USN-2607-1: Module::Signature vulnerabilities

John Lightsey discovered that Module::Signature incorrectly handled PGP signature boundaries. A remote attacker could use this issue to trick Module::Signature into parsing the unsigned portion of the SIGNATURE file as the signed portion. CVE-2015-3406 John Lightsey discovered that...

[USN-2607-1] Module::Signature vulnerabilities

========================================================================== Ubuntu Security Notice USN-2607-1 May 12, 2015 libmodule-signature-perl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

CVE-2015-3408

Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest...

CVE-2014-3408

Cross-site scripting XSS vulnerability in the web framework in Cisco Prime Optical 10 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq80763...

CVE-2014-3408

Cisco Prime Optical 10’s web framework is affected by CVE-2014-3408, a reflected XSS in the web framework via an unspecified parameter (Bug ID CSCuq80763). The NVD entry lists a CVSSv2 base score of 6.8 (Network, medium complexity, no auth, partial impacts). Cisco’s advisory states that software ...

CVE-2013-3408

The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to gain privileges via an unspecified sequence of commands, aka Bug ID CSCuc31764...

Fedora Update for puppet FEDORA-2012-10891

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

DEBIAN-CVE-2012-3408

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

CVE-2012-3408

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

CVE-2012-3408

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

CVE-2011-3408

Csrsrv.dll in the Client/Server Run-time Subsystem aka CSRSS in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly check permissions for sending inter-process...

Windows Client/Server Run-time Subsystem Privilege Elevation Vulnerability (2620712)

This host is missing an important security update according to Microsoft Bulletin MS11-097. OpenVAS Vulnerability Test $Id: secpodms11-097.nasl 5362 2017-02-20 12:46:39Z cfi $ Windows Client/Server Run-time Subsystem Privilege Elevation Vulnerability 2620712 Authors: Rachana Shetty Copyright:...

CVE-2011-3408

CVE-2011-3408 describes a local privilege-escalation vulnerability in the Windows Client/Server Run-time Subsystem (CSRSS). Csrsrv.dll in CSRSS fails to properly check permissions when a lower-integrity process sends inter-process device-event messages to a higher-integrity process, allowing a lo...

Fedora 15 : wordpress-3.1-1.fc15 (2011-3408)

Update to 3.1 to fix multiple vulnerabilities and track upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2009-3408

CVE-2009-3408 is an Oracle E-Business Suite vulnerability affecting the Oracle Application Object Library in EBS 11.5.10. The connected Oracle Critical Patch Update (October 2009) entry shows this CVE in the Oracle E-Business Suite Risk Matrix with: HTTP as the affected protocol, remote exploitat...

CVE-2009-1437

Stack-based buffer overflow in PortableApps CoolPlayer Portable aka CoolPlayer+ Portable 2.19.6 and earlier allows remote attackers to execute arbitrary code via a long string in a malformed playlist .m3u file. NOTE: this may overlap CVE-2008-3408...

CVE-2009-1437

The CVE-2009-1437 issue affects PortableApps CoolPlayer Portable (CoolPlayer+ Portable) up to version 2.19.6 and earlier, where a stack-based buffer overflow in handling .m3u playlist files allows remote code execution via a crafted long string in the playlist. Root cause is a boundary error whil...

CoolPlayer m3u playlist processing filename buffer overflow

Added: 08/13/2008 CVE: CVE-2008-3408 BID: 30418 OSVDB: 47194 Background CoolPlayer is a free audio player for Windows platforms. Problem A buffer overflow vulnerability in CoolPlayer allows command execution when a user opens an m3u playlist file containing a specially crafted filename. Resolutio...

CoolPlayer m3u playlist processing filename buffer overflow

Added: 08/13/2008 CVE: CVE-2008-3408 BID: 30418 OSVDB: 47194 Background CoolPlayer is a free audio player for Windows platforms. Problem A buffer overflow vulnerability in CoolPlayer allows command execution when a user opens an m3u playlist file containing a specially crafted filename. Resolutio...

CVE-2008-3408

CoolPlayer contains a stack-based buffer overflow in m3u playlist handling (filename processing) affecting CoolPlayer 2.18 and potentially other versions. A remote attacker could execute arbitrary code by opening a crafted .m3u file; exploitation relies on the user opening the exploit file and wo...