Security
Mozilla and deprecating HTTP
On April 30, Mozilla announced its intention to try to phase out the usage of HTTP in favor of HTTPS. The plan involves systematically deprecating support in Firefox for certain web features on those sites running un-secure HTTP. That way, the thinking goes, site administrators will be compelled to migrate their servers over to HTTPS. Needless to say, the plan attracted its fair share of criticism—for its perceived use of strong-arm tactics, for the claims it makes about HTTPS security, and for the practical challenges it will need to overcome.
Firefox Security Lead Richard Barnes wrote the April 30 announcement. It began by pointing out that there have been numerous calls in recent months to migrate all web sites over to HTTPS (and, indeed, calls to encrypt all Internet applications). Mozilla brought the topic to its community mailing list in early April, expressing the project's interest in luring more site maintainers over to HTTPS by implementing new Firefox features only for secure connections.
What followed was a lengthy debate—sometimes over legitimate, specific concerns, but sometimes devolving into less high-minded criticism of Mozilla. Barnes and Martin Thomson drafted a more detailed plan in a publicly-readable Google Docs document.
The plan
That plan proposed four phases. First, stakeholders would need to define what precisely counts as a "secure" context. This is not necessarily a simple encryption-or-no-encryption question. For instance, the W3C WebAppSec working group is currently considering how an authenticated TLS connection impacts deciding whether or not various types of page content ought to be considered parts of the same secure context—from IFrames to Web Workers. It is also expected to come up with a plan for determining whether local resources (such as localhost/ and file:/// URLs) should be treated as secure and how organizations should treat internal servers.
Whatever the eventual consensus looks like, the second phase
involved publicly declaring a cutoff date, after which new browser
features will only be implemented for use in secure contexts. The
third phase would involve a second cutoff date, after which certain
existing browser features would be disabled for insecure contexts.
The fourth phase, simply put, is "essentially all of the web is
HTTPS
".
The tricky part, the document goes on to explain, is deciding which features need to be cut off in phase three. The plan does not involve switching off arbitrary functionality just to make HTTP sites break; the set of features being looked at is those that have the potential to be a security risk for users: localStorage, getUserMedia, IndexedDB, cookies, and so on.
The blog post goes on to explain that, once implemented by Firefox, the plan would not require site owners to rewrite millions of http:// URLs into https:// ones. HTTP Strict Transport Security (HSTS) and Upgrade Insecure Requests allow the browser to transform URLs into HTTPS requests automatically. Firefox has had HSTS support since 2010.
The other major obstacle to the proposed plan is that it requires all sites to have a valid TLS certificate. While, historically, TLS certificates backed by certificate authorities (CAs) have been expensive and difficult to acquire, over the past few years more and more services have appeared with the goal of providing ubiquitous certificates. Let's Encrypt, the non-profit program backed by Mozilla (among others) is arguably the most famous (though it has yet to launch), but there are others. The FAQ document [PDF] at the end of Barnes's blog post mentions StartSSL and WoSign among the other such services.
Opposition
In the mailing list discussion in April, several objections were
raised to the plan. Some took umbrage at the notion that Mozilla was
setting out to force site owners to make technical changes; user "vic"
called
it "strong-arming," for example. Barnes and the other Mozilla
employees in the discussion largely left such accusations alone,
although Barnes did point
out that HTTP/2 mandates TLS encryption already—and does so
strictly on a public-policy basis, not on technical grounds.
"So if you're OK with limiting HTTP/2 to TLS, you've sort of
already bought into the strategy we're proposing here,
" he
said.
Others raised more technical concerns. Eli Naeher (among others)
noted
that there are "hundreds of millions of home routers and similar
devices with web UIs on private networks
" that would
potentially be broken if the plan is implemented. Many such
devices are not designed to be user-upgradable; others are simply so old or
resource-constrained that adding a new HTTPS stack might be tricky or
impossible.
