Security
Fuzzing open source
Fuzz testing finds bugs, so it stands to reason that continuous fuzz testing will find more bugs and find them sooner. That is part of the premise behind the OSS-Fuzz program announced by Google on December 1. Since many of the bugs found by fuzzing have security implications, discovering more earlier can only be a good thing for the security of our systems.
OSS-Fuzz is meant to apply fuzzing power to free and open-source software projects, especially those that are part of the critical internet infrastructure. As might be guessed based on that, the Core Infrastructure Initiative has worked with Google to develop OSS-Fuzz. The underlying technology used comes partly from the ClusterFuzz project that has been successfully employed to find a large number of bugs in the Chrome browser.
The basic idea is to continuously fuzz test the latest source version of the projects that have signed up (and been approved) for the OSS-Fuzz beta test. Initially, OSS-Fuzz will be using the libFuzzer coverage-guided fuzzing library in conjunction with AddressSanitizer (ASan) to try to find various types of memory misuse that could be exploited by attackers. That process is parallelized across thousands of virtual machines such that some four trillion test cases are run per week (or were at the time of the announcement, that number may have grown since then).
The announcement describes an early success story for the project:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000000ffa READ of size 2 at 0x615000000ffa thread T0 SCARINESS: 24 (2-byte-read-heap-buffer-overflow-far-from-bounds) #0 0x885e06 in tt_face_vary_cvtsrc/truetype/ttgxvar.c:1556:31OSS-Fuzz automatically notified the maintainer, who fixed the bug; then OSS-Fuzz automatically confirmed the fix. All in one day!
Many bugs have been found, 150 at the time of the announcement, though there are 200 entries (with 177 verified) in the bug tracker as of this writing. Roughly half of those are marked as security bugs. All of the bugs found will be disclosed within 90 days of their discovery in keeping with Google's own disclosure policy.
ClusterFuzz does more than just parallelize the fuzzing process, it manages test cases to both whittle them down to something small that still reproduces the problem and to continue to run them to detect when the problem is fixed and, after that, whether regressions bring it back. It also tries to determine which change (or set of changes) introduced a problem by doing a bisection.
Projects interested in joining the OSS-Fuzz effort will need to add some fuzz targets to their code. These targets are functions that accept a byte array from the fuzzing engine and use that input in an "interesting" way using the project's API. These fuzz targets are not libFuzzer-specific and can be used by other fuzzers (there is talk of adding support for american fuzzy lop, for example). Those fuzz targets must be integrated with the build and test system for the project.
After that, a corpus of both good and bad inputs for the fuzz target should be created. That gives the fuzzing engine a starting point that has the proper structure for the input data (and the bad inputs will help show ways to "break" the format), which eliminates a whole bunch of wasted effort on inputs that won't get past the first tests in the code. In coverage-guide fuzzing, the binary is instrumented to provide information on the code that a given input has caused to be executed. Changing the input data to cause new paths through the code to be taken is the underlying mechanism for coverage-guided fuzzing.
To set up a new project, a directory needs to be created under projects in a GitHub clone of the oss-fuzz Git repository. It needs a Dockerfile to describe the container environment for building the project and its fuzz targets, a build script (build.sh) that will run in the container to generate a build of the project, and a configuration file (project.yaml) with some project metadata. A pull request can be made to the oss-fuzz project and if it is accepted, the project will be tossed into the ClusterFuzz hopper.
The FAQ
lists two main criteria for a project's inclusion in the beta: exposure to
remote input
and the number of dependent users (people and projects). Right now, the
goal is to add "established projects that have a critical impact on
infrastructure and user security
", though expanding the reach of
OSS-Fuzz is in the plans. The current project list has
over 50 entries that reads a bit like a "who's who" of open-source projects
that fit the criteria including libreoffice, curl, libarchive, pcre2, libpng,
openssl, postgresql, sqlite3, tor, strongswan, and so on. There is also a
build
status page where the most recent build log for each project can be accessed.
Fuzzing takes a lot of resources, but it is an inherently parallelizable process, so it is a perfect match for Google and others with enormous clusters of computers. Though it has taken some time, the security-testing story for open-source projects has certainly gotten better over the years. The lessons of Heartbleed (and, seemingly to a lesser extent, some of the larger vulnerabilities of yesteryear) have not gone completely unheeded. Beyond that, it is good to see other projects that are applying fuzzing to the kernel. Fuzzing is no panacea, but it can certainly help find the next "zero day" before it actually becomes one.
Brief items
Security quotes of the fortnight
This state can then be verified whenever a process performs an action requiring a permissions check. For example, when a process requests that a file be opened, the kernel now calls out to the hypervisor. The hypervisor is then able to examine the process state and ensure that it remains consistent with its internal representation of process state. If so, execution is allowed to continue. If not, this indicates that the kernel's internal process state has been modified and the administrator can be alerted that the container has been compromised. The container state can be saved to disk and the container either terminated or restarted in a clean state.
By isolating examination to cases where a permissions check is performed, the overhead of this approach is minimised to the point where most real-world use cases will see no measurable performance impact.
But there's a key difference between floods/earthquakes and class breaks in computer systems: the former are random natural phenomena, while the latter is human-directed. Floods don't change their behavior to maximize their damage based on the types of defenses we build. Attackers do that to computer systems. Attackers examine our systems, looking for class breaks. And once one of them finds one, they'll exploit it again and again until the vulnerability is fixed.
How to find Android apps that respect user privacy (opensource.com)
Over at opensource.com, Joshua Allen Holm writes about two projects (Privacy Friendly Apps and Simple Mobile Tools) that are producing Android apps that are open source, privacy respecting, and only request the privileges they need. "Below, I take a look at two projects producing a wide variety of Android apps designed to only request the permissions they require to function. These apps cover a wide range of functions with each app being focused on doing only one task and doing that task well. Users looking for well designed, functional apps with no extra features and no anti-features (i.e., advertisements) should consider checking these apps out. Developers, especially those just getting started with developing for Android, should take a look at the source code for these apps to learn about developing apps with a focus on using minimal permissions and respecting users' privacy."
The Year Encryption Won (Wired)
It's not entirely clear that the title is justified, but Wired does cover some progress on the encryption front in 2016. "End-to-end encryption, which ensures that the only people who can see your communications are you and the person on the receiving end, certainly isn’t new. But in 2016, encryption went mainstream, reaching billions of people all over the world. Even more significantly, it overcame its most aggressive legal challenge yet, in a prolonged standoff between Apple and the FBI. And just this week, a Congressional committee affirmed the importance of encryption, giving hope that future laws around the topic will include at least a modicum of sanity. There’s still a long way to go, and any gains that were made could potentially be rolled back, but for now it’s worth taking a step back to appreciate just how far encryption came this year. As far as silver linings go, you could do a lot worse."
Bottomley: TPM2 and Linux
James Bottomley looks at Trusted Platform Module (TPM) version 2. "Recently Microsoft started mandating TPM2 as a hardware requirement for all platforms running recent versions of windows. This means that eventually all shipping systems (starting with laptops first) will have a TPM2 chip. The reason this impacts Linux is that TPM2 is radically different from its predecessor TPM1.2; so different, in fact, that none of the existing TPM1.2 software on Linux (trousers, the libtpm.so plug in for openssl, even my gnome keyring enhancements) will work with TPM2. The purpose of this blog is to explore the differences and how we can make ready for the transition." (Thanks to Paul Wise)
New vulnerabilities
bash: code execution
| Package(s): | bash | CVE #(s): | CVE-2016-9401 | ||||||||
| Created: | January 2, 2017 | Updated: | January 6, 2017 | ||||||||
| Description: | From the Gentoo advisory:
Multiple vulnerabilities were found in Bash, the worst of which may allow execution of arbitrary code. A local attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. | ||||||||||
| Alerts: |
| ||||||||||
borgbackup: two vulnerabilities
| Package(s): | borgbackup | CVE #(s): | |||||||||
| Created: | January 4, 2017 | Updated: | January 4, 2017 | ||||||||
| Description: | borgbackup 1.0.9 is available (includes security fixes). From the borgbackup changelog.
A flaw in the cryptographic authentication scheme in Borg allowed an attacker to spoof the manifest. The attack requires an attacker to be able to
If you have archives in your repository that were made with attic <= 0.13 (and later migrated to borg), running borg check would report errors in these archives. The reason for this is a invalid (and useless) metadata key that was always added due to a bug in these old attic versions. If you run borg check --repair, things escalate quickly: all archive items with invalid metadata will be killed. Due to that attic bug, that means all items in all archives made with these old attic versions. | ||||||||||
| Alerts: |
| ||||||||||
botan: integer overflow
| Package(s): | botan | CVE #(s): | CVE-2016-9132 | ||||||||||||
| Created: | December 23, 2016 | Updated: | January 16, 2017 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
While decoding BER length fields, an integer overflow could occur. This could occur while parsing untrusted inputs such as X.509 certificates. The overflow does not seem to lead to any obviously exploitable condition, but exploitation cannot be positively ruled out. Only 32-bit platforms are likely affected; to cause an overflow on 64-bit the parsed data would have to be many gigabytes. | ||||||||||||||
| Alerts: |
| ||||||||||||||
chicken: two vulnerabilities
| Package(s): | chicken | CVE #(s): | CVE-2013-2024 CVE-2014-9651 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entry:
Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures." (CVE-2014-9651) From the Gentoo advisory: A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. | ||||||
| Alerts: |
| ||||||
curl: information leak
| Package(s): | curl | CVE #(s): | CVE-2016-9594 | ||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | January 5, 2017 | ||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable. This function has been introduced in 7.52.0 | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
curl: buffer overflow
| Package(s): | curl | CVE #(s): | CVE-2016-9586 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary checks. The functions have been documented as deprecated for a long time and users are discouraged from using them in "new programs" as they are planned to get removed at a future point. But as the functions are present and there's nothing preventing users from using them, we expect there to be a certain amount of existing users in the wild. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exist in the command line tool. We are not aware of any exploit of this flaw. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
cxf: two vulnerabilities
| Package(s): | cxf | CVE #(s): | CVE-2016-6812 CVE-2016-8739 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the Red Hat bugzilla [1], [2]:
[1] Apache CXF HTTP transport module uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client. [2] Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk. | ||||||
| Alerts: |
| ||||||
cyassl: multiple vulnerabilities
| Package(s): | cyassl | CVE #(s): | CVE-2014-2896 CVE-2014-2897 CVE-2014-2898 CVE-2014-2899 CVE-2014-2900 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entries:
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found. (CVE-2014-2899) wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate. (CVE-2014-2900) From the Gentoo advisory: Multiple vulnerabilities have been found in CyaSSL, the worst of which may allow attackers to execute arbitrary code. An attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or conduct a man-in-the-middle attack. | ||||||
| Alerts: |
| ||||||
dovecot: denial of service
| Package(s): | dovecot | CVE #(s): | CVE-2016-8652 | ||||||||
| Created: | December 22, 2016 | Updated: | January 4, 2017 | ||||||||
| Description: | From the Red Hat bugzilla entry:
If auth-policy component has been activated in Dovecot, then remote user can use SASL authentication to crash auth component. | ||||||||||
| Alerts: |
| ||||||||||
exim4: information leak
| Package(s): | exim4 | CVE #(s): | CVE-2016-9963 | ||||||||||||
| Created: | December 26, 2016 | Updated: | January 6, 2017 | ||||||||||||
| Description: | From the Exim advisory:
Exim leaks the private DKIM signing key to the log files. Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used, the key material is included in the bounce message. | ||||||||||||||
| Alerts: |
| ||||||||||||||
firejail-lts: denial of service
| Package(s): | firejail-lts | CVE #(s): | |||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||
| Description: | From the Gentoo advisory:
Multiple vulnerabilities have been discovered in Firejail. Please review upstream's release notes for details. A remote attacker could possibly bypass sandbox protection, cause a Denial of Service condition, or change a system's DNS server. | ||||||
| Alerts: |
| ||||||
gdk-pixbuf2: unspecified
| Package(s): | gdk-pixbuf2 | CVE #(s): | |||||
| Created: | December 23, 2016 | Updated: | January 4, 2017 | ||||
| Description: | Somewhere in the mess below evidently lie some security updates. From the Fedora advisory:
gdk-pixbuf 2.36.2 release. * Remove the pixdata loader (#776004) * Fix integer overflows in the jpeg loader (#775218) * Add an external thumbnailer for images * Fix a NULL pointer dereference (#776026) * Fix a memory leak (#776020) * Support bmp headers with bitmask (#766890) * Add tests for scaling (#80925) * Handle compressed pixdata in resources (#776105) * Avoid a buffer overrun in the qtif loader ($#775648) * Fix a crash in the bmp loader (#775242) * Fix crash opening pnm images with large dimensions (#775232) * Prevent buffer overflow in the pixdata loader (#775693) * Translation updates | ||||||
| Alerts: |
| ||||||
graphicsmagick: denial of service
| Package(s): | GraphicsMagick | CVE #(s): | CVE-2016-9830 | ||||||||
| Created: | December 22, 2016 | Updated: | January 4, 2017 | ||||||||
| Description: | Nothing seems to clearly define the bug, but the SUSE bugzilla entry (and links from there) give some hints:
This is an old memory failure, discovered time ago. The maintainer, Mr. Bob Friesenhahn was able to reproduce the issue; I’m quoting his feedback about: The problem is that the embedded JPEG data claims to have dimensions 59395×56833 and this is only learned after we are in the JPEG reader. | ||||||||||
| Alerts: |
| ||||||||||
gstreamer-plugins-good: code execution
| Package(s): | gstreamer-plugins-good | CVE #(s): | CVE-2016-9810 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 30, 2016 | Updated: | January 4, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
CVE-2016-9810: A maliciously crafted flic file can still cause invalid memory accesses [bsc#1013663] | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
httpd: three vulnerabilities
| Package(s): | httpd | CVE #(s): | CVE-2016-8743 CVE-2016-2161 CVE-2016-0736 | ||||||||||||||||
| Created: | December 26, 2016 | Updated: | January 4, 2017 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-0736: It was found that session data/cookies presented to mod_session_crypto were not authenticated that can lead to deciphering or tampering with a padding oracle attack. Affects version 2.4.x up to 2.4.23 CVE-2016-2161: It was found that malicious input to mod_auth_digest will cause the server to crash, and each instance continues to crash even for subsequently valid requests. Affects versions 2.4.x up to 2.4.23 CVE-2016-8743: Apache HTTP Server, prior to release 2.4.25, accepted a broad pattern of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB in parsing the request line and request header lines, as well as HTAB in parsing the request line. Any bare CR present in request lines was treated as whitespace and remained in the request field member "the_request", while a bare CR in the request header field name would be honored as whitespace, and a bare CR in the request header field value was retained the input headers array. Implied additional whitespace was accepted in the request line and prior to the ':' delimiter of any request header lines. These defects represent a security concern when httpd is participating in any chain of proxies or interacting with back-end application servers, either through mod_proxy or using conventional CGI mechanisms. In each case where one agent accepts such CTL characters and does not treat them as whitespace, there is the possibility in a proxy chain of generating two responses from a server behind the uncautious proxy agent. In a sequence of two requests, this results in request A to the first proxy being interpreted as requests A + A' by the backend server, and if requests A and B were submitted to the first proxy in a keepalive connection, the proxy may interpret response A' as the response to request B, polluting the cache or potentially serving the A' content to a different downstream user-agent. Affects versions since 2.2.0 up to 2.4.23 | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
imagemagick: code execution
| Package(s): | ImageMagick | CVE #(s): | CVE-2016-9773 | ||||||||||||
| Created: | December 22, 2016 | Updated: | January 4, 2017 | ||||||||||||
| Description: | From a oss-sec mailing list post:
heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) | ||||||||||||||
| Alerts: |
| ||||||||||||||
imagemagick: code execution
| Package(s): | imagemagick | CVE #(s): | CVE-2016-8707 | ||||||||||||||||
| Created: | December 22, 2016 | Updated: | January 4, 2017 | ||||||||||||||||
| Description: | From the Talos vulnerability report:
An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks’s convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution.. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
irc-otr: information disclosure
| Package(s): | irc-otr irssi-otr | CVE #(s): | |||||||||
| Created: | December 30, 2016 | Updated: | February 13, 2017 | ||||||||
| Description: | From the SUSE bugzilla entry:
It was discovered that irssi-otr had a flaw in handing data returned by libotr. After the initiation of the OTR session only the first line was sent as a PRIVMSG, while additional data would be sent as raw commands to the IRC server. The additional data would ordinarily be a human-readable HTML-formatted instruction message from libotr, a fixed string. However this is a minor security concern and the remediation avoids further security issues. | ||||||||||
| Alerts: |
| ||||||||||
js-jquery: cross-site scripting
