33563 matches found
openSUSE Security Update : rsync (openSUSE-2016-764)
rsync was updated to fix one security issue. This security issue was fixed : - CVE-2014-9512: rsync allowed remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path boo915410. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...
SUSE: Security Advisory for kernel (SUSE-SU-2016:1690-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Elastic Logstash 'CVE-2014-4326' RCE Vulnerability - Linux
Elastic Logstash is prone to a remote code execution RCE vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2014-9904
The sndcompresscheckinput function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service insufficient memory allocation or possibly have unspecified other impact...
CVE-2014-9904
The sndcompresscheckinput function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service insufficient memory allocation or possibly have unspecified other impact...
CVE-2014-9903
CVE-2014-9903 (Linux kernel) : Affects Linux kernel 3.14-rc1 to 3.14-rc3 (and earlier rc builds) where sched_read_attr in kernel/sched/core.c uses an incorrect size. This enables a local attacker to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call. The...
CVE-2014-9904
CVE-2014-9904 affects the Linux kernel ALSA subsystem: snd_compress_check_input in sound/core/compress_offload.c before 3.17 fails to check for an integer overflow. This can allow local users to cause a denial of service (insufficient memory allocation) or other unspecified impact via a crafted S...
CVE-2014-9904
The sndcompresscheckinput function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service insufficient memory allocation or possibly have unspecified other impact...
Cisco IOS Zone-Based Firewall Feature Security Bypass (CSCun94946)
According to its self-reported version, the Cisco IOS software running on the remote device is affected by a security bypass vulnerability in the Zone-Based Firewall feature due to insufficient zone checking for traffic belonging to existing sessions. An unauthenticated, remote attacker can explo...
Cisco IOS-XE Zone-Based Firewall Feature Security Bypass (CSCun96847)
According to its self-reported version, the Cisco IOS-XE software running on the remote device is affected by a security bypass vulnerability in the Zone-Based Firewall feature due to insufficient zone checking for traffic belonging to existing sessions. An unauthenticated, remote attacker can...
Elastic Logstash 'CVE-2014-4326' RCE Vulnerability
Elastic Logstash is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
OracleVM 3.2 : libxml2 (OVMSA-2016-0063)
The remote OracleVM system is missing necessary patches to address critical security updates : - Add libxml2-enterprise.patch - Replaced doc/redhat.gif in tarball with updated image - CVE-2014-3660 denial of service via recursive entity expansion rhbz1161841 - fixed one regexp bug and added a...
OracleVM 3.2 : openssl (OVMSA-2016-0071)
The remote OracleVM system is missing necessary patches to address critical security updates : - To disable SSLv2 client connections create the file /etc/sysconfig/openssl-ssl-client-kill-sslv2 John Haxby orabug 21673934 - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - f...
OracleVM 3.2 : bind (OVMSA-2016-0055)
The remote OracleVM system is missing necessary patches to address critical security updates : - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite - Fix CVE-2016-1285, CVE-2016-1286 - Fix CVE-2015-8704 - Fix CVE-2015-8000 - Fix CVE-2015-5722 - Fix CVE-2015-5477 - Remove...
OracleVM 3.2 : sudo (OVMSA-2016-0079)
The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-277...
SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1581-1)
This update for php53 fixes the following issues : - CVE-2016-5093: A geticuvalueinternal out-of-bounds read could crash the php interpreter bsc982010 - CVE-2016-5094,CVE-2016-5095: Don't allow creating strings with lengths outside int range, avoids overflows bsc982011,bsc982012 - CVE-2016-5096: ...
SUSE SLES10 Security Update : Xen (SUSE-SU-2016:1445-1)
Xen was updated to fix the following security issues : CVE-2016-2841: net: ne2000: infinite loop in ne2000receive bsc969351 CVE-2016-2391: usb: multiple eoftimers in ohci module leads to NULL pointer dereference bsc967101 CVE-2016-2270: x86: inconsistent cachability flags on guest mappings XSA-15...
Mozilla Firefox DLL Hijacking
Hi @ll, should have fixed CVE-2014-1520 in Mozilla's executable installers for Windows ... but does NOT! JFTR: this type of vulnerability really: a bloody stupid trivial beginner's error! is well-known and well-documented as . Proof of concept/demonstration: 0. download "Firefox Setup Stub...
F5 Networks BIG-IP : OpenSSH vulnerabilities (K15780)
CVE-2014-2653 The verifyhostkey function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. CVE-2014-2532 sshd in OpenSSH before 6.6 does not properly support wildcards on...