2017-06-10
ALT-BU-2017-3166-1
Branch p8 update bulletin.
Closed vulnerabilities
Published: 2017-06-09
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-0375
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- 99017
- 99017
- https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7
- https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7
- https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html
- https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html
- https://trac.torproject.org/projects/tor/ticket/22493
- https://trac.torproject.org/projects/tor/ticket/22493
Published: 2017-06-09
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-0376
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- DSA-3877
- DSA-3877
- https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd
- https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd
- https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html
- https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html
- https://trac.torproject.org/projects/tor/ticket/22494
- https://trac.torproject.org/projects/tor/ticket/22494
Closed vulnerabilities
Published: 2017-04-29
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- 98445
- 98445
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11
- GLSA-201707-11
- GLSA-201707-11