From owner-svn-ports-head@freebsd.org Fri Sep 29 16:28:30 2017 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4C0A2E3003D; Fri, 29 Sep 2017 16:28:30 +0000 (UTC) (envelope-from zi@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E920C6C5C8; Fri, 29 Sep 2017 16:28:29 +0000 (UTC) (envelope-from zi@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v8TGSTqR035856; Fri, 29 Sep 2017 16:28:29 GMT (envelope-from zi@FreeBSD.org) Received: (from zi@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v8TGSMLD035850; Fri, 29 Sep 2017 16:28:22 GMT (envelope-from zi@FreeBSD.org) Message-Id: <201709291628.v8TGSMLD035850@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: zi set sender to zi@FreeBSD.org using -f From: Ryan Steinmetz Date: Fri, 29 Sep 2017 16:28:22 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r450911 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: zi X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 450911 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Sep 2017 16:28:30 -0000 Author: zi Date: Fri Sep 29 16:28:22 2017 New Revision: 450911 URL: https://svnweb.freebsd.org/changeset/ports/450911 Log: - Condense additional entries where description >4500 characters Approved by: ports-secteam (with hat) Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Sep 29 16:06:29 2017 (r450910) +++ head/security/vuxml/vuln.xml Fri Sep 29 16:28:22 2017 (r450911) @@ -1070,64 +1070,17 @@ Notes: GitLab -- multiple vulnerabilities - gitlab - 1.0.09.3.10 - 9.4.09.4.5 - 9.5.09.5.3 + gitlab + 1.0.09.3.10 + 9.4.09.4.5 + 9.5.09.5.3

GitLab reports:

-
Cross-Site Scripting (XSS) vulnerability in profile names
-
An external security audit performed by Madison Gurkha disclosed a - Cross-Site Scripting (XSS) vulnerability in user names that could be - exploited in several locations.
-
Open Redirect in go-get middleware
-
Tim Goddard via HackerOne reported that GitLab was vulnerable to an open - redirect vulnerability caused when a specific flag is passed to the go-get - middleware. This vulnerability could also possibly be used to conduct - Cross-Site Scripting attacks.
-
Race condition in project uploads
-
Jobert Abma from HackerOne reported that GitLab was vulnerable to a race - condition in project uploads. While very difficult to exploit this race - condition could potentially allow an attacker to overwrite a victim's - uploaded project if the attacker can guess the name of the uploaded file - before it is extracted.
-
Cross-Site Request Forgery (CSRF) token leakage
-
naure via HackerOne reported that GitLab was vulnerable to CSRF token - leakage via improper filtering of external URLs in relative URL creation. A - specially crafted link configured in a project's environments settings could - be used to steal a visiting user's CSRF token.
-
Potential project disclosure via project deletion bug
-
An internal code review discovered that removed projects were not always - being deleted from the file system. This could allow an attacker who knew - the full path to a previously deleted project to steal a copy of the - repository. These releases prevent the leftover repository from being - accessed when creating a new project. The project deletion bug will be fixed - in a later release.
-
White-listed style attribute for table contents in MD enables UI - redressing
-
An external security audit performed by Recurity-Labs discovered a UI - redressing vulnerability in the GitLab markdown sanitization library.
-
DOM clobbering in sanitized MD causes errors
-
An external security audit performed by Recurity-Labs discovered a DOM - clobbering vulnerability in the GitLab markdown sanitization library that - could be used to render project pages unreadable.
-
Nokogiri vendored libxslt library vulnerable to potential integer - overflow (CVE-2017-5029 and CVE-2016-4738)
-
The bundled Nokogiri library has been updated to patch an integer - overflow vulnerability. Details are available in the Nokogiri issue.
-
Security risk in recommended Geo configuration could give all users - access to all repositories
-
An internal code review discovered that GitLab Geo instances could be - vulnerable to an attack that would allow any user on the primary Geo - instance to clone any repository on a secondary Geo instance.
-
GitLab Pages private certificate disclosure via symlinks
-
An external security review conducted by Recurity-Labs discovered a - vulnerability in GitLab Pages that could be used to disclose the contents of - private SSL keys.
+
Please reference CVE/URL list for details

@@ -2183,47 +2136,9 @@ Notes:

The cURL project reports:

-
FILE buffer read out of bounds
-
When asking to get a file from a file:// URL, libcurl provides - a feature that outputs meta-data about the file using HTTP-like - headers.
-
The code doing this would send the wrong buffer to the user - (stdout or the application's provide callback), which could - lead to other private data from the heap to get inadvertently - displayed.
-
The wrong buffer was an uninitialized memory area allocated on - the heap and if it turned out to not contain any zero byte, it - would continue and display the data following that buffer in - memory.
-
-
TFTP sends more than buffer size
-
When doing a TFTP transfer and curl/libcurl is given a URL that - contains a very long file name (longer than about 515 bytes), - the file name is truncated to fit within the buffer boundaries, - but the buffer size is still wrongly updated to use the - untruncated length. This too large value is then used in the - sendto() call, making curl attempt to send more data than what - is actually put into the buffer. The sendto() function will then - read beyond the end of the heap based buffer.
-
A malicious HTTP(S) server could redirect a vulnerable libcurl- - using client to a crafted TFTP URL (if the client hasn't - restricted which protocols it allows redirects to) and trick it - to send private memory contents to a remote server over UDP. - Limit curl's redirect protocols with --proto-redir and libcurl's - with CURLOPT_REDIR_PROTOCOLS.
-
-
URL globbing out of bounds read
-
curl supports "globbing" of URLs, in which a user can pass a - numerical range to have the tool iterate over those numbers to - do a sequence of transfers.
-
In the globbing function that parses the numerical range, there - was an omission that made curl read a byte beyond the end of the - URL if given a carefully crafted, or just wrongly written, URL. - The URL is stored in a heap based buffer, so it could then be - made to wrongly read something else instead of crashing.
-
An example of a URL that triggers the flaw would be - http://ur%20[0-60000000000000000000.
-
+
FILE buffer read out of bounds
+
TFTP sends more than buffer size
+
URL globbing out of bounds read

