codemadness.org

       oss-sec - sfeed_tests - sfeed tests and RSS and Atom files
 (HTM) git clone git://git.codemadness.org/sfeed_tests
 (DIR) Log
 (DIR) Files
 (DIR) Refs
 (DIR) README
 (DIR) LICENSE
       ---
       oss-sec (14380B)
       ---
            1 <?xml version="1.0" encoding="utf-8"?>
            2 <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
            3   <channel>
            4     <title>Open Source Security</title>
            5     <link>http://seclists.org/#oss-sec</link>
            6     <atom:link href="http://seclists.org/rss/oss-sec.rss" rel="self" type="application/rss+xml" />
            7     <language>en-us</language>
            8     <description>Discussion of security flaws, concepts, and practices in the Open Source community</description>
            9     <pubDate>Thu, 17 Sep 2020 11:00:03 GMT</pubDate>
           10     <lastBuildDate>Thu, 17 Sep 2020 11:00:03 GMT</lastBuildDate>
           11 <!-- MHonArc v2.6.19 -->
           12 
           13  
           14 
           15   <item>
           16     <title>Apache + PHP &lt;= 7.4.10 open_basedir bypass</title>
           17     <link>http://seclists.org/oss-sec/2020/q3/184</link>
           18     <description>&lt;p&gt;Posted by Havijoori on Sep 17&lt;/p&gt;Introduction&lt;br&gt;
           19 ============&lt;br&gt;
           20 open_basedir security feature can be bypassed when Apache web server runs PHP scripts.&lt;br&gt;
           21 &lt;br&gt;
           22 Proof of Concept&lt;br&gt;
           23 ================&lt;br&gt;
           24 1. Set open_basedir as a security feature in php.ini file :&lt;br&gt;
           25    open_basedir = /var/www/html:/tmp&lt;br&gt;
           26 2. Make a directory with the name of your web server&amp;apos;s home directory inside your web server&amp;apos;s home directory :&lt;br&gt;
           27    mkdir -p /var/www/html/var/www/html&lt;br&gt;
           28 3. Make a symlink to a restricted writable...&lt;br&gt;</description>
           29     <pubDate>Thu, 17 Sep 2020 10:50:42 GMT</pubDate>
           30     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/184</guid>
           31   </item>
           32   <item>
           33     <title>Samba and CVE-2020-1472 (&quot;Zerologon&quot;)</title>
           34     <link>http://seclists.org/oss-sec/2020/q3/183</link>
           35     <description>&lt;p&gt;Posted by Douglas Bagnall on Sep 17&lt;/p&gt;In August, Microsoft patched CVE-2020-1472, which gives administrator&lt;br&gt;
           36 access to an unauthenticated user on a Domain Controller.  Microsoft gave&lt;br&gt;
           37 it a CVSS score of 10.&lt;br&gt;
           38 &lt;br&gt;
           39 &lt;a  rel=&quot;nofollow&quot; href=&quot;https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1472#ID0EUGAC&quot;&gt;https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1472#ID0EUGAC&lt;/a&gt;&lt;br&gt;
           40 &lt;br&gt;
           41 The Samba security team was not contacted before the announcement, which&lt;br&gt;
           42 is very sparse on detail, and was unable to learn much through an&lt;br&gt;
           43 established (and generally quite useful) channel for...&lt;br&gt;</description>
           44     <pubDate>Thu, 17 Sep 2020 10:48:56 GMT</pubDate>
           45     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/183</guid>
           46   </item>
           47   <item>
           48     <title>CVE-2020-25625 QEMU: usb: hcd-ohci: infinite loop issue while processing transfer descriptors</title>
           49     <link>http://seclists.org/oss-sec/2020/q3/182</link>
           50     <description>&lt;p&gt;Posted by P J P on Sep 17&lt;/p&gt;   Hello,&lt;br&gt;
           51 &lt;br&gt;
           52 An infinite loop issue was found in the USB OHCI controller emulator of QEMU. &lt;br&gt;
           53 It could occur while servicing OHCI isochronous transfer descriptors (TD) in &lt;br&gt;
           54 ohci_service_iso_td routine, as it retires a TD if it has passed its time &lt;br&gt;
           55 frame. While doing so it does not check if the TD was already processed ones &lt;br&gt;
           56 and holds an error code in TD_CC. It may happen if the TD list has a loop.&lt;br&gt;
           57 &lt;br&gt;
           58 A guest user/process may use this flaw to consume cpu...&lt;br&gt;</description>
           59     <pubDate>Thu, 17 Sep 2020 10:15:23 GMT</pubDate>
           60     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/182</guid>
           61   </item>
           62 
           63 
           64   <item>
           65     <title>CVE-2020-25085 QEMU: sdhci: out-of-bounds access issue while doing multi block SDMA</title>
           66     <link>http://seclists.org/oss-sec/2020/q3/181</link>
           67     <description>&lt;p&gt;Posted by P J P on Sep 16&lt;/p&gt;   Hello,&lt;br&gt;
           68 &lt;br&gt;
           69 An out-of-bounds r/w access issue was found in the SDHCI Controller emulator &lt;br&gt;
           70 of QEMU. It may occur while doing multi block SDMA, if transfer block size &lt;br&gt;
           71 exceeds the &amp;apos;s-&amp;gt;fifo_buffer[s-&amp;gt;buf_maxsz]&amp;apos; size. It&amp;apos;d leave the current &lt;br&gt;
           72 element pointer &amp;apos;s-&amp;gt;data_count&amp;apos; pointing out of bounds. Leading the subsequent &lt;br&gt;
           73 DMA r/w operation to OOB access issue. A guest user/process may use this flaw &lt;br&gt;
           74 to crash the QEMU...&lt;br&gt;</description>
           75     <pubDate>Wed, 16 Sep 2020 18:56:48 GMT</pubDate>
           76     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/181</guid>
           77   </item>
           78   <item>
           79     <title>CVE-2020-25084 QEMU: usb: use-after-free issue while setting up packet</title>
           80     <link>http://seclists.org/oss-sec/2020/q3/180</link>
           81     <description>&lt;p&gt;Posted by P J P on Sep 16&lt;/p&gt;   Hello,&lt;br&gt;
           82 &lt;br&gt;
           83 An use-after-free issue was found in USB(xHCI/eHCI) controller emulators of &lt;br&gt;
           84 QEMU. It occurs while setting up USB packet, as usb_packet_map() routine may &lt;br&gt;
           85 return an error, which was not checked. A guest user/process may use this flaw &lt;br&gt;
           86 to crash the QEMU process resulting in DoS scenario.&lt;br&gt;
           87 &lt;br&gt;
           88 Upstream patches:&lt;br&gt;
           89 -----------------&lt;br&gt;
           90    -&amp;gt; &lt;a  rel=&quot;nofollow&quot; href=&quot;https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html&quot;&gt;https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html&lt;/a&gt;&lt;br&gt;
           91    -&amp;gt;...&lt;br&gt;</description>
           92     <pubDate>Wed, 16 Sep 2020 18:29:25 GMT</pubDate>
           93     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/180</guid>
           94   </item>
           95   <item>
           96     <title>Re: [CVE-2020-13944] Apache Airflow Reflected XSS via Origin Parameter &lt;= 1.10.12</title>
           97     <link>http://seclists.org/oss-sec/2020/q3/179</link>
           98     <description>&lt;p&gt;Posted by Kaxil Naik on Sep 16&lt;/p&gt;Correction the issue only affects &amp;lt; 1.10.12 (not &amp;lt;= 1.10.12)&lt;br&gt;</description>
           99     <pubDate>Wed, 16 Sep 2020 14:54:19 GMT</pubDate>
          100     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/179</guid>
          101   </item>
          102   <item>
          103     <title>Multiple vulnerabilities in Jenkins plugins</title>
          104     <link>http://seclists.org/oss-sec/2020/q3/178</link>
          105     <description>&lt;p&gt;Posted by Daniel Beck on Sep 16&lt;/p&gt;Jenkins is an open source automation server which enables developers around&lt;br&gt;
          106 the world to reliably build, test, and deploy their software.&lt;br&gt;
          107 &lt;br&gt;
          108 The following releases contain fixes for security vulnerabilities:&lt;br&gt;
          109 &lt;br&gt;
          110 * Blue Ocean Plugin 1.23.3&lt;br&gt;
          111 * computer-queue-plugin Plugin 1.6&lt;br&gt;
          112 * Email Extension Plugin 2.76&lt;br&gt;
          113 * Health Advisor by CloudBees Plugin 3.2.1&lt;br&gt;
          114 * Mailer Plugin 1.32.1&lt;br&gt;
          115 * Perfecto Plugin 1.18&lt;br&gt;
          116 * Pipeline Maven Integration Plugin 3.9.3&lt;br&gt;
          117 * Validating String...&lt;br&gt;</description>
          118     <pubDate>Wed, 16 Sep 2020 13:14:57 GMT</pubDate>
          119     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/178</guid>
          120   </item>
          121   <item>
          122     <title>[CVE-2020-13944] Apache Airflow Reflected XSS via Origin Parameter &lt;= 1.10.12</title>
          123     <link>http://seclists.org/oss-sec/2020/q3/177</link>
          124     <description>&lt;p&gt;Posted by Kaxil Naik on Sep 16&lt;/p&gt;Versions Affected: &amp;lt;= 1.10.12&lt;br&gt;
          125 Description:&lt;br&gt;
          126 The &amp;quot;origin&amp;quot; parameter passed to some of the endpoints like &amp;apos;/trigger&amp;apos; was&lt;br&gt;
          127 vulnerable to XSS exploit.&lt;br&gt;
          128 &lt;br&gt;
          129 Credit:&lt;br&gt;
          130 The issue was independently discovered and reported by Ali Al-Habsi of&lt;br&gt;
          131 Accellion &amp;amp; Everardo Padilla Saca.&lt;br&gt;
          132 &lt;br&gt;
          133 Thanks,&lt;br&gt;
          134 Kaxil,&lt;br&gt;
          135 on behalf of Apache Airflow PMC&lt;br&gt;</description>
          136     <pubDate>Wed, 16 Sep 2020 12:08:37 GMT</pubDate>
          137     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/177</guid>
          138   </item>
          139   <item>
          140     <title>Linux Kernel: out-of-bounds reading in vgacon_scrolldelta</title>
          141     <link>http://seclists.org/oss-sec/2020/q3/176</link>
          142     <description>&lt;p&gt;Posted by NopNop Nop on Sep 16&lt;/p&gt;Hi,&lt;br&gt;
          143 &lt;br&gt;
          144 We found a out-of-bounds reading in vgacon_scrolldelta. This BUG is caused&lt;br&gt;
          145 by &amp;quot;soff&amp;quot; being negative after VT_RESIZE.&lt;br&gt;
          146 &lt;br&gt;
          147 Our PoC (panic with CONFIG_KASAN=y):&lt;br&gt;
          148 &lt;br&gt;
          149 #include &amp;lt;stdio.h&amp;gt;&lt;br&gt;
          150 #include &amp;lt;stdlib.h&amp;gt;&lt;br&gt;
          151 #include &amp;lt;unistd.h&amp;gt;&lt;br&gt;
          152 #include &amp;lt;sys/types.h&amp;gt;&lt;br&gt;
          153 #include &amp;lt;sys/stat.h&amp;gt;&lt;br&gt;
          154 #include &amp;lt;sys/ioctl.h&amp;gt;&lt;br&gt;
          155 #include &amp;lt;fcntl.h&amp;gt;&lt;br&gt;
          156 &lt;br&gt;
          157 int main(int argc, char** argv)&lt;br&gt;
          158 {&lt;br&gt;
