Security
Nested NMIs lead to CVE-2015-3290
Non-maskable interrupts (or NMIs) are a hardware feature that is typically used to signal hardware errors or other unrecoverable faults. They differ from regular interrupts in that they can occur when interrupts are otherwise blocked (i.e. they are not maskable). NMIs can be caused by user-space programs, though, so their handling in the kernel needs to be bulletproof or it can lead to security holes. Since the beginning of 2014, it would seem that NMI handling has been subject to races that allow user-space programs to elevate their privileges—a bug that is known as CVE-2015-3290.
NMIs are used by profiling and debugging tools, such as perf, to determine where in the code the CPU is currently executing. NMIs also get nested, effectively, when an NMI handler causes an exception like a breakpoint or a page fault. Handling that nesting is complicated, which is what went astray and led to the bug.
The first notification about the problem came in a July 22 post to the oss-security mailing list from
Andy Lutomirski about
a number of NMI-handling security bugs. All are security-related, but one
was embargoed to allow distributions to fix it before releasing any
details.
So he mentioned CVE-2015-3290 without
giving any details, though he did include something of a warning: "*Patch
your systems*
".
The details came in a post-embargo advisory from Lutomirski on August 4. In some detail, he described the problem, but also provided a proof-of-concept program to tickle the bug. It requires that user space be able to do two things: arrange for nested NMIs to occur and for those NMIs return to a 16-bit stack, which is normally done for running 16-bit binaries using programs like DOSEMU. A 16-bit stack can be arranged via the modify_ldt() system call. One way to generate the NMIs required is to be run with a heavy perf load, as the proof-of-concept exploit suggests.
The Linux nested-NMI handling relies on a small section of code that needs to be run atomically. That works fine on x86_64 when using iret to return to a 64-bit stack (which effectively does the needed steps in an atomic manner), but when the NMI is returning to a segment with a 16-bit stack, iret does not restore the register state correctly. So the kernel has a workaround (called "espfix64") that tries to handle that situation by doing a complicated stack-switching dance.
That stack switching is where the problem lies. There are approximately 19 instructions where a second (i.e. nested) NMI will cause the "atomic" section to not be atomic. Furthermore, an attacker who can arrange (or luck into) landing in a two-instruction window in those instructions will be able to reliably elevate their privileges to that of root. During that window, the attacker controls the address where the return from interrupt will go. Outside of the window, a nested NMI will cause various failures and crashes, which Lutomirski's exploit will fix up while it waits for one to hit the window:
The espfix64 code was added in Linux 3.13, which was released over a year and a half ago in January 2014. Given that Lutomirski's proof of concept works quickly, that means there are (or, hopefully, were) a lot of systems that could be easily affected by this flaw.
The fix
uses a "sneaky trick
", according to Lutomirski. Instead of
checking the value of the 64-bit stack pointer register (i.e. RSP) to
see if it points at the NMI stack to determine if there is a nested NMI, a
different test is used. As he pointed out, malicious user-space code could
point RSP there, issue a system call, then cause an NMI to happen,
which would fool the kernel into believing it was processing a nested NMI
when it wasn't.
Lutomirski uses the fact that the "direction flag" (DF) bit in the FLAGS register is atomically reset by the iret instruction, so he sets that bit to indicate that the kernel is processing an NMI. His fix also changes the system-call entry point so that a user-space program cannot set DF while it still controls the value of RSP.
CVE-2015-3290 and the rest of the NMI-handling problems that Lutomirski has found seem a little concerning, overall. NMIs are complex beasties and their handling even more so. It would be surprising if there are not other problems lurking there. But, for now, taking Lutomirski's advice should be high on everyone's list.
Brief items
Security quotes of the fortnight
The search engine had previously removed links relating to a 10 year-old criminal offence by an individual after requests made under the right to be forgotten ruling. Removal of those links from Google’s search results for the claimant’s name spurred new news posts detailing the removals, which were then indexed by Google’s search engine.
Google refused to remove links to these later news posts, which included details of the original criminal offence, despite them forming part of search results for the claimant’s name, arguing that they are an essential part of a recent news story and in the public interest.
An EU spokesperson noted that upon finalization of this global RTBF [right to be forgotten] censorship order, all search and other references to articles, stories, or other materials describing this order, including this posting, would be retroactively deleted.
The winner(s) will be invited to a special edition of the Journal of Craptology (JoC). The first prize is a bottle of premium snake oil, and 100 trillion ZWR (Third Zimbabwean Dollar), equivalent to 1027 ZWD (First Zimbabwean Dollar). The loser will also be invited to the JoC.
