|
Security
ByNathan Willis
July 22, 2015
The Linux Foundation's Core Infrastructure
Initiative (CII) exists to "fortify" critical open-source software
projects with funding, code reviews, and other kinds of support, with
a particular eye toward shoring up those packages to prevent serious
security crises. CII was formed in response to the memorable
"Heartbleed" vulnerability discovered in OpenSSL, which was the
first adopted project. Recently, CII unveiled its Census
Project, a semi-automated ranking of open-source projects by
security risk. The numbers make for some interesting
reading—although the conclusions subsequently drawn by the CII
can be puzzling.
The Census Project was announced on July 9, at which time the CII
presented the results of its project-analysis work. There is a
multi-page HTML table on the Census Project page, as well as a
white
paper [PDF] co-authored with the Institute for Defense Analyses
(IDA) that goes into detail on the methods and metrics considered and
used. The upshot is that each project examined in the census is
assigned an integer score on a scale from 0 to 16, with higher
numbers indicating the greatest risk that the project could be the
source of an undiscovered security hole. The peculiar aspect to the
story, however, is that the CII appears to have amassed a list of
high-risk projects that has little to do with the results of the
Census Project.
Scoring projects
The process used to determine the scores, though, did not involve
any inspection of the code itself—just a look at project
"metadata" of various flavors. As described on the web site, the
Census Project counts seven factors when compiling its scores. How
these factors are measured requires a more detailed examination
(below), but the list itself is short:
-
The number of CVEs filed (worth from 0 to 3 points)
-
The project's contributor count over the past 12 months (2 to 5 points)
-
The project's ranking in the Debian popularity list (point
value unspecified)
-
Whether or not the project has a known web site (0 or 1 point)
-
Whether or not the package is exposed to the network (0 or 2
points)
-
Whether or not the package processes network data (0 or 1 point)
-
Whether or not the package could be used for local privilege
escalation (0 or 1 point)
-
Whether or not the project includes an executable or only provides
data (0 or -3 points)
The number of points assigned for popularity in Debian is not
specified. The other factors, however, are only enough to add up to a
score of 13, so perhaps the popularity is a 0–to–3
score—and it would appear that a high popularity ranking
corresponds to more "risk" points. In
addition, CII's Emily Ratliff noted that only CVEs since
2010 were counted.
Individual pages for each project assessment provide a bit more detail (see, for example,
the page for tcpd), noting
which language the program is implemented in, so other factors may be part of the
scoring formula. Ultimately, of course, the score is the product of a human
assessment of the project, as the CII web site makes plain. While
some of the input data is harvested from Debian and from Black Duck's
OpenHub, other factors clearly involve some
qualitative judgment—such as whether or not a package could be
used for local privilege escalation—and the white paper
mentions that the speed with which CVEs are fixed played a role in the
rankings.
Of the packages assessed so far, the first big cliff in the scoring
occurs between the packages scoring 9 or above and those scoring 8 or
below. This top-scoring class of packages includes the following:
| Package | Score |
|---|
| tcpd | 11 |
| whois | 11 |
| ftp | 11 |
| netcat-traditional | 11 |
| at | 10 |
| libwrap0 | 10 |
| traceroute | 10 |
| xauth | 10 |
| bzip2 | 9 |
| hostname | 9 |
| libacl1 | 9 |
| libaudit0 | 9 |
| libbz2-1.0 | 9 |
| libept1.4.12 | 9 |
| libreadline6 | 9 |
| libtasn1-3 | 9 |
| linux-base | 9 |
| telnet | 9 |
Regrettably, the raw numbers that make up each package's score do
not appear to be available. It would have been interesting to see the
exact point values assigned for number of contributors, for example.
It is also not entirely clear how some of factors are
scored—does "could be used for local privilege escalation" mean
simply "is installed setuid," for example?
The project has a GitHub
repository where some of the data-scraping code can be inspected,
but the CII site and white paper both indicate that human assessment
of the data plays a major role in the final process (starting with
cleaning up the "noisy" raw data).
Beyond scores
In the end, though, the oddest thing about the scoring is that
these raw scores do not indicate which projects
CII will invest in. The white paper, after a lengthy (60-page) explanation of
the methodologies employed, comes up with a different set of
human-selected "riskiest" projects based on the authors'
"knowledge of how the programs are used" and on which
project "appear to be relatively unmaintained." The
human-identified project list includes: xauth, bzip2, libaudit0,
libtasn1-3, bind9, exim4, isc-dhcp, gnutls26, gpgme, openldap, pam,
openssl, net-tools, openssh, rsyslog, wget, apr-util, coolkey, ntp,
gnupg, gzip, expat, freetype, libgcrypt11, keyutils, xz-utils,
p11-kit, pcre3, cyrus-sasl2, libxml2, shadow, tar, zlib, apr,
libjpeg8, libpng, libressl, unzip, giflib, mod-gnutls, postfix, and
cryptsetup.
This list contains little that is surprising. The projects
highlighted are those that must deal with untrusted network
connections, those that are responsible for processing potentially
malicious data file formats, and those that are responsible for
enforcing security measures for the system as a whole or for
application programs. This may seem a bit anticlimactic, since
it varies little from the list that any security-conscious user might
come up with on their own.
Nevertheless, it is good to see someone attempt systematic analysis
to reach a conclusion about the riskiness of common programs. The
troubling factor is that, so far, the analysis only underscores common sense. The larger question is what
CII intends to do with this information. The first few CII-supported
projects
(ntpd, GnuPG, Frama-C, OpenSSL, OpenSSH, Debian's reproducible builds,
and The Fuzzing Project) were
selected before there was a formal process in place.
The Census Project is a first step toward assembling such a
process. Still, the web page makes a point of saying that『the
decision to fund a project in need is not automated by any
means.』 The white paper concludes by saying only that CII
participants『believe the next step is to further investigate
these OSS projects for security and project healthiness.』
Interestingly enough, outsiders are invited to participate in the
CII's project-identification process by contributing patches or
suggestions to the Census Project code on GitHub or by writing to one
of the CII
mailing lists. Thus far, two other projects have been suggested
for consideration on the cii-census list (the archives of which are
visible only to subscribers): the Trinity fuzz tester and the
PaX patch set. Both suggestions were referred to the CII steering
committee, which includes one representative each from the supporting
companies: Amazon Web Services, Adobe, Bloomberg, Cisco, Dell,
Facebook, Fujitsu, Google, Hitachi, HP, Huawei, IBM, Intel, Microsoft,
NetApp, NEC, Qualcomm, RackSpace, Salesforce.com, and VMware.
The CII itself is still finding its footing. Apart from the Census
Project, multiple pages on the site invite projects interested in
funding to contact the CII with a grant request, but point them to a
contact page
but does not yet have a formal process defined. Time will tell how CII goes about selecting which
projects to support from among the high-risk prospects. Hopefully,
much of that selection process will take place in the open. As this
census shows, there is
no shortage of important projects that are in need of additional
support; transparency in determining which ones merit support is as
important as the ability to study the resulting improvements to the
source code.
Comments (4 posted)
Brief items
I'm speaking to the choir when I lament
the fact that so much leakage of information seems to be necessary in
order to use most modern devices... that ship has sailed, and we're just
fighting a rearguard action now.
— Don Armstrong
I guess I should be signing stuff, but I've never been sure what to
sign. Maybe if I post my private key, I can crowdsource my decisions about
what to sign.
— xkcd
[Charlie] Miller and [Chris] Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say they’re working on perfecting their steering control—for now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeep’s GPS coordinates, measure its speed, and even drop pins on a map to trace its route.
— Andy
Greenberg drives a Jeep controlled remotely by way of a security vulnerability
Comments (none posted)
New vulnerabilities
apache: multiple vulnerabilities
| Package(s): | apache httpd |
CVE #(s): | CVE-2015-0253
CVE-2015-3183
CVE-2015-3185
|
| Created: | July 20, 2015 |
Updated: | August 26, 2015 |
| Description: |
From the Arch Linux advisory:
- CVE-2015-0253 (denial of service):
Fix a crash with ErrorDocument 400 pointing to a local URL-path with the
INCLUDES filter active, introduced in 2.4.11. PR 57531.
- CVE-2015-3183 (denial of service):
core: Fix chunk header parsing defect. Remove apr_brigade_flatten(),
buffering and duplicated code from the HTTP_IN filter, parse chunks in a
single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be
strict about chunk-ext authorized characters.