          159         int fd = open(&amp;quot;/dev/tty1&amp;quot;, O_RDWR, 0);...&lt;br&gt;</description>
          160     <pubDate>Wed, 16 Sep 2020 10:14:45 GMT</pubDate>
          161     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/176</guid>
          162   </item>
          163 
          164 
          165   <item>
          166     <title>[CVE-2020-13948] Apache Superset Remote Code Execution Vulnerability</title>
          167     <link>http://seclists.org/oss-sec/2020/q3/175</link>
          168     <description>&lt;p&gt;Posted by William Barrett on Sep 15&lt;/p&gt;Affected Versions: Apache Superset &amp;lt; 0.37.1&lt;br&gt;
          169 &lt;br&gt;
          170 While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests &lt;br&gt;
          171 via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the &lt;br&gt;
          172 web application process. It was thus possible for an authenticated user to list and access files, environment &lt;br&gt;
          173 variables, and process information. Additionally...&lt;br&gt;</description>
          174     <pubDate>Tue, 15 Sep 2020 18:26:51 GMT</pubDate>
          175     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/175</guid>
          176   </item>
          177   <item>
          178     <title>CVE-2020-14390: Linux kernel: slab-out-of-bounds in fbcon</title>
          179     <link>http://seclists.org/oss-sec/2020/q3/174</link>
          180     <description>&lt;p&gt;Posted by Minh Yuan on Sep 15&lt;/p&gt;Hi,&lt;br&gt;
          181 &lt;br&gt;
          182 I found a out-of-bound write in fbcon_redraw_softback while the kernel&lt;br&gt;
          183 version &amp;lt;= 5.9.rc5. The oldest affected kernel version is 2.2.3.&lt;br&gt;
          184 The root cause of this vulnerability is that the value of vc-&amp;gt;vc_origin is&lt;br&gt;
          185 not updated in time while invoking vc_do_resize.&lt;br&gt;
          186 &lt;br&gt;
          187 This is my PoC (need the permission to open and write the tty, and need to&lt;br&gt;
          188 have a fbcon driver):&lt;br&gt;
          189 &lt;br&gt;
          190 // author by ziiiro@thu&lt;br&gt;
          191 #include &amp;lt;stdio.h&amp;gt;&lt;br&gt;
          192 #include &amp;lt;stdlib.h&amp;gt;...&lt;br&gt;</description>
          193     <pubDate>Tue, 15 Sep 2020 11:08:01 GMT</pubDate>
          194     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/174</guid>
          195   </item>
          196   <item>
          197     <title>Fwd: [CVE-2020-13928 ] Apache Atlas Multiple XSS Vulnerability</title>
          198     <link>http://seclists.org/oss-sec/2020/q3/173</link>
          199     <description>&lt;p&gt;Posted by Keval Bhatt on Sep 15&lt;/p&gt;Hello,&lt;br&gt;
          200 &lt;br&gt;
          201 Please find below details on CVE fixed in Apache Atlas releases *2.1.0*&lt;br&gt;
          202 &lt;br&gt;
          203 -------------------------------------------------------------------------------------------------&lt;br&gt;
          204 &lt;br&gt;
          205 CVE-2020-13928:         Atlas was found vulnerable to a Cross-Site&lt;br&gt;
          206 Scripting in Basic Search functionality.&lt;br&gt;
          207 &lt;br&gt;
          208 Severity:                      Critical&lt;br&gt;
          209 &lt;br&gt;
          210 Vendor:                        The Apache Software Foundation&lt;br&gt;
          211 &lt;br&gt;
          212 Versions affected:        Apache Atlas versions 2.0.0...&lt;br&gt;</description>
          213     <pubDate>Tue, 15 Sep 2020 07:34:08 GMT</pubDate>
          214     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/173</guid>
