Security
Privacy Badger gives teeth to Do Not Track
The Electronic Frontier Foundation (EFF) has released a browser add-on called Privacy Badger that repurposes the familiar "ad-blocking extension" concept to filter and block out web-tracking tools, rather than advertisements. Privacy Badger detects a number of behavior-tracking methods, attempting to block those that are either loaded invisibly or otherwise operate without the user's consent. In addition to its emphasis on privacy protection, though, it also offers several controls that distinguish it from ad-centric blockers like AdBlock Plus. Perhaps more interestingly, the extension is accompanied by an EFF policy through which sites can be whitelisted by adhering to privacy-respecting rules.
Privacy Badger was announced
on May 1, with builds available for Firefox (although not Firefox for
Android) and for Chrome/Chromium. The stated purpose of the extension
is to help users combat "intrusive and objectionable practices
in the online advertising industry, and many advertisers' outright
refusal to meaningfully honor Do Not Track requests.
"
Do Not Track (DNT), of course, is an HTTP header intended to let users specify that they wish to opt out of web-tracking mechanisms. DNT was designed to be a voluntary mechanism that advertisers and data collectors would use as a means of self-regulation. Those businesses have done their best to undermine DNT, however, as many privacy advocates predicted they would.
Among other tactics, various advertising
associations devised their own "interpretations" of DNT that,
predictably, still involve tracking DNT users. On April 30, Yahoo's
"Privacy Team" publicly announced
that the company will start ignoring DNT completely, on the grounds
that there is no "single standard
" about the meaning of
DNT. With the voluntary-self-policing loop now neatly closed, it
should probably come as no surprise that the EFF followed up with a
technical solution—although the timing of events could still be
coincidental.
Privacy Badger does care
Privacy Badger is based on a fork of the AdBlock Plus engine; it blocks certain HTTP requests, but rather than blocking ads, the blocked content is limited to third-party requests (scripts, cookies, images, or other embedded resources) that are believed to be used as a user-tracking mechanism. These third-party resources are what Privacy Badger regards as "trackers;" they tend to be invisible to the user, but they allow the third-party domain to follow the user across multiple sites by logging the HTTP requests (usually setting a cookie containing some form of identifying string). Not requesting these resources in the first place prevents the remote party from tracking the user; the majority of these trackers emanate from the domains of third-party services, but some come from sites that otherwise contribute functionality to the page. Since blocking all third-party resources would break functionality of many sites, the extension attempts to distinguish between necessary resources and unnecessary ones. The EFF collected data prior to the release of the extension and created a whitelist of patterns that Privacy Badger will not block.
For third-party trackers not on the whitelist, however, Privacy Badger starts off by giving each site the benefit of the doubt. It includes the DNT header with each request, and does not block the tracker when it is first encountered. But if the tracker is encountered on another, unrelated site, that is regarded as evidence that it is violating the user's privacy, and it is added to the block list.
![[Privacy Badger menu]](https://static.lwn.net/images/2014/05-privacybadger-sm.png)
The status of the current page can be examined by opening the Privacy Badger menu (which, on Firefox, is placed in the "Add-on Bar"). All trackers detected in the current page are shown, color-coded to indicate their blocking state. Green means that the tracker is being allowed, yellow means it is a cross-domain tracker on the whitelist (that is, it is being permitted to prevent the site from breaking), and red means it is being blocked. The very first time a user employs Privacy Badger, all of the trackers will be either green or yellow, but the privacy-violating ones quickly get recognized and turned red after visiting just a few sites.
For the whitelisted tracker domains, Privacy Badger loads the resources (e.g., scripts or images), but it still blocks user-tracking cookies from the domain, which should provide some measure of privacy protection. It is not always possible to determine whether a given cookie is used for user tracking purposes or not, of course; the heuristic used allows cookies that have some other clear purpose (such as setting the preferred language), but the EFF notes that more work on the problem would be helpful.
Tracker go home
In practice, the Privacy Badger menu is a nice visualization aid. It shows only the domain name of the tracker, whereas AdBlock Plus and similar extensions generally present lengthy URLs and the full regular expressions used to match them. That means skimming through it is a lot easier.