- CVE-2015-3185 (authentication bypass):
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with
new ap_some_authn_required and ap_force_authn hook. |
| Alerts: |
|
Comments (none posted)
cacti: SQL injection
| Package(s): | cacti |
CVE #(s): | CVE-2015-4634
|
| Created: | July 21, 2015 |
Updated: | July 27, 2015 |
| Description: |
From the Debian LTS advisory:
CVE-2015-4634:
SQL injection vulnerability in Cacti before 0.8.8e allows remote
attackers to execute arbitrary SQL commands in graphs.php
Currently unknown or unassigned CVE's
SQL injection vulnerability in Cacti before 0.8.8e allows remote
attackers to execute arbitrary SQL commands in cdef.php, color.php,
data_input.php, data_queries.php, data_sources.php,
data_templates.php, gprint_presets.php, graph_templates.php,
graph_templates_items.php, graphs_items.php, host.php,
host_templates.php, lib/functions.php, rra.php, tree.php and
user_admin.php |
| Alerts: |
|
Comments (none posted)
drupal7-feeds: three vulnerabilities
| Package(s): | drupal7-feeds |
CVE #(s): | |
| Created: | July 16, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Drupal release notes:
This is a security release. People running 7.x-2.0-alpha8 or below should update. This release only contains security fixes, no additional bug fixes or features.
Changes since 7.x-2.0-alpha8:
-
#2495145 by twistor, cashwilliams, greggles, klausi: Possible XSS in PuSHSubscriber.inc
-
#2502419 by klausi: Log messages XSS attack vector
-
#1848498 by twistor: Respect allowed file extensions in file mapper
|
| Alerts: |
|
Comments (none posted)
drupal7-migrate: cross-site scripting
| Package(s): | drupal7-migrate |
CVE #(s): | |
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Drupal advisory:
The module doesn't sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability (XSS).
This vulnerability is mitigated by the fact that an attacker must have a role
with permission to create/edit fields (such as "administer taxonomy"), or be able to modify source data being imported by an administrator. Furthermore, the migrate_ui submodule must be enabled. |
| Alerts: |
|
Comments (none posted)
drupal7-views_bulk_operations: permission bypass
| Package(s): | drupal7-views_bulk_operations |
CVE #(s): | |
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Drupal advisory:
The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled (such as admin/people when the administration_views module is used), they will be able to edit their own account and give themselves a higher role (such as "administrator") even if they don't have the "'administer users'" permission.
This vulnerability is mitigated by the fact that an attacker must have access to such a user listing page and that the bulk operation for changing Roles is enabled. |
| Alerts: |
|
Comments (none posted)
freexl: denial of service
| Package(s): | freexl |
CVE #(s): | |
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Debian advisory:
It was discovered that an integer overflow in freexl, a library to parse
Microsoft Excel spreadsheets may result in denial of service if a
malformed Excel file is opened. |
| Alerts: |
|
Comments (none posted)
groovy: code execution
| Package(s): | groovy |
CVE #(s): | CVE-2015-3253
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Debian LTS advisory:
cpnrodzc7, working with HP's Zero Day Initiative, discovered that
Java applications using standard Java serialization mechanisms to
decode untrusted data, and that have Groovy on their classpath, can
be passed a serialized object that will cause the application to
execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
inspircd: denial of service
| Package(s): | inspircd |
CVE #(s): | |
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Debian LTS advisory:
Adam <adam AT anope.org>, upstream author of inspircd found the Debian
patch that fixed CVE-2012-1836 was incomplete. Furthermore, it
introduced an issue, since invalid dns packets caused an infinite loop.
|
| Alerts: |
|
Comments (none posted)
java: multiple unspecified vulnerabilities
| Package(s): | java-1.6.0-sun |
CVE #(s): | CVE-2015-2627
CVE-2015-2637
CVE-2015-2638
CVE-2015-2664
|
| Created: | July 17, 2015 |
Updated: | August 13, 2015 |
| Description: |
From the CVE entries:
CVE-2015-2627: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.
CVE-2015-2637: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
CVE-2015-2638: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2015-2664: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. |
| Alerts: |
|
Comments (none posted)
java: multiple unspecified vulnerabilities
| Package(s): | java-1.7.0-oracle |
CVE #(s): | CVE-2015-2596
CVE-2015-2613
CVE-2015-2619
CVE-2015-4729
CVE-2015-4736
|
| Created: | July 17, 2015 |
Updated: | August 13, 2015 |
| Description: |
From the CVE entries:
CVE-2015-2596: Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
CVE-2015-2613: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.
CVE-2015-2619: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
CVE-2015-4729: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.
CVE-2015-4736: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. |
| Alerts: |
|
Comments (none posted)
libidn: information disclosure
| Package(s): | libidn |
CVE #(s): | CVE-2015-2059
|
| Created: | July 20, 2015 |
Updated: | August 17, 2015 |
| Description: |
From the Debian LTS advisory:
Thijs Alkemade discovered that the Jabber server may pass an invalid
UTF-8 string to libidn, the GNU library for Internationalized Domain
Names (IDNs). In the case of the Jabber server, this results in
information disclosure, and it is likely that some other applications
using libidn have similar vulnerabilities. This update changes libidn
to check for invalid strings rather than assuming that the application
has done so. |
| Alerts: |
|
Comments (none posted)
lxc: two vulnerabilities
| Package(s): | lxc |
CVE #(s): | CVE-2015-1331
CVE-2015-1334
|
| Created: | July 22, 2015 |
Updated: | August 11, 2015 |
| Description: |
From the Ubuntu advisory:
Roman Fiedler discovered that LXC had a directory traversal flaw when creating
lock files. A local attacker could exploit this flaw to create an arbitrary
file as the root user. (CVE-2015-1331)
Roman Fiedler discovered that LXC incorrectly trusted the container's proc
filesystem to set up AppArmor profile changes and SELinux domain transitions. A
local attacker could exploit this flaw to run programs inside the container
that are not confined by AppArmor or SELinux. (CVE-2015-1334) |
| Alerts: |
|
Comments (none posted)
mysql: multiple unspecified vulnerabilities
| Package(s): | mysql |
CVE #(s): | CVE-2015-2582
CVE-2015-2620
CVE-2015-2643
CVE-2015-2648
CVE-2015-4737
CVE-2015-4752
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the CVE entries:
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS. (CVE-2015-2582)
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. (CVE-2015-2620)
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-2643)
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2015-2648)
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth. (CVE-2015-4737)
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S. (CVE-2015-4752)
|
| Alerts: |
|
Comments (none posted)
mysql: multiple unspecified vulnerabilities
Comments (none posted)
pacemaker: privilege escalation
| Package(s): | pacemaker |
CVE #(s): | CVE-2015-1867
|
| Created: | July 22, 2015 |
Updated: | August 4, 2015 |
| Description: |
From the Red Hat advisory:
A flaw was found in the way pacemaker, a cluster resource manager,
evaluated added nodes in certain situations. A user with read-only access
could potentially assign any other existing roles to themselves and then
add privileges to other users as well. |
| Alerts: |
|
Comments (none posted)
pdns: denial of service
| Package(s): | pdns pdns-recursor |
CVE #(s): | CVE-2015-5470
|
| Created: | July 22, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the PowerDNS advisory:
A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.
Update 7th of July 2015: Toshifumi Sakaguchi discovered that the original fix was insufficient in some cases. Updated versions of the Authoritative Server and Recursor were released on the 9th of June. Minimal patches are available. The insufficient fix was assigned CVE-2015-5470.
|
| Alerts: |
|
Comments (none posted)
php-horde: multiple vulnerabilities
| Package(s): | php-horde |
CVE #(s): | |
| Created: | July 21, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Fedora advisory:
**Horde_Form 2.0.10**
* [jan] SECURITY: Fixed XSS in form renderer.
**Horde_Icalendar 2.1.1**
* [jan] Fix generated VALARM TRIGGER attributes with empty duration (Ralf Becker).
**Horde_Auth 2.1.10**
* [jan] SECURITY: Don't allow to login to LDAP with an empty password.
**Horde_Core 2.20.6**
* [jan] SECURITY: Don't allow to login with an empty password.
