[SECURITY] Fedora 11 Update: kdetoys-4.4.3-1.fc11.1

kdetoys includes: amor: Amusing Misuse Of Resources put's comic figures above your windows kteatime: makes sure your tea does not get too strong ktux: Tux-in-a-Spaceship screen saver kweather: display the current weather outside...

Mac OS X : Java for Mac OS X 10.5 Update 7

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 7. The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary co...

[slackware-security] sudo

New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. Here are the details from the Slackware 13.0 ChangeLog: patches/packages/sudo-1.7.2p6-i486-1slack13.0.txz: Upgraded. This update fixes security issues...

sudo: incomplete fix for the sudoedit privilege escalation issue CVE-2010-0426

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a...

DEBIAN-CVE-2010-1163

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a...

nss_db: Information leak due the DB_CONFIG file read from current working directory

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

Mozilla Firefox Cross Document DOM Node Moving Remote Code Execution Vulnerability

This vulnerability allows remote attackers to bypass specific script execution enforcements on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists when moving DOM nodes in...

Apple QuickTime MJPEG Sample Dimensions Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists during the parsing of...

Apple QuickTime MediaVideo Compressor Name Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists during the parsing of...

Microsoft Internet Explorer Tabular Data Control ActiveX Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer 6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the Tabular Data Control...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 13.0 and -current to fix security issues. More details about the issues may be found on the Mozilla website: http://www.mozilla.org/security/known-vulnerabilities/firefox36.html Here are the details from the Slackware 13.0 ChangeLog:...

KVM: Check cpl before emulating debug register access

The handledr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level CPL before accessing a debug register, which allows guest OS users to cause a denial of service trap on the host OS via a crafted application...

Apple Webkit Blink Event Dangling Pointer Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable software utilizing Apple's WebKit library. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists due to a failure to unregister a callba...

Slackware 13.0 / current : gzip (SSA:2010-060-03)

New gzip packages are available for Slackware 13.0 64-bit and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2010-060-03. The text itself is copyright C...

IT-Grundschutz M5.008: Regelmäßiger Sicherheitscheck des Netzes

IT-Grundschutz M5.008: Regelmäßiger Sicherheitscheck des Netzes. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.95050 Diese Prüfung bezieht sich auf die 10...

[slackware-security] pidgin

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2010-0013 Here are the details from the Slackware 13.0...

Microsoft Internet Explorer Table Layout Reuse Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists when specific elements are used with...

IT-Grundschutz M4.023: Sicherer Aufruf ausführbarer Dateien

IT-Grundschutz M4.023: Sicherer Aufruf ausführbarer Dateien. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94194 Diese Prüfung bezieht sich auf die 11...

libtool: libltdl may load and execute code from a library in the current directory

ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file...

Slackware 12.2 / 13.0 / current : seamonkey (SSA:2009-352-01)

New seamonkey packages are available for Slackware 12.2, 13.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2009-352-01. The text itself is copyright...