In addition, the green/yellow/red status of each tracker also has a slider (albeit one that has just three discrete positions), so users can easily toggle between the settings for every tracker if they so desire. That is probably most useful for enabling a blocked tracker that is hampering site functionality, but it can be employed for other tasks, too (like seeing how many yellow trackers one can disable and still have a functioning browser session). Here, again, the ad-blocking extensions tend to expose a significantly less usable interface: if a blocked item is breaking page functionality, one must usually hunt through the blocked-items window, enabling and disabling specific expressions in hopes of finding it.
To be perfectly fair, though, ad blockers have a broader scope of content to try and match against, so it is only natural that they have more complicated tools with which to tune the results. The EFF goes to great lengths to explain that Privacy Badger is not, fundamentally speaking, an ad blocker. It will, as a matter of blocking third-party trackers, block third-party-tracker-laden ads, but users interested in reducing their exposure to advertising will need to find another extension to handle the task.
There are two other important categories of tracker that Privacy Badger does not protect against: "first-party" trackers and trackers that rely only on browser fingerprinting techniques. First-party trackers means tracking elements sent by the domain of the main URL itself. As is the case with whitelisted domains domains mentioned earlier, a concern with blocking resource requests too aggressively would be breaking the site's functionality; nevertheless the EFF notes that it hopes to be able to implement some level of first-party tracker blocking in a subsequent release.
Browser fingerprinting is a different beast entirely. The technique relies on gathering specific information about the user by recording information from the browser's User-Agent string, installed plugins, local time zone, accepted HTTP headers, and other system data that can be queried remotely. The EFF's Panopticlick demonstrates just how much data is leaked in this manner. As with first-party trackers, the Privacy Badger project says it hopes to add fingerprinting countermeasures in a future release, but those countermeasures will certainly involve techniques beyond tracker blocking.
Getting on the straight and narrow
As mentioned earlier, Privacy Badger includes the DNT header in each HTTP request; consequently, sites that respect the header and do not return user trackers do not get blocked. The EFF is using this approach as a means to promote DNT adoption. Specifically, advertisers (and other tracker-using sites) that specify a DNT-respecting policy will, in future versions of Privacy Badger, automatically be unblocked.
The EFF has written a proposed DNT policy as part of the initiative. The plan is that a site would store the policy document in plain text at a well-known location (https://example-domain.com/.well-known/dnt-policy.txt in the current draft), where Privacy Badger and other programs could locate it automatically and take the appropriate action in response (such as whitelisting the site). The hope is that if DNT policy statements become widespread, as robots.txt files are for search-engine exclusion, tracker-blocking programs like Privacy Badger can dispense with the built-in whitelist approach currently in use.
But dispensing with the hand-crafted whitelist is only part of the goal. The ultimate point is for sites to respect the DNT header. For that to happen, Privacy Badger and related tools will have to be deployed in significant enough numbers for advertisers to take notice. The EFF notes on the DNT policy page that it is open to having further discussions about the wording of the DNT policy document. If that policy document does take off, it would in essence be the de-facto standard interpretation of DNT's meaning—which would mean, in turn, that there is a consensus around DNT, which would eliminate the "no one agrees on what DNT means" argument espoused recently by Yahoo.
Of course, if that argument is really a spurious claim only tossed out to provide cursory justification for what the company wants to do anyway, then Yahoo and other tracker-using sites will find another argument and continue to track users. It is hard to handicap the chances that Privacy Badger has for making a significant impact on user-tracking behavior. It may remain a useful tool that only a few users employ (as is the case with ad-blocking extensions and other EFF privacy tools like HTTPS Everywhere). On the other hand, browser makers could take the concept to heart and build it into future releases, changing the game significantly.
For now, Privacy Badger is an alpha release, and much more work is still to come. But it is an easy-to-use tool, and it both offers protection against web trackers and sheds light on just how pervasive web-tracker deployment is; both are useful outcomes. The mobile versions of Chrome and Firefox are on the agenda for future releases, as is Opera support; on the project site, the EFF asks for developers interested in working on Safari and Internet Explorer extensions to make contact. There is no telling how well the project will fare as a DNT enforcement tool, but it may be the best option currently available.
New vulnerabilities
asterisk: denial of service
| Package(s): | asterisk | CVE #(s): | CVE-2014-2288 CVE-2014-2289 | ||||
| Created: | May 5, 2014 | Updated: | May 9, 2014 | ||||
| Description: | From the CVE entries:
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request. (CVE-2014-2288) res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference. (CVE-2014-2289) | ||||||
| Alerts: |
| ||||||
chromium-browser: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2014-1730 CVE-2014-1731 CVE-2014-1732 CVE-2014-1733 CVE-2014-1734 CVE-2014-1735 CVE-2014-1736 | ||||||||||||||||||||||||
| Created: | May 5, 2014 | Updated: | May 16, 2014 | ||||||||||||||||||||||||
| Description: | From the CVE entries:
Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc. (CVE-2014-1730) core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements. (CVE-2014-1731) Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration. (CVE-2014-1732) The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access. (CVE-2014-1733) Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. (CVE-2014-1734) Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. (CVE-2014-1735) From the Debian advisory: SkyLined discovered an integer overflow issue in the v8 javascript library. (CVE-2014-1736) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
cups-filters: command execution
| Package(s): | cups-filters | CVE #(s): | CVE-2014-4336 CVE-2014-4337 CVE-2014-4338 | ||||||||||||||||||||||||||||||||
| Created: | May 6, 2014 | Updated: | November 4, 2014 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
According to Sebastian Krahmer, the initial fix for CVE-2014-2707 is incomplete:
"This issue was reported as fixed in 1.0.51:
but it was found that the fix was incomplete with the full fix in 1.0.53: On June 19, CVE entries CVE-2014-4336, CVE-2014-4337, and CVE-2014-4338 were assigned to this issue. From the Mageia advisory: The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336). In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337). In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338). | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
fish: multiple vulnerabilities
| Package(s): | fish | CVE #(s): | CVE-2014-2905 CVE-2014-2914 CVE-2014-2906 | ||||||||||||||||||||||||||||||||
| Created: | May 6, 2014 | Updated: | October 9, 2014 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A number of vulnerabilities were reported in fish versions prior to 2.1.1: CVE-2014-2905: fish universal variable socket vulnerable to permission bypass leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not check the credentials of processes communicating over the fishd universal variable server UNIX domain socket. This allows a local attacker to elevate their privileges to those of a target user running fish, including root. fish version 2.1.1 is not vulnerable. CVE-2014-2906: fish temporary file creation vulnerable to race condition leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates temporary files in an insecure manner. Versions 1.23.0 to 2.1.0 (inclusive) execute code from these temporary files, allowing privilege escalation to those of any user running fish, including root. Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive), fish will read data using the psub function from these temporary files, meaning that the input of commands used with the psub function is under the control of the attacker. fish version 2.1.1 is not vulnerable. CVE-2014-2914: fish web interface does not restrict access leading to remote code execution fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict connections to the Web-based configuration service (fish_config). This allows remote attackers to execute arbitrary code in the context of the user running fish_config. The service is generally only running for short periods of time. fish version 2.1.1 restricts incoming connections to localhost only. At this stage, users should avoid running fish_config on systems where there are untrusted local users, as they are still able to connect to the fish_config service and elevate their privileges to those of the user running fish_config. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2014-0196 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 6, 2014 | Updated: | July 24, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrator privileges. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libpng12: multiple vulnerabilities
| Package(s): | libpng12 | CVE #(s): | CVE-2013-7353 CVE-2013-7354 | ||||||||||||||||||||||||||||||||||||