* [jan] Give administrators access to all groups, even with $conf['share']['any_group'] disabled. |
| Alerts: |
|
Comments (none posted)
pki-core: cross-site scripting
| Package(s): | pki-core |
CVE #(s): | CVE-2012-2662
|
| Created: | July 22, 2015 |
Updated: | August 4, 2015 |
| Description: |
From the Red Hat advisory:
Multiple cross-site scripting flaws were discovered in the Red Hat
Certificate System Agent and End Entity pages. An attacker could use these
flaws to perform a cross-site scripting (XSS) attack against victims using
the Certificate System's web interface. |
| Alerts: |
|
Comments (none posted)
python-keystonemiddleware: certificate verification botch
| Package(s): | python-keystonemiddleware |
CVE #(s): | CVE-2015-1852
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the CVE entry:
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. |
| Alerts: |
|
Comments (none posted)
rawstudio: insecure temp files
| Package(s): | rawstudio |
CVE #(s): | CVE-2014-4978
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Red Hat bugzilla:
The following was reported:
The function "rs_filter_graph" located in file ./librawstudio/rs-filter.c contains the following code:
g_string_append_printf(str, "}\n");
g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
ignore = system("dot -Tpng >/tmp/rs-filter-graph.png >/tmp/rs-filter-graph");
ignore = system("gnome-open /tmp/rs-filter-graph.png");
This code makes insecure use of two temporary files:
/tmp/rs-filter-graph.png and
/tmp/rs-filter-graph
This allows the truncation of arbitrary files which are owned by the user running
rawstudio - for example:
ln -s ~/.important /tmp/rs-filter-graph
ln -s /etc/shadow /tmp/rs-filter-graph.png |
| Alerts: |
|
Comments (none posted)
rsyslog: denial of service
| Package(s): | rsyslog |
CVE #(s): | CVE-2015-3243
|
| Created: | July 16, 2015 |
Updated: | July 22, 2015 |
| Description: |
The Red Hat bugzilla entry talks about rsyslog exiting on a SIGSEGV from SanitizeMsg():
I haven't seen a crash, but I can observe the issue under valgrind.
Can be reproduced with something like:
python -c "from systemd import journal; journal.send('', SYSLOG_FACILITY='10', PRIORITY='4')" |
| Alerts: |
|
Comments (none posted)
ruby: denial of service
| Package(s): | ruby1.9.1 |
CVE #(s): | CVE-2014-6438
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Debian LTS advisory:
It was discovered that the uri package in the Ruby standard library
uses regular expressions that may result in excessive backtracking.
Ruby applications that parse untrusted URIs using this library were
susceptible to denial-of-service attacks by passing crafted URIs.
|
| Alerts: |
|
Comments (none posted)
springframework: denial of service
| Package(s): | springframework |
CVE #(s): | CVE-2015-3192
|
| Created: | July 16, 2015 |
Updated: | July 29, 2015 |
| Description: |
From the Red Hat bugzilla entry:
If DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protect against this kind of attack DTD support must be disabled by setting the disallow-doctype-dec feature in the DOM and SAX APIs to true and by setting the supportDTD property in the StAX API to false. |
| Alerts: |
|
Comments (none posted)
squashfs-tools: two vulnerabilities
| Package(s): | squashfs-tools |
CVE #(s): | CVE-2015-4645
CVE-2015-4646
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the sasquatch advisory:
CVE-2015-4645:
The first problem overflows the bytes variable, so that the allocation of fragments_bytes[] has an erroneous size.
int bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
...
fragment_table = malloc(bytes);
CVE-2015-4646:
If we fix this by making the variable size_t, we run into an unrelated problem in which the stack VLA allocation of fragment_table_index[] can easily exceed RLIMIT_STACK. |
| Alerts: |
|
Comments (none posted)
tidy: two vulnerabilities
| Package(s): | tidy |
CVE #(s): | CVE-2015-5522
CVE-2015-5523
|
| Created: | July 20, 2015 |
Updated: | July 30, 2015 |
| Description: |
From the Debian advisory:
Fernando Muñoz discovered that invalid HTML input passed to tidy, an
HTML syntax checker and reformatter, could trigger a buffer overflow.
This could allow remote attackers to cause a denial of service (crash)
or potentially execute arbitrary code.
Geoff McLane also discovered that a similar issue could trigger an
integer overflow, leading to a memory allocation of 4GB. This could
allow remote attackers to cause a denial of service by saturating the
target's memory. |
| Alerts: |
|
Comments (none posted)
webkitgtk4: denial of service
| Package(s): | webkitgtk4 |
CVE #(s): | |
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the Red Hat bugzilla:
This bug has been created based on an anonymous crash report requested by the package maintainer. |
| Alerts: |
|
Comments (none posted)
xen: privilege escalation
| Package(s): | xen |
CVE #(s): | CVE-2015-3259
|
| Created: | July 20, 2015 |
Updated: | July 22, 2015 |
| Description: |
From the CVE entry:
Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument. |
| Alerts: |
|
Comments (none posted)
Page editor: Jake Edge
Next page:
Kernel development>>
|
|
