ruby: hash table collisions CPU usage DoS (oCERT-2011-003)

Ruby aka CRuby before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table...

Moderate: Red Hat Security Advisory: php security update

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CVE-2011-4899

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

CVE-2011-4898

CVE-2011-4898 affects WordPress 3.3.1 and earlier, in wp-admin/setup-config.php. The issue stems from different error messages returned for requests without a dbname depending on MySQL credentials, which can facilitate brute-force attempts by cycling uname/pwd across requests. The connected Nessu...

CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

CVE-2011-4899

CVE-2011-4899 affects WordPress 3.3.1 and earlier; the installation component wp-admin/setup-config.php may not verify the chosen MySQL database service, allowing remote attackers to configure an arbitrary database via the dbhost and dbname parameters and subsequently perform static code injectio...

CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

CVE-2011-4899

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

Description of the update for Lync Server 2010, Web Components Server: December 2011

Describes the update for Lync Server 2010, Web Components Server that is dated December 2011.SummaryThis article describes the update for Microsoft Lync Server 2010, Web Components Server that is dated December 2011. ResolutionMicrosoft Download CenterThe following file is available for download...

php security update

4.3.9-3.35 - add glibc-headers to BuildRequires because of stdint.h needed by CVE-2011-0708.patch, adopt the patch's include header section 769761 4.3.9-3.33 - fix CVE-2011-4566 patch to be RHEL-4 php/exif compatible 769761 4.3.9-3.32 - add security fixes for CVE-2011-4885, CVE-2011-4566,...

SuSE 11.1 Security Update : KVM (SAT Patch Number 5655)

The following vulnerabilities have been fixed in KVM : - buffer overflow in e1000 device emulation. CVE-2012-0029 - missing initgroups for -runas CVE-2011-2527 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11...

Cisco Security Advisory: Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability Advisory ID: cisco-sa-20120126-ironport Revision 1.0 For Public Release 2012 January 26 17:00 UTC GMT...

[ GLSA 201201-04 ] Logsurfer: Arbitrary code execution

Gentoo Linux Security Advisory GLSA 201201-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Fedora 15 : qt-4.7.4-10.fc15 (2011-17565)

This build addresses a security issue : - CVE-2011-3922 qt: Stack-based buffer overflow in embedded harfbuzz code as well as includes an upstream patch to address : - 'closed windows stay in the taskbar sometimes, taskbar doesn't react on clicks', http://bugs.kde.org/275469 Note that Tenable...

ruby security update

1.8.5-22.1 - Properly initialize the random number generator when forking new process ruby-1.8.7-CVE-2011-3009.patch - Related: rhbz768829 1.8.5-21.1 - Revert accidential move of tcl/tk libraries. - Related: rhbz768829 1.8.5-20.1 - Address CVE-2011-4815 "DoS excessive CPU use via hash...

ruby security update

1.8.7.352-4 - Address CVE-2011-4815 'DoS excessive CPU use via hash meet-in-the-middle attacks oCERT-2011-003' ruby-1.8.7-p352-CVE-2011-4815.patch - Resolves: rhbz768831...

Fedora 16 : t1lib-5.1.2-9.fc16 (2012-0289)

This update fixes several security flaws in t1lib flaws in AFM parser and when handling specially crafted Type1 fonts. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and form...

SuSE 11.1 Security Update : squid3 (SAT Patch Number 5583)

This update fixes the following security issue : - 727492: Invalid free by processing CNAME CVE-2011-4096 It also fixes the following non-security issue : - 737905: installation creates empty spurious file '/1' %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

GLSA-201201-15 : ktsuss: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201201-15 ktsuss: Privilege escalation Two vulnerabilities have been found in ktuss: Under specific circumstances, ktsuss skips authentication and fails to change the effective UID back to the real UID CVE-2011-2921. The GTK...