Security
Docker image "verification"
One might be forgiven for expecting that a message stating that a download has been "verified" would actually be indicating some kind of verification. But, as Jonathan Rudenberg discovered, getting that message when downloading a Docker image is, at best, misleading—at worst it is flat-out wrong. Worse still, perhaps, is that an image file that is definitely corrupted only provokes a warning, though Rudenberg was unable to even make that happen. All told, his post should serve as an eye opener for those Docker users who are concerned about the security of the images they run.
After downloading an official container image using the Docker tools, Rudenberg saw
the following message: "ubuntu:14.04: The image you are pulling has
been verified
". At the time, he believed it was the result of a
feature described
in the Docker 1.3 release announcement, which touted a "tech
preview" of digital-signature verification for images. Subsequently, however, he had
reason to look a bit deeper and was not impressed with what he found:
Docker’s report that a downloaded image is “verified” is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest. An attacker could provide any image alongside a signed manifest. This opens the door to a number of serious vulnerabilities.
Beyond that, the processing pipeline for images also suffers from a number of flaws: it does three separate processing steps using the unverified (potentially malicious) image. To begin with, the image is decompressed using one of three different algorithms: gzip, bzip2, or xz. The first two use the memory-safe Go language library routines, which should provide resilience against code-execution flaws, he said, but xz decompression is a different story.
To decompress an image that uses the xz algorithm, Docker spawns the xz binary, as root. That binary is written in C, thus it does not have any of the memory safety provided by Go, so it could well be vulnerable to (unknown) code-execution vulnerabilities. That means that a simple "docker pull" command could potentially lead to full system compromise, which is probably not quite what the user expected.
Docker uses TarSum to deterministically generate a checksum/hash from a tar file, but doing so means that the tar file must be decoded. The program calculates a hash for specific portions of the tar file, but that is done before any verification step. So an attacker-controlled tar file could potentially exploit a TarSum vulnerability to evade the hashing process. That might allow additions or subtractions to a tar file without changing its TarSum-calculated hash.
The final step in the processing pipeline is to unpack the tar file into the "proper" location. Once again, this is done pre-verification, so any path traversal or other vulnerability in the unpacking code (Rudenberg points to three vulnerabilities that have already been found there) could be exploited. All three of those problems could be alleviated by verifying the entire image before processing it.
Unfortunately, even after those three processing steps have been done, Docker does not actually verify much of anything before emitting its "verified" message. In fact, Rudenberg reported that the presence of a signed manifest that passes libtrust muster is enough to trigger the message. No checking is done to see if the manifest corresponds to the rest of the image. In addition, the public key that is used to sign the manifest is retrieved each time an image is pulled, rather than provided as part of the Docker tool suite, for example.
Overall, the image verification feature is sloppy work, so far, that is likely to mislead Docker users. In a thread on Hacker News, Docker founder and CTO Solomon Hykes complained that Rudenberg's analysis did not quote the "work in progress" disclaimer in the Docker announcement. Notably, though, he did not argue with any of the technical points made in the analysis.
Rudenberg made several suggestions for improving Docker image verification in the post. Verifying the entirety of the image, rather than just parts using TarSum, is one. Another is to employ privilege separation so that tasks like decompression are not run as root. Furthermore, he suggested adopting The Update Framework rather than using the largely undocumented libtrust for signature verification.
Perhaps the biggest mistake made by Docker here was to enable the feature by default when it was clearly not even close to ready. As pointed out by Red Hat, there are other ways to get Docker images that are more secure, so just avoiding the docker pull command until image verification is fully baked may be the right course for security-conscious users.
Brief items
Security quotes of the week
If the “I CAN'T LET YOU DO THAT, DAVE” message is being generated by a program on your desktop labeled HAL9000.exe, you will certainly drag that program into the trash. If your computer's list of running programs shows HAL9000.exe lurking in the background like an immigration agent prowling an arrivals hall, looking for sneaky cell phone users to shout at, you will terminate that process with a satisfied click.
So the only way to sustain HAL9000.exe and its brethren—the programs that today keep you from installing non-App Store apps on your iPhone and tomorrow will try to stop you from printing gun.stl on your 3-D printer—is to design the computer to hide them from you. And that creates vulnerabilities that make your computer susceptible to malicious hacking.
The Darkmail Internet Mail Environment
From Phillip Zimmermann and Ladar Levison (among others) comes the Darkmail Internet Mail Environment, an attempt to replace SMTP with a more secure protocol. It has a 108-page specification [PDF] for those wanting details, and code is available on GitHub. "In addition to the usual protection of content, a design goal for secure email must be to limit what meta-information is disclosed so that a handling agent only has access to the information it needs to see. The Dark Internet Mail Environment (DIME) achieves this with a core model having multiple layers of key management and multiple layers of message encryption."
New vulnerabilities
apache: mis-handling of Require directives
| Package(s): | apache2 | CVE #(s): | CVE-2014-8109 | ||||||||||||||||||||||||||||||||
| Created: | December 29, 2014 | Updated: | March 16, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
Fixes handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
asterisk: multiple vulnerabilities
| Package(s): | asterisk | CVE #(s): | CVE-2014-8412 CVE-2014-8414 CVE-2014-8417 CVE-2014-8418 CVE-2014-9374 | ||||||||||||
| Created: | December 29, 2014 | Updated: | January 9, 2015 | ||||||||||||
| Description: | From the CVE entries:
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry. (CVE-2014-8412) ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media. (CVE-2014-8414) ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action. (CVE-2014-8417) The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol. (CVE-2014-8418) Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. (CVE-2014-9374) | ||||||||||||||
| Alerts: |
| ||||||||||||||
cgmanager: information disclosure
| Package(s): | cgmanager | CVE #(s): | CVE-2014-1425 | ||||
| Created: | January 6, 2015 | Updated: | January 7, 2015 | ||||
| Description: | From the Ubuntu advisory:
cgmanager could be made to expose sensitive information or devices to containers running on the system. | ||||||
| Alerts: |
| ||||||
cxf: denial of service
| Package(s): | cxf | CVE #(s): | CVE-2014-3584 | ||||
| Created: | December 31, 2014 | Updated: | January 7, 2015 | ||||
| Description: | From the CVE entry:
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service. | ||||||
| Alerts: |
| ||||||
ettercap: denial of service
| Package(s): | ettercap | CVE #(s): | CVE-2014-9380 CVE-2014-9381 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 30, 2014 | Updated: | March 27, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature. (CVE-2014-9380) Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation. (CVE-2014-9381) | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
ettercap: multiple vulnerabilities
| Package(s): | ettercap | CVE #(s): | CVE-2014-6396 CVE-2014-6395 CVE-2014-9377 CVE-2014-9376 CVE-2014-9379 CVE-2014-9378 | ||||||||||||||||||||||||||||||||||||
| Created: | January 5, 2015 | Updated: | March 27, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location. (CVE-2014-6396) Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password. (CVE-2014-6395) Heap-based buffer overflow in the nbns_spoof function in plug-ins/nbns_spoof/nbns_spoof.c in Ettercap 8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet. (CVE-2014-9377) Integer underflow in Ettercap 8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissector_dhcp function in dissectors/ec_dhcp.c, (2) length value to the dissector_gg function in dissectors/ec_gg.c, or (3) string length to the get_decode_len function in ec_utils.c or a request without a (4) username or (5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c. (CVE-2014-9376) The radius_get_attribute function in dissectors/ec_radius.c in Ettercap 8.1 performs an incorrect cast, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which triggers a stack-based buffer overflow. (CVE-2014-9379) Ettercap 8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c. (CVE-2014-9378) | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
glpi: SQL injection
| Package(s): | glpi | CVE #(s): | CVE-2014-9258 | ||||||||||||||||||||
| Created: | January 2, 2015 | Updated: | January 12, 2015 | ||||||||||||||||||||
| Description: | From the CVE entry: SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2014-9419 CVE-2014-9420 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 7, 2015 | Updated: | January 13, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. (CVE-2014-9419) The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. (CVE-2014-9420). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libevent: denial of service
| Package(s): | libevent | CVE #(s): | CVE-2014-6272 | ||||||||||||||||||||||||||||||||||||
| Created: | January 6, 2015 | Updated: | March 28, 2016 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory
Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
libpng: memory overwrite
| Package(s): | libpng | CVE #(s): | CVE-2014-9495 | ||||||||||||||||||||||||||||
| Created: | January 7, 2015 | Updated: | March 9, 2015 | ||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
libpng versions 1.6.9 through 1.6.15 have an integer-overflow vulnerability in png_combine_row() when decoding very wide interlaced images, which can allow an attacker to overwrite an arbitrary amount of memory with arbitrary (attacker-controlled) data. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
libreoffice: denial of service
| Package(s): | libreoffice | CVE #(s): | CVE-2014-9093 | ||||||||||||||||||||
| Created: | December 29, 2014 | Updated: | February 20, 2015 | ||||||||||||||||||||
| Description: | From the CVE entry:
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libssh: denial of service
| Package(s): | libssh | CVE #(s): | CVE-2014-8132 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 5, 2015 | Updated: | January 19, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
libvirt: three denial of service flaws
| Package(s): | libvirt | CVE #(s): | CVE-2014-8131 CVE-2014-8135 CVE-2014-8136 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 25, 2014 | Updated: | February 17, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian security tracker entry:
CVE-2014-8131: deadlock and segfault in qemuConnectGetAllDomainStats CVE-2014-8135: From the CVE entry: The storageVolUpload function in storage/storage_driver.c in libvirt does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command. CVE-2014-8136: From the CVE entry: The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
mantis: multiple vulnerabilities
| Package(s): | mantis | CVE #(s): | CVE-2014-8553 CVE-2014-8986 CVE-2014-8988 CVE-2014-9269 CVE-2014-9270 CVE-2014-9271 CVE-2014-9272 CVE-2014-9281 CVE-2014-9388 | ||||
| Created: | January 7, 2015 | Updated: | January 7, 2015 | ||||
| Description: | From the Debian advisory:
Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. | ||||||
| Alerts: |
| ||||||
mime-support: code execution
| Package(s): | mime-support | CVE #(s): | CVE-2014-7209 | ||||||||||||
| Created: | December 29, 2014 | Updated: | January 8, 2015 | ||||||||||||
| Description: | From the Debian advisory:
Timothy D. Morgan discovered that run-mailcap, an utility to execute programs via entries in the mailcap file, is prone to shell command injection via shell meta-characters in filenames. In specific scenarios this flaw could allow an attacker to remotely execute arbitrary code. | ||||||||||||||
| Alerts: |
| ||||||||||||||
nvidia: code execution
| Package(s): | nvidia | CVE #(s): | CVE-2014-8298 | ||||
| Created: | January 7, 2015 | Updated: | January 7, 2015 | ||||
| Description: | From the CVE entry:
The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra (L4T) driver before R21.2, and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request. | ||||||
| Alerts: |
| ||||||
openvas-manager: sql injection
| Package(s): | openvas-manager | CVE #(s): | CVE-2014-9220 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 6, 2015 | Updated: | July 14, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
It has been identified that OpenVAS Manager before 4.0.6 is vulnerable to sql injections due to a improper handling of the timezone parameter in modify_schedule OMP command. It has been identified that this vulnerability may allow read-access via sql for authorized user account which have permission to modify schedule objects. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
privoxy: two vulnerabilities
| Package(s): | privoxy | CVE #(s): | |||||
| Created: | January 6, 2015 | Updated: | January 7, 2015 | ||||
| Description: | From the Mageia advisory:
A memory leak occurred in privoxy 3.0.21 compiled with IPv6 support when rejecting client connections due to the socket limit being reached. (CID 66382) A use-after-free bug was found in privoxy 3.0.21 and two additional potential use-after-free issues were detected by Coverity scan. (CID 66394, CID 66376, CID 66391) See the Privoxy changelog for details. | ||||||
| Alerts: |
| ||||||
python-django-horizon: denial of service
| Package(s): | python-django-horizon | CVE #(s): | CVE-2014-8124 | ||||||||||||||||
| Created: | January 5, 2015 | Updated: | January 7, 2015 | ||||||||||||||||
| Description: | From the CVE entry:
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
python-pip: denial of service
| Package(s): | python-pip | CVE #(s): | CVE-2014-8991 | ||||||||
| Created: | January 6, 2015 | Updated: | January 15, 2015 | ||||||||
| Description: | From the CVE request:
There is a local DoS in pip 1.3, 1.3.1, 1.4, 1.4.1, 1.5, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, and 1.5.6. In an attempt to fix CVE-2013-1888 pip modified it's build directories from pip-build to pip-build-<username> and added in checks that would ensure that only a directory owned by the current user would be used. However because the build directory is predictable a local DoS is possible simply by creating a /tmp/pip-build-<username>/ directory owned by someone other than the defined user. This issue has also been reported to the Debian bug tracker as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847. | ||||||||||
| Alerts: |
| ||||||||||
strongswan: denial of service
| Package(s): | strongswan | CVE #(s): | CVE-2014-9221 | ||||||||||||||||||||||||||||
| Created: | January 5, 2015 | Updated: | August 19, 2015 | ||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Mike Daskalakis reported a denial of service vulnerability in charon, the IKEv2 daemon for strongSwan, an IKE/IPsec suite used to establish IPsec protected links. The bug can be triggered by an IKEv2 Key Exchange (KE) payload that contains the Diffie-Hellman (DH) group 1025. This identifier is from the private-use range and only used internally by libtls for DH groups with custom generator and prime (MODP_CUSTOM). As such the instantiated method expects that these two values are passed to the constructor. This is not the case when a DH object is created based on the group in the KE payload. Therefore, an invalid pointer is dereferenced later, which causes a segmentation fault. This means that the charon daemon can be crashed with a single IKE_SA_INIT message containing such a KE payload. The starter process should restart the daemon after that, but this might increase load on the system. Remote code execution is not possible due to this issue, nor is IKEv1 affected in charon or pluto. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
torque: two vulnerabilities
| Package(s): | torque | CVE #(s): | CVE-2011-2907 CVE-2011-4925 | ||||
| Created: | December 29, 2014 | Updated: | January 7, 2015 | ||||
| Description: | From the CVE entries:
Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program. (CVE-2011-2907) Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when munge authentication is used, allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors. (CVE-2011-4925) | ||||||
| Alerts: |
| ||||||
unzip: code execution
| Package(s): | unzip | CVE #(s): | CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 29, 2014 | Updated: | March 29, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139), the test_compr_eb() function (CVE-2014-8140) and the getZip64Data() function (CVE-2014-8141), which may lead to the execution of arbitrary code. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
webmin: malicious symlinks
| Package(s): | webmin | CVE #(s): | CVE-2015-1377 | ||||
| Created: | January 7, 2015 | Updated: | January 27, 2015 | ||||
| Description: | From the Mageia advisory:
The webmin package has been updated to version 1.730 to fix possible security issues that could be caused by malicious symlinks when reading mail. | ||||||
| Alerts: |
| ||||||
xlockmore: X error
| Package(s): | xlockmore | CVE #(s): | |||||
| Created: | December 29, 2014 | Updated: | January 10, 2015 | ||||
| Description: | From the Mageia advisory:
xlockmore before 5.45 contains a security flaw related to a bad value of fnt for pyro2 which could cause an X error. This update backports the fix for version 5.43. | ||||||
| Alerts: |
| ||||||
Page editor: Jake Edge
Next page:
Kernel development>>