Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

acroread

  • Author: Miklos Vajna
  • Vulnerable: 8.1.2-1
  • Unaffected: 8.1.3-1solaria1

Multiple vulnerabilities have been reported in Adobe Reader/Acrobat, which can be exploited by malicious, local users to gain escalated privileges or by malicious people to compromise a user’s system.

  1. A boundary error exists when parsing format strings containing a floating point specifier in the “util.printf()” Javascript function. This can be exploited to cause a stack-based buffer overflow via a specially crafted PDF and allows execution of arbitrary code.
  2. An out-of-bounds array indexing error when parsing embedded Type 1 fonts can be exploited to corrupt memory and may allow execution of arbitrary code.
  3. An error in an AcroJS function used to perform HTTP authentication can be exploited to corrupt memory via an overly long string passed to the function. This may allow execution of arbitrary code.
  4. An error when creating a Collab object and performing a specific sequence of actions on it can be exploited to corrupt memory. This may allow execution of arbitrary code.
  5. An unspecified error when parsing malformed PDF objects can be exploited to corrupt memory, which may allow execution of arbitrary code.
  6. An input validation error in the Download Manager used by Adobe Reader may allow code execution during the download process.
  7. An error in the Download Manager used by Adobe Reader may result in a user’s Internet Security options being changed during the download process.
  8. An input validation error in a JavaScript method may allow code execution.
  9. An unspecified privilege escalation vulnerability exists in the version for UNIX/Linux.

CVEs:

cups

  • Author: Miklos Vajna
  • Vulnerable: 1.3.8-1
  • Unaffected: 1.3.9-1solaria1

Some vulnerabilities have been reported in CUPS, which potentially can be exploited by malicious people to compromise a vulnerable system.

  1. Two boundary errors exist in the implementation of the HP-GL/2 filter. These can be exploited to cause buffer overflows via HP-GL/2 files containing overly large pen numbers.
  2. A boundary error exists within the “read_rle16()” function when processing SGI (Silicon Graphics Image) files. This can be exploited to cause a heap-based buffer overflow via a specially crafted SGI file.
  3. An integer overflow error exists within the “WriteProlog()” function included in the “texttops” utility. This can be exploited to cause a heap-based buffer overflow via a specially crafted file. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

CVEs:

net-snmp

  • Author: Miklos Vajna
  • Vulnerable: 5.4.1.2-1
  • Unaffected: 5.4.2.1solaria1-1

A vulnerability has been reported in Net-snmp, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an integer overflow error within the “netsnmp_create_subtree_cache()” function in agent/snmp_agent.c. This can be exploited to cause a crash via a specially crafted SNMP GETBULK request.

CVEs:

opensc

  • Author: Miklos Vajna
  • Vulnerable: 0.11.5-1
  • Unaffected: 0.11.6-1solaria1

A security issue has been reported in OpenSC, which can be exploited by malicious people to bypass certain security restrictions. The security issue is caused due to the application improperly setting the ADMIN file control information to “00” while initializing smart cards having a Siemens CardOS M4 operating system. This can be exploited to change a user PIN code without having the PIN or PUK if the smart card was initialized with OpenSC.

drupal

  • Author: Miklos Vajna
  • Vulnerable: 5.11-1solaria1
  • Unaffected: 5.12-1solaria1

A vulnerability has been reported in Drupal, which can potentially be exploited by malicious, local users to gain escalated privileges. Input passed to unspecified parameters is not properly verified before being used to include files. This can be exploited to include specially named files from local resources and potentially escalate privileges. Successful exploitation requires that the web server is configured to use virtual hosts.

drupal-cck

  • Author: Miklos Vajna
  • Vulnerable: 5.x_1.10-1solaria1
  • Unaffected: 5.x_1.9-1

Some vulnerabilities have been reported in the Drupal Content Construction Kit (CCK), which can be exploited by malicious users to conduct script insertion attacks. Input passed to unspecified field labels and “content-type” names is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user’s browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires “administer content” privileges.

drupal6

  • Author: Miklos Vajna
  • Vulnerable: 6.5-1solaria1
  • Unaffected: 6.6-1solaria1

Two vulnerabilities have been reported in Drupal, which can be exploited by malicious users to conduct script insertion attacks. An input passed as book page titles is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user’s browser session in context of an affected site when the malicious data is viewed. For more info about the other issue, see FSA548. Successful exploitation requires valid user credentials with the “create book content” permission or the permission to edit book nodes.

phpmyadmin

  • Author: Miklos Vajna
  • Vulnerable: 2.11.9.2-1solaria1
  • Unaffected: 2.11.9.3-1solaria1

Hadi Kiamarsi has discovered a vulnerability in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the “db” parameter in pmd_pdf.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. Successful exploitation may require that the victim has valid user credentials.