| Created: | May 2, 2014 | Updated: | June 10, 2014 | ||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE bug reports: CVE-2013-7353: An integer overflow leading to a heap-based buffer overflow was found in the png_set_sPLT() and png_set_text_2() API functions of libpng. A attacker could create a specially-crafted image file and render it with an application written to explicitly call png_set_sPLT() or png_set_text_2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application. The vendor mentions that internal calls use safe values. These issues could potentially affect applications that use the libpng API. Apparently no such applications were identified. CVE-2013-7354: An integer overflow leading to a heap-based buffer overflow was found in the png_set_unknown_chunks() API function of libpng. A attacker could create a specially-crafted image file and render it with an application written to explicitly call png_set_unknown_chunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application. The vendor mentions that internal calls use safe values. These issues could potentially affect applications that use the libpng API. Apparently no such applications were identified. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
libvirt: denial of service
| Package(s): | libvirt | CVE #(s): | CVE-2013-7336 | ||||||||||||
| Created: | May 2, 2014 | Updated: | May 7, 2014 | ||||||||||||
| Description: | An unprivileged user can, through a specific sequence of calls, cause the libvirtd daemon to crash. | ||||||||||||||
| Alerts: |
| ||||||||||||||
mediawiki: cross-site scripting
| Package(s): | mediawiki | CVE #(s): | CVE-2014-2853 | ||||||||||||||||||||
| Created: | May 6, 2014 | Updated: | May 9, 2014 | ||||||||||||||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
nagios-nrpe: code execution
| Package(s): | nagios-nrpe | CVE #(s): | CVE-2014-2913 | ||||||||||||||||||||||||||||
| Created: | May 2, 2014 | Updated: | December 8, 2014 | ||||||||||||||||||||||||||||
| Description: | From the openSUSE bug report: A remote, command execution flaw was discovered in Nagios NRPE when command arguments are enabled. A remote attacker could use this flaw to execute arbitrary commands. This issue affects versions 2.15 and older. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
ndjbdns: denial of service
| Package(s): | ndjbdns | CVE #(s): | |||||||||
| Created: | May 1, 2014 | Updated: | May 7, 2014 | ||||||||
| Description: | Version 1.06 of N-DJBDNS includes fixes for two denial-of-service vulnerabilities. See the ndjbdns changelog for more information. | ||||||||||
| Alerts: |
| ||||||||||
neutron: unintended access to other tenant networks
| Package(s): | neutron | CVE #(s): | CVE-2014-0056 | ||||||||
| Created: | May 6, 2014 | Updated: | May 30, 2014 | ||||||||
| Description: | From the Ubuntu advisory:
Aaron Rosen discovered that OpenStack Neutron did not properly perform authorization checks when creating ports when using plugins relying on the l3-agent. A remote authenticated attacker could exploit this to access the network of other tenants. | ||||||||||
| Alerts: |
| ||||||||||
openshift-origin-broker-util: privilege escalation
| Package(s): | openshift-origin-broker-util | CVE #(s): | CVE-2014-0164 | ||||||||
| Created: | May 2, 2014 | Updated: | May 7, 2014 | ||||||||
| Description: | From the Red Hat advisory: It was discovered that the mcollective client.cfg configuration file was world-readable by default. A malicious, local user on a host with the OpenShift Broker installed could read sensitive information regarding the mcollective installation, including mcollective authentication credentials. A malicious user able to obtain said credentials would potentially have full control over all OpenShift nodes managed via mcollective. | ||||||||||
| Alerts: |
| ||||||||||
openssl: denial of service
| Package(s): | openssl | CVE #(s): | CVE-2014-0198 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 5, 2014 | Updated: | July 24, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
A null pointer dereference bug in OpenSSL 1.0.1g and earlier in so_ssl3_write() could possibly allow an attacker to cause generate an SSL alert which would cause OpenSSL to crash, resulting in a denial of service. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
openstack-glance: command execution
| Package(s): | openstack-glance | CVE #(s): | CVE-2014-0162 | ||||||||||||
| Created: | May 1, 2014 | Updated: | May 13, 2014 | ||||||||||||
| Description: | From the Red Hat advisory:
It was found that Sheepdog, a distributed object storage system, did not properly validate Sheepdog image URIs. A remote attacker able to insert or modify glance image metadata could use this flaw to execute arbitrary commands with the privileges of the user running the glance service. Note that only OpenStack Image setups using the Sheepdog back end were affected. | ||||||||||||||
| Alerts: |
| ||||||||||||||
php: privilege escalation
| Package(s): | php | CVE #(s): | CVE-2014-0185 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 6, 2014 | Updated: | October 6, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that, on some distributions, PHP FPM (a FastCGI Process Manager for PHP) used a UNIX socket with insecure, default permissions. This would allow local users to execute PHP scripts with the privileges of the "apache" user. This is a similar situation to using mod_php where users can place scripts in their "~/public_html/" directory. Original report: http://www.openwall.com/lists/oss-security/2014/04/29/5 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
