Skip to content

Commit

Permalink
security/vuxml: sync with upstream
Browse files Browse the repository at this point in the history 
Taken from: FreeBSD
  • Loading branch information
@fichtner
fichtner committed May 31, 2017
1 parent 842e78b commit 0eb518f
Showing 1 changed file with 85 additions and 25 deletions.
110 changes: 85 additions & 25 deletions security/vuxml/vuln.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -224,11 +224,18 @@ Notes:
</vuln>

<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
<topic>imagemagick -- multiple vulnerabilities</topic>
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>imagemagick</name>
<range><lt>6.9.8.6</lt></range>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4_2,1</lt></range>
<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.5.9</lt></range>
</package>
</affects>
<description>
Expand Down Expand Up @@ -329,7 +336,7 @@ Notes:
to cause a denial of service (memory leak) via a crafted file.</li>
<li>CVE-2017-8357: ReadEPTImage function in ept.c allows attackers
to cause a denial of service (memory leak) via a crafted file.</li>
<li>CVE-2017-8365: The function named ReadICONImage in coders\icon.c
<li>CVE-2017-8765: The function named ReadICONImage in coders\icon.c
has a memory leak vulnerability which can cause memory exhaustion
via a crafted ICON file.</li>
<li>CVE-2017-8830: ReadBMPImage function in bmp.c:1379 allows
Expand Down Expand Up @@ -386,7 +393,7 @@ Notes:
<cvename>CVE-2017-8355</cvename>
<cvename>CVE-2017-8356</cvename>
<cvename>CVE-2017-8357</cvename>
<cvename>CVE-2017-8365</cvename>
<cvename>CVE-2017-8765</cvename>
<cvename>CVE-2017-8830</cvename>
<cvename>CVE-2017-9141</cvename>
<cvename>CVE-2017-9142</cvename>
Expand All @@ -396,6 +403,7 @@ Notes:
<dates>
<discovery>2017-03-05</discovery>
<entry>2017-05-25</entry>
<modified>2017-05-29</modified>
</dates>
</vuln>

Expand Down Expand Up @@ -672,25 +680,57 @@ Notes:
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
<h1>Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types</h1>
<p>Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new project import view for gitlab_project import types. This XSS vulnerability was caused by the use of Hamlit filters inside HAML views without manually escaping HTML. Unlike content outside of a filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) is not automatically escaped.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in project import file names
for gitlab_project import types</h1>
<p>Timo Schmid from ERNW reported a persistent Cross-Site Scripting
vulnerability in the new project import view for gitlab_project import
types. This XSS vulnerability was caused by the use of Hamlit filters inside
HAML views without manually escaping HTML. Unlike content outside of a
filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain)
is not automatically escaped.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in git submodule support</h1>
<p>Jobert Abma from HackerOne reported a persitent XSS vulnerability in the GitLab repository files view that could be exploited by injecting malicious script into a git submodule.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in repository "new branch" view</h1>
<p>A GitLab user reported a persistent XSS vulnerability in the repository new branch view that allowed malicious branch names or git references to execute arbitrary Javascript.</p>
<p>Jobert Abma from HackerOne reported a persitent XSS vulnerability in the
GitLab repository files view that could be exploited by injecting malicious
script into a git submodule.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in repository "new branch"
view</h1>
<p>A GitLab user reported a persistent XSS vulnerability in the repository
new branch view that allowed malicious branch names or git references to
execute arbitrary Javascript.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in mirror errors display</h1>
<p>While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters.</p>
<p>While investigating Timo Schmid's previously reported XSS vulnerability
in import filenames another persistent XSS vulnerability was discovered in
the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was
also caused by the misuse of Hamlit filters.</p>
<h1>Potential XSS vulnerability in DropLab</h1>
<p>An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future.</p>
<h1>Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files</h1>
<p>edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.</p>
<p>The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable.</p>
<p>An internal code audit disclosed a vulnerability in DropLab's templating
that, while not currently exploitable, could become exploitable depending on
how the templates were used in the future.</p>
<h1>Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and
other markup files</h1>
<p>edio via HackerOne reported two tab nabbing vulnerabilities. The first
tab nabbing vulnerability was caused by improper hostname filtering when
identifying user-supplied external links. GitLab did not properly filter
usernames from the URL. An attacker could construct a specially crafted link
including a username to bypass GitLab's external link filter. This allowed
an attacker to post links in Markdown that did not include the appropriate
"noreferrer noopener" options, allowing tab nabbing attacks.</p>
<p>The second vulnerability was in the AsciiDoctor markup
library. AsciiDoctor was not properly including the "noreferrer noopener"
options with external links. An internal investigation discovered other
markup libraries that were also vulnerable.</p>
<h1>Unauthorized disclosure of wiki pages in search</h1>
<p>M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects.</p>
<p>M. Hasbini reported a flaw in the project search feature that allowed
authenticated users to disclose the contents of private wiki pages inside
public projects.</p>
<h1>External users can view internal snippets</h1>
<p>Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets.</p>
<h1>Subgroup visibility for private subgroups under a public parent group</h1>
<p>Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public.</p>
<p>Christian Kühn discovered a vulnerability in GitLab snippets that allowed
an external user to view the contents of internal snippets.</p>
<h1>Subgroup visibility for private subgroups under a public parent
group</h1>
<p>Matt Harrison discovered a vulnerability with subgroups that allowed
private subgroup names to be disclosed when they belong to a parent group
that is public.</p>
</blockquote>
</body>
</description>
Expand All @@ -700,6 +740,7 @@ Notes:
<dates>
<discovery>2017-05-08</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>