@@ -2300,34 +2215,7 @@ Notes:

Mozilla Foundation reports:

-
CVE-2017-7798: XUL injection in the style editor in devtools
-
CVE-2017-7800: Use-after-free in WebSockets during disconnection
-
CVE-2017-7801: Use-after-free with marquee during window resizing
-
CVE-2017-7784: Use-after-free with image observers
-
CVE-2017-7802: Use-after-free resizing image elements
-
CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM
-
CVE-2017-7786: Buffer overflow while painting non-displayable SVG
-
CVE-2017-7806: Use-after-free in layer manager with SVG
-
CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements
-
CVE-2017-7787: Same-origin policy bypass with iframes through page reloads
-
CVE-2017-7807: Domain hijacking through AppCache fallback
-
CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID
-
CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher
-
CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts
-
CVE-2017-7808: CSP information leak with frame-ancestors containing paths
-
CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections
-
CVE-2017-7781: Elliptic curve point addition error when using mixed Jacobian-affine coordinates
-
CVE-2017-7794: Linux file truncation via sandbox broker
-
CVE-2017-7803: CSP containing 'sandbox' improperly applied
-
CVE-2017-7799: Self-XSS XUL injection in about:webrtc
-
CVE-2017-7783: DOS attack through long username in URL
-
CVE-2017-7788: Sandboxed about:srcdoc iframes do not inherit CSP directives
-
CVE-2017-7789: Failure to enable HSTS when two STS headers are sent for a connection
-
CVE-2017-7790: Windows crash reporter reads extra memory for some non-null-terminated registry values
-
CVE-2017-7796: Windows updater can delete any file named update.log
-
CVE-2017-7797: Response header name interning leaks across origins
-
CVE-2017-7780: Memory safety bugs fixed in Firefox 55
-
CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3
+
Please reference CVE/URL list for details

@@ -2441,52 +2329,8 @@ Notes:

Google Chrome releases reports:

-
40 security fixes in this release, including:
-
-
[728887] High CVE-2017-5091: Use after free in IndexedDB. Reported by - Ned Williamson on 2017-06-02
-
[733549] High CVE-2017-5092: Use after free un PPAPI. Reported by - Yu Zhou, Yuan Deng of Ant-financial Light-Year Security Lab on 2017-06-15
-
[550017] High CVE-2017-5093: UI spoofing in Blink. Reported by - Luan Herrera on 2015-10-31
-
[702946] High CVE-2017-5094: Type confusion in extensions. Reported by - Anonymous on 2017-03-19
-
[732661] High CVE-2017-5095: Out-of-bounds write in PDFium. Reported by - Anonymous on 2017-06-13
-
[714442] High CVE-2017-5096: User information leak via Android intents. Reported by - Takeshi Terada on 2017-04-23
-
[740789] High CVE-2017-5097: Out-of-bounds read in Skia. Reported by - Anonymous on 2017-07-11
-
[740803] High CVE-2017-5098: Use after free in V8. Reported by - Jihoon Kim on 2017-07-11
-
[733548] High CVE-2017-5099: Out-of-bounds write in PPAPI. Reported by - Yuan Deng, Yu Zhou of Ant-financial Light-Year Security Lab on 2017-06-15
-
[718292] Medium CVE-2017-5100: Use after free in Chrome Apps. Reported by - Anonymous on 2017-05-04
-
[681740] Medium CVE-2017-5101: URL spoofing in OmniBox. Reported by - Luan Herrera on 2017-01-17
-
[727678] Medium CVE-2017-5102: Uninitialized use in Skia. Reported by - Anonymous on 2017-05-30
-
[726199] Medium CVE-2017-5103: Uninitialized use in Skia. Reported by - Anonymous on 2017-05-25
-
[729105] Medium CVE-2017-5104: UI spoofing in browser. Reported by - Khalil Zhani on 2017-06-02
-
[742407] Medium CVE-2017-7000: Pointer disclosure in SQLite. Reported by - Chaitin Security Research Lab working with Trend Micro's Zero Day Initiative
-
[729979] Low CVE-2017-5105: URL spoofing in OmniBox. Reported by - Rayyan Bijoora on 2017-06-06
-
[714628] Medium CVE-2017-5106: URL spoofing in OmniBox. Reported by - Jack Zac on 2017-04-24
-
[686253] Low CVE-2017-5107: User information leak via SVG. Reported by - David Kohlbrenner of UC San Diego on 2017-01-27
-
[695830] Low CVE-2017-5108: Type of confusion in PDFium. Reported by - Guang Gong of Alpha Team, Qihoo 360 on 2017-02-24
-
[710400] Low CVE-2017-5109: UI spoofing in browser. Reported by - Jose Maria Acunia Morgado on 2017-04-11
-
[717476] Low CVE-2017-5110: UI spoofing in payments dialog. Reported by - xisigr of Tencent's Xuanwu Lab on 2017-05-02
-
[748565] Various fixes from internal audits, fuzzing and other initiatives
-
+
40 security fixes in this release
+
Please reference CVE/URL list for details