A commenter named "Lorenzo" pointed out that the plan could seriously impact networking infrastructure: if all web traffic is encrypted with HTTPS, it cannot be cached by caching proxies. To that point, Mozilla's Gervase Markham responded that there are some possible solutions. For instance, the proposal could allow Firefox to accept HTTP resources requested from an HTTPS page. Since only the non-user-specific elements on a page (e.g., generic site images, but not user data) should be cached in the first place, network operators could still be using caching proxies to reduce their bandwidth requirements.
Elsewhere, Ben Klemens raised privacy concerns over the plan in a blog post. He pointed out that even free-TLS-certificate vendors require users to send in a sizable amount of personal information (including their real name and email address), which would hamper web usage by dissidents and others seeking anonymity. Markham replied to that by pointing out that web-hosting providers and domain-name registrars have similar policies already (as well as noting the irony that Klemens's post only allows comments to be left through Facebook and Twitter).
Barnes replied to a number of the frequently repeated concerns in a
summary
message. There, he acknowledged that it is still not trivial for
everyone to implement HTTPS. While there are a number of initiatives
working to make the process easier, he reminded everyone that the
HTTPS-only future was still a long ways off. Other recurring concerns
will require work on the part of other players—such as the home
router vendors. But, he said, "interfaces to these sorts of
devices don’t typically use a lot of advanced web features, so may not
be impacted by this deprecation plan for a long time (if
ever).
"
The more philosophical criticisms of the plan, however, do not have pat answers. Plenty of commenters on the blog post accused Mozilla of breaking the web, not caring about its users, not caring about site maintainers, and several variations on the theme of general corruption. Then again, similar criticisms seem to appear in response to many announcements that Mozilla makes, so it is easy to see why the browser maker spends little time responding to them.
The future
As it stands now, Mozilla seems intent on pursuing the plan, but it is clearly quite a few steps away from implementing the first technical changes. In addition to deciding on a time frame and determining what features ought to be marked for HTTP deprecation, there are still user-interface issues to be considered (e.g., the meaning of the lock icon in the location bar would surely need to change, since it currently reports whether HTTP or HTTPS is used), and Let's Encrypt has yet to launch.
Perhaps the biggest unanswered question, though, is how much of an impact a move like this on Mozilla's part would have in reality—and on what sort of time scale. Google's Chromium team has evidently been considering a similar approach—though with less publicity than Mozilla's attracted. With the two largest browser vendors on board, it seems likely that most site administrators would eventually have to capitulate and migrate to HTTPS, even if such a large-scale operation seems hard to imagine at present.
Brief items
Security quotes of the week
This statement from Mozilla describes itself as “a message to the web developer community”. The introverts on the desert island, the me of the 1990s, the kid of the present day who doesn’t like WordPress and has the energy and curiosity to try building something new, the real-world dissidents in real-world totalitarian countries, are dark matter in the background and not addressed directly in the announcement, but are affected by the announcement nonetheless.
