Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

sdlimage

  • Vulnerable: 1.2.6-1
  • Unaffected: 1.2.6-2kalgan1

Two vulnerabilities have been reported in SDL_image, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

  1. A boundary error within the “LWZReadByte()” function in IMG_gif.c can be exploited to trigger the overflow of a static buffer via a specially crafted GIF file.
  2. A boundary error within the “IMG_LoadLBM_RW()” function in IMG_lbm.c can be exploited to cause a heap-based buffer overflow via a specially crafted IFF ILBM file.

CVEs:

vlc

  • Vulnerable: 0.8.6-11
  • Unaffected: 0.8.6-12kalgan1

Some vulnerabilities have been reported in VLC Media Player, which potentially can be exploited by malicious people to compromise a user’s system.

  1. An integer overflow error within the “MP4_ReadBox_rdrf()” function in modules/demux/mp4/libmp4.c can be exploited to cause a heap-based buffer overflow via e.g. a MP4 file with a specially crafted RDRF atom.
  2. A boundary error within the “sdpplin_parse()” function in modules/access/rtsp/real_sdpplin.c can be exploited to overwrite arbitrary memory regions.
  3. Two integer overflow errors within the “cinepak_decode_frame()” function in modules/codec/cinepak.c can be exploited to cause a heap-based buffer overflow. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

CVEs:

xine-lib

  • Author: vmiklos
  • Vulnerable: 1.1.11-1kalgan1
  • Unaffected: 1.1.11-1kalgan2

Luigi Auriemma has reported some vulnerabilities in xine-lib, which potentially can be exploited by malicious people to compromise a user’s system. The vulnerabilities are caused due to integer overflow errors when allocating memory in src/demuxers/demux_flv.c, src/demuxers/demux_qt.c, src/demuxers/demux_real.c, src/demuxers/demux_wc3movie.c, src/demuxers/ebml.c, and src/demuxers/demux_film.c. These can be exploited to cause heap-based buffer overflows via overly large fields included in e.g. FLV, MOV, RM, MVE, MKV, and CAK files.

cups

  • Author: vmiklos
  • Vulnerable: 1.3.6-1
  • Unaffected: 1.3.6-2kalgan1

Some vulnerabilities have been reported in CUPS, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise a vulnerable system.

  1. A boundary error exists within the “cgiCompileSearch()” function in cgi-bin/search.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted IPP request. Successful exploitation may allow execution of arbitrary code, but requires that the vulnerable system is sharing printers on the network. NOTE: If printer sharing is disabled, the vulnerability can only be exploited by malicious, local users.
  2. A boundary error exists within the “gif_read_image()” function in filter/image-gif.c. This can be exploited to cause a buffer overflow via overly large “code_size” values in GIF image files. Successful exploitation may allow execution of arbitrary code.

CVEs:

opera

  • Author: vmiklos
  • Vulnerable: 9.26-1
  • Unaffected: 9.27-1kalgan1

Some vulnerabilities have been reported in Opera, which potentially can be exploited by malicious people to compromise a user’s system.

  1. An error when prompting the user to add a newsfeed can be exploited to cause an invalid memory access via a specially crafted newsfeed source.
  2. An error exists in the processing of HTML CANVAS elements. This can be exploited to cause a memory corruption via specially crafted scaled pattern images. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

CVEs:

python

  • Author: vmiklos
  • Vulnerable: 2.5.2-1
  • Unaffected: 2.5.2-2kalgan1

David Remahl has discovered a security issue in the imageop module for Python, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. The security issue is caused due to an incomplete fix (see FSA295) and can be exploited to cause a heap-based buffer overflow when specially crafted parameters are passed to the function. Successful exploitation may allow execution of arbitrary code.

gnupg

  • Author: voroskoi
  • Vulnerable: 1.4.8-1
  • Unaffected: 1.4.9-1kalgan1

A vulnerability has been reported in GnuPG, which can potentially be exploited to compromise a vulnerable system. The vulnerability is caused due to an error when importing keys with duplicated IDs. This can be exploited to cause a memory corruption when importing keys via –refresh-keys or –import. Successful exploitation potentially allows execution of arbitrary code, but has not been proven yet.

CVEs:

gnupg2

  • Author: voroskoi
  • Vulnerable: 2.0.8-1
  • Unaffected: 2.0.9-1kalgan1

A vulnerability has been reported in GnuPG, which can potentially be exploited to compromise a vulnerable system. The vulnerability is caused due to an error when importing keys with duplicated IDs. This can be exploited to cause a memory corruption when importing keys via –refresh-keys or –import. Successful exploitation potentially allows execution of arbitrary code, but has not been proven yet.

CVEs:

firefox

  • Author: vmiklos
  • Vulnerable: 2.0.0.12-1
  • Unaffected: 2.0.0.13-1kalgan1

Some vulnerabilities and weaknesses have been reported in Mozilla Firefox, which can be exploited by malicious people to bypass certain security restrictions, disclose potentially sensitive information, conduct cross-site scripting and phishing attacks, and potentially compromise a user’s system.

  1. An unspecified error in the handling of “XPCNativeWrappers” can lead to the execution of arbitrary Javascript code with the user’s privileges via “setTimeout()” calls.
  2. Various errors in the handling of Javascript code can be exploited to conduct cross-site scripting attacks or execute arbitrary code.
  3. Various errors in the layout engine can be exploited to cause a memory corruption.
  4. Various errors in the Javascript engine can be exploited to cause a memory corruption. Successful exploitation of these vulnerabilities may allow execution of arbitrary code.
  5. An error within the handling of HTTP “Referer:” headers sent with requests to URLs containing “Basic Authentication” credentials having an empty username can be exploited to bypass cross-site request forgery protections.
  6. The problem is that Firefox offers a previously configured private SSL certificate when establishing connections to webservers requesting SSL Client Authentication. This can potentially be exploited to disclose sensitive information via a malicious webserver.
  7. An error in the handling of the “jar:” protocol can be exploited to establish connections to arbitrary ports on the local machine.
  8. An error when displaying XUL pop-up windows can be exploited to hide the window’s borders and facilitate phishing attacks.

CVEs:

seamonkey

  • Author: vmiklos
  • Vulnerable: 1.1.8-1
  • Unaffected: 1.1.9-1kalgan1

Some vulnerabilities and weaknesses have been reported in Mozilla SeaMonkey, which can be exploited by malicious people to bypass certain security restrictions, disclose potentially sensitive information, conduct cross-site scripting and phishing attacks, and potentially compromise a user’s system. For more information, please see FSA406.

CVEs: