CentOS 7 : autofs (CESA-2015:2417)

Updated autofs packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

openSUSE Security Update : znc (openSUSE-2015-845)

Znc was updated to 1.6.2 to fix one security issue. The following vulnerability was fixed : - CVE-2014-9403: Remote unauthenticated users could cause denial of service via channel creation. boo956254 Also contains all bug fixes in the 1.6.2 release. %NASLMINLEVEL 70300 C Tenable Network Security,...

CentOS 7 : cpio (CESA-2015:2108)

Updated cpio packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CentOS 7 : unbound (CESA-2015:2455)

Updated unbound packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Advantech Switch Bash Environment Variable Code Injection Shellshock', 'Description' = %q This module exploits the Shellshock...

CentOS 7 : ntp (CESA-2015:2231)

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

SUSE SLED11 Security Update : cabextract (SUSE-SU-2015:2131-1)

This security update fixes the following issues : - Fix possible infinite loop caused DoS bsc919283, CVE-2014-9556 - Fix zero dereference bsc934524, CVE-2014-9732 - Fix off by one bsc934527, CVE-2015-4470 - Fix buffer under-read crash bsc934528, CVE-2015-4471 Note that Tenable Network Security ha...

Advantech Switch Bash Environment Variable Code Injection (Shellshock)

This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets the 'ping.sh' CGI script, accessible through the Boa web server on Advantech switches. This module was tested against firmware version 1322D1.98. Module...

Debian DLA-356-1 : libsndfile security update

CVE-2014-9496 The sd2parsersrcfork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a 1 map offset or 2 rsrc marker, which triggers an out-of-bounds read. CVE-2014-9756 The psffwrite function in fileio.c in libsndfile allows attackers to cause a...

[SECURITY] [DLA 357-1] libphp-snoopy security update

Package : libphp-snoopy Version : 2.0.0-1deb6u1 CVE ID : CVE-2008-7313 CVE-2014-5008 Debian Bug : 778634 It was discovered that missing input sanitizing in Snoopy, a PHP class that simulates a web browser may result in the execution of arbitrary commands. For the oldoldstable distribution...

python, tkinter security update

CentOS Errata and Security Advisory CESA-2015:2101 Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...

krb5 security update

CentOS Errata and Security Advisory CESA-2015:2154 Updated krb5 packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabili...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2015:2152 Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 7. This is the second...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2015:2159 Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...

openSUSE Security Update : libsndfile (openSUSE-2015-820)

The libsndfile package was updated to fix the following security issue : - CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service DoS bsc953521. - CVE-2015-7805: Fixed heap overflow issue bsc953516. - CVE-2015-8075: Fixed heap overflow issue bsc953519. %NASLMINLEVEL...

Oracle Linux 7 : tigervnc (ELSA-2015-2233)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2233 advisory. - Resolves: bz1248422 CVE-2014-8240 CVE-2014-8241 tigervnc: various flaws Tenable has extracted the preceding description block directly from the Oracl...

Schneider Electric Invensys Positioner Buffer Overflow Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a buffer overflow security vulnerability in the DTM Device Type Manager software for Schneider Electric’s Invensys SRD Control Valve Positioner product line. Schneider Electric has produced a new version that mitigates this vulnerability...

Updated tigervnc packages fix security vulnerabilities

Updated tigervnc packages fix security vulnerabilities: An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way TigerVNC handled screen sizes. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code on the clien...

CVE-2014-3665

Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave...

CVE-2014-3665

CVE-2014-3665 affects Jenkins before 1.587 and LTS before 1.580.1, where trust separation between master and slaves is not properly enforced. This could allow remote attackers to execute arbitrary code on the Jenkins master by exploiting access to a slave. The issue is documented across multiple ...