Expand All @@ -718,23 +759,41 @@ Notes:
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
<h1>Information Disclosure in Issue and Merge Request Trackers</h1>
<p>During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to disclose that user's private token, email token, email address, and encrypted OTP secret. Reporter-level access to a GitLab project is required to exploit this flaw.</p>
<p>During an internal code review a critical vulnerability in the GitLab
Issue and Merge Request trackers was discovered. This vulnerability could
allow a user with access to assign ownership of an issue or merge request to
another user to disclose that user's private token, email token, email
address, and encrypted OTP secret. Reporter-level access to a GitLab project
is required to exploit this flaw.</p>
<h1>SSRF when importing a project from a Repo by URL</h1>
<p>GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services that are bound to the local interface of the server. These services often do not require authentication. Depending on the service an attacker might be able craft an attack using the project import request URL.</p>
<p>GitLab instances that have enabled project imports using "Repo by URL"
were vulnerable to Server-Side Request Forgery attacks. By specifying a
project import URL of localhost an attacker could target services that are
bound to the local interface of the server. These services often do not
require authentication. Depending on the service an attacker might be able
craft an attack using the project import request URL.</p>
<h1>Links in Environments tab vulnerable to tabnabbing</h1>
<p>edio via HackerOne reported that user-configured Environment links include target=_blank but do not also include rel: noopener noreferrer. Anyone clicking on these links may therefore be subjected to tabnabbing attacks where a link back to the requesting page is maintained and can be manipulated by the target server.</p>
<h1>Accounts with email set to "Do not show on profile" have addresses exposed in public atom feed</h1>
<p>Several GitLab users reported that even with "Do not show on profile" configured for their email addresses those addresses were still being leaked in Atom feeds if they commented on a public project.</p>
<p>edio via HackerOne reported that user-configured Environment links
include target=_blank but do not also include rel: noopener
noreferrer. Anyone clicking on these links may therefore be subjected to
tabnabbing attacks where a link back to the requesting page is maintained
and can be manipulated by the target server.</p>
<h1>Accounts with email set to "Do not show on profile" have addresses
exposed in public atom feed</h1>
<p>Several GitLab users reported that even with "Do not show on profile"
configured for their email addresses those addresses were still being leaked
in Atom feeds if they commented on a public project.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
<cvename>CVE-2017-0882</cvename>
<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-03-20</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>

Expand Down Expand Up @@ -8939,6 +8998,7 @@ Notes:
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-09</entry>
<modified>2017-05-18</modified>
</dates>
</vuln>

Expand Down

0 comments on commit 0eb518f

Please sign in to comment.