| Package(s): | js-jquery | CVE #(s): | |||||||||||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
jQuery is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain ajax request is performed without the dataType option causing text/javascript responses to be executed. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2016-9588 | ||||||||||||||||||||
| Created: | December 23, 2016 | Updated: | January 4, 2017 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
Linux kernel built with the KVM virtualisation support(CONFIG_KVM), with nested virtualisation(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exceptions issue. It could occur if a L2 guest was to throw an exception which is not handled by L1 guest. A L1 guest user could use this flaw to crash the guest resulting in DoS. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
kernel: three vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2012-6704 CVE-2016-7915 CVE-2016-10088 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option. (CVE-2012-6704) The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device, as demonstrated by a Logitech DJ receiver. (CVE-2016-7915) The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576. (CVE-2016-10088) | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
libarchive: denial of service
| Package(s): | libarchive | CVE #(s): | CVE-2015-8927 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entry:
The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password. | ||||||
| Alerts: |
| ||||||
libcrypto++: denial of service
| Package(s): | libcrypto++ | CVE #(s): | CVE-2016-9939 | ||||||||||||
| Created: | December 26, 2016 | Updated: | January 9, 2017 | ||||||||||||
| Description: | From the Debian advisory:
Gergely Gábor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of service. | ||||||||||||||
| Alerts: |
| ||||||||||||||
libphp-phpmailer: code execution
| Package(s): | libphp-phpmailer | CVE #(s): | CVE-2016-10033 CVE-2016-10045 | ||||||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | January 18, 2017 | ||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
The mailSend function in the isMail transport in PHPMailer before 5.2.18, when the Sender property is not set, might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted From address. (CVE-2016-10033) The isMail transport in PHPMailer before 5.2.20, when the Sender property is not set, might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. (CVE-2016-10045) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
libpng: NULL dereference bug
| Package(s): | libpng | CVE #(s): | CVE-2016-10087 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | January 30, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the libpng-1.6.27, 1.5.28, and 1.2.57 release announcement:
These all fix a potential "NULL dereference" bug that has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
libvncserver: two vulnerabilities
| Package(s): | libvncserver | CVE #(s): | CVE-2016-9941 CVE-2016-9942 | ||||||||||||||||||||||||||||
| Created: | January 4, 2017 | Updated: | February 21, 2017 | ||||||||||||||||||||||||||||
| Description: | From the CVE entries:
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area. (CVE-2016-9941) Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions. (CVE-2016-9942) | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
mariadb: multiple unspecified vulnerabilities
| Package(s): | mariadb mysql | CVE #(s): | CVE-2016-3495 CVE-2016-5625 CVE-2016-5628 CVE-2016-5631 CVE-2016-5632 CVE-2016-5633 CVE-2016-5634 CVE-2016-5635 CVE-2016-6652 CVE-2016-8286 CVE-2016-8287 CVE-2016-8289 CVE-2016-8290 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entries:
Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. (CVE-2016-3495) Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Packaging. (CVE-2016-5625) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML. (CVE-2016-5628) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached. (CVE-2016-5631) Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer. (CVE-2016-5632) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290. (CVE-2016-5633) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR. (CVE-2016-5634) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit. (CVE-2016-5635) SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call. (CVE-2016-6652) Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges. (CVE-2016-8286) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication. (CVE-2016-8287) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB. (CVE-2016-8289) Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633. (CVE-2016-8290) | ||||||
| Alerts: |
| ||||||
msgpuck: two denial of service flaws
| Package(s): | msgpuck | CVE #(s): | CVE-2016-9036 CVE-2016-9037 | ||||||||||||||||
| Created: | December 22, 2016 | Updated: | January 4, 2017 | ||||||||||||||||
| Description: | CVE-2016-9036: From the Talos vulnerability report:
An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool’s Msgpuck library 1.0.3. A specially crafted packet can cause the mp_check function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer, resulting in a denial of service vulnerability.
CVE-2016-9037: From the Talos vulnerability report: An exploitable out-of-bounds array access vulnerability exists in the xrow_header_decode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified key’s value. This can lead to an out of bounds read within the context of the server. An attacker who exploits this vulnerability can cause a denial of service vulnerability on the server. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
nagios-plugins: multiple vulnerabilities
| Package(s): | nagios-plugins | CVE #(s): | |||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||
| Description: | From the Red Hat bugzilla [1], [2], 3]:
[1] Version-Release number of selected component (if applicable): 1.4.15-2 Steps to Reproduce:
ldap_bind: Can't contact LDAP server (-1) additional info: TLS error -8172:Unknown code ___f 20 Could not bind to the LDAP serverExpected results: LDAP OK - 0,008 seconds response time|time=0,007882s;;;0,000000 [2] Calling check_file_age is broken: # /usr/lib64/nagios/plugins/check_file_age Can't locate utils.pm in @INC (you may need to install the utils module) (@INC contains: . /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at /usr/lib64/nagios/plugins/check_file_age line 30. [3] check_mailq fails with syntax error: [root@fedora24 ~]# /usr/lib64/nagios/plugins/check_mailq syntax error at /usr/lib64/nagios/plugins/check_mailq line 40, near ") sub print_help ()" Execution of /usr/lib64/nagios/plugins/check_mailq aborted due to compilation errors. | ||||||||||
| Alerts: |
| ||||||||||
openfire: multiple vulnerabilities
| Package(s): | openfire | CVE #(s): | CVE-2015-6972 CVE-2015-6973 CVE-2015-7707 | ||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||
| Description: | From the CVE entries:
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group-summary.jsp. (CVE-2015-6972) Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp. (CVE-2015-6973) Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp. (CVE-2015-7707) | ||||||||||
| Alerts: |
| ||||||||||
openjpeg2: multiple vulnerabilities
| Package(s): | openjpeg2 | CVE #(s): | CVE-2016-9112 CVE-2016-9113 CVE-2016-9114 CVE-2016-9115 CVE-2016-9116 CVE-2016-9117 CVE-2016-9118 | ||||||||||||||||||||
| Created: | December 28, 2016 | Updated: | February 20, 2017 | ||||||||||||||||||||
| Description: | From the CVE entries:
Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2. (CVE-2016-9112) There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service. (CVE-2016-9113) There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service. (CVE-2016-9114) Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. (CVE-2016-9115) NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. (CVE-2016-9116) NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. (CVE-2016-9117) Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2. (CVE-2016-9118) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
openssh: multiple vulnerabilities
| Package(s): | openssh | CVE #(s): | CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 | ||||||||||||||||
| Created: | December 23, 2016 | Updated: | February 1, 2017 | ||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-10009 (arbitrary code execution): It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh- agent. Note that the attacker must have control of the forwarded agent- socket and the ability to write to the filesystem of the host running ssh-agent. - CVE-2016-10010 (privilege escalation): It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config. - CVE-2016-10011 (information disclosure): It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users. - CVE-2016-10012 (insufficient validation): It was found that the shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimizing compilers. Additionally, this memory manager was incorrectly accessible when pre-authentication compression was disabled. This could potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process (a compromise of the latter would be required first). | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
pcsclite: privilege escalation
| Package(s): | pcsclite | CVE #(s): | CVE-2016-10109 | ||||||||||||||||||||||||||||||||||||
| Created: | January 4, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
The SCardReleaseContext function normally releases resources associated with the given handle (including "cardsList") and clients should cease using this handle. A malicious client can however make the daemon invoke SCardReleaseContext and continue issuing other commands that use "cardsList", resulting in a use-after-free. When SCardReleaseContext is invoked multiple times, it additionally results in a double-free of "cardsList". The issue allows a local attacker to cause a denial of service, but can potentially result in privilege escalation since the daemon is running as root while any local user can connect to the Unix socket. Fixed by patch "SCardReleaseContext: prevent use-after-free of cardsList" which is released with hpcsc-lite 1.8.20 on 30 December 2016. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
php-zendframework-zend-mail: parameter injection
| Package(s): | php-zendframework-zend-mail | CVE #(s): | CVE-2016-10034 | ||||||||||||
| Created: | January 2, 2017 | Updated: | January 13, 2017 | ||||||||||||
| Description: | From the Zend Framework advisory:
When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability. | ||||||||||||||
| Alerts: |
| ||||||||||||||
pillow: heap-based buffer overflow
| Package(s): | pillow | CVE #(s): | CVE-2016-4009 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entry:
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow. | ||||||
| Alerts: |
| ||||||
postgresql-common: file overwrites
| Package(s): | postgresql-common | CVE #(s): | CVE-2016-1255 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the Debian LTS advisory:
Dawid Golunski discovered that a symlink in /var/log/postgresql/ could be used by the "postgres" system user to write to arbitrary files on the filesystem the next time PostgreSQL is started by root. | ||||||
| Alerts: |
| ||||||
python-crypto: denial of service
| Package(s): | python-crypto | CVE #(s): | CVE-2013-7459 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | February 21, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
It was discovered that there was a vulnerability in python-crypto, a library of cryptographic algorithms and protocols for Python. Calling AES.new with an invalid parameter could crash the Python interpreter | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
python-wikitcms: code execution
| Package(s): | python-wikitcms | CVE #(s): | |||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||
| Description: | From the Fedora advisory:
This update contains a **SECURITY** fix for an issue with potentially serious consequences but very limited scope. If an administrator of a wiki you talked to using python-wikitcms were malicious, they could cause arbitrary code execution as the user running wikitcms. No-one besides a wiki administrator could do this, as it requires crafting the wiki's response to an edit request to include a malicious payload. It also drops some now useless or unneeded code (due to changes in mediawiki and mwclient). | ||||||||||
| Alerts: |
| ||||||||||
qemu: denial of service
| Package(s): | qemu | CVE #(s): | CVE-2016-9911 | ||||||||||||||||||||||||||||
| Created: | December 26, 2016 | Updated: | January 4, 2017 | ||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/ process could use this issue to leak host memory, resulting in DoS for a host. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
smack: TLS bypass
| Package(s): | smack | CVE #(s): | CVE-2016-10027 | ||||
| Created: | December 30, 2016 | Updated: | January 4, 2017 | ||||
| Description: | From the Red Hat bugzilla entry:
A vulnerability in the Smack XMPP library was reported where the security of the TLS connection is not always enforced. By stripping the "starttls" feature from the server response with a man-in-the-middle tool, an attacker can force the client to authenticate in clear text even if the "SecurityMode.required" TLS setting has been set. | ||||||
| Alerts: |
| ||||||
spip: two vulnerabilities
| Package(s): | spip | CVE #(s): | CVE-2016-9997 CVE-2016-9998 | ||||
| Created: | December 26, 2016 | Updated: | January 4, 2017 | ||||
| Description: | From the Debian LTS advisory:
CVE-2016-9997: It was discovered that the 'id' parameter to the puce_statut action isn't sanitized properly. An attacker could inject arbitrary HTML code by tricking an authenticated SPIP user to open a specially crafted URL. CVE-2016-9998: It was discovered that the 'plugin' parameter to the info_plugin action isn't sanitized properly. An attacker could inject arbitrary HTML code by tricking an authenticated SPIP user to open a specially crafted URL. | ||||||
| Alerts: |
| ||||||
springframework: directory traversal
| Package(s): | springframework | CVE #(s): | CVE-2016-9878 | ||||
| Created: | January 2, 2017 | Updated: | January 4, 2017 | ||||
| Description: | From the CVE entry:
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks. | ||||||
| Alerts: |
| ||||||
squid: two vulnerabilities
| Package(s): | squid | CVE #(s): | CVE-2016-10002 CVE-2016-10003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 23, 2016 | Updated: | February 7, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
Incorrect processing of responses to If-None-Modified HTTP conditional requests leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information (CVE-2016-10002). Incorrect HTTP Request header comparison results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients (CVE-2016-10003). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
tracker: adding sandboxing
| Package(s): | tracker | CVE #(s): | |||||
| Created: | December 30, 2016 | Updated: | January 4, 2017 | ||||
| Description: | From the Fedora advisory:
This update adds security sandboxing to tracker-extract. | ||||||
| Alerts: |
| ||||||
xen: two vulnerabilities
| Package(s): | xen | CVE #(s): | CVE-2016-10013 CVE-2016-10024 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 22, 2016 | Updated: | January 16, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
xen: denial of service
| Package(s): | xen | CVE #(s): | CVE-2016-10025 | ||||||||||||
| Created: | December 28, 2016 | Updated: | January 4, 2017 | ||||||||||||
| Description: | From the Red Hat bugzilla:
When support for the Intel VMX VMFUNC leaf 0 was added, a new optional function pointer hvmemul_vmfunc was added to the hvm_emulate_ops table. As is intended, that new function pointer is NULL on non-VMX hardware, including AMD SVM hardware. However at a call site, the necessary NULL check was omitted before the indirect function call. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). | ||||||||||||||
| Alerts: |
| ||||||||||||||
xen: denial of service
| Package(s): | xen | CVE #(s): | CVE-2016-9776 | ||||||||||||||||||||||||||||
| Created: | January 2, 2017 | Updated: | February 15, 2017 | ||||||||||||||||||||||||||||
| Description: | From the CVE entry:
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>