An integer overflow will happen on 64bit archs if task's sum of rss, swapents and nr_ptes exceeds (2^31)/1000 value. This was introduced by commit f755a04 oom: use pte pages in OOM score. This can cause a denial of service. https://lkml.org/lkml/2011/10/31/138 Eugene -- -- Eugene Teo / Red Hat Security Response Team
On 10/31/2011 06:09 PM, Eugene Teo wrote: > An integer overflow will happen on 64bit archs if task's sum of rss, > swapents and nr_ptes exceeds (2^31)/1000 value. This was introduced by > commit f755a04 oom: use pte pages in OOM score. This can cause a denial > of service. > > https://lkml.org/lkml/2011/10/31/138 > > Eugene Please use CVE-2011-4097 for this issue -- -- -Kurt Seifried / Red Hat Security Response Team
Hi All,
It was found that capsh program, usually shipped with the libcap
package, did not do a chdir("/") after calling chroot, when called with
a "--chroot" option. This resulted in the current directory being
outside the chroot.
This has been assigned CVE-2011-4099
Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=722694
--
--
Huzaifa Sidhpurwala / Red Hat Security Response Team
"It was discovered that both Piston and Tastypie share a similar vulnerability with respect to their de-serialization of YAML post data. Both Piston and Tastypie used the yaml.load method, which is unsafe. In certain circumstances this could be used to allow remote execution of arbitrary code." [0] Can a CVE be assigned to both Tastypie and Django-piston regarding these issues ? [0] https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
On 11/01/2011 11:11 AM, David Black wrote: > y with respect to their de-serialization of YAML post > data. Both Piston and Tastypie used the yaml.load method, which is > unsafe. In certain Can you please send me links for Piston and Tastypie announcements/code commits showing the vuln please? Thanks. -- -- -Kurt Seifried / Red Hat Security Response Team
Can I get CVEs assigned to the following wireshark flaws? 1) An uninitialized variable in the CSN.1 dissector could cause a crash. Affects: 1.6.0 to 1.6.2, fixed in 1.6.3 References: http://www.wireshark.org/security/wnpa-sec-2011-17.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6351 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39140 https://bugzilla.redhat.com/show_bug.cgi?id=750643 2) Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. Affects: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2, fixed in 1.6.3 References: http://www.wireshark.org/security/wnpa-sec-2011-18.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6476 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39500 https://bugzilla.redhat.com/show_bug.cgi?id=750645 3) Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. Affects: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2, fixed in 1.6.3 References: http://www.wireshark.org/security/wnpa-sec-2011-19.html(Continue reading)
* [2011-11-01 13:15:53 -0600] Kurt Seifried wrote: >On 11/01/2011 11:11 AM, David Black wrote: >> y with respect to their de-serialization of YAML post >> data. Both Piston and Tastypie used the yaml.load method, which is >> unsafe. In certain >Can you please send me links for Piston and Tastypie announcements/code >commits showing the vuln please? Thanks. Can't speak for Tastypie (we don't ship it so I didn't look), but for Piston: https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543 https://bugzilla.redhat.com/show_bug.cgi?id=750658 There is no Piston announcement that I can see. -- -- Vincent Danen / Red Hat Security Response Team
For the record: this is a *perfect* CVE request =). It's descriptive, it has versions, it has all the links to verify it with the original sources, all that good stuff. On 11/01/2011 03:51 PM, Vincent Danen wrote: > Can I get CVEs assigned to the following wireshark flaws? > > > 1) An uninitialized variable in the CSN.1 dissector could cause a crash. > > Affects: 1.6.0 to 1.6.2, fixed in 1.6.3 > > References: > http://www.wireshark.org/security/wnpa-sec-2011-17.html > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6351 > http://anonsvn.wireshark.org/viewvc?view=revision&revision=39140 > https://bugzilla.redhat.com/show_bug.cgi?id=750643 > Please use CVE-2011-4100 for this. > > 2) Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that > the Infiniband dissector could dereference a NULL pointer. > > Affects: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2, fixed in 1.6.3 > > References: > http://www.wireshark.org/security/wnpa-sec-2011-18.html > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6476 > http://anonsvn.wireshark.org/viewvc?view=revision&revision=39500(Continue reading)
On 11/01/2011 03:58 PM, Vincent Danen wrote: > * [2011-11-01 13:15:53 -0600] Kurt Seifried wrote: > >> On 11/01/2011 11:11 AM, David Black wrote: >>> y with respect to their de-serialization of YAML post >>> data. Both Piston and Tastypie used the yaml.load method, which is >>> unsafe. In certain >> Can you please send me links for Piston and Tastypie announcements/code >> commits showing the vuln please? Thanks. > > Can't speak for Tastypie (we don't ship it so I didn't look), but for > Piston: > > https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543 > https://bugzilla.redhat.com/show_bug.cgi?id=750658 > > There is no Piston announcement that I can see. > Please use CVE-2011-4103 for the Piston yaml.load issue. -- -- -Kurt Seifried / Red Hat Security Response Team
The Tastypie announcement can be found at http://groups.google.com/group/django-tastypie/browse_thread/thread/8b668d1831d35012 and the patch to fix this bug can be found at https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
RSS Feed148 | |
|---|---|
244 | |
237 | |
322 | |
214 | |
157 | |
186 | |
185 | |
232 | |
207 | |
150 | |
127 | |
235 | |
209 | |
292 | |
188 | |
333 | |
144 | |
239 | |
204 | |
133 | |
162 | |
258 | |
224 | |
155 | |
354 | |
319 | |
168 | |
149 | |
136 | |
187 | |
84 | |
175 | |
137 | |
117 | |
141 | |
115 | |
118 | |
122 | |
94 | |
72 | |
74 | |
105 | |
122 | |
102 | |
98 | |
84 | |
59 | |
96 | |
114 | |
75 | |
81 | |
89 | |
108 | |
127 | |
123 | |
127 | |
126 | |
149 | |
112 | |
136 | |
143 | |
103 | |
103 |