I've never understood the argument that terrorists are too dangerous to house in US prisons. They're just terrorists, it's not like they're Magneto.
Stagefright: Mission Accomplished? (Exodus Intelligence)
It would seem that reports of the demise of the Stagefright Android vulnerability may be rather premature. Exodus Intelligence is reporting that at least one of the fixes for integer overflow did not actually fully fix the problem, so MPEG4 files can still crash Android and potentially allow code execution. "Around July 31st, Exodus Intelligence security researcher Jordan Gruskovnjak noticed that there seemed to be a severe problem with the proposed patch. As the code was not yet shipped to Android devices, we had no ability to verify this authoritatively. In the following week, hackers converged in Las Vegas for the annual Black Hat conference during which the Stagefright vulnerability received much attention, both during the talk and at the various parties and events. After the festivities concluded and the supposedly patched firmware was released to the public, Jordan proceeded to investigate whether his assumptions regarding its fallibility were well founded. They were."
Ruoho: Multiple Vulnerabilities in Pocket
On his blog, Clint Ruoho reports on multiple vulnerabilities he found in the Pocket service that saves articles and other web content for reading later on a variety of devices. Pocket integration has been controversially added to Firefox recently, which is what drew his attention to the service. "The full output from server-status then was synced to my Android, and was visible when I switched from web to article view. Apache’s mod_status can provide a great deal of useful information, such as internal source and destination IP address, parameters of URLs currently being requested, and query parameters. For Pocket’s app, the URLs being requested include URLs being viewed by users of the Pocket application, as some of these requests are done as HTTP GETs. These details can be omitted by disabling ExtendedStatus in Apache. Most of Pocket’s backend servers had ExtendedStatus disabled, however it remained enabled on a small subset, which would provide meaningful information to attackers." He was able to get more information, such as the contents of /etc/passwd on Pocket's Amazon EC2 servers. (Thanks to Scott Bronson and Pete Flugstad.)
Reports from the Linux Security Summit
The Linux Security Summit was held August 20-21 in Seattle, Washington. Unfortunately, that overlapped Linux Plumbers Conference, so LWN was unable to attend. But both James Morris and Paul Moore have nice writeups of the summit. From Morris's: "As with the previous year, we followed a two-day format, with most of the refereed presentations on the first day, with more of a developer focus on the second day. We had good attendance, and also this year had participants from a wider field than the more typical kernel security developer group. We hope to continue expanding the scope of participation next year, as it’s a good opportunity for people from different areas of security, and FOSS, to get together and learn from each other. This was the first year, for example, that we had a presentation on Incident Response, thanks to Sean Gillespie who presented on GRR, a live remote forensics tool initially developed at Google."
New vulnerabilities
audit: unsafe escape-sequence handling
| Package(s): | audit | CVE #(s): | CVE-2015-5186 | ||||||||||||
| Created: | August 19, 2015 | Updated: | August 31, 2015 | ||||||||||||
| Description: | From the CVE entry: When auditing the filesystem the names of files are logged. These filenames can contain escape sequences, when viewed using the ausearch programs "-i" option for example this can result in the escape sequences being processed unsafely by the terminal program being used to view the data. | ||||||||||||||
| Alerts: |
| ||||||||||||||
conntrack: denial of service
| Package(s): | conntrack | CVE #(s): | CVE-2015-6496 | ||||||||||||||||||||||||
| Created: | August 20, 2015 | Updated: | January 4, 2016 | ||||||||||||||||||||||||
| Description: | From the Debian advisory:
It was discovered that in certain configurations, if the relevant conntrack kernel module is not loaded, conntrackd will crash when handling DCCP, SCTP or ICMPv6 packets. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
extplorer: cross-site scripting
| Package(s): | extplorer | CVE #(s): | CVE-2015-0896 | ||||||||
| Created: | August 24, 2015 | Updated: | May 4, 2016 | ||||||||
| Description: | From the CVE entry:
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||||||||
| Alerts: |
| ||||||||||
firefox: multiple vulnerabilities
| Package(s): | firefox | CVE #(s): | CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 CVE-2015-4495 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 17, 2015 | Updated: | December 2, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: |
* MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety
hazards
* MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with
malformed MP3 file
* MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream
playback
* MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of
non-configurable JavaScript object properties
* MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues
in libstagefright
* MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting
through Mozilla Maintenance Service with hard links (only affected
Windows)
* MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with
Updater and malicious MAR file (does not affect openSUSE RPM packages
which do not ship the updater)
* MFSA 2015-86/CVE-2015-4483 (bmo#1148732) Feed protocol with POST
bypasses mixed content protections
* MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared
memory in JavaScript
* MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf
when scaling bitmap images
* MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)
Buffer overflows on Libvpx when decoding WebM video
* MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities
found through code inspection
* MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla Content Security
Policy allows for asterisk wildcards in violation of CSP specification
* MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in
XMLHttpRequest with shared workers
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
golang: HTTP request smuggling
| Package(s): | golang | CVE #(s): | CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 | ||||||||||||||||||||
| Created: | August 18, 2015 | Updated: | July 28, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
There have been found potentially exploitable flaws in Golang net/http library affecting versions 1.4.2 and 1.5.