@@ -2698,60 +2542,19 @@ Notes: GitLab -- Various security issues - gitlab - 8.0.08.17.6 + gitlab + 8.0.08.17.6 9.0.09.0.10 9.1.09.1.7 9.2.09.2.7 - 9.3.09.3.7 + 9.3.09.3.7

GitLab reports:

-
Projects in subgroups authorization bypass with SQL wildcards - (CVE-2017-11438)
-
An internal code review disclosed that by choosing a namespace with - underscores an authenticated user could take advantage of a badly written - SQL query to add themselves to any project inside a subgroup with - permissions of their choice.
- This vulnerability was caused by a SQL query that automatically adjusts - project permissions but does not escape wildcards. This vulnerability was - coincidentally patched when the affected code was rewritten for - 9.3. Therefore, versions 9.3 and above are not vulnerable.
-
- This issue has been assigned CVE-2017-11438.
-
- Note: GitLab-CE+EE 8.17 is not vulnerable to this issue, however patches - have been included to improve the security of the SQL queries in 8.17.7.
-
Symlink cleanup from a previous security release
-
The 9.2.5 security release contained a fix for a data corruption - vulnerability involving file uploads. This fix utilized symlinks to migrate - file uploads to a new directory. Due to a typo in the included migration a - symlink was accidentally left behind after the migration finished. This - symlink can cause problems with instance backups. A fix is included with - these releases to remove the problematic symlink.
-
Accidental or malicious use of reserved names in group names could cause - deletion of all snippet uploads
-
The 9.2.5 security release contained a fix for a data corruption - vulnerability involving file uploads. After the release of 9.2.5 an internal - code review determined that the recently introduced snippet file uploads - feature was also vulnerable to file deletion. Snippet uploads have now been - moved into the protected system namespace.
-
Project name leak on todos page
-
An internal code review discovered that forceful browsing could be - utilized to disclose the names of private projects.
-
Denial of Service via regular expressions in CI process
-
Lukas Svoboda reported that regular expressions (regex) included with CI - scripts could be utilized to perform a denial-of-service attack on GitLab - instances. GitLab now uses the re2 Regex library to limit regex execution - time.
-
Issue title leakage when external issue tracker is enabled
-
An internal code review determined that when an external issue tracker is - configured it was possible to discover the titles of all issues in a given - GitLab instance, including issues in private projects and confidential - issues.
+
Please reference CVE/URL list for details

@@ -2814,45 +2617,7 @@ Notes:

Oracle reports:

-
-
Reserved [CVE-2017-3629]
-
A remote user can exploit a flaw in the Server: Memcached component to partially - modify data and cause denial of service conditions [CVE-2017-3633].
-
A remote authenticated user can exploit a flaw in the Server: DML component to - cause denial of service conditions [CVE-2017-3634].
-
A remote authenticated user can exploit a flaw in the Connector/C component to - cause denial of service conditions [CVE-2017-3635].
-
A remote authenticated user can exploit a flaw in the C API component to cause - denial of service conditions [CVE-2017-3635].
-
A local user can exploit a flaw in the Client programs component to partially - access data, partially modify data, and partially deny service - [CVE-2017-3636].
-
A remote authenticated user can exploit a flaw in the Server: UDF component to - cause denial of service conditions [CVE-2017-3529].
-
A remote authenticated user can exploit a flaw in the X Plugin component to - cause denial of service conditions [CVE-2017-3637].
-
A remote authenticated user can exploit a flaw in the Server: DML component to - cause denial of service conditions [CVE-2017-3639, CVE-2017-3640, CVE-2017-3641, - CVE-2017-3643, CVE-2017-3644].
-
A remote authenticated user can exploit a flaw in the Server: Optimizer - component to cause denial of service conditions [CVE-2017-3638, CVE-2017-3642, - CVE-2017-3645].
-
A remote authenticated user can exploit a flaw in the X Plugin component to - cause denial of service conditions [CVE-2017-3646].
-
A remote authenticated user can exploit a flaw in the Server: Charsets component - to cause denial of service conditions [CVE-2017-3648].
-
A remote authenticated user can exploit a flaw in the Server: Replication - component to cause denial of service conditions [CVE-2017-3647, - CVE-2017-3649].
-
A remote authenticated user can exploit a flaw in the Client mysqldump component - to partially modify data [CVE-2017-3651].
-
A remote authenticated user can exploit a flaw in the Server: DDL component to - partially access and partially modify data [CVE-2017-3652].
-
A remote user can exploit a flaw in the C API component to partially access data - [CVE-2017-3650].
-
A remote authenticated user can exploit a flaw in the Server: DDL component to - partially modify data [CVE-2017-3653].
-
+
Please reference CVE/URL list for details

@@ -3455,46 +3220,7 @@ Notes:

GitLab reports:

-
Cross-Site Scripting (XSS) vulnerability when editing comments
-
A GitLab.com user reported that recent changes to Markdown rendering - designed to improve performance by allowing comments to be rendered - client-side opened a persistent Cross-Site Scripting (XSS) vulnerability - when comments are edited and then re-saved. This vulnerability is difficult - to exploit because a victim must be tricked into editing and then saving - another user's comment.
-
API vulnerable to embedding in iFrames using Session Auth
-
A tip from a Twitter user led to an internal code audit that discovered a - malicious website could embed a GitLab API URL inside an iFrame, possibly - tricking a user into thinking that the website had access to the user's - GitLab user information. This attack would not disclose the user's data to - the malicious website, but it could cause confusion and the API has added an - X-Frame-Options header to prevent content from the API being included in - iFrames.
-
Accidental or malicious use of reserved names in group names could cause - deletion of all project avatars
-
A GitLab.com user reported that creating a group named project and then - renaming the group would cause all project avatars to be deleted. This was - due to an improperly constructed path variable when renaming files. To help - prevent this from happening again all avatar uploads have been moved from - /public/uploads/(user|group|project) to - /public/uploads/system/(user|group|project) and system has been made a - reserved namespace. A migration included with this release will rename any - existing top-level system namespace to be system0 (or system1, system2, - etc.)
-
Unauthenticated disclosure of usernames in autocomplete controller
-
HackerOne reporter Evelyn Lee reported that usernames could be enumerated - using the autocomplete/users.json endpoint without authenticating. This - could allow an unauthenticated attacker to gather a list of all valid - usernames from a GitLab instance.
-
Information leakage with references to private project snippets
-
GitLab.com user Patrick Fiedler reported that titles of private project - snippets could leak when they were referenced in other issues, merge - requests, or comments.
-
Elasticsearch does not implement external user checks correctly
-
An internal code review discovered that on instances with Elasticsearch - enabled GitLab allowed external users to view internal project data. This - could unintentionally expose sensitive information to external users. This - vulnerability only affects EE installations with Elasticsearch enabled.
+
Please reference CVE/URL list for details

@@ -3824,68 +3550,7 @@ maliciously crafted GET request to the Horde server.

BestPractical reports:

-
RT 4.0.0 and above are vulnerable to an information - leak of cross-site request forgery (CSRF) verification - tokens if a user visits a specific URL crafted by an - attacker. This vulnerability is assigned CVE-2017-5943. It - was discovered by a third-party security researcher.
- -
RT 4.0.0 and above are vulnerable to a cross-site - scripting (XSS) attack if an attacker uploads a malicious - file with a certain content type. Installations which use - the AlwaysDownloadAttachments config setting are - unaffected. This fix addresses all existant and future - uploaded attachments. This vulnerability is assigned - CVE-2016-6127. This was responsibly disclosed to us first - by Scott Russo and the GE Application Security Assessment - Team.
- -
One of RT's dependencies, a Perl module named - Email::Address, has a denial of service vulnerability - which could induce a denial of service of RT itself. We - recommend administrators install Email::Address version - 1.908 or above, though we additionally provide a new - workaround within RT. Tss vulnerability was assigned - CVE-2015-7686. This vulnerability's application to RT was - brought to our attention by Pali Rohár.
- -
RT 4.0.0 and above are vulnerable to timing - side-channel attacks for user passwords. By carefully - measuring millions or billions of login attempts, an - attacker could crack a user's password even over the - internet. RT now uses a constant-time comparison algorithm - for secrets to thwart such attacks. This vulnerability is - assigned CVE-2017-5361. This was responsibly disclosed to - us by Aaron Kondziela.
- -
RT's ExternalAuth feature is vulnerable to a similar - timing side-channel attack. Both RT 4.0/4.2 with the - widely-deployed RT::Authen::ExternalAuth extension, as - well as the core ExternalAuth feature in RT 4.4 are - vulnerable. Installations which don't use ExternalAuth, or - which use ExternalAuth for LDAP/ActiveDirectory - authentication, or which use ExternalAuth for cookie-based - authentication, are unaffected. Only ExternalAuth in DBI - (database) mode is vulnerable.
- -
RT 4.0.0 and above are potentially vulnerable to a - remote code execution attack in the dashboard subscription - interface. A privileged attacker can cause unexpected code - to be executed through carefully-crafted saved search - names. Though we have not been able to demonstrate an - actual attack owing to other defenses in place, it could - be possible. This fix addresses all existant and future - saved searches. This vulnerability is assigned - CVE-2017-5944. It was discovered by an internal security - audit.
- -
RT 4.0.0 and above have misleading documentation which - could reduce system security. The RestrictLoginReferrer - config setting (which has security implications) was - inconsistent with its implementation, which checked for a - slightly different variable name. RT will now check for - the incorrect name and produce an error message. This was - responsibly disclosed to us by Alex Vandiver.
+
Please reference CVE/URL list for details

@@ -3975,29 +3640,7 @@ maliciously crafted GET request to the Horde server.

Mozilla Foundation reports:

-
CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
-
CVE-2017-7749: Use-after-free during docshell reloading
-
CVE-2017-7750: Use-after-free with track elements
-
CVE-2017-7751: Use-after-free with content viewer listeners
-
CVE-2017-7752: Use-after-free with IME input
-
CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
-
CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files
-
CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
-
CVE-2017-7757: Use-after-free in IndexedDB
-
CVE-2017-7778: Vulnerabilities in the Graphite 2 library
-
CVE-2017-7758: Out-of-bounds read in Opus encoder
-
CVE-2017-7759: Android intent URLs can cause navigation to local file system
-
CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service
-
CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application
-
CVE-2017-7762: Addressbar spoofing in Reader mode
-
CVE-2017-7763: Mac fonts render some unicode characters as spaces
-
CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
-
CVE-2017-7765: Mark of the Web bypass when saving executable files
-
CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service
-
CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service
-
CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service
-
CVE-2017-5471: Memory safety bugs fixed in Firefox 54
-
CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2
+
Please reference CVE/URL list for details

@@ -4135,42 +3778,8 @@ maliciously crafted GET request to the Horde server.

Google Chrome releases reports:

-
30 security fixes in this release, including:
-
-
[722756] High CVE-2017-5070: Type confusion in V8. Reported by - Zhao Qixun of Qihoo 360 Vulcan Team on 2017-05-16
-
[715582] High CVE-2017-5071: Out of bounds read in V8. Reported by - Choongwood Han on 2017-04-26
-
[709417] High CVE-2017-5072: Address spoofing in Omnibox. Reported by - Rayyan Bijoora on 2017-04-07
-
[716474] High CVE-2017-5073: Use after free in print preview. Reported by - Khalil Zhani on 2017-04-28
-
[700040] High CVE-2017-5074: Use after free in Apps Bluetooth. Reported by - anonymous on 2017-03-09
-
[678776] Medium CVE-2017-5075: Information leak in CSP reporting. Reported by - Emmanuel Gil Peyrot on 2017-01-05
-
[722639] Medium CVE-2017-5086: Address spoofing in Omnibox. Reported by - Rayyan Bijoora on 2017-05-16
-
[719199] Medium CVE-2017-5076: Address spoofing in Omnibox. Reported by - Samuel Erb on 2017-05-06
-
[716311] Medium CVE-2017-5077: Heap buffer overflow in Skia. Reported by - Sweetchip on 2017-04-28
-
[711020] Medium CVE-2017-5078: Possible command injection in mailto handling. - Reported by Jose Carlos Exposito Bueno on 2017-04-12
-
[713686] Medium CVE-2017-5079: UI spoofing in Blink. Reported by - Khalil Zhani on 2017-04-20
-
[708819] Medium CVE-2017-5080: Use after free in credit card autofill. - Reported by Khalil Zhani on 2017-04-05
-
[672008] Medium CVE-2017-5081: Extension verification bypass. Reported by - Andrey Kovalev of Yandex Security Team on 2016-12-07
-
[721579] Low CVE-2017-5082: Insufficient hardening in credit card editor. - Reported by Nightwatch Cybersecurity Research on 2017-05-11
-
[714849] Low CVE-2017-5083: UI spoofing in Blink. Reported by - Khalil Zhani on 2017-04-24
-
[692378] Low CVE-2017-5085: Inappropriate javascript execution on WebUI pages. - Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15
-
[729639] Various fixes from internal audits, fuzzing and other initiatives
-
+
30 security fixes in this release
+
Please reference CVE/URL list for details

@@ -4831,57 +4440,7 @@ maliciously crafted GET request to the Horde server.

GitLab reports:

-
Cross-Site Scripting (XSS) vulnerability in project import file names - for gitlab_project import types
-
Timo Schmid from ERNW reported a persistent Cross-Site Scripting - vulnerability in the new project import view for gitlab_project import - types. This XSS vulnerability was caused by the use of Hamlit filters inside - HAML views without manually escaping HTML. Unlike content outside of a - filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) - is not automatically escaped.
-
Cross-Site Scripting (XSS) vulnerability in git submodule support
-
Jobert Abma from HackerOne reported a persistent XSS vulnerability in the - GitLab repository files view that could be exploited by injecting malicious - script into a git submodule.
-
Cross-Site Scripting (XSS) vulnerability in repository "new branch" - view
-
A GitLab user reported a persistent XSS vulnerability in the repository - new branch view that allowed malicious branch names or git references to - execute arbitrary Javascript.
-
Cross-Site Scripting (XSS) vulnerability in mirror errors display
-
While investigating Timo Schmid's previously reported XSS vulnerability - in import filenames another persistent XSS vulnerability was discovered in - the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was - also caused by the misuse of Hamlit filters.
-
Potential XSS vulnerability in DropLab
-
An internal code audit disclosed a vulnerability in DropLab's templating - that, while not currently exploitable, could become exploitable depending on - how the templates were used in the future.
-
Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and - other markup files
-
edio via HackerOne reported two tab nabbing vulnerabilities. The first - tab nabbing vulnerability was caused by improper hostname filtering when - identifying user-supplied external links. GitLab did not properly filter - usernames from the URL. An attacker could construct a specially crafted link - including a username to bypass GitLab's external link filter. This allowed - an attacker to post links in Markdown that did not include the appropriate - "noreferrer noopener" options, allowing tab nabbing attacks.
-
The second vulnerability was in the AsciiDoctor markup - library. AsciiDoctor was not properly including the "noreferrer noopener" - options with external links. An internal investigation discovered other - markup libraries that were also vulnerable.
-
Unauthorized disclosure of wiki pages in search
-
M. Hasbini reported a flaw in the project search feature that allowed - authenticated users to disclose the contents of private wiki pages inside - public projects.
-
External users can view internal snippets
-
Christian Kühn discovered a vulnerability in GitLab snippets that allowed - an external user to view the contents of internal snippets.
-
Subgroup visibility for private subgroups under a public parent - group
-
Matt Harrison discovered a vulnerability with subgroups that allowed - private subgroup names to be disclosed when they belong to a parent group - that is public.
+
Please reference CVE/URL list for details

@@ -5538,81 +5097,8 @@ maliciously crafted GET request to the Horde server.

NVD reports:

-
LibTIFF version 4.0.7 is vulnerable to a heap buffer - overflow in the tools/tiffcp resulting in DoS or code - execution via a crafted BitsPerSample value.
+
Please reference CVE/URL list for details

-
The putagreytile function in tif_getimage.c in LibTIFF - 4.0.7 has a left-shift undefined behavior issue, which - might allow remote attackers to cause a denial of service - (application crash) or possibly have unspecified other - impact via a crafted image.
-

-
tif_read.c in LibTIFF 4.0.7 does not ensure that - tif_rawdata is properly initialized, which might allow - remote attackers to obtain sensitive information from - process memory via a crafted image.
-

-
The OJPEGReadHeaderInfoSecTablesDcTable function in - tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to - cause a denial of service (memory leak) via a crafted - image.
-

-
The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF - 4.0.7 allows remote attackers to cause a denial of service - (divide-by-zero error and application crash) via a crafted - image.
-

-
LibTIFF 4.0.7 has an "outside the range of - representable values of type float" undefined behavior - issue, which might allow remote attackers to cause a - denial of service (application crash) or possibly have - unspecified other impact via a crafted image.
-

-
tif_dirread.c in LibTIFF 4.0.7 has an "outside the - range of representable values of type float" undefined - behavior issue, which might allow remote attackers to - cause a denial of service (application crash) or possibly - have unspecified other impact via a crafted image.
-

-
tif_dirread.c in LibTIFF 4.0.7 might allow remote - attackers to cause a denial of service (divide-by-zero - error and application crash) via a crafted image.
-

-
LibTIFF 4.0.7 has an "outside the range of - representable values of type short" undefined behavior - issue, which might allow remote attackers to cause a - denial of service (application crash) or possibly have - unspecified other impact via a crafted image.
-

-
LibTIFF 4.0.7 has an "outside the range of - representable values of type unsigned char" undefined - behavior issue, which might allow remote attackers to - cause a denial of service (application crash) or possibly - have unspecified other impact via a crafted image.
-

-
LibTIFF 4.0.7 has a "shift exponent too large for - 64-bit type long" undefined behavior issue, which might - allow remote attackers to cause a denial of service - (application crash) or possibly have unspecified other - impact via a crafted image.
-

-
LibTIFF 4.0.7 has a signed integer overflow, which - might allow remote attackers to cause a denial of service - (application crash) or possibly have unspecified other - impact via a crafted image.
-

@@ -5934,45 +5420,7 @@ maliciously crafted GET request to the Horde server.

Mozilla Foundation reports:

-
CVE-2017-5433: Use-after-free in SMIL animation functions
-
CVE-2017-5435: Use-after-free during transaction processing in the editor
-
CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2
-
CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS
-
CVE-2017-5459: Buffer overflow in WebGL
-
CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL
-
CVE-2017-5434: Use-after-free during focus handling
-
CVE-2017-5432: Use-after-free in text input selection
-
CVE-2017-5460: Use-after-free in frame selection
-
CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing
-
CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing
-
CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing
-
CVE-2017-5441: Use-after-free with selection during scroll events
-
CVE-2017-5442: Use-after-free during style changes
-
CVE-2017-5464: Memory corruption with accessibility and DOM manipulation
-
CVE-2017-5443: Out-of-bounds write during BinHex decoding
-
CVE-2017-5444: Buffer overflow while parsing application/http-index-format content
-
CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data
-
CVE-2017-5447: Out-of-bounds read during glyph processing
-
CVE-2017-5465: Out-of-bounds read in ConvolvePixel
-
CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor
-
CVE-2017-5437: Vulnerabilities in Libevent library
-
CVE-2017-5454: Sandbox escape allowing file system read access through file picker
-
CVE-2017-5455: Sandbox escape through internal feed reader APIs
-
CVE-2017-5456: Sandbox escape allowing local file system access
-
CVE-2017-5469: Potential Buffer overflow in flex-generated code
-
CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content
-
CVE-2017-5449: Crash during bidirectional unicode manipulation with animation
-
CVE-2017-5450: Addressbar spoofing using javascript: URI on Firefox for Android
-
CVE-2017-5451: Addressbar spoofing with onblur event
-
CVE-2017-5462: DRBG flaw in NSS
-
CVE-2017-5463: Addressbar spoofing through reader view on Firefox for Android
-
CVE-2017-5467: Memory corruption when drawing Skia content
-
CVE-2017-5452: Addressbar spoofing during scrolling with editable content on Firefox for Android
-
CVE-2017-5453: HTML injection into RSS Reader feed preview page through TITLE element
-
CVE-2017-5458: Drag and drop of javascript: URLs can allow for self-XSS
-
CVE-2017-5468: Incorrect ownership model for Private Browsing information
-
CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1
-
CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1
+
Please reference CVE/URL list for details

@@ -6984,46 +6432,8 @@ maliciously crafted GET request to the Horde server.

Google Chrome Releases reports:

-
36 security fixes in this release, including:
-
-
[682194] High CVE-2017-5030: Memory corruption in V8. Credit to - Brendon Tiszka
-
[682020] High CVE-2017-5031: Use after free in ANGLE. Credit to - Looben Yang
-
[668724] High CVE-2017-5032: Out of bounds write in PDFium. Credit to - Ashfaq Ansari - Project Srishti
-
[676623] High CVE-2017-5029: Integer overflow in libxslt. Credit to - Holger Fuhrmannek
-
[678461] High CVE-2017-5034: Use after free in PDFium. Credit to - Ke Liu of Tencent's Xuanwu Lab
-
[688425] High CVE-2017-5035: Incorrect security UI in Omnibox. Credit to - Enzo Aguado
-
[691371] High CVE-2017-5036: Use after free in PDFium. Credit to - Anonymous
-
[679640] High CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer. - Credit to Yongke Wang of Tecent's Xuanwu Lab
-
[679649] High CVE-2017-5039: Use after free in PDFium. Credit to - jinmo123
-
[691323] Medium CVE-2017-5040: Information disclosure in V8. Credit to - Choongwoo Han
-
[642490] Medium CVE-2017-5041: Address spoofing in Omnibox. Credit to - Jordi Chancel
-
[669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink. - Credit to Nicolai Grodum
-
[671932] Medium CVE-2017-5042: Incorrect handling of cookies in Cast. - Credit to Mike Ruddy
-
[695476] Medium CVE-2017-5038: Use after free in GuestView. Credit to - Anonymous
-
[683523] Medium CVE-2017-5043: Use after free in GuestView. Credit to - Anonymous
-
[688987] Medium CVE-2017-5044: Heap overflow in Skia. Credit to - Kushal Arvind Shah of Fortinet's FortiGuard Labs
-
[667079] Medium CVE-2017-5045: Information disclosure in XSS Auditor. - Credit to Dhaval Kapil
-
[680409] Medium CVE-2017-5046: Information disclosure in Blink. Credit to - Masato Kinugawa
-
[699618] Various fixes from internal audits, fuzzing and other initiatives
-
+
36 security fixes in this release
+
Please reference CVE/URL list for details

