109 matches found
CVE-2012-3462
SSSD 1.9.0 contains a logic flaw in its access-provider path where HBAC rule results are ignored if the access-provider also sets the user’s SELinux context. Affected component: SSSD HBAC/access-provider integration. Impact described: incorrect HBAC evaluation under scenarios where SELinux user c...
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...
CVE-2019-3462
CVE-2019-3462 affects apt 1.4.8 and earlier due to incorrect sanitation of the 302 redirect field in the HTTP transport, enabling content injection by a MITM attacker and potentially leading to remote code execution. Public docs confirm the flaw is in apt’s redirect handling and that exploitation...
Advanced Package Tool Remote Code Execution (CVE-2019-3462)
A remote code execution vulnerability exists in Advanced Package Tool. The vulnerability is due to lack of sanitation on Location headers in HTTP responses. Successful exploitation could result in installation and execution of altered packages...
Exploit for CVE-2019-3462
Check @Debia...
USN-3863-1: APT vulnerability | Cloud Foundry
Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Max Justicz discovered that APT incorrectly handled certain parameters during redirects. If a remote attacker were able to perform a man-in-the-middle attack,...
CVE-2019-3462
creationtimestamp| type| source ---|---|--- 2019-01-22 17:40:03+00:00| seen| https://t.me/canyoupwnme/5039 2019-01-23 08:41:50+00:00| seen| https://t.me/thehackernews/178 2019-01-23 11:22:52+00:00| seen| https://t.me/SecLabNews/4085 2019-01-31 10:11:02+00:00| published-proof-of-concept|...
Critical RCE Flaw in Linux APT Allows Remote Attackers to Hack Systems
Just in time… Some cybersecurity experts this week arguing over Twitter in favor of not using HTTPS and suggesting software developers to only rely on signature-based package verification, just because APT on Linux also does the same. Ironically, a security researcher just today revealed details ...
[SECURITY] [DLA 1637-1] apt security update
Package : apt Version : 1.0.9.8.5 CVE ID : CVE-2019-3462 Debian Bug : Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesnt properly sanitize fields transmitted over the wire. This vulnerability could be...
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...
Debian: Security Advisory (DLA-1637-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 14.04 LTS / 16.04 LTS : Pacemaker vulnerabilities (USN-3462-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3462-1 advisory. Jan Pokorn and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue t...
Important: Red Hat Security Advisory: rh-mysql57-mysql security and bug fix update
An update for rh-mysql57-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2014-3462
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes"...
CVE-2014-3462
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes"...
CVE-2014-3462
The CVE-2014-3462 issue affects encfs before 1.7.5, where the .encfs6.xml configuration file can be manipulated by setting blockMACBytes to 0 and increasing blockMACRandBytes by 8, enabling a remote attacker to access sensitive data. Public reports consistently describe this as a data disclosure ...
CVE-2014-3462
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes"...
Important: mysql56
Issue Overview: Server: Security: Privileges unspecified vulnerability CPU Apr 2017: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easi...