Problems: | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
jasper: denial of service
| Package(s): | jasper | CVE #(s): | CVE-2015-5203 | ||||||||||||||||||||||||||||||||||||
| Created: | August 26, 2015 | Updated: | September 19, 2016 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
A double free issue has been discovered in the function jasper_image_stop_load. This vulnerability can be triggered by loading a specially crafted image through jasper. A remote attacker is able to send a specially crafted image that triggers a double free leading to denial of service. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
kdepim: no attachment encryption
| Package(s): | kdepim | CVE #(s): | CVE-2014-8878 | ||||
| Created: | August 18, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the Mageia advisory:
This update fixes a security vulnerability in kdepim : kmail doesn't encrypt attachments when "automatic encryption" is selected | ||||||
| Alerts: |
| ||||||
libstruts1.2-java: unclear vulnerability
| Package(s): | libstruts1.2-java | CVE #(s): | CVE-2014-0899 |
| Created: | August 18, 2015 | Updated: | August 26, 2015 |
| Description: | From the Debian-LTS advisory:
The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web application may be vulnerable even when this function is not used explicitly. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
mediawiki: multiple vulnerabilities
| Package(s): | mediawiki | CVE #(s): | |
| Created: | August 24, 2015 | Updated: | August 26, 2015 |
| Description: | From the Mediawiki advisory:
I would like to announce the release of MediaWiki 1.25.2, 1.24.3, and 1.23.10. * Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList. * Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf. * John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss. Additionally, several extensions have been updated to fix security issues. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
mysql: unspecified vulnerability
| Package(s): | rh-mysql56-mysql | CVE #(s): | CVE-2015-4756 | ||||||||||||||||
| Created: | August 17, 2015 | Updated: | August 26, 2015 | ||||||||||||||||
| Description: | From the Red Hat advisory:
CVE-2015-4756 mysql: unspecified vulnerability related to Server:InnoDB | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
nagios-plugins: three vulnerabilities
| Package(s): | nagios-plugins | CVE #(s): | CVE-2014-4702 CVE-2014-4701 CVE-2014-4703 | ||||||||
| Created: | August 18, 2015 | Updated: | August 26, 2015 | ||||||||
| Description: | From a Red Hat bugzilla entry:
CVE-2014-4702: Similar to the CVE-2014-4701 issue in the check_dhcp plug-in, the same flaw was found to affect check_icmp. A local attacker could obtain sensitive information by using this flaw to read parts of INI configuration files that belong to the root user. From another Red Hat bugzilla entry: CVE-2014-4701, CVE-2014-4703: It was reported that check_dhcp plugin allow local unprivileged user to read parts of INI config files belonging to root on a local system. It could allow an attacker to obtain sensitive information like passwords that should only be accessible by root user. The vulnerability is due to check_dhcp plugin having Root SUID permissions and inappropriate access control when reading user provided config file (through --extra-opts= option). | ||||||||||
| Alerts: |
| ||||||||||
net-snmp: code execution
| Package(s): | net-snmp | CVE #(s): | CVE-2015-5621 | ||||||||||||||||||||||||||||||||||||||||
| Created: | August 18, 2015 | Updated: | September 8, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd. (CVE-2015-5621) | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
openshift: privilege escalation
| Package(s): | openshift | CVE #(s): | CVE-2015-5222 | ||||
| Created: | August 21, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the Red Hat advisory:
An improper permission check issue was discovered in the server admission control component in OpenShift. A user with build permissions could use this flaw to execute arbitrary shell commands on a build pod with the privileges of the root user. | ||||||
| Alerts: |
| ||||||
openssh: multiple vulnerabilities
| Package(s): | openssh | CVE #(s): | CVE-2015-6565 CVE-2015-6563 CVE-2015-6564 | ||||||||||||||||||||||||||||||||||||
| Created: | August 19, 2015 | Updated: | August 26, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the OpenSSH release notes: sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world- writable. Local attackers may be able to write arbitrary messages to logged-in users, including terminal escape sequences. Reported by Nikolay Edigaryev. (CVE-2015-6565) sshd(8): Portable OpenSSH only: Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users. Reported by Moritz Jodeit. (CVE-2015-6563) sshd(8): Portable OpenSSH only: Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution. Also reported by Moritz Jodeit. (CVE-2015-6564) | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
