Vtiger 5.4.0 Cross Site Scripting

SOJOBO-ADV-13-05 - Vtiger 5.4.0 Reflected Cross Site Scripting I. Information ================== Name : Vtiger 5.4.0 Reflected Cross Site Scripting Software : Vtiger 5.4.0 and possibly below. Vendor Homepage : https://www.vtiger.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity :...

Updated busybox package fixes security vulnerability

It was found that the mdev BusyBox utility could create certain directories within /dev with world-writable permissions. A local unprivileged user could use this flaw to manipulate portions of the /dev directory tree CVE-2013-1813...

UBUNTU-CVE-2013-1813

util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors...

CVE-2013-6833

The qlseioctl function in sys/dev/qlxge/qlsioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call...

busybox: insecure directory permissions in /dev

util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors...

PT-2013-1202

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.21.0 Description The issue in BusyBox allows local users to have unknown impact and attack vectors due to the use of 0777 permissions for parent directories when creating nested directories under /dev/. Additionally...

/Dev/Random PRNG in Linux Questioned

The sanctity of the dev/random random number generator used in the Linux kernel has been a hot-button issue for more than a month. A petition posted to change.org in September to remove RdRand from dev/random, for example, was met with fury from Linus Torvalds who called the developer who posted ...

[SOJOBO-ADV-13-01] - Zenphoto 1.4.5.2 multiple vulnerabilities

SOJOBO-ADV-13-01 - Zenphoto 1.4.5.2 multiple vulnerabilities I. Information ================== Name : Zenphoto 1.4.5.2 multiple vulnerabilities Software : Zenphoto 1.4.5.2 and possibly below. Vendor Homepage : http://www.zenphoto.org/ Vulnerability Type : SQL Injection, Reflected Cross-Site...

CVE-2013-5933

Stack-based buffer overflow in the subE110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service memory corruption by writing a long string to the /dev/socket/initrunit...

Stack overflow

Stack-based buffer overflow in the subE110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service memory corruption by writing a long string to the /dev/socket/initrunit...

PT-2013-5873

Name of the Vulnerable Software and Affected Versions Android version 2.3.7 on Motorola Defy XT phone Description A stack-based buffer overflow issue exists in a certain configuration of the affected device, allowing local users to potentially gain privileges or cause a denial of service due to...

CVE-2013-4777: Undefined Security Weakness

A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/initrunit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object...

Updated perl-Crypt-DSA package fixes security vulnerability

The Crypt::DSA aka Crypt-DSA module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack CVE-2011-3599. This update removes t...

CVE-2013-5155

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service infinite loop via an application that writes crafted values to /dev/random...

Code injection

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service infinite loop via an application that writes crafted values to /dev/random...

CVE-2013-5155

CVE-2013-5155 affects Apple iOS prior to 7, specifically the Sandbox subsystem. A malicious or misbehaving app that writes crafted values to /dev/random can trigger an infinite loop, causing a denial of service on the device. Technical detail: the vulnerability arises from how the Sandbox handles...

PT-2013-5400

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 7 Description The issue allows attackers to cause a denial of service, specifically an infinite loop, by writing crafted values to /dev/random via an application. Recommendations For Apple iOS versions prior to 7,...

CVE-2013-5155: Improper Input Validation

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service infinite loop via an application that writes crafted values to /dev/random...

Fedora 19 : perl-Crypt-DSA-1.17-10.fc19 (2013-15786)

As taught by the '09 Debian PGP disaster relating to DSA, the randomness source is extremely important. On systems without /dev/random, Crypt::DSA falls back to using Data::Random. Data::Random uses rand, about which the perldoc says 'rand is not cryptographically secure. You should not rely on i...

Fedora 18 : perl-Crypt-DSA-1.17-10.fc18 (2013-15755)

As taught by the '09 Debian PGP disaster relating to DSA, the randomness source is extremely important. On systems without /dev/random, Crypt::DSA falls back to using Data::Random. Data::Random uses rand, about which the perldoc says 'rand is not cryptographically secure. You should not rely on i...