CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0374

Affected software/component: libconfig-model-perl (Config-Model) – the file lib/Config/Model.pm. Vulnerability: in versions before 2.102, a crafted model in the current working directory can cause local privilege elevation via the INC path mechanism (use of “.” with INC). Impact: local users can ...

[SECURITY] Fedora 26 Update: pcre-8.40-7.fc26

PCRE, Perl-compatible regular expression, library has its own native API, b ut a set of wrapper functions that are based on the POSIX API are also supplied in the libpcreposix library. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

[SECURITY] Fedora 25 Update: pcre2-10.23-6.fc25

PCRE2 is a re-working of the original PCRE Perl-compatible regular expression library to provide an entirely new API. PCRE2 is written in C, and it has its own API. There are three sets of functions, one for the 8-bit library, which processes strings of bytes, one for the 16-bit library, which...

[SECURITY] Fedora 24 Update: ntp-4.2.6p5-44.fc24

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

Debian DLA-887-1 : libdatetime-timezone-perl new upstream version

This update includes the changes in tzdata 2017b for the Perl bindings. For the list of changes, see DLA-886-1. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.58-1+2017b. We recommend that you upgrade your libdatetime-time zone-perl packages. NOTE: Tenable Network Security h...

[SECURITY] [DLA 887-1] libdatetime-timezone-perl new upstream version

Package : libdatetime-timezone-perl Version : 1:1.58-1+2017b This update includes the changes in tzdata 2017b for the Perl bindings. For the list of changes, see DLA-886-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2017b. We recommend that you upgrade your...

DLA-887-1 libdatetime-timezone-perl - new upstream version

Bulletin has no description...

[SECURITY] Fedora 26 Update: ntp-4.2.8p10-1.fc26

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts are in the ntp-perl package, ntpdate is in...

[SECURITY] Fedora 25 Update: ntp-4.2.6p5-44.fc25

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

PCRE 'pcre32_copy_substring' function buffer overflow vulnerability (CNVD-2017-04912)

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. A buffer overflow vulnerability exists in the 'pcre32copysubstring' function in the pcreget.c file of libpcre1 in PCRE version 8.40. A...

MikroTik RouterBoard 6.38.5 - Denial of Service

!/usr/local/bin/perl use Socket; $srchost =3D $ARGV0;=20 $srcport =3D $ARGV1;=20 $dsthost =3D $ARGV2;=20 $dstport =3D $ARGV3;=20 if!defined $srchost or !defined $srcport or !defined $dsthost or !defin= ed $dstport=20 =09 =09print "Usage: $0 \n"; =09exit; =20 else=20 =09 =09main; =20 sub main=20...

MikroTik RouterBoard 6.38.5 - Denial of Service

MikroTik RouterBoard 6.38.5 - Denial of Service !/usr/local/bin/perl use Socket; $srchost =3D $ARGV0;=20 $srcport =3D $ARGV1;=20 $dsthost =3D $ARGV2;=20 $dstport =3D $ARGV3;=20 if!defined $srchost or !defined $srcport or !defined $dsthost or !defin= ed $dstport=20 =09 =09print "Usage: $0 \n";...

MikroTik RouterBoard 6.38.5 Denial Of Service

!/usr/local/bin/perl use Socket; $srchost =3D $ARGV0;=20 $srcport =3D $ARGV1;=20 $dsthost =3D $ARGV2;=20 $dstport =3D $ARGV3;=20 if!defined $srchost or !defined $srcport or !defined $dsthost or !defin= ed $dstport=20 =09 =09print "Usage: $0 \n"; =09exit; =20 else=20 =09 =09main; =20 sub main=20...

libguestfs, ocaml, perl, python, ruby security update

CentOS Errata and Security Advisory CESA-2017:0564 An update for libguestfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

DEBIAN-CVE-2017-7245

Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service WRITE of size 4 or possibly have unspecified other impact via a crafted file...

ALPINE-CVE-2017-7244

The pcre32xclass function in pcrexclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service invalid memory read via a crafted file...

Code injection

AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971...

ALPINE-CVE-2017-7186

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...

dnaLIMS Admin Module Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'dnaLIMS Admin Module Command Execution', 'Description' = %q This module utilizes an administrative module which allows for...