Microsoft Office Memory Corruption (MS16-042: CVE-2016-0139; CVE-2016-0140)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

Oracle: Security Advisory (ELSA-2014-0139)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 201406-21

Gentoo Linux Local Security Checks GLSA 201406-21 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Updated lftp packages fix CVE-2014-0139

Updated lftp packages fix security vulnerability: lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or ju...

MGASA-2015-0165 Updated lftp packages fix CVE-2014-0139

Updated lftp packages fix security vulnerability: lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or ju...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF15 / 8.5.0.0 < 8.5.0.0 CF05 Multiple XSRF / XSS (PI34987, PI33329, PI35228)

The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 Cumulative Fix 15 / 8.5.0.0 prior to 8.5.0.0 Cumulative Fix 05. It is, therefore, affected by multiple vulnerabilities : - An unspecified XSRF vulnerability exists due to improper validation of...

CVE-2015-0139

CVE-2015-0139 is an XSS vulnerability in IBM WebSphere Portal. Affected versions: WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05. The issue allows remote authenticated users to inject arbitrary script/HTML via a crafted URL. The connected sources reiterate the same impact and d...

Fedora Update for mingw-curl FEDORA-2014-6921

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for mingw-curl FEDORA-2014-6912

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : curl (openSUSE-SU-2014:0598-1)

This curl update fixes two security issues : - bnc868627: Fixed wrong re-use of connections CVE-2014-0138. - bnc868629: Fixed IP address wildcard certificate validation CVE-2014-0139. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Fedora 20 : mingw-curl-7.37.0-1.fc20 (2014-6912)

Update to 7.37.0 - Fixes CVE-2014-0138 and CVE-2014-0139 RHBZ 1080880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 19 : mingw-curl-7.37.0-1.fc19 (2014-6921)

Update to 7.37.0 - Fixes CVE-2014-0138 and CVE-2014-0139 RHBZ 1080880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

SuSE 11.3 Security Update : curl (SAT Patch Number 9133)

This curl update fixes the following security issues : - wrong re-use of connections. CVE-2014-0138. bnc868627 - IP address wildcard certificate validation. CVE-2014-0139. bnc868629 - --insecure option inappropriately enforcing security safeguard. bnc870444 %NASLMINLEVEL 70300 C Tenable Network...

SUSE-SU-2015:0962-1 Security update for curl

This curl update fixes the following security issues: bnc868627: wrong re-use of connections CVE-2014-0138. bnc868629: IP address wildcard certificate validation CVE-2014-0139. bnc870444: --insecure option inappropriately enforcing security safeguard. Security Issue references: CVE-2014-0138...

CVE-2014-0139

CVE-2014-0139 affects curl/libcurl up to version 7.36.0 when using TLS with OpenSSL, axtls, qsossl or gskit. The vulnerability arises from how the hostname validation handles wildcard characters in the certificate’s Common Name (CN); a crafted certificate could allow MITM spoofing of SSL servers....

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : curl vulnerabilities (USN-2167-1)

Steve Holme discovered that libcurl incorrectly reused wrong connections when using protocols other than HTTP and FTP. This could lead to the use of unintended credentials, possibly exposing sensitive information. CVE-2014-0138 Richard Moore discovered that libcurl incorrectly validated wildcard...

Debian DSA-2902-1 : curl - security update

Two vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-0138 Steve Holme discovered that libcurl can in some circumstances re-use the wrong connection when asked to do transfers usin...

[SECURITY] [DSA 2902-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2902-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 13, 2014 http://www.debian.org/security/faq -...

DSA-2902-1 curl - security update

Bulletin has no description...

Debian Security Advisory DSA 2902-1 (curl - security update)

Two vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0138 Steve Holme discovered that libcurl can in some circumstances re-use the wrong connection when asked to do transfers using...