python-fedora: two vulnerabilities
| Package(s): | python-fedora | CVE #(s): | |||||||||
| Created: | May 7, 2014 | Updated: | May 22, 2014 | ||||||||
| Description: | From the Fedora advisory:
Fix two security issues for services using python-fedora's TG1 and flask helpers. The TG1 fix quotes variables that could have been used to launch an XSS attack. The flask fix addresses OpenID Covert Redirect for web services which use flask_fas_openid to authenticate against the Fedora Account System. | ||||||||||
| Alerts: |
| ||||||||||
python-lxml: code injection
| Package(s): | python-lxml | CVE #(s): | CVE-2014-3146 | ||||||||||||||||||||||||||||||||
| Created: | May 5, 2014 | Updated: | March 29, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
The lxml.html.clean module cleans up HTML by removing embedded or script content, special tags, CSS style annotations and much more. It was found that the clean_html() function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters (\x01-\x08). A remote attacker could use this flaw to serve malicious content to an application using the clean_html() function to process HTML, possibly allowing the attacker to inject malicious code into a website generated by this application. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
python3: privilege escalation
| Package(s): | python3 | CVE #(s): | CVE-2014-2667 | ||||||||||||||||||||||||||||
| Created: | May 2, 2014 | Updated: | January 6, 2015 | ||||||||||||||||||||||||||||
| Description: | From the openSUSE bug report: It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit files created by a program using this call. Note that prior versions of Python, including 2.x, do not include the vulnerable _get_masked_mode() function that is used by os.makedirs() when exist_ok is set to True. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
qt: denial of service
| Package(s): | qt | CVE #(s): | CVE-2014-0190 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 2, 2014 | Updated: | December 15, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Fedora bug tracker: A NULL pointer dereference flaw was found in QGIFFormat::fillRect. If an application using the qt-x11 libraries opened a malicious GIF file, it could cause the application to crash. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
rxvt-unicode: command execution
| Package(s): | rxvt-unicode | CVE #(s): | CVE-2014-3121 | ||||||||||||||||||||||||||||||||
| Created: | May 5, 2014 | Updated: | June 25, 2014 | ||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
rxvt-unicode (aka urxvt) before 9.20 is vulnerable to a user-assisted arbitrary commands execution issue. This can be exploited by the unprocessed display of certain escape sequences in a crafted text file or program output. Arbitrary command sequences can be constructed using this, and unintentionally executed if used in conjunction with various other escape sequences. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
strongswan: denial of service
| Package(s): | strongswan | CVE #(s): | CVE-2014-2891 | ||||||||||||||||
| Created: | May 5, 2014 | Updated: | May 7, 2014 | ||||||||||||||||
| Description: | From the Debian advisory:
A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE/IPsec suite used to establish IPsec protected links. By sending a crafted ID_DER_ASN1_DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a null pointer dereference in the daemon parsing the identity, leading to a crash and a denial of service. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
struts: code execution
| Package(s): | struts | CVE #(s): | CVE-2014-0114 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 7, 2014 | Updated: | July 20, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
varnish: world-readable log files
| Package(s): | varnish | CVE #(s): | CVE-2013-0345 | ||||||||||||
| Created: | May 6, 2014 | Updated: | May 7, 2014 | ||||||||||||
| Description: | From the Red Hat bugzilla:
Agostino Sarubbo reported on the oss-security mailing list that, on Gentoo, /var/log/varnish is world-accessible and the log files inside the directory are world-readable. This could allow an unprivileged user to read the log files. Checking on Fedora and EPEL, /var/log/varnish is provided with 0755 permissions. These should be reduced to 0700 permissions, like /var/log/httpd. | ||||||||||||||
| Alerts: |
| ||||||||||||||
xbuffy: code execution
| Package(s): | xbuffy | CVE #(s): | CVE-2014-0469 | ||||
| Created: | May 5, 2014 | Updated: | May 7, 2014 | ||||
| Description: | From the Debian advisory:
Michael Niedermayer discovered a vulnerability in xbuffy, an utility for displaying message count in mailbox and newsgroup accounts. By sending carefully crafted messages to a mail or news account monitored by xbuffy, an attacker can trigger a stack-based buffer overflow, leading to xbuffy crash or even remote code execution. | ||||||
| Alerts: |
| ||||||
Page editor: Jake Edge
Next page:
Kernel development>>