Computer Security
[EN] securityvulns.ru no-pyccku


libext2fs / e2fsprogs buffer overflow
updated since 16.02.2015
Published:08.03.2015
Source:
SecurityVulns ID:14263
Type:library
Threat Level:
5/10
Description:Buffer overflow on block group descriptor information.
Affected:E2FS : e2fsprogs 1.42
CVE:CVE-2015-1572 (Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.)
 CVE-2015-0247 (Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.)
Original documentdocumentUBUNTU, [USN-2507-1] e2fsprogs vulnerabilities (08.03.2015)
 documentAndrea Barisani, [oCERT-2015-002] e2fsprogs input sanitization errors (16.02.2015)
 documentMANDRIVA, [ MDVSA-2015:045 ] e2fsprogs (16.02.2015)

Cisco IOS XR DoS
Published:08.03.2015
Source:
SecurityVulns ID:14299
Type:remote
Threat Level:
6/10
Description:DoS on IPv6 packets processing.
CVE:CVE-2015-0618 (Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241.)
Files:Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability

Apache taglibs security vulnerabilities
Published:08.03.2015
Source:
SecurityVulns ID:14297
Type:library
Threat Level:
7/10
Description:Code executions, XXE.
Affected:APACHE : Taglibs 1.2
CVE:CVE-2015-0254 (Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.)
Original documentdocumentAPACHE, [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags (08.03.2015)

sudo privilege escalation
Published:08.03.2015
Source:
SecurityVulns ID:14298
Type:local
Threat Level:
5/10
Description:Elevated file access is possible.
Affected:SUDO : sudo 1.8
CVE:CVE-2014-9680
Original documentdocumentDEBIAN, [SECURITY] [DSA 3167-1] sudo security update (08.03.2015)

Asus RT-G32 security vulnerabilities
Published:08.03.2015
Source:
SecurityVulns ID:14300
Type:remote
Threat Level:
4/10
Description:XSS, CSRF.
Affected:ASUS : ASUS RT-G32
Original documentdocumentMustLive, Vulnerabilities in ASUS RT-G32 (08.03.2015)

unace buffer overflow
Published:08.03.2015
Source:
SecurityVulns ID:14302
Type:local
Threat Level:
4/10
Description:Buffer overflow on archives extraction.
Affected:UNACE : UNACE 1.2
CVE:CVE-2015-2063 (Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which triggers a buffer overflow.)
Original documentdocumentDEBIAN, [SECURITY] [DSA 3178-1] unace security update (08.03.2015)

xdg-open code execution
updated since 19.01.2015
Published:08.03.2015
Source:
SecurityVulns ID:14230
Type:library
Threat Level:
7/10
Description:Code execution because of insufficient shell characters filtering in protocol handlers.
Affected:XDG : xdg-utils 1.1
CVE:CVE-2015-1877
 CVE-2014-9622 (Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.)
Original documentdocumentDEBIAN, [SECURITY] [DSA 3165-1] xdg-utils security update (08.03.2015)
 documentDEBIAN, [SECURITY] [DSA 3131-1] xdg-utils security update (19.01.2015)

HP XP P9000 crossite scripting
Published:08.03.2015
Source:
SecurityVulns ID:14303
Type:remote
Threat Level:
5/10
Affected:HP : HP XP P9000
CVE:CVE-2014-7896 (Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before 7.6.1-06, and HP XP7 Global Link Manager Software (aka HGLM) 6.x through 8.x before 8.1.2-00, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.)
Original documentdocumentHP, [security bulletin] HPSBST03274 rev.1 - HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux, Remote Cross-site Scripting (XSS) (08.03.2015)

Freetype multiple security vulnerabilities
Published:08.03.2015
Source:
SecurityVulns ID:14296
Type:library
Threat Level:
7/10
Description:Multiple memory corruptions on fonts parsing.
Affected:FREETYPE : FreeType 2.5
CVE:CVE-2014-9675 (bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.)
 CVE-2014-9674 (The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.)
 CVE-2014-9673 (Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.)
 CVE-2014-9672 (Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.)
 CVE-2014-9671 (Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.)
 CVE-2014-9670 (Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.)
 CVE-2014-9669 (Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.)
 CVE-2014-9668 (The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.)
 CVE-2014-9667 (sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.)
 CVE-2014-9666 (The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.)
 CVE-2014-9665 (The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.)
 CVE-2014-9664 (FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.)
 CVE-2014-9663 (The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.)
 CVE-2014-9662 (cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.)
 CVE-2014-9661 (type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.)
 CVE-2014-9660 (The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.)
 CVE-2014-9659 (cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.)
 CVE-2014-9658 (The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.)
 CVE-2014-9657 (The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.)
 CVE-2014-9656 (The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.)
Original documentdocumentUBUNTU, [USN-2510-1] FreeType vulnerabilities (08.03.2015)

GNU patch security vulnerabilities
updated since 08.03.2015
Published:29.06.2015
Source:
SecurityVulns ID:14301
Type:local
Threat Level:
5/10
Description:DoS, directory traversal.
Affected:GNU : patch 2.7
CVE:CVE-2015-1396
 CVE-2015-1395
 CVE-2015-1196 (GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.)
 CVE-2014-9637
Original documentdocumentGNU, [USN-2651-1] GNU patch vulnerabilities (29.06.2015)
 documentMANDRIVA, [ MDVSA-2015:050 ] patch (08.03.2015)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod