In libsndfile before 1.0.28, an error in the “flac_buffer_copy()” function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
Category Archives: Security
Security
Open Atrium – Moderately critical – Information Disclosure – SA-CONTRIB-2014-041
- Advisory ID: DRUPAL-SA-CONTRIB-2014-041
- Project: Open Atrium Core (third-party module), OA Comment (third-party module)
- Version: 7.x
- Date: 2017-April-12
- Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All
- Vulnerability: Information Disclosure
Description
Open Atrium is a distribution the enables collaboration sites to be built. It contains several custom modules to provide various functionality. While content is often protected behind private groups, public content can also be shared. When using Open Atrium as an internal Intranet, this “public” content might be restricted to only logged in users by disabling anonymous access to the site.
The oa_core and oa_comment modules do not properly respect the “view published content” permission and allows anonymous users to view this “public” content regardless of the permission setting.
This only affects sites that have disabled the “view published content” permission for anonymous users, and only affects a small number of views.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615
- oa_core 7.x-2.x versions prior to 7.x-2.84.
- oa_comment 7.x-2.x versions prior to 7.x-2.14.
Drupal core is not affected. If you do not use the contributed Open Atrium Core module, there is nothing you need to do.
Solution
Install the latest version of Open Atrium. Be sure to revert the following features:
oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections
Also see the Open Atrium project page.
Reported by
- Mike Potter of the Drupal Security Team
Fixed by
- Mike Potter the distribution maintainer and member of the Drupal Security Team
Coordinated by
- Mike Potter of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Drupal version:
@Base – Critical – Unsupported – SA-CONTRIB-2017-040
- Advisory ID: DRUPAL-SA-CONTRIB-2017-040
- Project: @Base (third-party module)
- Date: 2017-April-12
Description
Provide some more API for developer to work with Drupal 7.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions.
Drupal core is not affected. If you do not use the contributed @Base module, there is nothing you need to do.
Solution
If you use the @Base module for Drupal you should uninstall it.
Also see the @Base project page.
Reported by
Fixed by
Not applicable.
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Drupal version:
Scheduler Workbench Integration – Critical – Unsupported – SA-CONTRIB-2017-39
- Advisory ID: DRUPAL-SA-CONTRIB-2017-39
- Project: Scheduler Workbench Integration (third-party module)
- Date: 12-Apr-2017
Description
Provides integration between the Scheduler module and the Workbench Moderation module.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions
Drupal core is not affected. If you do not use the contributed Scheduler Workbench Integration module, there is nothing you need to do.
Solution
If you use the Scheduler Workbench Integration module for Drupal you should uninstall it.
Also see the Scheduler Workbench Integration project page.
Reported by
Fixed by
Not applicable
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
CVE-2017-7722
In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with “cmc” and “password” (the default username and password). By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the restricted shell.
References – Critical – Unsupported – SA-CONTRIB-2017-38
- Advisory ID: DRUPAL-SA-CONTRIB-2017-38
- Project: References (third-party module)
- Date: 12-Apr-2017
Description
Please note, the security team will not release information on this vulnerability for up to a month, the recommendation is to migrate. Emails asking for details on the vulnerability will not be responded to. If you would like to maintain the module, please follow the directions below.
This project provides D7 versions of the ‘node_reference’ and ‘user_reference’ field types, that were part of the CCK package in D6, at functional parity with the D6 counterparts.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions
Drupal core is not affected. If you do not use the contributed References module, there is nothing you need to do.
Solution
If you use the References module for Drupal you should uninstall it.
Also see the References project page.
Notably, if you started with References and need to maintain equivalent functionality, we recommend reviewing the feature set of Entity Reference. If Entity Reference can work for you, there is a Reference to EntityReference Field Migration module that can assist in the transition.
Reported by
- Cash Williams of the Drupal Security Team
Fixed by
Not applicable
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Filemaker Form – Critical – Unsupported – SA-CONTRIB-2017-37
- Advisory ID: DRUPAL-SA-CONTRIB-2017-37
- Project: Filemaker Form (third-party module)
- Date: 12-Apr-2017
Description
Easily create forms in Drupal that submit data to Filemaker databases which are hosted on Filemaker Server.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions
Drupal core is not affected. If you do not use the contributed Filemaker Form module, there is nothing you need to do.
Solution
If you use the Filemaker Form module for Drupal you should uninstall it.
Also see the Filemaker Form project page.
Reported by
Fixed by
Not applicable
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Legal – Critical – Unsupported – SA-CONTRIB-2017-36
- Advisory ID: DRUPAL-SA-CONTRIB-2017-36
- Project: Legal (third-party module)
- Date: 12-Apr-2017
Description
Displays your Terms & Conditions to users who want to register, and requires that they accept the T&C before their registration is accepted.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions
Drupal core is not affected. If you do not use the contributed Legal module, there is nothing you need to do.
Solution
If you use the Legal module for Drupal you should uninstall it.
Also see the Legal project page.
Reported by
Fixed by
Not applicable
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via
the contact form at https://www.drupal.org/contact.
Learn more about the
Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Book access – Critical – Unsupported – SA-CONTRIB-2017-35
- Advisory ID: DRUPAL-SA-CONTRIB-2017-35
- Project: Book access (third-party module)
- Date: 12-April-2017
Description
This module alters the book module permissions model by letting you specify access/modify/delete rights on a per-book basis. Normally, book-related permissions provided by drupal core apply across all books, but this module will let you drill down as granular as to letting specific users have specific rights for specific books.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
Versions affected
- All versions
Drupal core is not affected. If you do not use the contributed Book access module, there is nothing you need to do.
Solution
If you use the Book access module for Drupal you should uninstall it.
Also see the Book access project page.
Reported by
Fixed by
Not applicable
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Red Hat Security Advisory 2017-0933-01
Red Hat Security Advisory 2017-0933-01 – The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated kernel packages include several security issues and numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory.