Slackware 14.2 / current : libssh2 (SSA:2019-077-01)

New libssh2 packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-077-01. The text itself is copyright C Slackware Linux, Inc...

[slackware-security] libssh2

New libssh2 packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libssh2-1.8.1-i586-1slack14.2.txz: Upgraded. Fixed several security issues. For more information, see:...

Ubuntu 16.04 LTS / 18.04 LTS : PEAR vulnerability (USN-3857-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3857-1 advisory. Fariskhi Vidyan discovered that PEAR ArchiveTar incorrectly handled certain archive paths. A remote attacker could possibly use this issue to execute...

Heap overflow

An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and...

CVE-2018-3857

Canvas Draw 4.0.0 contains a heap-based buffer overflow in TIFF parsing that allows overwriting memory and executing code when processing a crafted TIFF image. This is the core issue described across multiple sources (e.g., CNVD entries) linking to CVE-2018-3857. Practical impact: attacker-suppli...

Debian DSA-3857-1 : mysql-connector-java - security update

Two vulnerabilities have been found in the MySQL Connector/J JDBC driver. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3857. The text itself is copyright C Software in the Public...

Debian: Security Advisory (DSA-3857-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-3857

CVE-2017-3857 is a DoS vulnerability in Cisco IOS (12.0–12.4, 15.0–15.6) and IOS XE (3.1–3.18) caused by improper validation in the Layer 2 Tunneling Protocol (L2TP) parsing function. An unauthenticated, remote attacker can send crafted L2TP packets to trigger a device reload when the L2TP featur...

[SECURITY] [DLA 609-1] linux security update

Package : linux Version : 3.2.81-2 CVE ID : CVE-2016-3857 CVE-2016-4470 CVE-2016-5696 CVE-2016-5829 CVE-2016-6136 CVE-2016-6480 CVE-2016-6828 CVE-2016-7118 Debian Bug : 827561 This update fixes the CVEs described below. CVE-2016-3857 Chiachih Wu reported two bugs in the ARM OABI compatibility lay...

CVE-2016-3857

The kernel in Android before 2016-08-05 on Nexus 7 2013 devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518...

CVE-2016-3857

CVE-2016-3857 is an Android/Linux kernel privilege-escalation flaw in the ARM OABI compatibility layer present on Nexus 7 (2013) devices prior to 2016-08-05. The issue arises from two bugs in the ARM OABI area that can let local attackers escalate privileges via a crafted app (internal bug 285225...

CVE-2016-3857

The kernel in Android before 2016-08-05 on Nexus 7 2013 devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518...

Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description: Kerio Control brings together multiple capabilities including a network firewall and router, intrusion...

Kerio Control 8.3.1 - Blind SQL Injection Vulnerability

Kerio Control versions 8.3.1 and below suffer from a boolean-based blind remote SQL injection vulnerability. Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description...

CVE-2014-3857

Kerio Control (formerly WinRoute Firewall) prior to 8.3.2 contains a boolean‑based blind SQL injection in the print.php handler used by Kerio Control Statistics. The vulnerability is exploitable via the x_16 and x_17 parameters, and requires a valid client session (remote, authenticated access is...

Kerio Control 8.3.1 - Blind SQL Injection

Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description: Kerio Control brings together multiple capabilities including a network firewall and router, intrusion...

Kerio Control 8.3.1 Blind SQL Injection

Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description: Kerio Control brings together multiple capabilities including a network firewall and router, intrusion...

MS13-072: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537)

The remote Windows host is running a version of Microsoft Office, Microsoft Word, Office Compatibility Pack, or Microsoft Word Viewer that is affected by the following remote code execution vulnerabilities : - A remote code execution vulnerability exists due to the way the XML parser used by Word...

MS13-067: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2834052)

The versions of Office SharePoint Server, SharePoint Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple vulnerabilities : - A denial of service vulnerability exits that could cause the W3WP process to stop respondin...

CVE-2011-3857

CVE-2011-3857 affects the Antisnews WordPress theme prior to 1.10. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary script/HTML via the s parameter. Exploitation details are consistent across sources: vulnerable component is the Antisnews the...