Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

php

  • Author: voroskoi
  • Vulnerable: 5.2.1-3terminus1
  • Unaffected: 5.2.2-1terminus1

Several vulnerabilities and weaknesses have been reported in PHP, where some have unknown impacts and others can be exploited by malicious users to manipulate certain data, disclose potentially sensitive information, bypass certain security restrictions, or to cause a DoS (Denial of Service), and potentially by malicious people to compromise a vulnerable system.

  1. An input validation error in the “ftp_putcmd()” function can be exploited to inject newline characters.
  2. An unspecified error in the “import_request_variables()” can be exploited to overwrite global variables.
  3. An unspecified error can remotely be exploited to cause a buffer overflow within in the “make_http_soap_request()” function (PHP 5).
  4. An unspecified error can be exploited to cause a buffer overflow within the “user_filter_factory_create()” function (PHP 5).
  5. An unspecified error in the bundled libxmlrpc library can remotely be exploited to cause a heap-based buffer overflow and may allow execution of arbitrary code.
  6. An input validation error in the “mail()” function allows injection of headers via the “To” and “Subject” parameters.
  7. An error in the “mail()” function allows to truncate messages via ASCIIZ bytes.
  8. The “safe_mode” and “open_basedir” protection mechanisms can be bypassed via the “zip://” and “bzip://” wrappers.
  9. An integer overflow exists in “substr_compare()”, which can be exploited to read memory from memory behind PHP variables. The “substr_count” function is reportedly also affected.
  10. An error in the “mb_parse_str()” can be exploited to activate “register_globals”.
  11. An error in the Zend engine related to nested array variables that can be exploited to crash a PHP application.

CVEs:

python

  • Author: voroskoi
  • Vulnerable: 2.5-2
  • Unaffected: 2.5-3terminus1

Piotr Engelking has reported a security issue in Python, which can be exploited by malicious people to disclose potentially sensitive information. The security issue is caused due to an off-by-one error within the “PyLocale_strxfrm()” function in Modules/_localemodule.c, which can be exploited to disclose certain parts of the memory.

CVEs:

squirrelmail

  • Author: voroskoi
  • Vulnerable: 1.4.9-1
  • Unaffected: 1.4.10-1terminus1

Some vulnerabilities have been reported in SquirrelMail, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks.

  1. SquirrelMail does not sanitise charsets in HTML or JavaScript data before sending it to browsers. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site by sending malicious HTML emails. Reportedly, this affects Internet Explorer only.
  2. The script compose.php allows users to perform certain actions via HTTP requests without performing validity checks to verify the request. This can be exploited to e.g. send emails from another user’s account by including malicious links to images in an email.

CVEs:

unzip

  • Author: voroskoi
  • Vulnerable: 5.52-1
  • Unaffected: 5.52-2terminus1

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete. Buffer overflow in UnZip allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.

vim

  • Author: voroskoi
  • Vulnerable: 7.0-3
  • Unaffected: 7.0-4terminus1

Tomas Golembiovsky has discovered a vulnerability in Vim, which can be exploited by malicious people to compromise a user’s system. The vulnerability is caused due to the application allowing e.g. the “feedkeys()” function to be called in the sandbox. This can be exploited to execute arbitrary commands with privileges of the Vim user. Successful exploitation requires that the “modelines” option is enabled and the user is tricked into opening a malicious file.

xmms

  • Author: voroskoi
  • Vulnerable: 1.2.10-11
  • Unaffected: 1.2.10-12terminus1

Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user’s system.

  1. An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information. Successful exploitation allows execution of arbitrary code.
  2. An integer overflow error exists in the processing of skin bitmap images. This can be exploited to cause memory corruption via specially crafted skin images containing manipulated header information. Successful exploitation may allow the execution of arbitrary code.

CVEs:

xscreensaver

  • Author: voroskoi
  • Vulnerable: 5.01-1
  • Unaffected: 5.01-2terminus1

Alex Yamauchi has reported a weakness in XScreenSaver, which potentially can be exploited by malicious people to bypass certain security restrictions. The weakness is caused due to an error within the parsing of results of a call to “getpwuid()” in drivers/lock.c when using directory servers during a network outage. This can be exploited to e.g. crash XScreenSaver and thus gain access to a locked system.

php

  • Author: voroskoi
  • Vulnerable: 5.2.1-2terminus1
  • Unaffected: 5.2.1-3terminus1

Ivan Fratric has reported a vulnerability in PHP, which potentially can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an integer overflow within the “readwbmp()” function in ext/gd/libgd/wbmp.c. This can be exploited to e.g. cause a DoS by tricking a PHP script into loading a specially crafted wbmp image. Stefan Esser has reported some vulnerabilities in PHP, which can be exploited by malicious users to compromise a vulnerable system.

postgresql

  • Author: voroskoi
  • Vulnerable: 8.2.3-1
  • Unaffected: 8.2.4-1terminus1

A security issue has been reported in PostgreSQL, which potentially can be exploited by malicious users to gain escalated privileges. The security issue is caused due to an error in SECURITY DEFINER functions and can be exploited to gain escalated privileges by modifying the search_path and using temporary objects.

CVEs:

proftpd

  • Author: voroskoi
  • Vulnerable: 1.3.0-6
  • Unaffected: 1.3.0-7terminus1

A security issue has been reported in ProFTPD, which potentially can be exploited by malicious people to bypass certain security restrictions. The security issue is caused due to an error within ProFTPD’s Auth API. If multiple authentication modules are used, it is possible that one module provides data, which is then authenticated against another module. This can e.g. be exploited to bypass certain security restrictions if authentication modules are configured with different policies.