Tomas Hoger

A local privilege escalation issue exists, allowing local users to obtain root access by exploiting a flaw in the handling of UNIX domain sockets. This can be achieved by manipulating the multipath setup, taking advantage of the mishandling of repeated keywords when arithmetic ADD is used instead of bitwise OR.

The issue allows a malicious site to bypass the Same Origin Policy (SOP) checks via a spoofed codebase value. This is possible because the IcedTea-Web uses the codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the SOP checks, and the specified codebase does not have to match the applet's actual origin.

Name of the Vulnerable Software and Affected Versions: Jasper versions prior to 2.0.26 Description: A NULL pointer dereference flaw was found in the way Jasper handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. Recommendations: For Jasper versions prior to 2.0.26, update to version 2.0.26 or later to resolve the issue. As a temporary workaround, consider avoiding the use of JP2 image files with applications that utilize the Jasper library until a patch is applied.

The issue allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message. This is a result of the DHCPv6 client (dhcp6c) not properly sanitizing hostnames received from DHCP messages, allowing an attacker to inject shell metacharacters and execute commands on the client system.

The issue is related to an insecure setting of the LD LIBRARY PATH environment variable in ruby193.

The issue allows remote attackers to cause a denial of service, resulting in an application crash in xpdf-based PDF viewers, due to an infinite loop in the xref table.

The issue is related to weak permissions for certain configuration files, specifically (1) `/etc/sysconfig/tomcat` and (2) `/etc/tomcat/tomcat.conf`. This weakness allows local users to gain privileges by leveraging membership in the `tomcat` group.

The issue allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name. This is related to executing external commands with the `commands.getstatusoutput` function in the `fix lookup id` function in sealert.

The issue allows local users to bypass an intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial with a crafted file name, handled by the ` set tpath` function, or via a crafted `local id` or `analysis id` field in a crafted XML document to the `run fix` function. The vulnerability is related to the `subprocess.check output` and `commands.getstatusoutput` functions.

The issue arises from the `compile branch` function in `pcre compile.c` and `pcre2 compile.c`, which mishandles patterns containing an `(*ACCEPT)` substring in conjunction with nested parentheses. This allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression. The vulnerability has been demonstrated by a JavaScript `RegExp` object encountered by Konqueror.

The issue allows local users to write to arbitrary files via a symlink attack on the Hotspot component.

The issue is related to a buffer overflow in the GIF loader when initializing decompression tables. This occurs due to an input validation flaw, which can be exploited.

The issue allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager. This is part of a broader set of vulnerabilities addressed in Oracle's February 2015 Critical Patch Update.

The issue is related to a problem in ruby-lang ruby. No specific details about the nature of the issue or its potential impact are provided.

The issue allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. This occurs when the GNUTLS VERIFY ALLOW X509 V1 CA CRT flag is not enabled, causing version 1 X.509 certificates to be treated as intermediate CAs.

The issue affects confidentiality and is related to vectors connected to CORBA. It is noted that Oracle has not commented on claims that the problem is related to an incorrect check for code permissions by CORBA stub factories.

The issue affects the integrity of data and is related to the Security component. It allows remote attackers to exploit the vulnerability via unknown vectors. There are claims that the CanonicalizerBase.java in the XML canonicalizer is involved, potentially allowing untrusted code to access mutable byte arrays. However, Oracle has not commented on these claims.

The issue allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. It is reportedly an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding, although Oracle has not commented on this. The vulnerability can be exploited by a remote attacker to disrupt confidentiality and integrity of data using the Beans component.

The issue affects confidentiality, integrity, and availability via unknown vectors related to 2D. It is reportedly due to incorrect input validation in the ICU Layout Engine, which allows attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file.

The issue is caused by an off-by-one error in the `dane raw tlsa` function of the DANE library (libdane) in GnuTLS. This error allows remote servers to cause a denial of service (memory corruption) by sending a response with more than four DANE entries.