David Golden of MongoDB discovered that File::Spec::canonpath() in Perl
returned untainted strings even if passed tainted input. This defect
undermines taint propagation, which is sometimes used to ensure that
unvalidated user input does not reach sensitive code.

When sudo is configured to allow a user to edit files under a directory
that they can already write to without using sudo, they can actually
edit (read and write) arbitrary files. Daniel Svartman reported that a
configuration like this might be introduced unintentionally if the
editable files are specified using wildcards, for example:

Two vulnerabilities were discovered in Prosody, a lightweight
Jabber/XMPP server. The Common Vulnerabilities and Exposures project
identifies the following issues:

Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in
the TLS 1.2 protocol which could allow the MD5 hash function to be used
for signing ServerKeyExchange and Client Authentication packets during a
TLS handshake. A man-in-the-middle attacker could exploit this flaw to
conduct collision attacks to impersonate a TLS server or an
authenticated TLS client.

It was discovered that unplugging one of the monitors in a multi-monitor
setup can cause xscreensaver to crash. Someone with physical access to
a machine could use this problem to bypass a locked session.

Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in
the TLS 1.2 protocol which could allow the MD5 hash function to be used
for signing ServerKeyExchange and Client Authentication packets during a
TLS handshake. A man-in-the-middle attacker could exploit this flaw to
conduct collision attacks to impersonate a TLS server or an
authenticated TLS client.

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leak.

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly
handled recursive clones of git repositories. A remote attacker could
possibly use this issue to execute arbitary code by injecting commands
via crafted URLs.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix. The Common Vulnerabilities and
Exposures project identifies the following issues:

Multiple security issues have been found in Icedove, Debian’s version of
the Mozilla Thunderbird mail client: Multiple memory safety errors,
integer overflows, buffer overflows and other implementation errors may
lead to the execution of arbitrary code or denial of service.