vid="cacaffbc-5e64-11d8-80e3-0020ed76ef5a">
<topic>GNU libtool insecure temporary file handling</topic>
<affects>
<package>
<name>libtool</name>
<range><ge>1.3</ge><lt>1.3.5_2</lt></range>
<range><ge>1.4</ge><lt>1.4.3_3</lt></range>
<range><ge>1.5</ge><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtool attempts to create a temporary directory in
which to write scratch files needed during processing. A
malicious user may create a symlink and then manipulate
the directory so as to write to files to which she normally
has no permissions.</p>
<p>This has been reported as a ``symlink vulnerability'',
although I do not think that is an accurate description.</p>
<p>This vulnerability could possibly be used on a multi-user
system to gain elevated privileges, e.g. root builds some
packages, and another user successfully exploits this
vulnerability to write to a system file.</p>
</body>
</description>
<references>
<mlist>http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405</mlist>
<mlist>http://www.securityfocus.com/archive/1/352333</mlist>
</references>
<dates>
<discovery>2004-01-30</discovery>
<entry>2004-02-13</entry>
</dates>
</vuln>
<vuln vid="0e154a9c-5d7a-11d8-80e3-0020ed76ef5a">
<topic>seti@home remotely exploitable buffer overflow</topic>
<affects>
<package>
<name>setiathome</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The seti@home client contains a buffer overflow in the HTTP
response handler. A malicious, spoofed seti@home server can
exploit this buffer overflow to cause remote code execution
on the client. Exploit programs are widely available.</p>
</body>
</description>
<references>
<url>http://setiathome.berkeley.edu/version308.html</url>
<url>http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/</url>
</references>
<dates>
<discovery>2003-04-08</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a">
<topic>icecast 1.x multiple vulnerabilities</topic>
<affects>
<package>
<name>icecast</name>
<range><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>icecast 1.3.11 and earlier contained numerous security
vulnerabilities, the most severe allowing a remote attacker
to execute arbitrary code as root.</p>
</body>
</description>
<references>
<cvename>CVE-2002-0177</cvename>
<cvename>CVE-2001-1230</cvename>
<cvename>CVE-2001-1229</cvename>
<cvename>CVE-2001-1083</cvename>
<cvename>CVE-2001-0784</cvename>
<bid>4415</bid>
<bid>2933</bid>
</references>
<dates>
<discovery>2002-04-28</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="83119e27-5d7c-11d8-80e3-0020ed76ef5a">
<topic>nap allows arbitrary file access</topic>
<affects>
<package>
<name>nap</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to the author:</p>
<blockquote>
<p>Fixed security loophole which allowed remote
clients to access arbitrary files on our
system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS</url>
</references>
<dates>
<discovery>2001-04-12</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="a736deab-5d7d-11d8-80e3-0020ed76ef5a">
<topic>CCE contains exploitable buffer overflows</topic>
<affects>
<package>
<name>zh-cce</name>
<range><lt>0.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Chinese Console Environment contains exploitable buffer
overflows.</p>
</body>
</description>
<references>
<url>http://programmer.lib.sjtu.edu.cn/cce/cce.html</url>
</references>
<dates>
<discovery>2000-06-22</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="49ad1bf8-5d7e-11d8-80e3-0020ed76ef5a">
<topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic>
<affects>
<package>
<name>zh-chitex</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Niels Heinen reports that ChiTeX installs set-user-id root
executables that invoked system(3) without setting up the
environment, trivially allowing local root compromise.</p>
</body>
</description>
<references>
<url>https://docs.freebsd.org/cgi/mid.cgi?200303251301.h2PD1m9Y053389</url>
</references>
<dates>
<discovery>2003-04-25</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5789a92e-5d7f-11d8-80e3-0020ed76ef5a">
<topic>pine remotely exploitable buffer overflow in newmail.c</topic>
<affects>
<package>
<name>zh-pine</name>
<name>iw-pine</name>
<name>pine</name>
<name>pine4-ssl</name>
<range><le>4.21</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kris Kennaway reports a remotely exploitable buffer overflow
in newmail.c. Mike Silbersack submitted the fix.</p>
</body>
</description>
<references>
<url>https://docs.freebsd.org/cgi/mid.cgi?200009290728.AAA69097</url>
</references>
<dates>
<discovery>2000-09-29</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="34134fd4-5d81-11d8-80e3-0020ed76ef5a">
<topic>pine insecure URL handling</topic>
<affects>
<package>
<name>pine</name>
<name>zh-pine</name>
<name>iw-pine</name>
<range><lt>4.44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker may send an email message containing a specially
constructed URL that will execute arbitrary commands when
viewed.</p>
</body>
</description>
<references>
<freebsdsa>SA-02:05.pine</freebsdsa>
</references>
<dates>
<discovery>2002-01-04</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5abfee2d-5d82-11d8-80e3-0020ed76ef5a">
<topic>pine remote denial-of-service attack</topic>
<affects>
<package>
<name>pine</name>
<name>zh-pine</name>
<name>iw-pine</name>
<range><lt>4.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker may send a specially-formatted email message
that will cause pine to crash.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2</mlist>
<cvename>CVE-2002-1320</cvename>
</references>
<dates>
<discovery>2002-10-23</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="39bd57e6-5d83-11d8-80e3-0020ed76ef5a">
<topic>pine remotely exploitable vulnerabilities</topic>
<affects>
<package>
<name>pine</name>
<name>zh-pine</name>
<name>iw-pine</name>
<range><lt>4.58</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pine versions prior to 4.58 are affected by two
vulnerabilities discovered by iDEFENSE, a buffer overflow
in mailview.c and an integer overflow in strings.c. Both
vulnerabilities can result in arbitrary code execution
when processing a malicious message.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0720</cvename>
<cvename>CVE-2003-0721</cvename>
<url>http://www.idefense.com/application/poi/display?id=5</url>
</references>
<dates>
<discovery>2003-09-10</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5729b8ed-5d75-11d8-80e3-0020ed76ef5a">
<topic>rsync buffer overflow in server mode</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>2.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When rsync is run in server mode, a buffer overflow could
allow a remote attacker to execute arbitrary code with the
privileges of the rsync server. Anonymous rsync servers are
at the highest risk.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0962</cvename>
<mlist>http://lists.samba.org/archive/rsync-announce/2003/000011.html</mlist>
<url>http://rsync.samba.org/#security</url>
</references>
<dates>
<discovery>2003-12-04</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="3388eff9-5d6e-11d8-80e3-0020ed76ef5a">
<topic>Samba 3.0.x password initialization bug</topic>
<affects>
<package>
<name>samba</name>
<range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Samba 3.0.2 release notes:</p>
<blockquote cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
<p>Security Announcement: It has been confirmed that
previous versions of Samba 3.0 are susceptible to a password
initialization bug that could grant an attacker unauthorized
access to a user account created by the mksmbpasswd.sh shell
script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.samba.org/samba/whatsnew/samba-3.0.2.html</url>
<cvename>CVE-2004-0082</cvename>
</references>
<dates>
<discovery>2004-02-09</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="67c05283-5d62-11d8-80e3-0020ed76ef5a">
<topic>Buffer overflow in Mutt 1.4</topic>
<affects>
<package>
<name>mutt</name>
<name>ja-mutt</name>
<range><ge>1.4</ge><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mutt 1.4 contains a buffer overflow that could be exploited
with a specially formed message, causing Mutt to crash or
possibly execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0078</cvename>
<url>http://www.mutt.org/news.html</url>
</references>
<dates>
<discovery>2004-02-11</discovery>
<entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="7557a2b1-5d63-11d8-80e3-0020ed76ef5a">
<topic>Apache-SSL optional client certificate vulnerability</topic>
<affects>
<package>
<name>apache+ssl</name>
<range><lt>1.3.29.1.53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Apache-SSL security advisory:</p>
<blockquote>
<p>If configured with SSLVerifyClient set to 1 or 3 (client
certificates optional) and SSLFakeBasicAuth, Apache-SSL
1.3.28+1.52 and all earlier versions would permit a
client to use real basic authentication to forge a client
certificate.</p>
<p>All the attacker needed is the "one-line DN" of a valid
user, as used by faked basic auth in Apache-SSL, and the
fixed password ("password" by default).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache-ssl.org/advisory-20040206.txt</url>
</references>
<dates>
<discovery>2004-02-06</discovery>
<entry>2004-02-10</entry>
</dates>
</vuln>
<vuln vid="96ba2dae-4ab0-11d8-96f2-0020ed76ef5a">
<topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>3.8.1_351</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Heusser discovered vulnerabilities in tcpdump's
L2TP, ISAKMP, and RADIUS protocol handlers. These
vulnerabilities may be used by an attacker to crash a running
`tcpdump' process.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0989</cvename>
<cvename>CVE-2003-1029</cvename>
<cvename>CVE-2004-0057</cvename>
<mlist>http://www.tcpdump.org/lists/workers/2003/12/msg00083.html</mlist>
<mlist>http://marc.theaimsgroup.com/?l=tcpdump-workers&m=107325073018070&w=2</mlist>
</references>
<dates>
<discovery>2003-12-24</discovery>
<entry>2004-01-19</entry>
</dates>
</vuln>
<vuln vid="fd376b8b-41e1-11d8-b096-0020ed76ef5a">
<topic>Buffer overflow in INN control message handling</topic>
<affects>
<package>
<name>inn</name>
<range><ge>2.4.*</ge><lt>2.4.1</lt></range>
</package>
<package>
<name>inn-stable</name>
<range><lt>20031022_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A small, fixed-size stack buffer is used to construct a
filename based on a received control message. This could
result in a stack buffer overflow.</p>
</body>
</description>
<references>
<mlist msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&m=107351974008605</mlist>
</references>
<dates>
<discovery>2004-01-07</discovery>
<entry>2004-01-08</entry>
<modified>2004-10-21</modified>
</dates>
</vuln>
<vuln vid="cf0fb426-3f96-11d8-b096-0020ed76ef5a">
<topic>ProFTPD ASCII translation bug resulting in remote root compromise</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.2.8_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in the ProFTPD code that handles
translation of newline characters during ASCII-mode file
uploads. An attacker may exploit this buffer overflow by
uploading a specially crafted file, resulting in code
execution and ultimately a remote root compromise.</p>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/alerts/id/154</url>
<cvename>CVE-2003-0831</cvename>
</references>
<dates>
<discovery>2003-09-23</discovery>
<entry>2004-01-05</entry>
</dates>
</vuln>
<vuln vid="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd">
<topic>phpbb -- arbitrary command execution and other vulnerabilities</topic>
<affects>
<package>
<name>phpbb</name>
<range><lt>2.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ChangeLog for phpBB 2.0.11 states:</p>
<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
<p>Changes since 2.0.10</p>
<ul>
<li>Fixed vulnerability in highlighting code (<strong>very
high severity, please update your installation as soon
as possible</strong>)</li>
<li>Fixed unsetting global vars - <strong>Matt
Kavanagh</strong></li>
<li>Fixed XSS vulnerability in username handling
- <strong>AnthraX101</strong></li>
<li>Fixed not confirmed sql injection in username handling
- <strong>warmth</strong></li>
<li>Added check for empty topic id in topic_review
function</li>
<li>Added visual confirmation mod to code base</li>
</ul>
</blockquote>
<p>Additionally, a US-CERT Technical Cyber Security Alert reports:</p>
<blockquote cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
<p>phpBB contains an user input validation problem with
regard to the parsing of the URL. An intruder can deface a
phpBB website, execute arbitrary commands, or gain
administrative privileges on a compromised bulletin
board.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-1315</cvename>
<freebsdpr>ports/74106</freebsdpr>
<uscertta>TA04-356A</uscertta>
<certvu>497400</certvu>
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
<mlist msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110029415208724</mlist>
<mlist msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110079436714518</mlist>
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636</url>
</references>
<dates>
<discovery>2004-11-18</discovery>
<entry>2004-12-22</entry>
<modified>2005-01-24</modified>
</dates>
</vuln>
<vuln vid="81313647-2d03-11d8-9355-0020ed76ef5a">
<topic>ElGamal sign+encrypt keys created by GnuPG can be compromised</topic>
<affects>
<package>
<name>gnupg</name>
<range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Any ElGamal sign+encrypt keys created by GnuPG contain a
cryptographic weakness that may allow someone to obtain
the private key. <strong>These keys should be considered
unusable and should be revoked.</strong></p>
<p>The following summary was written by Werner Koch, GnuPG
author:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
<p>Phong Nguyen identified a severe bug in the way GnuPG
creates and uses ElGamal keys for signing. This is
a significant security failure which can lead to a
compromise of almost all ElGamal keys used for signing.
Note that this is a real world vulnerability which will
reveal your private key within a few seconds.</p>
<p>...</p>
<p>Please <em>take immediate action and revoke your ElGamal
signing keys</em>. Furthermore you should take whatever
measures necessary to limit the damage done for signed or
encrypted documents using that key.</p>
<p>Note that the standard keys as generated by GnuPG (DSA
and ElGamal encryption) as well as RSA keys are NOT
vulnerable. Note also that ElGamal signing keys cannot
be generated without the use of a special flag to enable
hidden options and even then overriding a warning message
about this key type. See below for details on how to
identify vulnerable keys.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0971</cvename>
<mlist>http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html</mlist>
</references>
<dates>
<discovery>2003-11-27</discovery>
<entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="f04cc5cb-2d0b-11d8-beaf-000a95c4d922">
<topic>bind8 negative cache poison attack</topic>
<affects>
<package>
<name>bind</name>
<range><ge>8.3</ge><lt>8.3.7</lt></range>
<range><ge>8.4</ge><lt>8.4.3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>5.1</ge><lt>5.1_11</lt></range>
<range><ge>5.0</ge><lt>5.0_19</lt></range>
<range><ge>4.9</ge><lt>4.9_1</lt></range>
<range><ge>4.8</ge><lt>4.8_14</lt></range>
<range><ge>4.7</ge><lt>4.7_24</lt></range>
<range><ge>4.6</ge><lt>4.6.2_27</lt></range>
<range><ge>4.5</ge><lt>4.5_37</lt></range>
<range><lt>4.4_47</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error in BIND 8 named can result in a DNS
message being incorrectly cached as a negative response. As
a result, an attacker may arrange for malicious DNS messages
to be delivered to a target name server, and cause that name
server to cache a negative response for some target domain
name. The name server would thereafter respond negatively
to legitimate queries for that domain name, resulting in a
denial-of-service for applications that require DNS.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0914</cvename>
<freebsdsa>SA-03:19.bind</freebsdsa>
<certvu>734644</certvu>
</references>
<dates>
<discovery>2003-11-28</discovery>
<entry>2003-12-12</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="96fdbf5b-2cfd-11d8-9355-0020ed76ef5a">
<topic>Mathopd buffer overflow</topic>
<affects>
<package>
<name>mathopd</name>
<range><lt>1.4p2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mathopd contains a buffer overflow in the prepare_reply()
function that may be remotely exploitable.</p>
</body>
</description>
<references>
<url>http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html</url>
</references>
<dates>
<discovery>2003-12-04</discovery>
<entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="d7af61c8-2cc0-11d8-9355-0020ed76ef5a">
<topic>lftp HTML parsing vulnerability</topic>
<affects>
<package>
<name>lftp</name>
<range><le>2.6.10</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in lftp which may be triggered when
requesting a directory listing from a malicious server over
HTTP.</p>
</body>
</description>
<references>
<cvename>CVE-2003-0963</cvename>
<url>http://lftp.yar.ru/news.html#2.6.10</url>
</references>
<dates>
<discovery>2003-12-11</discovery>
<entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="ebdf65c7-2ca6-11d8-9355-0020ed76ef5a">
<topic>qpopper format string vulnerability</topic>
<affects>
<package>
<name>qpopper</name>
<range><lt>2.53_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An authenticated user may trigger a format string
vulnerability present in qpopper's UIDL code, resulting
in arbitrary code execution with group ID `mail'
privileges.</p>
</body>
</description>
<references>
<bid>1241</bid>
<cvename>CVE-2000-0442</cvename>
<url>http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt</url>
</references>
<dates>
<discovery>2000-05-23</discovery>
<entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="af0296be-2455-11d8-82e5-0020ed76ef5a">
<topic>fetchmail -- address parsing vulnerability</topic>
<affects>
<package>
<name>fetchmail</name>
<range><le>6.2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fetchmail can be crashed by a malicious email message.</p>
</body>
</description>
<references>
<url>http://security.e-matters.de/advisories/052002.html</url>
</references>
<dates>
<discovery>2003-10-25</discovery>
<entry>2003-10-25</entry>
<modified>2012-09-04</modified>
</dates>
</vuln>
<vuln vid="2bcd2d24-24ca-11d8-82e5-0020ed76ef5a">
<topic>Buffer overflow in pam_smb password handling</topic>
<affects>
<package>
<name>pam_smb</name>
<range><lt>1.9.9_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applications utilizing pam_smb can be compromised by
any user who can enter a password. In many cases,
this is a remote root compromise.</p>
</body>
</description>
<references>
<url>http://www.skynet.ie/~airlied/pam_smb/</url>
<cvename>CVE-2003-0686</cvename>
</references>
<dates>
<discovery>2003-10-25</discovery>
<entry>2003-10-25</entry>
<modified>2003-10-25</modified>
</dates>
</vuln>
<vuln vid="c4b7badf-24ca-11d8-82e5-0020ed76ef5a">
<topic>Buffer overflows in libmcrypt</topic>
<affects>
<package>
<name>libmcrypt</name>
<range><lt>2.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libmcrypt does incomplete input validation, leading to
several buffer overflows. Additionally,
a memory leak is present. Both of these problems may be
exploited in a denial-of-service attack.</p>
</body>
</description>
<references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=104162752401212&w=2</mlist>
<cvename>CVE-2003-0031</cvename>
<cvename>CVE-2003-0032</cvename>
</references>
<dates>
<discovery>2003-10-25</discovery>
<entry>2003-10-25</entry>
<modified>2003-10-25</modified>
</dates>
</vuln>
<vuln vid="6fd9a1e9-efd3-11d8-9837-000c41e2cdad">
<cancelled/>
</vuln>
<vuln vid="3362f2c1-8344-11d8-a41f-0020ed76ef5a">
<cancelled/>
</vuln>
</vuxml>
<!-- EOF -->
<!-- Note: Please add new entries to the beginning of this file. -->
<!-- ex: set ts=8 tw=80 sw=2: -->
<!-- vim: set softtabstop=2 noexpandtab: -->
Zerion Mini Shell 1.0