SB2020071532 - Oracle Solaris security update for third party software (July 2020)
Published: July 15, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2020-1747)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when processing untrusted YAML files passed via the "full_load" method or with the "FullLoader" loader. A remote attacker can pass specially crafted input to the application and execute arbitrary code by abusing the python/object/new constructor.
2) Out-of-bounds write (CVE-ID: CVE-2020-12762)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in the "printbuf_memappend". A remote attacker can create a specially crafted JSON file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.
3) Stored cross-site scripting (CVE-ID: CVE-2020-12137)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to mailman uses the .obj extension for scrubbed application/octet-stream MIME parts. A remote attacker can send a specially crafted attachment to the list, trick the victim to open the email in the list archive and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Race condition (CVE-ID: CVE-2020-12399)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to time differences in Mozilla NSS library during the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key.
5) Cleartext transmission of sensitive information (CVE-ID: CVE-2020-12398)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in STARTTLS implementation for an IMAP, when the server sends a PREAUTH response. In this case Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
6) Spoofing attack (CVE-ID: CVE-2018-13796)
The vulnerability allows a remote attacker to conduct spoofing attack.
The vulnerability exists due to insufficient input validation. A remote attacker can submit a specially crafted URL and cause arbitrary text to be displayed on a web page from a trusted site.
7) Spoofing attack (CVE-ID: CVE-2020-12108)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data when processing email addresses. A remote attacker can create a specially crafted email and spoof content of email message.
8) Use-after-free (CVE-ID: CVE-2020-12405)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when in SharedWorkerService due to a race condition. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
9) Type Confusion (CVE-ID: CVE-2020-12406)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error during unboxed JavaScript objects removal. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Buffer overflow (CVE-ID: CVE-2020-12410)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.