DELTA 496292 0 325029 SVNpfr>$]~2]Xna8ba7358-4b02-11e9-9ba0-4c72b94353b5"> gitea -- XSS vulnerability gitea 1.7.4

Gitea Team reports:

Fix potential XSS vulnerability in repository descriptblog.gitea.io/2019/03/gitea-1.7.4-is-released/ 2019-03-12 2019-03-20 l(t/5Wx^]Pj0<_(rCՇ e-2!ߕӷAfgg5ax ?C= UYffިRFM"9ɵ\ߴԚveC7 Mm)=, (B:F]"r^w@{wD_팚d#ByZ5x6JBb~n~t=%.F !C 8\`B3B'>x,.jA(,hЅ(Y/}˜RE؈ ;U,p>8{F߂1(R.oʨ!/,k?|@o9y!9aOCo|89Kr}qv}5Ux^}k0Ɵ׿軭(-^`$4!f"gGstSl$Nl.crYhBۻ/\T<_Un7 D) o*54';\ u"#o2 %)ITZJSzVZ1|=b xn۪ u}zZd'NgSzȎ Bbw]ŋ{]ojB;Ae&nj|Ï `hGrACލw|&RӜ,NѿMb,coAh>F9Ť;d`g[D&yn@x{=cǯ E3u_9_}qW>@@R:{eading to worker exhaustion and a denial of service. (low)

  • mod_md, DoS via Coredumps on specially crafted requests (CVE-2018-8011). By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. (moderate)url>http://httpd.apache.org/security/vulnerabilities_24.html CVE-2018-1333 CVE-2018-80117-18frQ5Yx^MQN0|+V}qkL$N~`koӒIh4;ޙݱGu:Ky:PC`([˿"OBRQvP"FS;3ʶ,N7"*ya>juNɉ*y\SތpDpa^gM^bPd܉?J7gn5{E. wҞ {C< s=!蔜$t T %c3*"K忚E7Hx9JyHmNϟE1ƚ-M׫E(^o!֖W<ǐ=Dpv=Fΐ3B-TBZgm w@x?at5eecurity/AST-2018-002.html https://downloads.asterisk.org/pub/security/AST-2018-003.html phpMyAdmin -- self XSS in central columns feature phpMyAdmin 4.7.04.78-1/">

    Summary

    Self XSS in central colHC@==~={:Fbxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.6%aIb}zI:Q.a"7 u46 E1 1,qG~uӊ[& } Ҹ hM25_ HwL),u 1Qg(`R\KВiGg2$8kƇ#G^8색'.`ۆD%+r~eۊVs0TScs}C;"p*m]>?EX췥C:mŕ! oe͚ sqlite3 -- heap-buffer overflow sqlite3 3.20Google reports:

    A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databasesurl>https://bug^XN?3J53x^UQn <'_r.N*KCuBa_Z.,ٝϸ4_E$#ʘTau lH2Qh>鲬Իfghĥ7&sIYT"Sס'n@O= u8і80pp))GKv6S CWh ^tIiG:mI9s2ii:,]z}V_6d]WۺԊ88fC nUI9O;SiUqD<gYrvEn]|v\PFmA[aG $ݪ$X+rqV=+ήK6ڦo 52~|d|3]0J@Cx^N0>ݗ_}imR(v eoN;9 I:=ymNGDڅ G1`²WoU?Va9/6;Ӿ{?uM*IhiAtϡl 6d%ֽ+G嬪X;*M.Gn_Lɂ~Oe6!XhtłJYLUY^Z(뷗ч|! 5=a@fxp)Qd3 process can escalate its privilege to that of the guest operating system.