openstack-neutron: denial of service
| Package(s): | openstack-neutron | CVE #(s): | CVE-2015-3221 | ||||
| Created: | August 25, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the Red Hat advisory:
A Denial of Service flaw was found in the L2 agent when using the IPTables firewall driver. By submitting an address pair that will be rejected as invalid by the ipset tool, an attacker may cause the agent to crash. | ||||||
| Alerts: |
| ||||||
owncloud: three vulnerabilities
| Package(s): | owncloud | CVE #(s): | CVE-2015-4715 CVE-2015-4717 CVE-2015-4718 | ||||||||
| Created: | August 14, 2015 | Updated: | August 26, 2015 | ||||||||
| Description: | From the Mageia advisory:
In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted (CVE-2015-4715). In ownCloud before 6.0.8 and 8.0.4, the sanitization component for filenames was vulnerable to DoS when parsing specially crafted file names passed via specific endpoints. Effectively this lead to a endless loop filling the log file until the system is not anymore responsive (CVE-2015-4717). In ownCloud before 6.0.8 and 8.0.4, the external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ";" character which is interpreted as command separator by smbclient (the used software to connect to SMB shared by ownCloud). Effectively this allows an attacker to gain access to any file on the system or overwrite it, finally leading to a PHP code execution in the case of ownCloud’s config file (CVE-2015-4718). | ||||||||||
| Alerts: |
| ||||||||||
pcre: code execution
| Package(s): | pcre | CVE #(s): | CVE-2015-8381 | ||||||||||||||||||||||||||||||||||||||||
| Created: | August 14, 2015 | Updated: | December 2, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
Latest version of PCRE is prone to a Heap Overflow vulnerability which could caused by the following regular expression.
/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/
| ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | |
| Created: | August 24, 2015 | Updated: | August 26, 2015 |
| Description: | The php package has been updated to version 5.6.12, fixing several bugs and security issues. See the upstream Changelog for more details.
Also 5.5.28 has been released: upstream changelog. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
python-django: multiple vulnerabilities
| Package(s): | python-django | CVE #(s): | CVE-2015-5963 CVE-2015-5964 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 19, 2015 | Updated: | October 16, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory: Lin Hua Cheng discovered that a session could be created when anonymously accessing the django.contrib.auth.views.logout view. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted. Additionally the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session as well. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
python-django-horizon: cross-site scripting
| Package(s): | python-django-horizon | CVE #(s): | CVE-2015-3219 CVE-2015-3988 | ||||||||
| Created: | August 25, 2015 | Updated: | August 26, 2015 | ||||||||
| Description: | From the CVE entries:
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class. (CVE-2015-3219) Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate. (CVE-2015-3988) | ||||||||||
| Alerts: |
| ||||||||||
qemu: two vulnerabilities
| Package(s): | qemu | CVE #(s): | CVE-2015-5166 CVE-2015-5165 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 18, 2015 | Updated: | September 28, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From a Red Hat bugzilla entry:
CVE-2015-5165: Qemu emulator built with the RTL8139 emulation support is vulnerable to an information leakage flaw. It could occur while processing network packets under RTL8139 controller's C+ mode of operation. A guest user could use this flaw to read uninitialised Qemu heap memory upto 65K bytes. From another Red Hat bugzilla entry: CVE-2015-5166: Qemu emulator built with the IDE Emulation PCI PIIX3/4 support is vulnerable to a use-after-free flaw. It could occur when trying to write data to an I/O port inside guest. This issue is specific to the Xen platform. A privileged(CAP_SYS_RAWIO) guest user on the Xen platform could use this flaw to crash the Qemu instance or probably attempt to make a guest escape. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
request-tracker4: cross-site scripting
| Package(s): | request-tracker4 | CVE #(s): | CVE-2015-5475 | ||||||||||||
| Created: | August 13, 2015 | Updated: | August 26, 2015 | ||||||||||||
| Description: | From the Debian advisory:
It was discovered that Request Tracker, an extensible trouble-ticket tracking system is susceptible to a cross-site scripting attack via the user [and] group rights management pages (CVE-2015-5475) and via the cryptography interface, allowing an attacker with a carefully-crafted key to inject JavaScript into RT's user interface. Installations which use neither GnuPG nor S/MIME are unaffected by the second cross-site scripting vulnerability. | ||||||||||||||
| Alerts: |
| ||||||||||||||
roundup: multiple vulnerabilities
| Package(s): | roundup | CVE #(s): | CVE-2012-6130 CVE-2012-6131 CVE-2012-6132 CVE-2012-6133 | ||||
| Created: | August 24, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the CVE entries:
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. (CVE-2012-6130) Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. (CVE-2012-6131) Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. (CVE-2012-6132) From the Debian LTS advisory:
XSS flaws in ok and error messages | ||||||
| Alerts: |
| ||||||
ruby: information disclosure
| Package(s): | ruby1.8 | CVE #(s): | CVE-2009-5147 | ||||||||||||||||||||
| Created: | August 26, 2015 | Updated: | December 17, 2015 | ||||||||||||||||||||
| Description: | From the Debian LTS advisory:
"sheepman" fixed a vulnerability in Ruby 1.8: DL::dlopen could open a library with tainted name even if $SAFE > 0. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
strongswan: incorrect payload processing
| Package(s): | strongswan | CVE #(s): | CVE-2015-3991 | ||||||||
| Created: | August 19, 2015 | Updated: | August 26, 2015 | ||||||||
| Description: | From the Fedora advisory: Incorrect payload processing for different IKE versions. | ||||||||||
| Alerts: |
| ||||||||||
twig: code execution
| Package(s): | twig | CVE #(s): | |||||
| Created: | August 26, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the Debian advisory:
James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input. End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates. | ||||||
| Alerts: |
| ||||||
uwsgi: denial of service
| Package(s): | uwsgi | CVE #(s): | |||||||||
| Created: | August 18, 2015 | Updated: | August 26, 2015 | ||||||||
| Description: | From the uwsgi announcement:
Hi, an emergency release fixing an HTTPS resource leak (spotted by André Cruz) is available http://uwsgi-docs.readthedocs.org/en/latest/Changelog-2.0.11.1.html If you use the uWSGI https router you should upgrade to avoid excessive file descriptors and memory allocation. | ||||||||||
| Alerts: |
| ||||||||||
virtualbox: unspecified vulnerability
| Package(s): | virtualbox | CVE #(s): | CVE-2015-2594 | ||||||||||||
| Created: | August 18, 2015 | Updated: | September 14, 2015 | ||||||||||||
| Description: | From the SUSE bug tracker:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. | ||||||||||||||
| Alerts: |
| ||||||||||||||
vlc: code execution
| Package(s): | vlc | CVE #(s): | CVE-2015-5949 | ||||||||||||||||||||
| Created: | August 20, 2015 | Updated: | February 17, 2016 | ||||||||||||||||||||
| Description: | From the Debian advisory:
Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a multimedia player and streamer, could dereference an arbitrary pointer due to insufficient restrictions on a writable buffer. This could allow remote attackers to execute arbitrary code via crafted 3GP files. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
webkitgtk4: three unspecified vulnerabilities
| Package(s): | webkitgtk4 | CVE #(s): | |||||
| Created: | August 18, 2015 | Updated: | August 26, 2015 | ||||
| Description: | From the Fedora advisory:
WebKitGTK+ 2.8.5 includes fixes for 3 security issues. | ||||||
| Alerts: |
| ||||||
wireshark: multiple vulnerabilities
| Package(s): | wireshark | CVE #(s): | |
| Created: | August 24, 2015 | Updated: | August 26, 2015 |
| Description: | From the openSUSE advisory:
Wireshark was updated to fix several security vulnerabilities and bugs. - Wireshark 1.12.7 [boo#941500] The following vulnerabilities have been fixed: * Wireshark could crash when adding an item to the protocol tree. wnpa-sec-2015-21 * Wireshark could attempt to free invalid memory. wnpa-sec-2015-22 * Wireshark could crash when searching for a protocol dissector. wnpa-sec-2015-23 * The ZigBee dissector could crash. wnpa-sec-2015-24 * The GSM RLC/MAC dissector could go into an infinite loop. wnpa-sec-2015-25 * The WaveAgent dissector could crash. wnpa-sec-2015-26 * The OpenFlow dissector could go into an infinite loop. wnpa-sec-2015-27 * Wireshark could crash due to invalid ptvcursor length checking. wnpa-sec-2015-28 * The WCCP dissector could crash. wnpa-sec-2015-29 * Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.... | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
zendframework: XML external entity attack
| Package(s): | zendframework | CVE #(s): | CVE-2015-5161 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 20, 2015 | Updated: | September 15, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>