Security

Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes.

Fix a heap out of bounds condition with crafted upack packer files. This issue was discovered by Sebastian Andrzej Siewior.

It was reported that Context UI module wasn't checking for external URLs in the HTTP GET destination parameter when redirecting users that are activating/deactivating the Context UI inline editor dialog, thereby leading to an Open Redirect vulnerability.

This vulnerability is mitigated by the fact that the victim must have the permission "administer contexts" and that Context UI module must be enabled.

lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

Multiple vulnerabilities have been found in krb5, the MIT implementation of Kerberos:

CVE-2014-5352: Incorrect memory management in the libgssapi_krb5 library might result in denial of service or the execution of arbitrary code.

CVE-2014-9421: Incorrect memory management in kadmind's processing of XDR data might result in denial of service or the execution of arbitrary code.

CVE-2014-9422: Incorrect processing of two-component server principals might result in impersonation attacks.

CVE-2014-9423: An information leak in the libgssrpc library.

Jakub Wilk originally reported to the Debian BTS a problem with cabextract on a specially crafted cab file, causing cabextract to hang forever. The problem is actually in the embedded copy of libmspack, see [1]. Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is used in many project (or embedded there like also Clamav). This issue can cause a remotely exploitable denial-of-service condition due to clamav thread hanging forever while scanning the file.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773041

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVE-2014-9637: It was reported that a crafted diff file (attached) can make patch to eat memory and later segfault.

CVE-2015-1395: It was reported that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This could allow an attacker to overwrite arbitrary files by applying a specially crafted patch, with the privileges of the user running patch.

CVE-2015-1196: From the CVE entry: GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.

An upstream commit to the Passenger rubygem indicated that versions 4.0.5 and later are affected by a temporary file flaw described as follows:

" Phusion Passenger creates a "server instance directory" in /tmp during startup, which is a temporary directory that Phusion Passenger uses to store working files. This directory is deleted after Phusion Passenger exits. For various technical reasons, this directory must have a semi-predictable filename. If a local attacker can predict this filename, and precreates a symlink with the same filename that points to an arbitrary directory with mode 755, owner root and group root, then the attacker will succeed in making Phusion Passenger write files and create subdirectories inside that target directory. The following files/subdirectories are created:

* control_process.pid
* generation-X, where X is a number.

If you happen to have a file inside the target directory called `control_process.pid`, then that file's contents are overwritten.

These files and directories are deleted during Phusion Passenger exit. The target directory itself is not deleted, nor are any other contents inside the target directory, although the symlink is. "

It is fixed in upstream version 4.0.33.

From the CVE entry:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

It was reported that OOB access (both read and write) issues exist in test_compr_eb (extract.c) that can result in application crash or other unspecified impact.

This vulnerability can be triggered via crafted zip archives with extra fields that advertise STORED method compression (i.e. no compression) and have uncompressed field sizes smaller than the corresponding compressed field sizes.

Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service.

CVE-2014-9625: On 32 bit builds, parsing of update status files with a size of 4294967295 or more lead to an integer truncation in a call to malloc and a subsequent buffer overflow.

CVE-2014-9626: The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible integer underflow when using this length value in a call to memcpy(). This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.

CVE-2014-9627: The MP4 demuxer, when parsing string boxes, did not properly check that the conversion of the box length from 64bit integer to 32bit integer on 32bit platforms did not cause a truncation, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.

CVE-2014-9628: The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.

CVE-2014-9629: The Dirac and Schroedinger encoders did not properly check for an integer overflow on 32bit platforms, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution.

From the CVE entry:

oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.