    On both SVM and VMX (Intel hardware): a malicious unprivileged guest process can crash the gue93829250ac2e96-ba4d-11e6-ae1b-002590263bf5"> xen-kernel -- x86 null segments not always treated as unusableˀ~:v@DY@~5|210b8"> irssi -- heap corruption and missing boundary checks irssi zh-irssi 0.8.170.8.20Irssi reports:

    Remote crash and heap corruption. Remote code execution seems difficult since only Nuls are written.irssi.org/security/irssi_sa_2016.txt CVE-2016-7044 CVE-2016-7045 <ѠeWJ|[kt5c14-1943 CVE-2014-2270 SA-14:16.filef91a709-6007-11e6-a6c3-14dae9d210b8"> FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access6h1>Problem Description:

    A NULL pointer dereference in the initialization code of the HZ module and an out of bounds array access in t8`Wzd>v:6i>[583171] Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire.url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html CVE-2016-1683 CVE-2016-16846-20 squid -- remote DoS in HTTP response processing squid 3.5.15Squid security advisory 2016:2 reports:

    g] hn#)x^eR0;Bu pmm4 $&Ets&KL> kGP GO9c7IRΑV OsMn= 3@z/1B wI9艭1PJ=ؘt18 %iR9vTA/*P IPAIP ( iR%U2 5. m#0uqߟ!qBPB qXF|@v&NNKӎ]PHh(œ oڇrʒ2Î /oYXYD IxHiƯJ2= bhX 깹 mK5Kx^1 0 Sxbڦm"^]_!'SΧՖa~7

    [20140902] - Core - Unauthorized Logins

    Inadequate checking allowed unauthorized logins via LDAP authenticationcvename>CVE-2014-6632 http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html z^P2Y˦T3'p뼘mS ȝ8aD Bd(kj@reHT6$p*Tlg`H OHΒX;ᘑO*sSM|0_iu6wXřt//^5y,uS' Ɓ OK5Kx^0 E 6e3Ɋ.fѯWWqۦ[꽍7fy:hNYFD zߔԤ/1^_HFHy2R$i2%)XǮ0;FEO 6r_wa2L(x;˼u)b>紂or5IkL*?7fD S%rQl4v!5Ux^MO0 +@" *@6e$$=*%NiՈ'8=S邥)挧eII6/|T2+E%M {eT2He<ECF⍯:>*5[Ƈjkz,U F_:3"ָ/Bޙ d:{ǻ.:GCP!8ɼ"kK{Uw^j3/dNn%yQ}0}J`[)pIU4Di/sɯ?)33Ofq+t{8`/)l %K5Kx^ej0S ]@!]XCdIH#;O -xaМOgQ zi%69s߄uai&޿xO0)aǎe3P|a ,L^^~|s҄W@Ĕzh"U؄jdD $("QLLy'Q;pM#I9iU/S`7t Mur<4zu2BB?P|n\ !-| iNu*O,BT}mJFt*9) :4Oe:Z]7/fk'>b-V[w:e mC:!cOߐRzP)ר)IÄ9$L+hxp4-4 X˷3eKej *T%_M}&"k9r 5Yx^QMo0 =]4mZvy@;32] Q$Mߗ6`D_{\= R1RmkpæylmG?<ΔA)ٱ"ДkڏHꉟО.zB*Sˋ Zʏ>ӯ:Ĝʋtmpil;nS*~함KejVե`yNC*S@lDU6O5ު 􃝭5 ԅ@ sb$_<?4ȥGuCLq#iI/n>r2 fSzwq\9Rж3XGCzѭf)gKeeI`@rCI6">

    Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controllervvNa@p5t php53 5.3.26The PHP development team reports:

    A Heap-based buffer overflow flaw was found in the php quoted_printable_encode() function. A remote attacker could use this flaw to cause php to crash or execute arbirary code with the permission of the user running php0 https://bugzilla.redhat.com/show_bug.cgi?id=964969  9 N~ b/ . In this case this is achieved by using javascript source attributes with whitespaces.

    Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10r G:z5x^1 ϛ.(JO=^=eFđGbkɫ~źPÝ6![^,\ǰns8sZ?OOoeCS_(Jh5"x^Un0 )]SҖMULĥ$rRP~i߱cfqQ '0NQzei: $ #b/ROЍBԃa  XBm c4 +>Q u&59m³e^xPm%>C^DDR#4׏ע.RKL19EhLw=W&*&/E׽KzJs*yYrVp6aWաp4U>u*z^-+`Tc;h( )ZIFwF EVË{[|hc+ܳQ% |Ȁ|S?M@vcRx^?o0| +?T ,UJ"e}IFgCo_CO|wO(^:vd~Z^BRr 0 S۰?6`[}cJ>፝}Y%*LdW@KXT5^^y(ٯr`_&&y8˖%VINyg"OuNAsՔsşZeVp}F(% p$ӓ|hCl:D,#ΠKG{? 5Px^J0ǯ)Re0jA;a0 ktҷtC.?LM-No2o:{ eO5xh/>2^RTպޥqߢIGW[?|"ځ`ʣFX<5I㳲 @⸑>&j? c|Y5F3PU)bz; ^hW?+_z ,kiQz~ ܠ2˚$ `І%24bpLFbCwJ{̯/ dۇ @~EJڍs!e70rvT5Ux^mQ=0 {q,k72%WϽ_*ۥd}%CQKQ@\I9\mY߫RĮ~;=9 xCpsW u`+p|:f ʩ*<_s43}]USY.˲gQt)(ZnZ嗨=. :řC3~%9mu۰X#g .Ez%qɥke5dBc2ϷwBѳ8 BILu5W Q4@cK]F.XƕC/iyl$5azo=dXVL)F`O ri K=GZlt~x^mQN0<_a-)mRk,"#)$MC%K<^V}idrDXUܾp8,A'zuE5ENjWڑQNR' qۇEO9GýYhj<ڦ wοPƘ6C0*\6e-1N:ap8\Б9M UV8 t("N& pqg1ZK)+280Fjig."e ^zt,?T/i&36^KTA2N,ruv`5Ux^}R0=_1#nYH !Tq5q'k{пgp@ly{o1jr^"GPy8YE 8 ?eu0] ALq3F1Oj.>R>/2 $jjŎkMeN@ET4*x^QN0W'( ,Hsi,\ۜ{n {4}~}몮2eh|m#BQ$v_@Fc Z-MzHV2F>aЂ'0mw<*#(}6O[ FZLd=0=B1$2mGdH,@I{r!7ڲ!%x?SrŴGKEG&b9ԄV{Uuӈ|L;o̦ %Հ&F$n -'{O-A9؞E}݈0k}iss}P=~5{x^}N0)V=7uJ 77$wސU;NB'k<;;^bgwu䊗xIqr.olHri]R#<>a !)< h/H;༐{(B̀j8&YC+ 6AEQ1-xs }/lI {;Hk@ hؽ'b',O9;:M)r lm8`v&1eB %tfs?8N @%T8~n,W}g_@{kUbI]Sjb<]&ɪ@śJ s)]~X|x=H

    An error in the "jumpUrl" mechanism can be exploited to read arbitrary files from local resources by disclosing a hash secret used to restrict file access9-0815 CVE-2009-0816 http://secunia.com/advisories/33829/ http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/ 2009-02-10 2009-02k\v\_<sB8x^Un0 S.ؕL,o?jΆM~~I k8sr=[dqBwMw_Ft(:2 S7lBsOM;N5Dž^羿\. }+\\q~a9ޤ~+D@ׄ39j#5a(6p3^<" - ¾vg_#U_"52{Z 0xQRlN}XQv,;[yYݴ x5F ϖߚƴ+Bٶ1Jbwe6C-l@*ب_LmM!v?5Ux^Qn =_z'&ɚ5eeҮS⴨2 Y+m!Yт--ʊqc"×.7lt90gClџ2 < =|:+z!QFLD;)oL%'CFfZ?EK;j.q[v 9sCaiVMT_ǃ7ءmi5e,Jd,+W%*PJ8=:285)G$"(k8s: Y*a;a;סɳ*+c2P`];C$Rܯg9₆ /v[Z/x^RM0=7*zT[F{L5|$KE2~~hLpeV+UYNeeh]ڬ[C~r~  E$`PW;ٱMk=^>wҳ.T PmmgiЩ  7Fcd' ouP21]G]|Ԕo=zm%KN^KK> \P2Y9*a&VbD QWU_jDŽOnpΫW蒟y&MaXgfƐhzTP} A$_# ~̭I*s!X]0U0W >Ky ;~qI; t~n5drupal.org/node/162360f5b711b-3d0e-11dc-b3d3-0016179b2dd5"> drupal -- Multiple cross-site scripting vulnerabilities drupal4 4.7.7 drupal5 5.2p>The Drupal Project reports:

    Some server variablAt@R5Wx^An0E#JCRPJ+uY{c<5IZPc\xN FhgGQ›Ԉ_&UݕIUIı(MNޥLL;AXUN24H"p#*3zA08YgZ@$BZX|H%eU#.glè>`%3/VnmN}BB 5;x^mR0 ;  Х@qtRp$\(t('=R=434ٴSz`сRyHBn$r.<2C1&m]>y6"m% GAd,r2M |1_&2 ɴ=90Dh]`N/?wvi#9Rɬm(& aj^au?˪l [H;տf/G]*o%LȯIeP-Ƚ/B[(.SY0V74L>ݮoʵoaIDF?@F5 x^mQ=o0_q\c *)RǪK}`q@@ t>;,9l(*q#]cC(p"J(Ԋ3Ytp4[o2KSX{*ɓԯV7v c!^xfB*~p#&Q|.۹+yە{,EfX2) 24{dB8)KJ$٭Zο(` |ҩ mӴz m G_y,l=}";?x٨k0KLMϪyHƩh`xt {(xZȀu*>XY]F/Sׂ K5Kx^un@ S&F@KC;S+Kd}X|Q0>L'YW7_~=7ۏt}8>}F v>=k1UD̀e!Ip46&"=E&#һP"Y2u%G&㼇0T;?V h"`TJ+=gX"xWZj٨۾K"n01( Ӽ_B>?q'Lm-l]ԚX*:U*PC.Hwϗk[`{˜zѡ@)uU|̘36nbQ6N7V+a[OzufE-*SΣ?QwCN:5}x^MO0_1io@?(i ".U=MFjm8-)aya3}T ~& I%_6ΌΓ5w 4p[)a;m^a6W/@Tǒd eLq58|=Hx"ح\5hy%0gVMQy:mۘ#%UuxBǡh2CK{WNj_4=%%vHlXtAz&0ڐ bYq2ʅ5:4 SqȈUM(DI/Ytc+jZ꽥F^sS :ü K5Kx^uRn0 =_AXv')\ðCogY!(qA%] (mNqSeNyF TY L=V 6B. xbM weǩ?Q3C*:gޯ3>m ZCuf}]h& l[^S;4tNj 'jS4+(cra292ђ[ 4Z1q}%\#:c/QHr+kIPXO~Tv&,x^MQr ='_ jjBaM<޾ݷ[RoZVG&F0') hmG<<%"YZ%hJ )BߓTwiLwڹvnކ: UsZ ϹX0oNt#GȢ$y nZi;`hT9#4.*$iI)C(0P zzjע;뇾\"1X@)s#mj4o* r@`z.xvy`NJ1n,7?+ᖡ݂"!Uy GYjF@-5tream.

    The squid patches page notes:

    response_splitting">

    This patch additionally strengthens Squid from the HTTP response attack described by Sanctum.

    cvename>CVE-2005-0175response_splitt200 https://www.watchfire.com/securearea/whitepapers.aspx?id=8 625878 2004-03-01ŀ5R7)v?4P?@53 2004-11-091f922de0-3fe5-11d9-a9e7-0001020eed82"> unarj -- directory traversal vulnerability unarj 2.43_2unarj has insufficient checks for filenames that contain ... This can allow an attacker to overwrite arbitrary files with the permissions of the user running unarj1027 11436 D^!yx"` dɸ9t! JVXi %PF;Ւ `0WJ2}>"9t77~h ɭ67C,op2]>~uov}ߜ$er7q2)5e>F*ݲ~.>m׮7nv[/ɾfT%G\# 몟١;ׂ<Sx=5Sx^Mn0#%Dr#!U e8cؑm}XvS<sA{m,+㬊=9̇OŹӓ$om\T,}s*`G7]Xz9+F\YeMryqMeEn˛Dh܃&Zޑ"OX$W\J=8ъi>c,e5|%Ež#W7d< 3^b1toYJ8c?"uBQX!(,WF{NE+a\=M;|? c^\}̳ق: K:Kx^Mo0 ۯ zڀ%jC02d@o-36WYR%^hn/0HA|W$=Na߁ -*K ۍN_ AtJY90C՚Ɛ37*H[ǻJZ(>,^:t0bʰwYpD]|xX ;uNdJ}Tne>+^WW 74h]JAmk{p h -p;K,]iZ /FE[