[SECURITY] [DSA 4879-1] spamassassin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4879-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 27, 2021 https://www.debian.org/security/faq -...

FreeBSD : spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands (ec04f3d0-8cd9-11eb-bb9f-206a8a720317)

The Apache SpamAssassin project reports : Apache SpamAssassin 3.4.5 was recently released 1, and fixes an issue of security note where malicious rule configuration .cf files can be configured to run system commands. In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of...

CVE-2020-1946

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

CVE-2020-1946

CVE-2020-1946 affects Apache SpamAssassin prior to 3.4.5. Malicious rule configuration files (.cf) can be crafted to execute system commands without output or errors, enabling command execution in multiple scenarios. Root cause: untrusted .cf content can trigger privileged actions. Impact: potent...

CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

CVE-2020-1946

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

Debian: Security Advisory (DLA-1946-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : kernel (RHSA-2019:1946)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1946 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An industry-wide issue was found in th...

CVE-2019-1946 Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementatio...

Cross Site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

CVE-2018-1946

CVE-2018-1946 involves IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2 through 5.2.4.1. The issue is not a bug in code execution but a design/crypto negotiation flaw: multiple actors can negotiate which protection algorithms (e.g., encryption/authentication)...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2015-1946)

Summary IBM WebSphere Application Server is shipped as a component of IBM Rational ClearCase. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Multiple...

Security Bulletin: A security vulnerability has been identified in IBM Operations Analytics - Predictive Insights (CVE-2015-1885, CVE-2015-1927, CVE-2015-1946)

Summary IBM WebSphere Application Server Liberty Core 8.5.5.1 is shipped as a component of IBM Operations Analytics - Predictive Insights. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty Core 8.5.5.1 has been published in a security bulletin...

Security Bulletin:A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Network Manager IP Edition (CVE-2015-1885, CVE-2015-0250, CVE-2015-1927, and CVE-2015-1946)

Summary IBM WebSphere Application Server is shipped as a component of IBM Tivoli Network Manager IP Edition. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server 8.5 shipped with IBM Tivoli System Automation Application Manager 4.1 (CVE-2015-1946)

Summary WebSphere Application Server 8.5 is shipped as a component of IBM Tivoli System Automation Application Manager 4.1. Information about a security vulnerability affecting WebSphere Application Server 8.5 has been published in a security bulletin. Vulnerability Details Please consult the...

Security Bulletin: Three security vulnerabilities have been identified in WebSphere Application Server shipped with IBM eDiscovery Manager (CVE-2015-1885, CVE-2015-1927, CVE-2015-1946)

Summary WebSphere Application Server is shipped as a component of IBM eDiscovery Manager. Information about three security vulnerabilities that affect WebSphere Application Server are published in a security bulletin. Vulnerability Details For more information, see the WebSphere Application Serve...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearQuest (CVE-2015-1946)

Summary IBM WebSphere Application Server is shipped as a component of IBM Rational ClearQuest. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Multiple...

Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web version 7.0 software installations and IBM Tivoli Access Manager for e-business (CVE-2015-1946)

Summary IBM Security Access Manager for Web 7.0 software and IBM Tivoli Access Manager for e-business installations use WebSphere Application Server. WebSphere Application Server could allow a local attacker to gain elevated privileges on the system cause by the user roles not being handled...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2015-1946, CVE-2015-1927 )

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2015-1927, CVE-2015-1946, CVE-2015-1885)

Summary WebSphere Application Server is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin Vulnerability Details For vulnerability details, see the security bulletin Multipl...