          215   </item>
          216 
          217 
          218   <item>
          219     <title>[CVE-2020-11977] Apache Syncope: Remote Code Execution via Flowable workflow definition</title>
          220     <link>http://seclists.org/oss-sec/2020/q3/172</link>
          221     <description>&lt;p&gt;Posted by Francesco Chicchiriccò on Sep 14&lt;/p&gt;Description:&lt;br&gt;
          222 When the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to &lt;br&gt;
          223 perform malicious operations, including but not limited to file read, file write, and code execution.&lt;br&gt;
          224 &lt;br&gt;
          225 Severity: Low&lt;br&gt;
          226 &lt;br&gt;
          227 Vendor: The Apache Software Foundation&lt;br&gt;
          228 &lt;br&gt;
          229 Affects:&lt;br&gt;
          230 2.1.X releases prior to 2.1.7&lt;br&gt;
          231 &lt;br&gt;
          232 Solution:&lt;br&gt;
          233 2.1.X users: upgrade to 2.1.7&lt;br&gt;
          234 &lt;br&gt;
          235 Credit:&lt;br&gt;
          236 This issue was discovered by ch0wn of Orz Lab.&lt;br&gt;</description>
          237     <pubDate>Mon, 14 Sep 2020 10:57:54 GMT</pubDate>
          238     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/172</guid>
          239   </item>
          240 
          241 
          242   <item>
          243     <title>[CVE-2020-11991] Apache Cocoon security vulnerability</title>
          244     <link>http://seclists.org/oss-sec/2020/q3/171</link>
          245     <description>&lt;p&gt;Posted by Cédric Damioli on Sep 11&lt;/p&gt;[CVE-2020-11991] Apache Cocoon security vulnerability&lt;br&gt;
          246 &lt;br&gt;
          247 Severity: Important&lt;br&gt;
          248 &lt;br&gt;
          249 Vendor: The Apache Software Foundation&lt;br&gt;
          250 &lt;br&gt;
          251 Versions Affected: Apache Cocoon up to 2.1.12&lt;br&gt;
          252 &lt;br&gt;
          253 Description: When using the StreamGenerator, the code parse a &lt;br&gt;
          254 user-provided XML.&lt;br&gt;
          255 &lt;br&gt;
          256 A specially crafted XML, including external system entities, could be &lt;br&gt;
          257 used to access any file on the server system.&lt;br&gt;
          258 &lt;br&gt;
          259 Mitigation:&lt;br&gt;
          260 &lt;br&gt;
          261 The StreamGenerator now ignores external entities. 2.1.x users should...&lt;br&gt;</description>
          262     <pubDate>Fri, 11 Sep 2020 10:07:37 GMT</pubDate>
          263     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/171</guid>
          264   </item>
          265 
          266 
          267   <item>
          268     <title>Re: CVE Request: Linux kernel vsyscall page refcounting error</title>
          269     <link>http://seclists.org/oss-sec/2020/q3/170</link>
          270     <description>&lt;p&gt;Posted by Salvatore Bonaccorso on Sep 10&lt;/p&gt;CVE-2020-25221 has been assigned by MITRE for this issue (note one&lt;br&gt;
          271 cannot request anymore CVEs through that list but one can use&lt;br&gt;
          272 &lt;a  rel=&quot;nofollow&quot; href=&quot;https://cveform.mitre.org/&quot;&gt;https://cveform.mitre.org/&lt;/a&gt;)&lt;br&gt;
          273 &lt;br&gt;
          274 Regards,&lt;br&gt;
          275 Salvatore&lt;br&gt;</description>
          276     <pubDate>Thu, 10 Sep 2020 14:54:18 GMT</pubDate>
          277     <guid isPermaLink="true">http://seclists.org/oss-sec/2020/q3/170</guid>
          278   </item>
          279 
          280  
          281 
          282 <!-- MHonArc v2.6.19 -->
          283   </channel>
          284 </rss>