FreeBSD Security Advisory – Due to insufficient input validation in OpenSSH, a client which has permission to establish X11 forwarding sessions to a server can piggyback arbitrary shell commands on the data intended to be passed to the xauth tool. An attacker with valid credentials and permission to establish X11 forwarding sessions can bypass other restrictions which may have been placed on their account, for instance using ForceCommand directives in the server’s configuration file.

FreeBSD Security Advisory – A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to invalid use of a signed intermediate value in the bounds checking during argument validity verification, unbound zero’ing of the process LDT and adjacent memory can be initiated from usermode. This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

AKIPS Network Monitor versions 15.37 through 16.5 suffer from a remote command injection vulnerability.

The SecLogon service does not sanitize standard handles when creating a new process leading to duplicating a system service thread pool handle into a user accessible process. This can be used to elevate privileges to Local System.

There is a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file.

There is a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file.

This bulletin summary lists two bulletins that have undergone a major revision increment for March, 2016.