New vulnerabilities
async-http-client: multiple vulnerabilities
| Package(s): | async-http-client | CVE #(s): | CVE-2013-7398 CVE-2013-7397 | ||||||||
| Created: | May 8, 2015 | Updated: | May 14, 2015 | ||||||||
| Description: | From the Fedora advisory: CVE-2013-7398: missing hostname verification for SSL certificates. CVE-2013-7397t: SSL/TLS certificate verification is disabled under certain conditions. | ||||||||||
| Alerts: |
| ||||||||||
docker: multiple vulnerabilities
| Package(s): | docker | CVE #(s): | CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 | ||||||||||||||||
| Created: | May 11, 2015 | Updated: | May 21, 2015 | ||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-3627 (privilege escalation): The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation. - CVE-2015-3629 (privilege escalation): Symlink traversal on container respawn allows local privilege escalation. Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. - CVE-2015-3630 (unauthorized modification): Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. - CVE-2015-3631 (policy profile escalation): By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
dpkg: format string vulnerabilities
| Package(s): | dpkg | CVE #(s): | CVE-2014-8625 | ||||||||
| Created: | May 13, 2015 | Updated: | May 13, 2015 | ||||||||
| Description: | From the CVE entry:
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name. | ||||||||||
| Alerts: |
| ||||||||||
gnu_parallel: file overwrite
| Package(s): | gnu_parallel | CVE #(s): | |||||||||
| Created: | May 12, 2015 | Updated: | June 1, 2015 | ||||||||
| Description: | From the openSUSE advisory:
GNU parallel was updated to version 20150422 to fix one security issue, several bugs and add functionality. The following vulnerability was fixed: * A local attacker could make a user overwrite one of his own files with a single byte when using --compress, --tmux, --pipe, --cat or --fifo when guessing random file names within a time window of 15 ms. | ||||||||||
| Alerts: |
| ||||||||||
hostapd: denial of service
| Package(s): | hostapd | CVE #(s): | CVE-2015-4142 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | November 25, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
A vulnerability was found in hostapd that can be used to perform denial of service attacks by an attacker that is within radio range of the AP that uses hostapd for MLME/SME operations. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
icu: code execution
| Package(s): | icu | CVE #(s): | CVE-2014-8146 CVE-2014-8147 | ||||||||||||||||||||||||
| Created: | May 11, 2015 | Updated: | July 7, 2015 | ||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Pedro Ribeiro discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
java: multiple vulnerabilities
| Package(s): | java-1.6.0-ibm | CVE #(s): | CVE-2015-0138 CVE-2015-0192 CVE-2015-1914 CVE-2015-2808 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | May 13, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
CVE-2015-0138 IBM JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK) CVE-2015-0192 IBM JDK: unspecified Java sandbox restrictions bypass CVE-2015-1914 IBM JDK: unspecified partial Java sandbox restrictions bypass CVE-2015-2808 SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: use-after-free flaw
| Package(s): | kernel | CVE #(s): | CVE-2015-3636 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2015 | Updated: | August 19, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
It was found that the Linux kernel's ping socket implementation didn't properly handle socket unhashing during spurious disconnects which could lead to use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to increase their privileges on the system. Note: By default ping sockets are disabled on the system (net.ipv4.ping_group_range = 1 0) and have to be explicitly enabled by the system administrator for specific user groups in order to exploit this issue. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kexec-tools: file overwrites
| Package(s): | kexec-tools | CVE #(s): | CVE-2015-0267 | ||||||||||||||||
| Created: | May 13, 2015 | Updated: | May 14, 2015 | ||||||||||||||||
| Description: | From the Red Hat advisory:
It was found that the module-setup.sh script provided by kexec-tools created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kvm: code execution
| Package(s): | kvm | CVE #(s): | CVE-2015-3456 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | August 18, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libarchive: denial of service
| Package(s): | libarchive | CVE #(s): | |||||||||||||
| Created: | May 12, 2015 | Updated: | June 21, 2016 | ||||||||||||
| Description: | From the Mageia advisory:
An out-of-bounds read flaw was found in the way libarchive processed certain archives. An attacker could create a specially crafted archive that, when processed by an application using the libarchive library, would cause that application to crash. | ||||||||||||||
| Alerts: |
| ||||||||||||||
libmodule-signature-perl: multiple vulnerabilities
| Package(s): | libmodule-signature-perl | CVE #(s): | CVE-2015-3406 CVE-2015-3407 CVE-2015-3408 CVE-2015-3409 | ||||||||||||||||||||
| Created: | May 12, 2015 | Updated: | January 19, 2016 | ||||||||||||||||||||
| Description: | From the Ubuntu advisory:
John Lightsey discovered that Module::Signature incorrectly handled PGP signature boundaries. A remote attacker could use this issue to trick Module::Signature into parsing the unsigned portion of the SIGNATURE file as the signed portion. (CVE-2015-3406) John Lightsey discovered that Module::Signature incorrectly handled files that were not listed in the SIGNATURE file. A remote attacker could use this flaw to execute arbitrary code when tests were run. (CVE-2015-3407) John Lightsey discovered that Module::Signature incorrectly handled embedded shell commands in the SIGNATURE file. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3408) John Lightsey discovered that Module::Signature incorrectly handled module loading. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3409) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libssh: denial of service
| Package(s): | libssh | CVE #(s): | CVE-2015-3146 | ||||||||||||||||||||||||
| Created: | May 12, 2015 | Updated: | July 14, 2015 | ||||||||||||||||||||||||
| Description: | From the Mageia advisory:
libssh versions 0.5.1 and above, but before 0.6.5, have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a null pointer dereference. This is the packet after the initial key exchange and doesn’t require authentication. This could be used for a Denial of Service (DoS) attack. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libtasn1: denial of service
| Package(s): | libtasn1 | CVE #(s): | CVE-2015-3622 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 7, 2015 | Updated: | August 12, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
A malformed certificate input could cause a heap overflow read in the DER decoding functions of Libtasn1. The heap overflow happens in the function _asn1_extract_der_octet() (CVE-2015-3622). | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | September 4, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2708, CVE-2015-0797, CVE-2015-2710, CVE-2015-2713) A heap-based buffer overflow flaw was found in the way Firefox processed compressed XML data. An attacker could create specially crafted compressed XML content that, when processed by Firefox, could cause it to crash or execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2716) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2015-2709 CVE-2015-2711 CVE-2015-2712 CVE-2015-2715 CVE-2015-2717 CVE-2015-2718 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | September 4, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2711 (Referrer policy ignored when links opened by middle-click and context menu): Security researcher Alex Verstak reported that <meta name="referrer"> is ignored when a link is opened through the context menu or a middle-click by mouse. This means that, in some situations, the referrer policy is ignored when opening links in new tabs and may cause some pages to open without an HTTP Referer header being set according to the author's intended policy. - CVE-2015-2712 (Out-of-bounds read and write in asm.js validation): Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data. - CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation during shutdown): Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when triggered. - CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing MP4 video metadata): Security researcher laf.intel reported a buffer overflow and out-of-bounds read in the libstagefright library while parsing invalid metadata in MP4 video files. This can lead to a potentially exploitable crash. - CVE-2015-2718 (Untrusted site hosting trusted page can intercept webchannel responses): Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm handles message traffic. He found that when a trusted page is hosted within an <iframe> on an untrusted third-party untrusted framing page, the untrusted page could intercept webchannel responses meant for the trusted page, bypassing origin restrictions. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
netcf: denial of service
| Package(s): | netcf | CVE #(s): | CVE-2014-8119 | ||||||||||||||||||||||||
| Created: | May 11, 2015 | Updated: | December 22, 2015 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A flaw was found in the way the netcf's find_ifcfg_path() function processed certain XPath expressions. An attacker able to supply a specially crafted XML file to an application using netcf could cause that application to crash. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
