Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracefs: Reset permissions on remount if permissions are options<br /> <br /> There&amp;#39;s an inconsistency with the way permissions are handled in tracefs.<br /> Because the permissions are generated when accessed, they default to the<br /> root inode&amp;#39;s permission if they were never set by the user. If the user<br /> sets the permissions, then a flag is set and the permissions are saved via<br /> the inode (for tracefs files) or an internal attribute field (for<br /> eventfs).<br /> <br /> But if a remount happens that specify the permissions, all the files that<br /> were not changed by the user gets updated, but the ones that were are not.<br /> If the user were to remount the file system with a given permission, then<br /> all files and directories within that file system should be updated.<br /> <br /> This can cause security issues if a file&amp;#39;s permission was updated but the<br /> admin forgot about it. They could incorrectly think that remounting with<br /> permissions set would update all files, but miss some.<br /> <br /> For example:<br /> <br /> # cd /sys/kernel/tracing<br /> # chgrp 1002 current_tracer<br /> # ls -l<br /> [..]<br /> -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb<br /> -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb<br /> -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb<br /> -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer<br /> -rw-r----- 1 root root 0 May 1 21:25 dynamic_events<br /> -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info<br /> -r--r----- 1 root root 0 May 1 21:25 enabled_functions<br /> <br /> Where current_tracer now has group "lkp".<br /> <br /> # mount -o remount,gid=1001 .<br /> # ls -l<br /> -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb<br /> -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb<br /> -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb<br /> -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer<br /> -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events<br /> -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info<br /> -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions<br /> <br /> Everything changed but the "current_tracer".<br /> <br /> Add a new link list that keeps track of all the tracefs_inodes which has<br /> the permission flags that tell if the file/dir should use the root inode&amp;#39;s<br /> permission or not. Then on remount, clear all the flags so that the<br /> default behavior of using the root inode&amp;#39;s permission is done for all<br /> files and directories.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/9p: only translate RWX permissions for plain 9P2000<br /> <br /> Garbage in plain 9P2000&amp;#39;s perm bits is allowed through, which causes it<br /> to be able to set (among others) the suid bit. This was presumably not<br /> the intent since the unix extended bits are handled explicitly and<br /> conditionally on .u.

A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.

DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.

Improper Neutralization of Input During Web Page Generation (XSS or &amp;#39;Cross-site Scripting&amp;#39;) vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through 4.5.

Improper Neutralization of Input During Web Page Generation (XSS or &amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This issue affects Site Favicon: from n/a through 0.2.

Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.

The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product.

Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.