protection mechanism
header may not contain trusted input and could be used to poison the
cache.
CVE-2011-4140
The CSRF protection mechanism in Django does not properly handle
web-server configurations supporting arbitrary HTTP Host headers,
which allows remote attackers to trigger unauthenticated forged
requests.
For the oldstable distribution (lenny), this problem has been fixed in
The personality subsystem in the Linux kernel has a PER_CLEAR_ON_SETID
setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO
flags when executing a setuid or setgid program, which makes it
easier for local users to leverage the details of memory usage to (1)
conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr
protection mechanism, or (3) defeat address space layout randomization
(ASLR). (CVE-2009-1895)
The load_flat_shared_library function in fs/binfmt_flat.c in the
flat subsystem in the Linux kernel allows local users to cause a
denial of service (NULL pointer dereference and system crash) or
CVE-2011-1403
Due to a misconfiguration of the Pieform package in Mahara, the cross-site
request forgery protection mechanism that Mahara relies on to harden its
form was not working and was essentially disabled.
This is a critical vulnerability which could allow attackers to trick other
users (for example administrators) into performing malicious actions on
behalf of the attacker. Most Mahara forms are vulnerable.
information related to register size, which has unspecified impact
and local attack vectors, probably related to reading or writing
kernel memory. (CVE-2008-1675)
Linux kernel before 2.6.25.2 does not apply a certain protection
mechanism for fcntl functionality, which allows local users to (1)
execute code in parallel or (2) exploit a race condition to obtain
re-ordered access to the descriptor table. (CVE-2008-1669)
Additionaly, a number of fixes has been included for the rtc driver,
Arima W651DI audio chipset, unionfs, as well as Tomoyolinux has
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a
PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT
and MMAP_PAGE_ZERO flags when executing a setuid or setgid program,
which makes it easier for local users to leverage the details of
memory usage to (1) conduct NULL pointer dereference attacks, (2)
bypass the mmap_min_addr protection mechanism, or (3) defeat address
space layout randomization (ASLR). (CVE-2009-1895)
Stack-based buffer overflow in the parse_tag_11_packet function in
fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel
before 2.6.30.4 allows local users to cause a denial of service
in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1,
allows local users to cause a denial of service (OOPS) and possibly
gain privileges via unspecified vectors. (CVE-2008-1375)
The Linux kernel before 2.6.25.2 does not apply a certain protection
mechanism for fcntl functionality, which allows local users to (1)
execute code in parallel or (2) exploit a race condition to obtain
re-ordered access to the descriptor table. (CVE-2008-1669)
To update your kernel, please follow the directions located at:
in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1,
allows local users to cause a denial of service (OOPS) and possibly
gain privileges via unspecified vectors. (CVE-2008-1375)
The Linux kernel before 2.6.25.2 does not apply a certain protection
mechanism for fcntl functionality, which allows local users to (1)
execute code in parallel or (2) exploit a race condition to obtain
re-ordered access to the descriptor table. (CVE-2008-1669)
To update your kernel, please follow the directions located at:
dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP
and DNS forwarder and cache server used on many DSL/Cable routers now
has a simple DNS Rebinding protection mechanism. When executed with the
--stop-dns-rebind option the DNS resolver in dnsmasq will filter out
private IP addresses (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8,
172.16.0.0/12 and 169.254.0.0/16). This should be sufficient for most
private/home users.
Feedback welcome.
in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1,
allows local users to cause a denial of service (OOPS) and possibly
gain privileges via unspecified vectors. (CVE-2008-1375)
The Linux kernel before 2.6.25.2 does not apply a certain protection
mechanism for fcntl functionality, which allows local users to (1)
execute code in parallel or (2) exploit a race condition to obtain
re-ordered access to the descriptor table. (CVE-2008-1669)
To update your kernel, please follow the directions located at:
in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1,
allows local users to cause a denial of service (OOPS) and possibly
gain privileges via unspecified vectors. (CVE-2008-1375)
The Linux kernel before 2.6.25.2 does not apply a certain protection
mechanism for fcntl functionality, which allows local users to (1)
execute code in parallel or (2) exploit a race condition to obtain
re-ordered access to the descriptor table. (CVE-2008-1669)
To update your kernel, please follow the directions located at:
remote attackers to cause a denial of service (memory corruption and
application crash) or possibly execute arbitrary code via unknown
vectors (CVE-2011-0062).
The nsIScriptableUnescapeHTML.parseFragment method in the
ParanoidFragmentSink protection mechanism in Mozilla Firefox before
3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey
before 2.0.12 does not properly sanitize HTML in a chrome document,
which makes it easier for remote attackers to execute arbitrary
JavaScript with chrome privileges via a javascript: URI in input to
an extension, as demonstrated by a javascript:alert sequence in (1)
before 3.1.8, and SeaMonkey before 2.0.12 might allow remote attackers
to execute arbitrary code or cause a denial of service (application
crash) via a crafted JPEG image. (CVE-2011-0061)
The nsIScriptableUnescapeHTML.parseFragment method in the
ParanoidFragmentSink protection mechanism in Mozilla Firefox before
3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey
before 2.0.12 does not properly sanitize HTML in a chrome document,
which makes it easier for remote attackers to execute arbitrary
JavaScript with chrome privileges via a javascript: URI in input to
an extension, as demonstrated by a javascript:alert sequence in (1)
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Protection Mechanism Failure [CWE-693], Authentication Issues
[CWE-287], Cross-Site Scripting (XSS) [CWE-79]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-3272, CVE-2010-3273, CVE-2010-3274
to force a logged-in administrator to perform unwanted actions on the
IBM WebSphere administrative console, by enticing him to visit a
malicious web page.
The administrative console of IBM WebSphere Application Server includes
a standard protection mechanism against Cross-Site Request Forgery,
which consists of a token that is included as a hidden field on every
'FORM', named 'csrfid', that is sent to the web server in each 'POST'
request performed by the web browser. When the web server receives a
'POST' request, it checks that the 'csrfid' token included in the
parameters of the 'POST' request matches the anti-CSRF token associated
|
