diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 14a523944494..1b5c4d45d3bb 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -144,25 +144,23 @@ Note: Please add new entries to the beginning of this file.

Werner Koch reports:

CVE-2013-4576 has been assigned to this security bug.

-

The paper describes two attacks. The first attack allows -to distinguish keys: An attacker is able to notice which key is -currently used for decryption. This is in general not a problem but -may be used to reveal the information that a message, encrypted to a -commonly not used key, has been received by the targeted machine. We -do not have a software solution to mitigate this attack.

- + to distinguish keys: An attacker is able to notice which key is + currently used for decryption. This is in general not a problem but + may be used to reveal the information that a message, encrypted to a + commonly not used key, has been received by the targeted machine. We + do not have a software solution to mitigate this attack.

The second attack is more serious. It is an adaptive -chosen ciphertext attack to reveal the private key. A possible -scenario is that the attacker places a sensor (for example a standard -smartphone) in the vicinity of the targeted machine. That machine is -assumed to do unattended RSA decryption of received mails, for example -by using a mail client which speeds up browsing by opportunistically -decrypting mails expected to be read soon. While listening to the -acoustic emanations of the targeted machine, the smartphone will send -new encrypted messages to that machine and re-construct the private -key bit by bit. A 4096 bit RSA key used on a laptop can be revealed -within an hour.

+ chosen ciphertext attack to reveal the private key. A possible + scenario is that the attacker places a sensor (for example a standard + smartphone) in the vicinity of the targeted machine. That machine is + assumed to do unattended RSA decryption of received mails, for example + by using a mail client which speeds up browsing by opportunistically + decrypting mails expected to be read soon. While listening to the + acoustic emanations of the targeted machine, the smartphone will send + new encrypted messages to that machine and re-construct the private + key bit by bit. A 4096 bit RSA key used on a laptop can be revealed + within an hour.

@@ -454,7 +452,7 @@ within an hour.

The Samba project reports:

-

These are security releases in order to address CVE-2013-4408 +

These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).

@@ -789,12 +787,12 @@ within an hour.

Ruby Gem developers report:

The patch for CVE-2013-4363 was insufficiently verified so the - combined regular expression for verifying gem version remains - vulnerable following CVE-2013-4363.

+ combined regular expression for verifying gem version remains + vulnerable following CVE-2013-4363.

RubyGems validates versions with a regular expression that is - vulnerable to denial of service due to backtracking. For specially - crafted RubyGems versions attackers can cause denial of service - through CPU consumption.

+ vulnerable to denial of service due to backtracking. For specially + crafted RubyGems versions attackers can cause denial of service + through CPU consumption.

@@ -824,9 +822,9 @@ within an hour.

Ruby Gem developers report:

RubyGems validates versions with a regular expression that is - vulnerable to denial of service due to backtracking. For specially - crafted RubyGems versions attackers can cause denial of service - through CPU consumption.

+ vulnerable to denial of service due to backtracking. For specially + crafted RubyGems versions attackers can cause denial of service + through CPU consumption.

@@ -856,11 +854,11 @@ within an hour.

Ruby developers report:

Any time a string is converted to a floating point value, a - specially crafted string can cause a heap overflow. This can lead - to a denial of service attack via segmentation faults and possibly - arbitrary code execution. Any program that converts input of - unknown origin to floating point values (especially common when - accepting JSON) are vulnerable. + specially crafted string can cause a heap overflow. This can lead + to a denial of service attack via segmentation faults and possibly + arbitrary code execution. Any program that converts input of + unknown origin to floating point values (especially common when + accepting JSON) are vulnerable.

@@ -892,11 +890,11 @@ within an hour.

The Samba project reports:

-

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is - provided over SSL, uses world-readable permissions for a private key, - which allows local users to obtain sensitive information by reading the - key file, as demonstrated by access to the local filesystem on an AD - domain controller.

+

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is + provided over SSL, uses world-readable permissions for a private key, + which allows local users to obtain sensitive information by reading the + key file, as demonstrated by access to the local filesystem on an AD + domain controller.

@@ -938,7 +936,7 @@ within an hour.

The Samba project reports:

-

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, +

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying @@ -1127,18 +1125,15 @@ within an hour.

A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is - selected during kex exchange. - - If exploited, this vulnerability might permit code execution + selected during kex exchange.

+

If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.

Either upgrade to 6.4 or disable AES-GCM in the server configuration. The following sshd_config option will disable - AES-GCM while leaving other ciphers active: - - Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc -

+ AES-GCM while leaving other ciphers active:

+

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

@@ -1165,9 +1160,9 @@ within an hour.

Quassel IRC developers report:

SQL injection vulnerability in Quassel IRC before 0.9.1, - when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, - allows remote attackers to execute arbitrary SQL commands via - a \ (backslash) in a message.

+ when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, + allows remote attackers to execute arbitrary SQL commands via + a \ (backslash) in a message.

@@ -1277,10 +1272,10 @@ within an hour.

mod_pagespeed developers report:

Various versions of mod_pagespeed are subject to critical - cross-site scripting (XSS) vulnerability, CVE-2013-6111. This - permits a hostile third party to execute JavaScript in users' - browsers in context of the domain running mod_pagespeed, which - could permit theft of users' cookies or data on the site.

+ cross-site scripting (XSS) vulnerability, CVE-2013-6111. This + permits a hostile third party to execute JavaScript in users' + browsers in context of the domain running mod_pagespeed, which + could permit theft of users' cookies or data on the site.

@@ -1310,8 +1305,8 @@ within an hour.

Salvatore Bonaccorso reports:

This vulnerability affects the DANE library of gnutls 3.1.x and - gnutls 3.2.x. A server that returns more 4 DANE entries could - corrupt the memory of a requesting client.

+ gnutls 3.2.x. A server that returns more 4 DANE entries could + corrupt the memory of a requesting client.

@@ -1340,9 +1335,9 @@ within an hour.

Alan Coopersmith reports:

Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org - security team in which an authenticated X client can cause an X - server to use memory after it was freed, potentially leading to - crash and/or memory corruption.

+ security team in which an authenticated X client can cause an X + server to use memory after it was freed, potentially leading to + crash and/or memory corruption.

@@ -1410,16 +1405,16 @@ within an hour.

Additionally, we've adjusted security restrictions around file - uploads to mitigate the potential for cross-site scripting.

+ uploads to mitigate the potential for cross-site scripting.