Security Bulletin: Vulnerabilites in IBM Algorithmics Algo One Algo Risk Application (ARA) Stack trace may be thrown if no default error page was set up and exception occurred

Summary IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by improper handling of exceptions when a default error page does not exist. Liberty is bundled/embedded with Algo One ARA in Algo One versions 5.0 and 5.1. IBM Algo One Algo Risk...

Microsoft Windows SMB Tree Connect Response denial of service vulnerability

Overview Microsoft Windows contains a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system. Description Microsoft Windows fails to properly handle traffic from a malicious server. In particular...

Microsoft Windows Kernel - Registry Hive Loading nt!RtlEqualSid Out-of-Bounds Read (MS16-138)

Microsoft Windows Kernel - Registry Hive Loading nt!RtlEqualSid Out-of-Bounds Read MS16-138 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=874 We have encountered a Windows kernel crash in the nt!RtlEqualSid function invoked through nt!SeAccessCheck by...

Microsoft Windows VHDFS Driver Elevation of Privilege (MS16-138: CVE-2016-7225)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to insufficient specification for a certain flag. A remote attacker can exploit this vulnerability by enticing a user to run a specially crafted executable...

SUSE SLED11 / SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:2334-1)

Mozilla Firefox was updated to version 38.5.0 esr to fix the following issues : Following security issues were fixed : - MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards rv:43.0 / rv:38.5 - MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC when datachannel is used...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:2336-1)

Mozilla Firefox was updated to version 38.5.0 ESR. It fixes the following security issues : - MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards rv:43.0 / rv:38.5 - MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC when datachannel is used after being destroyed - MFS...

Amazon Linux: Security Advisory (ALAS-2012-138)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : xen-4.5.1-5.fc22 (2015-12657)

QEMU heap overflow flaw while processing certain ATAPI commands. XSA-138, CVE-2015-5154 1247142 try again to fix xen-qemu-dom0-disk-backend.service 1242246 correct qemu location in xen-qemu-dom0-disk-backend.service 1242246, rebuild efi grub.cfg if it is present 1239309, re-enable remus by buildi...

Fedora 21 : xen-4.4.2-9.fc21 (2015-12714)

QEMU heap overflow flaw while processing certain ATAPI commands. XSA-138, CVE-2015-5154 1247142 rebuild efi grub.cfg if it is present 1239309, add gcc5 build fixes, one needed for the following patch, modify gnutls use in line with Fedora's crypto policies 117935 Note that Tenable Network Securit...

OracleVM 3.3 : xen (OVMSA-2015-0095)

The remote OracleVM system is missing necessary patches to address critical security updates : - ide: Clear DRQ after handling all expected accesses This is additional hardening against an endtransferfunc that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer ha...

CVE-2015-5154

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands...

Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities

Quarterly update covers 138 different vulnerabilities...

Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:138)

Integer overflow in the rtlallocateMemory function in sal/rtl/source/allocglobal.c in OpenOffice.org OOo 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow. The updated packages have been patched to fix the issue...

Mandriva Update for kdebase MDKSA-2007:138 (kdebase)

Check for the Version of kdebase OpenVAS Vulnerability Test Mandriva Update for kdebase MDKSA-2007:138 kdebase Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for openoffice.org MDVSA-2008:138 (openoffice.org)

Check for the Version of openoffice.org OpenVAS Vulnerability Test Mandriva Update for openoffice.org MDVSA-2008:138 openoffice.org Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Debian Security Advisory DSA 138-1 (gallery)

The remote host is missing an update to gallery announced via advisory DSA 138-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authenticating security providers fails due to ClassLoader bugs

If the Trusted Application feature is not working and the following is seen noformat WARN atlassian.seraph.filter.TrustedApplicationsFilter Failed to login trusted application: confluence1234567 due to: com.atlassian.security.auth.trustedapps.InvalidCertificateException:...

HP-UX Security patch : PHCO_23089

The remote host is missing HP-UX Security Patch number PHCO23089 . Sec. Vulnerability in man1 command %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid17124; scriptversion"1.7";...

[SA13593] Symantec Brightmail AntiSpam Notifier Denial of Service

TITLE: Symantec Brightmail AntiSpam Notifier Denial of Service SECUNIA ADVISORY ID: SA13593 VERIFY ADVISORY: http://secunia.com/advisories/13593/ CRITICAL: Not critical IMPACT: DoS WHERE: From remote SOFTWARE: Symantec Brightmail AntiSpam 6.x http://secunia.com/product/3656/ DESCRIPTION: A weakne...