chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.
When chronyd is configured to save the pidfile in a directory where the
chrony user has write permissions (e.g. /var/run/chrony - the default
since chrony-3.4), an attacker that compromised the chrony user account
could create a symbolic link at the lΐ C N~% OΏ: "(Ais version of Rails contains an
important security patch, and you should upgrade! The release contains
only one patch that addresses CVE-2020-8185url>https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/
https://github.com/rails/rails/blob/6-0-stable/actionpack/CHANGELOG.mdΰ i g `u 9g
MySQL Client -- Multiple vulerabilities
mysql56-client
5.6.48
mysql57-client
5.7.30
mysql80-client B
v²?1 J @00.9.3The libssh team reports:
In an environment where a user is only allowed to copy files and
not to execute applications, it would be possible to pass a location
which contains commands to be executed in a _ FΞ@] R| ?]h1>Problem Description:
A function extracting the length from type-length-value
encoding is not properly validating the submitted length.
Impact:
A remote user could cause, for example, an out-of-bounds
read, decoding of unrelated data, or trigger a crash of the
software such as bsnmpd resulting in a denial of service₯ΐ 86 J 6s due to a catastrophic backtracking vulnerability in a
regular expression. The chars() and words() methods are used to
implement the truncatechars_html and truncatewords_html template
filters, which were thus vulnerable
The regular expressions used by Truncator have been simplified in
order to avoid potential backtracking issues. As a consequence, trailing
punctuation may now at times be included in«ΰ +A
Wh J )g/samba/security/CVE-2018-16860.html
CVE-2018-16860
https://www.samba.org/samba/security/CVE-2019-3880.html
CVE-2019-3880
Rust -- violation of Rust's safety guarantees
² 86 J 6 CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
libcurl contains a heap buffer out-of-bounds read flaw.
The function handling incoming NTLM type-2 messages
(lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming
data correctly and is subject to an integer overflow vulnerability.
Using that overflow, a malicious or broken NTLM server could trick
libcurl to accept aΈ L
J w@ ? J
2018-11-16
2018-11-21
2018-11-23
Flash Player -- arbitrary code execution
linux-flashplayer
31.0.0.15Ύΐ 86 J 6e length value is interpreted as signed char on many systems
(depending on default signedness of char), which can lead to an out
of boundary write up to 128 bytes in front of the allocated storage,
but limited to NUL byte(s).
If the server sends a reply in which even the first string would
overflow the transmitted bytes, list[0] (or flist[0]) will be set to
NULL and a count of 0 is returned. If the rΔΰ 86 J 6a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.
The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow andΛ b b' t C J `ve Execution Vulnerabilities8h1>Problem Description:
A number of issues relating to speculative execution
were found last year and publicly announced January 3rd.
Two of these, known as Meltdown and Spectre V2, arΡ k M S J i8 and Firefox ESR 52.6cvename>CVE-2018-5089
CVE-2018-5090
CVE-2018-5091
CVE-2018-5092
CVE-2018-5093
CVE-2018-5094
CVE-2018-5095
CVE-2018-5097
CVE-2018-5098
postgresql94-server
9.4.09.4.15
postgresql95-server
9.5.09.5.10
postgresql96-server
9.6.09.6.6
postgresql10-server
10.010έΰ I eΖ~½ B
Κ J the no_log directive where the information may not be sanitized properlyansible/ansible/issues/22505
CVE-2017-747-21
2017-09-25
wδ > J> KξR /2017-06-13
2017-06-15
mozillafirefox
54.0κ Bv v J J @s -- directory traversal on KTNEF
kdepimlibs
4.14.10_7Albert Aastals Cid reports:
A directory traversal issue was found in KTNEF which can be
exploited by trickinπΐ 4
2 J 2 This problem only affects Squid configured
to use the Collapsed Forwarding feature. It is of particular
importance for HTTPS reverse-proxy sites with Collapsed
Forwarding.
Squid security advisory 2016:11 reports:
MySQL -- Mmariadbariadb100-server
10.0.25
CVE-2016-4477
ports/209564
http://w1.fi/security/2016-1/psk-parameter-config-update.txt
2016-05-02
2016-05-20
2017-03-22
expat -- denial of service vulnerability on malformed inputΰ 86 J 6016-02-17
2016-03-09
2016-03-09
brotli -- buffer overflow
brotli
0.3.00.3.0_1
0.2.0_2
libbrotli
0.3.0_3
86 J 6CVE-2016-0751
CVE-2016-0752
CVE-2016-0753
https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ
https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ
https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ
https://groups.google.com/d/msg 86 J 6emulator built with the Virtual Network Device(virtio-net)
support is vulnerable to a DoS issue. It could occur while receiving
large packets over the tuntap/macvtap interfaces and when guest's
virtio-net driver did not support big/mergeable receive buffers.
An attacker on the local network could use this flaw to disable
guest's networking by sending a large number of jumbo frames to the
guest, exhau’ΐ
vΛ xR>
CVE-2015-8131
https://www.elastic.co/community/security/
2015-11-17
2015-11-22
a2ps -- format string vulnerability
a2ps
4.13b_8¨ΰ
O@ 1 ve a stack overflow vulnerability that could
lead to code execution (CVE-2015-5587).
These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-5572).
These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-6679― B: v J @3
RT -- two XSS vulnerabilities
rt42
4.2.04.2.12
rt40
4.0.04.0.24Best P΅ ³z iΕ. uUename>
CVE-2015-5144
CVE-2015-5145
2015-06-10
2015-07-09
libcurl provides applications a way to set custom HTTP
headers to be sent to the server by using CURLOPT_HTTPHEADER.
A similar option is available for the curl command-line
tool with the '--header' option.
When the connection passes through an HTTP proΑΰ 86 J 615-0209
CVE-2015-0288
https://www.openssl.org/news/secadv_20150319.txt
2015-03-19
2015-03-19
2016-08-09
libXfont -- BDF parsing issues
libXfont
1.12.4_10,Alan Coopersmith reports:
Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way the X server
code base handles requests from XΞ _§ Y€.6 J ]name>qt5-gui
5.2.1_44-April/000045.html">
The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug
that would lead to a null pointer dereference when loading certain
hand craftedΤΐ Nό c) 8xplorer when using an older version of the browser. If a user views
a malicious page while logged in, settings may be changed
unintentionallycvename>CVE-2014-0813
CVE-2014-0814
http://www.phpmyfaq.de/advisory_2014-02-04.phpΪΰ Zu ^
Σ@c J Xhat Little CMS did not properly verify certain
memory allocations. If a user or automated system using Little CMS
were tricked into opening a specially crafted file, an attacker
could cause Little CMS to crash (CVE-2013-4160).
4160
http://advisories.mageia.org/MGASA-2013-0240.html
https:α XH `β J Vn development team reports:
When modifying a URL parameter with a crafted value it
is possible to trigger an XSS.
These XSS can only be triggered when a valid database is
known and when a valid cookie token is used937
η `
^ v@ , ^age>
rubygem-rails
3.2.11
rubygem-actionpack
3.2.11
rubygem-activerecord
3.2.11
rubygem-activesupport
3.2.11νΐ [ ]Α@X J Y explicitly mentioned in the configuration. This means that if you
need resources on the server's domain to be handled by some other
system, you'll need to explicitly use ModPagespeedMapOriginDomain
or ModPagespeedDomain to authorize that2-4001
CVE-2012-4360
https://developers.goσΰ Tε« aΑ=Ί J 10.*10.5kinny Channel Driver Remote Crash Vulnerabi2-3553
http://downloads.digium.com/puϊ f R|T J d CVE-2012-0806
https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c
https://projects.duckcorp.org/issues/269
2012-01-07039d057e-544e-11e1-9fb7-003067b2972c">
surf -- private information disclo { I< I< I< &$11-3001
CVE-2011-3002
CVE-2011-3003
CVE-2011-3004
CVE-2011-3005
CVE-2011-3232
http://www.mozilla.org/security/announce/2011/mfsa2011-363738ΐ E4 s@ J C-11e0-b1ce-0019d1a7ece2">
tinyproxy -- ACL lists ineffective when range is configured
tinyproxy
1.8.2_2,1 When including a line to allow a network of IP addresses, the access to tinyproxy
56 is actually allowed for all IP addresses.
