Security
Shifting feature sets and search engines in Tor Browser 6
The Tor project has released version 6.0 of Tor Browser. As usual, the new release brings Tor Browser's feature set up to date with the most recent Extended Support Release (ESR) version of Firefox (on which Tor Browser is based) and adds some new privacy features. But 6.0 also makes some changes that users may want to be aware of. It drops Disconnect as the default search engine and it disables several recent Firefox features—including the privacy-focused Tracking Protection feature. Those changes might sound like regressions on the privacy front, but they were mandated by the ever-shifting landscape of web services.
Tor Browser 6.0 is based on Firefox 45 ESR, which was released in March 2016. The Tor Browser announcement notes that the update should improve the performance of HTML5 video playback. There are, of course, many other improvements bundled into the updated Firefox—some of which cause problems for Tor Browser users, rather than enhancing their web-browsing experience.
Consequently, several recently added Firefox features have been disabled in Tor Browser 6.0. The user-visible deletions include high-profile features like Mozilla's Shumway runtime for Flash content, the Firefox integration for the Pocket bookmark-sharing service, and the feedback and "health report" services that relay browser information back to Mozilla. In each of these instances, the privacy risk is easy to discern: Flash content can run arbitrary code, which makes it a risk regardless of whether Adobe's binary Flash plugin or Mozilla's Shumway executes it, and the other services all send browser information to remote servers.
There are also several less-visible features disabled in the new Tor Browser release. Multicast DNS support through libmdns, which could disclose the browser's location to other computers on the local network, has been disabled, as has the "Network Tickler" feature that was used in Firefox for Android to keep WiFi connections from timing out.
Several new vectors for browser fingerprinting and user tracking have also been found and disabled. They include support for the HTTP Alternative Services header (which can be exploited by supercookies), support for the mediaDevices.enumerateDevices method, and support for some WebGL methods known to be useful for fingerprinting. There have also been some changes to further guard against fingerprinting; for example, Tor Browser now spoofs the screen.orientation property.
Some of these features were first implemented in earlier Firefox releases but left disabled by default, then enabled in a subsequent Firefox update. The response from the Tor Browser developers typifies the process that they must engage in to keep on top of the constantly evolving set of APIs available in Firefox. Similarly, there are also some recent feature additions that Tor Browser has disabled even though it is not yet clear whether they constitute a security or privacy risk. One example is the mozTCPSocket API, which is meant to be used only by privileged processes to open TCP sockets.
Although the API is not known to pose a security risk, Tor Browser 6.0 disables it, pending a fuller security audit. Also disabled for the time being are the Reader View feature, the Push API (which is meant to be exposed only to Service Workers), and the <link rel=preconnect> resource hint, which is used to tell the browser to initiate an HTTP pre-connection for a soon-to-be-requested URI. The pre-connection includes a DNS lookup, TCP handshake, and (if needed) a TLS negotiation. Is it possible that this feature, like the others, will be re-enabled in a future Tor Browser release.
A potentially puzzling move, however, is that Tor Browser 6.0 disables Firefox Tracking Protection, a feature designed to safeguard user privacy by intercepting and blocking HTTP requests sent to domains listed on a secret blacklist curated by Mozilla. As it turns out, it is the blacklist that causes the trouble. In a comment on the bug report, Tor's George Kadianakis noted two objections. One is that Mozilla exempts certain known web trackers from the blacklist because blocking them would break the functionality of too many popular web sites. The other is described in a paper [PDF] (note: SSL certificate warning) Kadianakis linked to, which describes a method that tracking services could use to bypass the blacklist. The technique uses Apache's AliasMatch directive to serve the blacklisted content through several (or, indeed, a great many) customizable URLs.
Those objections may smack of "the perfect is the enemy of the good" to some users; after all, imperfect blacklisting is surely superior to no blacklisting at all. But "cypherpunks" indicated yet another problem: the presence of the blacklist can be used to fingerprint the browser. Ultimately, the site-breakage issue seems to be the one that made the decision final, but it would not be surprising if a significant number users find the lack of Tracking Protection to be a questionable choice.
Another change that may concern Tor Browser users is that the 6.0
release no longer uses Disconnect as the default search engine.
Disconnect is a meta-search engine that anonymizes search requests by
relaying the search terms to other search engines, then sanitizing the
results that it returns to the user (removing, for example,
web-tracking measures). But, in recent months, Disconnect searches have
evidently been blocked by Google, so the service has been falling back
to the Bing search engine. And, as the Tor Browser 6.0 release
announcement puts it, the results returned "were basically
unacceptable quality-wise.
" Consequently, Tor Browser now uses
DuckDuckGo as its default search engine, while the Disconnect team is
working to resolve its issues with Google.
There are several other interesting new features to be found in Tor Browser 6.0, including a keyboard shortcut to trigger the initialization of a new Tor circuit and one to clear all browser state, close all tabs, and initiate a new Tor circuit (a feature labeled "New Identity" in the Tor Browser interface). The browser has also dropped support for SHA-1 hashes on SSL certificates and has disabled the local logging of TLS/SSL key material. OS X builds are now signed; implementing this feature required changing the internal layout of the Mac application bundle.
Furthermore, Mozilla recently disabled hash checking for Firefox's update.xml file (which the browser fetches to see if a new release has been published and, if so, to get the new release's URL). Tor Browser has re-enabled that hash check, allowing it to verify that the update file has not been tampered with. Finally, Mozilla has now made signatures mandatory on browser extensions. Tor Browser disables the signature-checking feature for its own set of pre-installed extensions (such as HTTPS Everywhere).
Tor Browser is undoubtedly a project that many web users find valuable at least some portion of the time, even if they do not use it for all of their daily browsing. But it is interesting to observe how the project can find itself in the middle of a three-way arms race, with its developers doing their best to keep up not just with the site owners and service providers who are constantly finding new ways to violate the anonymity of users, but with Firefox as well, as Mozilla implements new features and changes browser behavior with every release—not always in ways that enhance user privacy.
Brief items
Security quotes of the week
Pretty much all more modern OS designs tend to have such a clear lifecycle btw: when the user is logged out, he's *really* logged out. And it's completely OK if certain users get [excluded] from that, but if so, then the admin needs to sign off on that, and thus a privilege check needs to be enforced.
But it's not entirely true. It's difficult, but we can analyze the cost-effectiveness of different security measures. We can compare them with each other. We can make estimations and decisions and optimizations. It's just not easy, and often it's more of an art than a science. But all is not lost.
Analog malicious hardware
Worth a read: this paper [PDF] From Kaiyuan Yang et al. on how an analog back door can be placed into a hardware platform like a CPU. "In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before effecting [sic] a chip’s functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transition between digital values. When the capacitors fully charge, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely-controllable privilege escalation by attaching the capacitor to a wire controllable and by selecting a victim flip-flop that holds the privilege bit for our processor."
Hertz: Abusing privileged and unprivileged Linux containers
This white paper by Jesse Hertz [PDF] examines various ways to compromise and escape from containers on Linux systems. "A common configuration for companies offering PaaS solutions built on containers is to have multiple customers’ containers running on the same physical host. By default, both LXC and Docker setup container networking so that all containers share the same Linux virtual bridge. These containers will be able to communicate with each other. Even if this direct network access is disabled (using the –icc=false flag for Docker, or using iptables rules for LXC), containers aren’t restricted for link-layer traffic. In particular, it is possible (and in fact quite easy) to conduct an ARP spoofing attack on another container within the same host system, allowing full middle-person attacks of the targeted container’s traffic."
New vulnerabilities
bozohttpd: two vulnerabilities
| Package(s): | bozohttpd | CVE #(s): | CVE-2014-5015 CVE-2015-8212 | ||||
| Created: | May 26, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian-LTS advisory:
CVE-2014-5015: Bozotic HTTP server (aka bozohttpd) before 201407081 truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path. CVE-2015-8212: A flaw in CGI suffix handler support was found, if the -C option has been used to setup a CGI handler, that could result in remote code execution. | ||||||
| Alerts: |
| ||||||
chromium: multiple vulnerabilities
| Package(s): | chromium | CVE #(s): | CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683 CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | July 18, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-1672: Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski. - CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1674: Cross-origin bypass in extensions. Credit to Mariusz Mlynski. - CVE-2016-1675: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1676: Cross-origin bypass in extension bindings. Credit to Rob Wu. - CVE-2016-1677: Type confusion in V8. Credit to Guang Gong of Qihoo 360. - CVE-2016-1678: Heap overflow in V8. Credit to Christian Holler. - CVE-2016-1679: Heap use-after-free in V8 bindings. Credit to Rob Wu. - CVE-2016-1680: Heap use-after-free in Skia. Credit to Atte Kettunen of OUSPG. - CVE-2016-1681: Heap overflow in PDFium. Credit to Aleksandar Nikolic of Cisco Talos. - CVE-2016-1682: CSP bypass for ServiceWorker. Credit to KingstonTime. - CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas Gregoire. - CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire. - CVE-2016-1685: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. - CVE-2016-1686: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. - CVE-2016-1687: Information leak in extensions. Credit to Rob Wu. - CVE-2016-1688: Out-of-bounds read in V8. Credit to Max Korenko. - CVE-2016-1689: Heap buffer overflow in media. Credit to Atte Kettunen of OUSPG. - CVE-2016-1690: Heap use-after-free in Autofill. Credit to Rob Wu. - CVE-2016-1691: Heap buffer-overflow in Skia. Credit to Atte Kettunen of OUSPG. - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker. Credit to Til Jasper Ullrich. - CVE-2016-1693: HTTP Download of Software Removal Tool. Credit to Khalil Zhani. - CVE-2016-1694: HPKP pins removed on cache clearance. Credit to Ryan Lester and Bryant Zadegan. - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
gd: information leak
| Package(s): | gd | CVE #(s): | CVE-2016-5116 | ||||||||||||||||||||||||
| Created: | June 2, 2016 | Updated: | June 8, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
While creating an XBM image (imagexbm) with an user supplied name, libgd isn't checking the vsnprintf return value and PHP 5.5 will trust this length and read more memory than it should, causing a read-out-of boundaries, leaking stack memory. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
glibc: privilege escalation
| Package(s): | eglibc, glibc | CVE #(s): | CVE-2016-2856 | ||||||||
| Created: | May 26, 2016 | Updated: | June 2, 2016 | ||||||||
| Description: | From the Ubuntu advisory:
Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856) | ||||||||||
| Alerts: |
| ||||||||||
imagemagick: command execution
| Package(s): | imagemagick graphicsmagick | CVE #(s): | CVE-2016-5118 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 22, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Slackware advisory:
Removed popen() support to prevent another shell vulnerability. This issue was discovered by Bob Friesenhahn, of the GraphicsMagick project. From the Debian advisory: Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
jenkins: multiple vulnerabilities
| Package(s): | jenkins | CVE #(s): | CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724 CVE-2016-3725 CVE-2016-3726 CVE-2016-3727 | ||||||||||||||||
| Created: | May 27, 2016 | Updated: | June 7, 2016 | ||||||||||||||||
| Description: | From the Fedora advisory: CVE-2016-3721: Arbitrary build parameters are passed to build scripts as environment variables. CVE-2016-3722: Malicious users with multiple user accounts can prevent other users from logging in. CVE-2016-3723: Information on installed plugins exposed via API. CVE-2016-3724: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration. CVE-2016-3725: Regular users can trigger download of update site metadata. CVE-2016-3726: Open redirect to scheme-relative URLs. CVE-2016-3727: Granting the permission to read node configurations allows access to overall system configuration. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: information disclosure
| Package(s): | kernel | CVE #(s): | CVE-2016-2117 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 1, 2016 | Updated: | August 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-4913 CVE-2016-4440 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 2, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem. (CVE-2016-4913) From the Red Hat bugzilla: Linux kernel built with the Kernel-based virtual machine(CONFIG_KVM) along with Hyper-v Synthetic Interrupt Controller(SynIC) support is vulnerable to an undue APIC register access issue. In that a guest with SynIC enabled, could gain access to host's Machine Specific Registers(MSR). A privileged user inside guest could use this flaw to crash the host kernel resulting in DoS OR potentially leverage it to escalate privileges on the host. (CVE-2016-4440) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2016-4951 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 2, 2016 | Updated: | June 9, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kf5-kinit: privilege escalation
| Package(s): | kf5-kinit | CVE #(s): | CVE-2016-3100 | ||||||||
| Created: | May 31, 2016 | Updated: | July 6, 2016 | ||||||||
| Description: | From the Fedora advisory:
Followup xauth (security-related) permissions fix, less racy. See also http://bugs.kde.org/358593. From the openSUSE bug report: It was found that kdeinit5 creates /tmp/xauth-xxx-_y with inappropriate permission, which are 644 instead of 600. This can be exploited by stealing X11 cookie and running X11 keylogger. Malicious user is able to read key strokes of a different user which might be a sudo user. If attacker can log key events of a sudo user then it can lead to local privilege escalation. | ||||||||||
| Alerts: |
| ||||||||||
libfpx: denial of service
| Package(s): | libfpx | CVE #(s): | CVE-2012-0025 | ||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the CVE entry:
Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image. | ||||||
| Alerts: |
| ||||||
libgd2: denial of service
| Package(s): | libgd2 | CVE #(s): | CVE-2015-8877 | ||||||||||||||||||||||||||||||||
| Created: | May 27, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the CVE entry: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function. ( CVE-2015-8877) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
libimobiledevice: sockets listening on INADDR_ANY
| Package(s): | libimobiledevice libusbmuxd | CVE #(s): | CVE-2016-5104 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | January 30, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that libimobiledevice and libusbmuxd libraries accidentally bound a listening IPv4 TCP socket to INADDR_ANY instead of INADDR_LOOPBACK. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
libxml2: multiple vulnerabilities
| Package(s): | libxml2 | CVE #(s): | CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-4483 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 27, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: CVE-2016-1762 (denial of service) A vulnerability has been discovered that allows remote attackers to cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1833 (denial of service) A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read. CVE-2016-1834 (arbitrary code execution) It has been discovered that a heap-buffer-overflow could happen in xmlStrncat. CVE-2016-1835 (arbitrary code execution) It has been discovered that a maliciously crafted file could cause the application to crash due to a heap use-after-free in xmlSAX2AttributeNs. CVE-2016-1836 (arbitrary code execution) It has been discovered that a heap-use-after free can happen in the xmlDictComputeFastKey. CVE-2016-1837 (arbitrary code execution) It has been discovered that a maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral. CVE-2016-1838 (denial of service) It has been discovered that a heap-based buffer overread could happen in xmlParserPrintFileContextInternal CVE-2016-1839 (denial of service) It has been discovered that a heap-based buffer overread could happen in xmlDictAddString. CVE-2016-1840 (arbitrary code execution) It has been discovered that a heap-buffer overflow could happen in xmlFAParsePosCharGroup CVE-2016-4483 (denial of service) It has been discovered that parsing a maliciously crafted XML file could cause the application to crash if recover mode is used. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libxml2: three vulnerabilities
| Package(s): | libxml2 | CVE #(s): | CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Slackware advisory:
Heap-based buffer underreads due to xmlParseName (CVE-2016-4447). Format string vulnerability (CVE-2016-4448). Inappropriate fetch of entities content (CVE-2016-4449). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
lxd: two vulnerabilities
| Package(s): | lxd | CVE #(s): | CVE-2016-1581 CVE-2016-1582 | ||||
| Created: | June 1, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Ubuntu advisory:
Robie Basak discovered that LXD incorrectly set permissions when setting up a loop based ZFS pool. A local attacker could use this issue to copy and read the data of any LXD container. (CVE-2016-1581) Robie Basak discovered that LXD incorrectly set permissions when switching an unprivileged container into privileged mode. A local attacker could use this issue to access any world readable path in the container directory, including setuid binaries. (CVE-2016-1582) | ||||||
| Alerts: |
| ||||||
mediawiki: multiple vulnerabilities
| Package(s): | mediawiki | CVE #(s): | |||||||||||||
| Created: | May 31, 2016 | Updated: | July 5, 2016 | ||||||||||||
| Description: | From the Mageia advisory:
The mediawiki package has been updated to version 1.23.14, which fixes multiple security issues and other bugs. See the release announcements for more details. https://lists.wikimedia.org/pipermail/mediawiki-announce/... https://lists.wikimedia.org/pipermail/mediawiki-announce/... | ||||||||||||||
| Alerts: |
| ||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | nss firefox | CVE #(s): | CVE-2015-2714 CVE-2016-1940 CVE-2016-1941 CVE-2016-1943 CVE-2016-1948 CVE-2016-1969 | ||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||
| Description: | From the CVE entries:
Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system, which allows attackers to obtain sensitive information via a crafted application that has a required permission for reading a log, as demonstrated by the READ_LOGS permission for the mixed-content violation log on Android 4.0 and earlier. (CVE-2015-2714) Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during (1) shortcut opening or (2) BOOKMARK intent processing. (CVE-2016-1940) The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended. (CVE-2016-1941) Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method. (CVE-2016-1943) Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to replace a theme's images and colors by modifying the client-server data stream. (CVE-2016-1948) The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font. (CVE-2016-1969) | ||||||||||
| Alerts: |
| ||||||||||
nginx: denial of service
| Package(s): | nginx | CVE #(s): | CVE-2016-4450 | ||||||||||||||||||||||||||||||||||||||||
| Created: | June 2, 2016 | Updated: | February 2, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
A vulnerability was found in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while handling the client request body. A remote attacker is able to use a specially crafted request to crash the worker resulting in denial of service. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
openafs: denial of service
| Package(s): | openafs | CVE #(s): | CVE-2015-8312 | ||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the CVE entry:
Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes. | ||||||
| Alerts: |
| ||||||
pdns: insecure database permissions
| Package(s): | pdns | CVE #(s): | CVE-2014-7210 | ||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian LTS advisory:
It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected. | ||||||
| Alerts: |
| ||||||
php: integer overflow
| Package(s): | php | CVE #(s): | CVE-2016-5094 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the PHP changelog:
Fixed bug #72135 (Integer Overflow in php_html_entities). (CVE-2016-5094) | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
php: two vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2016-5096 CVE-2016-5093 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
An integer underflow resulting into arbitrary null character write in fread/gzread function was found. (CVE-2016-5096) An out-of-bounds read vulnerability was found in get_icu_value_internal causes leakage of heap memory because of missing null character at the end of zend_string. (CVE-2016-5093) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
php: two vulnerabilities
| Package(s): | php5 | CVE #(s): | CVE-2015-8878 CVE-2015-8879 | ||||||||||||||||||||||||
| Created: | June 1, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||
| Description: | From the CVE entries:
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses. (CVE-2015-8878) The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table. (CVE-2015-8879) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
phpmyadmin: cross-site scripting
| Package(s): | phpmyadmin | CVE #(s): | CVE-2016-5099 | ||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
In phpMyAdmin before 4.4.15.6, a specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
phpmyadmin: two vulnerabilities
| Package(s): | phpMyAdmin | CVE #(s): | CVE-2016-5097 CVE-2016-5098 | ||||||||||||||||
| Created: | June 2, 2016 | Updated: | June 2, 2016 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
File Traversal Protection Bypass on Error Reporting (PMASA-2016-15): A specially crafted payload could result in the error reporting component exposing whether an arbitrary file exists on the file system and the size of that file. The attacker must be able to intercept and modify the user's POST data and must be able to trigger a JavaScript error to the user. This attack can be mitigated in affected installations by setting `$cfg['Servers'][$i]['SendErrorReports'] = 'never';`. Upgrading to a more recent development commit is suggested. (CVE-2016-5098) Sensitive Data in URL GET Query Parameters (PMASA-2016-14): Because user SQL queries are part of the URL, sensitive information made as part of a user query can be exposed by clicking on external links to attackers monitoring user GET query parameters or included in the webserver logs. As mitigation, avoid clicking on external links in phpMyAdmin which are not redirected through url.php script. Affects versions prior to 4.6.2. (CVE-2016-5097) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
postgresql: multiple vulnerabilities
| Package(s): | postgresql-9.1 | CVE #(s): | |||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian LTS advisory:
The PostgreSQL project released a new version of the PostgreSQL 9.1 branch: * Clear the OpenSSL error queue before OpenSSL calls, rather than assuming it's clear already; and make sure we leave it clear afterwards (Peter Geoghegan, Dave Vitek, Peter Eisentraut) This change prevents problems when there are multiple connections using OpenSSL within a single process and not all the code involved follows the same rules for when to clear the error queue. Failures have been reported specifically when a client application uses SSL connections in libpq concurrently with SSL connections using the PHP, Python, or Ruby wrappers for OpenSSL. It's possible for similar problems to arise within the server as well, if an extension module establishes an outgoing SSL connection. * Fix "failed to build any N-way joins" planner error with a full join enclosed in the right-hand side of a left join (Tom Lane) * Fix possible misbehavior of TH, th, and Y,YYY format codes in to_timestamp() (Tom Lane) These could advance off the end of the input string, causing subsequent format codes to read garbage. * Fix dumping of rules and views in which the array argument of a value operator ANY (array) construct is a sub-SELECT (Tom Lane) * Make pg_regress use a startup timeout from the PGCTLTIMEOUT environment variable, if that's set (Tom Lane) This is for consistency with a behavior recently added to pg_ctl; it eases automated testing on slow machines. * Fix pg_upgrade to correctly restore extension membership for operator families containing only one operator class (Tom Lane) In such a case, the operator family was restored into the new database, but it was no longer marked as part of the extension. This had no immediate ill effects, but would cause later pg_dump runs to emit output that would cause (harmless) errors on restore. * Rename internal function strtoi() to strtoint() to avoid conflict with a NetBSD library function (Thomas Munro) * Use the FORMAT_MESSAGE_IGNORE_INSERTS flag where appropriate. No live bug is known to exist here, but it seems like a good idea to be careful. | ||||||
| Alerts: |
| ||||||
qemu: two vulnerabilities
| Package(s): | qemu | CVE #(s): | CVE-2016-4439 CVE-2016-4441 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 6, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors. (CVE-2016-4439) The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command. (CVE-2016-4441) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ruby-mail: SMTP injection
| Package(s): | ruby-mail | CVE #(s): | |||||
| Created: | May 26, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian-LTS advisory:
Takeshi Terada (Mitsui Bussan Secure Directions, Inc.) released a whitepaper entitled "SMTP Injection via recipient email addresses" ( http://www.mbsd.jp/Whitepaper/smtpi.pdf). This whitepaper has a section discussing how one such vulnerability affected the 'mail' ruby gem (see section 3.1). Whitepaper has all the specific details, but basically the 'mail' ruby gem module is prone to the recipient attack as it does not validate nor sanitize given recipient addresses. Thus, the attacks described in chapter 2 of the whitepaper can be applied to the gem without any modification. The 'mail' ruby gem itself does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. This vulnerability affects only the applications that lack input validation. | ||||||
| Alerts: |
| ||||||
symfony: two vulnerabilities
| Package(s): | symfony | CVE #(s): | CVE-2016-1902 CVE-2016-4423 | ||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian advisory:
CVE-2016-1902: Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions random_bytes() or openssl_random_pseudo_bytes() are not available, the output of SecureRandom should not be consider secure. CVE-2016-4423: Marek Alaksa from Citadelo discovered that it is possible to fill up the session storage space by submitting inexistent large usernames. | ||||||
| Alerts: |
| ||||||
virtualbox: unspecified
| Package(s): | virtualbox | CVE #(s): | CVE-2016-0678 | ||||||||||||
| Created: | June 1, 2016 | Updated: | June 2, 2016 | ||||||||||||
| Description: | From the CVE entry:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.18 allows local users to affect confidentiality, integrity, and availability via vectors related to Core. | ||||||||||||||
| Alerts: |
| ||||||||||||||
webkitgtk4: two vulnerabilities
| Package(s): | webkitgtk4 | CVE #(s): | CVE-2016-1857 CVE-2016-1856 | ||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 21, 2016 | ||||||||||||||||||||
| Description: | From the CVE entries:
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856. (CVE-2016-1857) WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857. (CVE-2016-1856) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
wireshark: multiple vulnerabilities
| Package(s): | wireshark | CVE #(s): | CVE-2012-6052 CVE-2012-6053 CVE-2012-6055 CVE-2012-6057 CVE-2012-6058 CVE-2012-6059 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 | ||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||
| Description: | From the Debian LTS advisory:
Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP which could result in denial of service. This update also fixes many older less important issues by updating the package to the version found in Debian 8 also known as Jessie. | ||||||
| Alerts: |
| ||||||
xen: privilege escalation
| Package(s): | xen | CVE #(s): | CVE-2016-4480 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 31, 2016 | Updated: | June 2, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>