openssl: re-enable TLSv1.2 by default
| Package(s): | openssl | CVE #(s): | |||||
| Created: | May 12, 2015 | Updated: | May 13, 2015 | ||||
| Description: | From the Ubuntu advisory:
For compatibility reasons, Ubuntu 12.04 LTS shipped OpenSSL with TLSv1.2 disabled when being used as a client. This update re-enables TLSv1.2 by default now that the majority of problematic sites have been updated to fix compatibility issues. For problematic environments, TLSv1.2 can be disabled again by setting the OPENSSL_NO_CLIENT_TLS1_2 environment variable before library initialization. | ||||||
| Alerts: |
| ||||||
pcre: code execution
| Package(s): | pcre | CVE #(s): | CVE-2015-2325 CVE-2015-2326 | ||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2015 | Updated: | May 13, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
* CVE-2015-2325: Specially crafted regular expressions could have caused a heap buffer overflow in compile_branch(), potentially allowing the execution of arbitrary code. (boo#924960) * CVE-2015-2326: Specially crafted regular expressions could have caused a heap buffer overflow in pcre_compile2(), potentially allowing the execution of arbitrary code. [boo#924961] | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
pcs: privilege escalation
| Package(s): | pcs | CVE #(s): | CVE-2015-1848 | ||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | June 5, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forge cookies and bypass authorization checks, possibly gaining elevated privileges in the pcsd web UI. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
realmd: unsanitized input
| Package(s): | realmd | CVE #(s): | CVE-2015-2704 | ||||||||||||
| Created: | May 8, 2015 | Updated: | December 22, 2015 | ||||||||||||
| Description: | From the bug report: realmd configures sssd.conf and smb.conf. No data that was retrieved before join (and the point where mutual trust, sealing is established) should be used when configuring sssd.conf and/or smb.conf. | ||||||||||||||
| Alerts: |
| ||||||||||||||
ruby-redcarpet: cross-site scripting
| Package(s): | ruby-redcarpet | CVE #(s): | |||||
| Created: | May 12, 2015 | Updated: | May 13, 2015 | ||||
| Description: | From the Mageia advisory:
Redcarpet allows for possible XSS of untrusted markdown if the autolink extension is enabled. | ||||||
| Alerts: |
| ||||||
springframework: information disclosure
| Package(s): | springframework | CVE #(s): | CVE-2014-0225 | ||||||||
| Created: | May 8, 2015 | Updated: | May 13, 2015 | ||||||||
| Description: | From the bug report: When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. By observing differences in response times, an attacker could then identify valid IP addresses on the internal network with functioning web servers. | ||||||||||
| Alerts: |
| ||||||||||
suricata: denial of service
| Package(s): | suricata | CVE #(s): | CVE-2015-0971 | ||||||||||||
| Created: | May 11, 2015 | Updated: | June 1, 2015 | ||||||||||||
| Description: | From the Debian advisory:
Kostya Kortchinsky of the Google Security Team discovered a flaw in the DER parser used to decode SSL/TLS certificates in suricata. A remote attacker can take advantage of this flaw to cause suricata to crash. | ||||||||||||||
| Alerts: |
| ||||||||||||||
testdisk: multiple vulnerabilities
| Package(s): | testdisk | CVE #(s): | |||||||||
| Created: | May 8, 2015 | Updated: | May 13, 2015 | ||||||||
| Description: | TestDisk 7.0 has multiple unspecified security fixes from Coverity scans and fuzzing, as well as a report linked from the release notes of a code execution vulnerability via a stack buffer overflow. | ||||||||||
| Alerts: |
| ||||||||||
texlive: predictable filenames
| Package(s): | texlive | CVE #(s): | |||||
| Created: | May 13, 2015 | Updated: | May 13, 2015 | ||||
| Description: | From the Red Hat bugzilla:
It was reported that mktexlsr script uses /tmp in an insecure way. This is insecure because the filename is predictable and, more importantly, the program doesn't fail atomically if the file already exists. | ||||||
| Alerts: |
| ||||||
tomcat6: denial of service
| Package(s): | tomcat6 | CVE #(s): | CVE-2014-0230 | ||||||||||||||||||||
| Created: | May 13, 2015 | Updated: | May 13, 2015 | ||||||||||||||||||||
| Description: | From the Arch Linux advisory:
When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
zeromq3: security bypass
| Package(s): | zeromq3 | CVE #(s): | CVE-2014-9721 | ||||||||||||
| Created: | May 11, 2015 | Updated: | June 11, 2015 | ||||||||||||
| Description: | From the Debian advisory:
It was discovered that libzmq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers. | ||||||||||||||
| Alerts: |
| ||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>