Ubuntu 14.04 LTS : Apport vulnerability (USN-2782-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2782-1 advisory. Gabriel Campana discovered that Apport incorrectly handled Python module imports. A local attacker could use this issue to elevate privileges. Tenable has extract...

Updated arj packages fix security vulnerabilities

Updated arj package fixes security vulnerabilities: ARJ follows symlinks when unpacking stuff, even the symlinks that were created during the same unpack process, making it vulnerable to a directory traversal CVE-2015-0556. To protect from directory traversals, ARJ strips leading slash from the...

Mandriva Linux Security Advisory : arj (MDVSA-2015:201)

Multiple vulnerabilities has been found and corrected in arj : Jakub Wilk discovered that arj follows symlinks created during unpacking of an arj archive. A remote attacker could use this flaw to perform a directory traversal attack if a user or automated system were tricked into processing a...

Fedora Update for arj FEDORA-2015-5603

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-188-1 arj - security update

Bulletin has no description...

KLA10539 Multiple vulnerabilities in Open-source ARJ archiver

Buffer overflow, improper strings restriction and other unknown vulnerabilities were found in Open-source ARJ archiver. By exploiting these vulnerabilities malicious users can cause denial of service, execute arbitrary code or write to arbitrary local files. These vulnerabilities can be exploited...

[SECURITY] [DSA 3213-1] arj security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3213-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 06, 2015 http://www.debian.org/security/faq -...

Debian DSA-3213-1 : arj - security update

Multiple vulnerabilities have been discovered in arj, an open source version of the arj archiver. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-0556 Jakub Wilk discovered that arj follows symlinks created during unpacking of an arj archive. A remo...

[SECURITY] [DSA 3213-1] arj security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3213-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 06, 2015 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3213-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Internet Explorer Use After Free (CVE-2014-2782)

A memory corruption vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error while handling certain objects when processing HTML and script code. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a...

CVE-2014-2782

Microsoft Internet Explorer 9–11 is affected by CVE-2014-2782 (Memory Corruption via crafted web content). The vulnerability is described as a use-after-free/memory corruption issue arising when IE processes certain HTML/script handling, enabling remote code execution or a memory corruption-based...

Debian DSA-2782-1 : polarssl - several vulnerabilities

Multiple security issues have been discovered in PolarSSL, a lightweight crypto and SSL/TLS library : - CVE-2013-4623 Jack Lloyd discovered a denial of service vulnerability in the parsing of PEM-encoded certificates. - CVE-2013-5914 Paul Brodeur and TrustInSoft discovered a buffer overflow in th...

CVE-2013-2782

CVE-2013-2782 affects Schneider Electric Trio J-Series License Free Ethernet Radio firmware 3.6.0–3.6.3, where the AES encryption key is reused across different customer installations due to improper key generation. This weakens cryptographic protection and could allow remote attackers to access ...

Schneider Electric Trio J-Series Radio Encryption

OVERVIEW Schneider Electric has self-reported a hard-coded encryption key vulnerability in Schneider Electric’s J-Series Radios. Schneider Electric has produced a patch that mitigates this vulnerability and has published a customer security notification.Schneider Electric Cybersecurity...

CVE-2012-2782

CVE-2012-2782 is described in FFmpeg as an unspecified vulnerability in decode_slice_header (libavcodec/h264.c) for FFmpeg before 0.11, with unknown impact and attack vectors and related to a “rejected resolution change.” The connected sources confirm the affected component, and identify no expli...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

Google Fixes 30 Bugs in Chrome, Pays $17K in Bounties

Google has fixed 30 bugs in version 13.0.782.107, the latest build of its Chrome browser, pushed to the stable channel for Windows, Mac and Linux today. 14 of the bugs are deemed high-risk, including cross-origin script injection, HTML range handling and URI handling issues. Nine of the bugs are...

CVE-2009-2782

CVE-2009-2782 is a SQL injection vulnerability affecting the Joomla! JFusion (com_jfusion) component. The issue allows remote attackers to manipulate the database by injecting arbitrary SQL through the Itemid parameter sent to index.php. Public references note exploitation activity (e.g., exploit...