ΰ ^ OΠ~D D? 9\ted SNMP packet.
The vulnerability is confirmed in version 1.4.0 and
reported in version 1.2.11 and prior and version 1.4.0 and
priocvename>CVE-2010-3445
http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html
http://www.wireshark.org/lists/wireshark-announce/201010/msg00001 G S¬0 L½9 .Erly long byte streams9629
http://www.videolan.org/security/sa1003.html
2010-04-19
2010-05-01
2010-05-05
joom 86 J 6rride
MFSA 2009-61 Cross-origin data theft through
document.getSelection()
MFSA 2009-59 Heap buffer overflow in string to
number conversion
MFSA 2009-57 Chrome privilege escalation in
XPCVariant::VariantDataToJS()
MFSA 2009-56 Heap buffer overflow in GIF color map
parser
MFSA 2009-55 Crash in proxy auto-configuration
regexp parsing
MFSA 2009ΐ B v 1 J @2">
cups -- remote code execution and DNS rebinding
cups-base
1.3.10Gentoo security team summarizes:
The following issues were reported in CUPS:
₯ΰ B v=* J @pic>php5-gd -- uninitialized memory information disclosure vulnerability
php5-gd
5.2.8According to CVE-2008-5498 entry:
Array index error in the "imageRotate" fu¬ n JΘ8L J ln.net/home_page/security.php?issue=PMASA-2008-8
2008-09-23
2008-09-23
2008-10-03
gallerygallery
1.5.9
28373
Έΐ l _Π? B§& J into surrendering sensitive information. (CVE-2007-1095,
CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)09519
2007-10-22
2007-10-23
<Ύΰ
< » φ 2;php4-wddx
php4
4.4.7Ε >» zΘ@ J <
serendipity
1.0.1Serendipity Team reports:
Serendipity failed to correctly sanitize user input on the
media manager administration page. The content of GET varΛ [F ] J Y to read
any file which can be read by the Shoutcast server process6-3007
http://secunia.com/advisories/20524/
http://people.ksp.sk/~goober/advisory/001-shoutcast.html
2006-06-09
2006-07-11
In order to exploit this vulnerability, an attacker would
need to entice a user to follow a link to a malicious server.
Once the user visits a website under the control of an
attacker, it is possible in a default install of RealPlayer
to force a web-browser to use RealPlayer to connect to an
arbΧΰ ob IΚ? J m -- swf file handling arbitrary code
linux-flashplugin6
6.0r79_3
linux-flashplugin7
7.0r61430/">
<ή j N
X J h "Content-Disposition" HTTP header.
Successful exploitation may result in users being tricked
into executing a malicious file via the download dialog,
but requires that the "Arial Unicode MS" font
(ARIALUNI.TTF) has been installed on the systemurl>http://secunia.com/advisories/15870/
http://www.opera.com/freebsd/cδ 86 J 6name>CVE-2004-0412
http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html
2004-05-15
2005-06-01
tomcat -- Tomcat Manager cross-site scripting
jakarta-tomcat
5.0κΐ
9x G πΰ Eq sό R J Cw
2.4.3
fractorama
1.6.7_1
iv
ja-iv
ja-libimg
0
ISS X-Force reports that a remotely exploitable buffer
overflow exists in the Netscape Security Services (NSS)
library's implementation of SSLv2. From their advisory:
The NSS library contains a flaw in SSLv2 record parsing
that may lead to remote compromise. When parsing the
first record in an SSLv2 negotiaΐ α δ?h1 P=΅ α f
Midnight Commander uses a fixed sized stack buffer while
resolving symbolic links within file archives (tar or cpio).
If an attacker can cause a user to process a specially
crafted file archive with Midnight Commander,
the attacker may be able to obtain the privileges of the
target user1023