Tomas Hoger

A local privilege escalation issue exists, allowing local users to obtain root access by exploiting a flaw in the handling of UNIX domain sockets. This can be achieved by manipulating the multipath setup, taking advantage of the mishandling of repeated keywords when arithmetic ADD is used instead of bitwise OR.

A vulnerabilidade permite que um site malicioso contorne as verificações da Política de Mesma Origem (SOP) por meio de um valor falsificado do atributo `codebase`. Isso é possível porque o IcedTea-Web utiliza o atributo codebase da tag <applet> na página HTML que hospeda o applet Java nas verificações da SOP, e o codebase especificado não precisa corresponder à origem real do applet.

**Nome do software vulnerável e versões afetadas: Versões do Jasper anteriores à 2.0.26 Descrição: Foi identificada uma falha de desreferência de ponteiro NULL na forma como o Jasper processava referências a componentes na caixa CDEF do decodificador do formato de imagem JP2. Um arquivo de imagem JP2 especialmente criado poderia causar a falha de um aplicativo que utilizasse a biblioteca Jasper ao ser aberto. Recomendações: Para versões do Jasper anteriores à 2.0.26, atualize para a versão 2.0.26 ou posterior para resolver o problema. Como solução temporária, considere evitar o uso de arquivos de imagem JP2 em aplicativos que utilizam a biblioteca Jasper até que um patch seja aplicado.

The issue allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message. This is a result of the DHCPv6 client (dhcp6c) not properly sanitizing hostnames received from DHCP messages, allowing an attacker to inject shell metacharacters and execute commands on the client system.

The issue is related to an insecure setting of the LD LIBRARY PATH environment variable in ruby193.

The issue allows remote attackers to cause a denial of service, resulting in an application crash in xpdf-based PDF viewers, due to an infinite loop in the xref table.

The issue is related to weak permissions for certain configuration files, specifically (1) `/etc/sysconfig/tomcat` and (2) `/etc/tomcat/tomcat.conf`. This weakness allows local users to gain privileges by leveraging membership in the `tomcat` group.

The issue allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name. This is related to executing external commands with the `commands.getstatusoutput` function in the `fix lookup id` function in sealert.

The issue allows local users to bypass an intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial with a crafted file name, handled by the ` set tpath` function, or via a crafted `local id` or `analysis id` field in a crafted XML document to the `run fix` function. The vulnerability is related to the `subprocess.check output` and `commands.getstatusoutput` functions.

The issue arises from the `compile branch` function in `pcre compile.c` and `pcre2 compile.c`, which mishandles patterns containing an `(*ACCEPT)` substring in conjunction with nested parentheses. This allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression. The vulnerability has been demonstrated by a JavaScript `RegExp` object encountered by Konqueror.

The issue allows local users to write to arbitrary files via a symlink attack on the Hotspot component.

The issue is related to a buffer overflow in the GIF loader when initializing decompression tables. This occurs due to an input validation flaw, which can be exploited.

The issue allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager. This is part of a broader set of vulnerabilities addressed in Oracle's February 2015 Critical Patch Update.

The issue is related to a problem in ruby-lang ruby. No specific details about the nature of the issue or its potential impact are provided.

The issue allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. This occurs when the GNUTLS VERIFY ALLOW X509 V1 CA CRT flag is not enabled, causing version 1 X.509 certificates to be treated as intermediate CAs.

The issue affects confidentiality and is related to vectors connected to CORBA. It is noted that Oracle has not commented on claims that the problem is related to an incorrect check for code permissions by CORBA stub factories.

The issue affects the integrity of data and is related to the Security component. It allows remote attackers to exploit the vulnerability via unknown vectors. There are claims that the CanonicalizerBase.java in the XML canonicalizer is involved, potentially allowing untrusted code to access mutable byte arrays. However, Oracle has not commented on these claims.

The issue allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. It is reportedly an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding, although Oracle has not commented on this. The vulnerability can be exploited by a remote attacker to disrupt confidentiality and integrity of data using the Beans component.

The issue affects confidentiality, integrity, and availability via unknown vectors related to 2D. It is reportedly due to incorrect input validation in the ICU Layout Engine, which allows attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file.

The issue is caused by an off-by-one error in the `dane raw tlsa` function of the DANE library (libdane) in GnuTLS. This error allows remote servers to cause a denial of service (memory corruption) by sending a response with more than four DANE entries.