@@ -7257,34 +6667,7 @@ maliciously crafted GET request to the Horde server.

Mozilla Foundation reports:

-
CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
-
CVE-2017-5401: Memory Corruption when handling ErrorResult
-
CVE-2017-5402: Use-after-free working with events in FontFace objects
-
CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object
-
CVE-2017-5404: Use-after-free working with ranges in selections
-
CVE-2017-5406: Segmentation fault in Skia with canvas operations
-
CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
-
CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
-
CVE-2017-5411: Use-after-free in Buffer Storage in libGLES
-
CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service
-
CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
-
CVE-2017-5412: Buffer overflow read in SVG filters
-
CVE-2017-5413: Segmentation fault during bidirectional operations
-
CVE-2017-5414: File picker can choose incorrect default directory
-
CVE-2017-5415: Addressbar spoofing through blob URL
-
CVE-2017-5416: Null dereference crash in HttpChannel
-
CVE-2017-5417: Addressbar spoofing by draging and dropping URLs
-
CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access
-
CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running
-
CVE-2017-5427: Non-existent chrome.manifest file loaded during startup
-
CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses
-
CVE-2017-5419: Repeated authentication prompts lead to DOS attack
-
CVE-2017-5420: Javascript: URLs can obfuscate addressbar location
-
CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
-
CVE-2017-5421: Print preview spoofing
-
CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink
-
CVE-2017-5399: Memory safety bugs fixed in Firefox 52
-
CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8
+
Please reference CVE/URL list for details

@@ -8059,43 +7442,7 @@ maliciously crafted GET request to the Horde server.

Jenkins Security Advisory:

-
Description
-
SECURITY-304 / CVE-2017-2598
-
Use of AES ECB block cipher mode without IV for encrypting secrets
-
SECURITY-321 / CVE-2017-2599
-
Items could be created with same name as existing item
-
SECURITY-343 / CVE-2017-2600
-
Node monitor data could be viewed by low privilege users
-
SECURITY-349 / CVE-2011-4969
-
Possible cross-site scripting vulnerability in jQuery bundled with timeline widget
-
SECURITY-353 / CVE-2017-2601
-
Persisted cross-site scripting vulnerability in parameter names and descriptions
-
SECURITY-354 / CVE-2015-0886
-
Outdated jbcrypt version bundled with Jenkins
-
SECURITY-358 / CVE-2017-2602
-
Pipeline metadata files not blacklisted in agent-to-master security subsystem
-
SECURITY-362 / CVE-2017-2603
-
User data leak in disconnected agents' config.xml API
-
SECURITY-371 / CVE-2017-2604
-
Low privilege users were able to act on administrative monitors
-
SECURITY-376 / CVE-2017-2605
-
Re-key admin monitor leaves behind unencrypted credentials in upgraded installations
-
SECURITY-380 / CVE-2017-2606
-
Internal API allowed access to item names that should not be visible
-
SECURITY-382 / CVE-2017-2607
-
Persisted cross-site scripting vulnerability in console notes
-
SECURITY-383 / CVE-2017-2608
-
XStream remote code execution vulnerability
-
SECURITY-385 / CVE-2017-2609
-
Information disclosure vulnerability in search suggestions
-
SECURITY-388 / CVE-2017-2610
-
Persisted cross-site scripting vulnerability in search suggestions
-
SECURITY-389 / CVE-2017-2611
-
Insufficient permission check for periodic processes
-
SECURITY-392 / CVE-2017-2612
-
Low privilege users were able to override JDK download credentials
-
SECURITY-406 / CVE-2017-2613
-
User creation CSRF using GET by admins
+
Please reference CVE/URL list for details

@@ -8217,51 +7564,8 @@ maliciously crafted GET request to the Horde server.

Google Chrome Releases reports:

-
51 security fixes in this release, including:
-
-
[671102] High CVE-2017-5007: Universal XSS in Blink. Credit to - Mariusz Mlynski
-
[673170] High CVE-2017-5006: Universal XSS in Blink. Credit to - Mariusz Mlynski
-
[668552] High CVE-2017-5008: Universal XSS in Blink. Credit to - Mariusz Mlynski
-
[663476] High CVE-2017-5010: Universal XSS in Blink. Credit to - Mariusz Mlynski
-
[662859] High CVE-2017-5011: Unauthorised file access in Devtools. - Credit to Khalil Zhani
-
[667504] High CVE-2017-5009: Out of bounds memory access in WebRTC. - Credit to Sean Stanek and Chip Bradford
-
[681843] High CVE-2017-5012: Heap overflow in V8. Credit to - Gergely Nagy (Tresorit)
-
[677716] Medium CVE-2017-5013: Address spoofing in Omnibox. - Credit to Haosheng Wang (@gnehsoah)
-
[675332] Medium CVE-2017-5014: Heap overflow in Skia. Credit to - sweetchip
-
[673971] Medium CVE-2017-5015: Address spoofing in Omnibox. - Credit to Armin Razmdjou
-
[666714] Medium CVE-2017-5019: Use after free in Renderer. - Credit to Wadih Matar
-
[673163] Medium CVE-2017-5016: UI spoofing in Blink. Credit to - Haosheng Wang (@gnehsoah)
-
[676975] Medium CVE-2017-5017: Uninitialised memory access in webm video. - Credit to danberm
-
[668665] Medium CVE-2017-5018: Universal XSS in chrome://apps. - Credit to Rob Wu
-
[668653] Medium CVE-2017-5020: Universal XSS in chrome://downloads. - Credit to Rob Wu
-
[663726] Low CVE-2017-5021: Use after free in Extensions. Credit to - Rob Wu
-
[663620] Low CVE-2017-5022: Bypass of Content Security Policy in Blink. - Credit to Pujun Li of PKAV Team
-
[651443] Low CVE-2017-5023: Type confunsion in metrics. Credit to the - UK's National Cyber Security Centre (NCSC)
-
[643951] Low CVE-2017-5024: Heap overflow in FFmpeg. Credit to - Paul Mehta
-
[643950] Low CVE-2017-5025: Heap overflow in FFmpeg. Credit to - Paul Mehta
-
[634108] Low CVE-2017-5026: UI spoofing. Credit to Ronni Skansing
-
[685349] Various fixes from internal audits, fuzzing and other initiatives
-
+
51 security fixes in this release
+
Please reference CVE/URL list for details

@@ -8325,38 +7629,10 @@ maliciously crafted GET request to the Horde server.The OpenSSL project reports:

-
Truncated packet could crash via OOB read (CVE-2017-3731)
- Severity: Moderate
- If an SSL/TLS server or client is running on a 32-bit host, and a specific - cipher is being used, then a truncated packet can cause that server or client - to perform an out-of-bounds read, usually resulting in a crash.
-
Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
- Severity: Moderate
- If a malicious server supplies bad parameters for a DHE or ECDHE key exchange - then this can result in the client attempting to dereference a NULL pointer - leading to a client crash. This could be exploited in a Denial of Service - attack.
-
BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
- Severity: Moderate
- There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No - EC algorithms are affected. Analysis suggests that attacks against RSA and DSA - as a result of this defect would be very difficult to perform and are not - believed likely. Attacks against DH are considered just feasible (although very - difficult) because most of the work necessary to deduce information - about a private key may be performed offline. The amount of resources - required for such an attack would be very significant and likely only - accessible to a limited number of attackers. An attacker would - additionally need online access to an unpatched system using the target - private key in a scenario with persistent DH parameters and a private - key that is shared between multiple clients. For example this can occur by - default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very - similar to CVE-2015-3193 but must be treated as a separate problem.
-
Montgomery multiplication may produce incorrect results (CVE-2016-7055)
- Severity: Low
- There is a carry propagating bug in the Broadwell-specific Montgomery - multiplication procedure that handles input lengths divisible by, but - longer than 256 bits. (OpenSSL 1.0.2 only)
- This issue was previously fixed in 1.1.0c
+
Truncated packet could crash via OOB read (CVE-2017-3731)
+
Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
+
BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
+
Montgomery multiplication may produce incorrect results (CVE-2016-7055)

@@ -8407,30 +7683,7 @@ maliciously crafted GET request to the Horde server.

Mozilla Foundation reports:

-
CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7
-
CVE-2017-5374: Memory safety bugs fixed in Firefox 51
-
CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP
-
CVE-2017-5376: Use-after-free in XSL
-
CVE-2017-5377: Memory corruption with transforms to create gradients in Skia
-
CVE-2017-5378: Pointer and frame data leakage of Javascript objects
-
CVE-2017-5379: Use-after-free in Web Animations
-
CVE-2017-5380: Potential use-after-free during DOM manipulations
-
CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations
-
CVE-2017-5382: Feed preview can expose privileged content errors and exceptions
-
CVE-2017-5383: Location bar spoofing with unicode characters
-
CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)
-
CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers
-
CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions
-
CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages
-
CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks
-
CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests
-
CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer
-
CVE-2017-5391: Content about: pages can load privileged about: pages
-
CVE-2017-5392: Weak references using multiple threads on weak proxy objects lead to unsafe memory usage
-
CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager
-
CVE-2017-5394: Android location bar spoofing using fullscreen and JavaScript events
-
CVE-2017-5395: Android location bar spoofing during scrolling
-
CVE-2017-5396: Use-after-free with Media Decoder
+
Please reference CVE/URL list for details

@@ -8480,69 +7733,25 @@ maliciously crafted GET request to the Horde server.

The phpMyAdmin development team reports:

-
Summary

Open redirect
-
Description
-
It was possible to trick phpMyAdmin to redirect to - insecure using special request path.
-
Severity
-
We consider this vulnerability to be non critical.

-
Summary

php-gettext code execution
-
Description
-
The php-gettext library can suffer to code - execution. However there is no way to trigger this inside - phpMyAdmin.
-
Severity
-
We consider this to be minor.

-
Summary

DOS vulnerability in table editing
-
Description
-
It was possible to trigger recursive include operation by - crafted parameters when editing table data.
-
Severity
-
We consider this to be non critical.

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***