Fedora Update for python3 FEDORA-2014-14257

Check the version of python3 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868482";...

Fedora 20 : python3-3.3.2-18.fc20 (2014-14245)

Fix for CVE-2014-4650: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs. Fix for CVE-2014-4650 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

Fedora 20 : python-2.7.5-15.fc20 (2014-14227)

Fix for CVE-2014-4650: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much...

Fedora Update for python FEDORA-2014-14227

Check the version of python SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868463";...

Amazon Linux AMI : python27 (ALAS-2014-440)

It was discovered that Python built-in module CGIHTTPServer does not properly handle URL-encoded path separators in URLs which may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root. CVE-2014-4650 Integer overflow in bufferobject.c i...

Medium: python27

Issue Overview: It was discovered http://bugs.python.org/issue21766 that Python built-in module CGIHTTPServer does not properly handle URL-encoded path separators in URLs which may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root...

[RT-SA-2014-008] Python CGIHTTPServer File Disclosure and Potential Code Execution

Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...

openSUSE Security Update : python3 (openSUSE-SU-2014:1070-1)

This python3 update fixes the following security and non security issues : - CGIHTTPServer filedisclosure and directory traversal through URL-encoded characters CVE-2014-4650, bnc885882 - DoS on ssl.matchhostname via a crafted certificate with too many wildcards CVE-2013-2099, bnc886001 - fix...

openSUSE Security Update : python3 (openSUSE-SU-2014:1042-1)

This python3 update fixes the following security and non security issues : - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters CVE-2014-4650, bnc885882 - fix importfailed hook file names %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

SuSE 11.3 Security Update : Python (SAT Patch Number 9581)

This update for Python provides fixes for the following issues : - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters. CVE-2014-4650 - The 'urlparse' module has been updated to correctly parse IPv6 addresses. bnc872848 - Correctly enable IPv6 support. %NASLMINLEV...

Updated python & python3 packages fix two vulnerabilities

Updated python and python3 packages fix security vulnerabilities: Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value tha...

Python CGIHTTPServer Encoded Path Traversal Vulnerability

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root. The CGIHTTPServer Python module does not properly handle URL-encoded path...

Python CGIHTTPServer - Encoded Directory Traversal

Python CGIHTTPServer - Encoded Directory Traversal Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute...

Python CGIHTTPServer - Encoded Directory Traversal

Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...

Python CGIHTTPServer File Disclosure / Code Execution

Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...

CVE-2014-4650

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as...

openSUSE Security Update : kernel (openSUSE-SU-2011:0416-1)

The openSUSE 11.4 kernel was updated to 2.6.37.6 fixing lots of bugs and security issues. Following security issues have been fixed: CVE-2011-1493: In the rose networking stack, when parsing the FACNATIONALDIGIS facilities field, it was possible for a remote host to provide more digipeaters than...

MongoDB < 2.4.5 / 2.5.1 Multiple Vulnerabilities

The version of the remote MongoDB server is a version prior to version 2.4.5 / 2.5.1. It is, therefore, potentially affected by the following vulnerabilities : - A remote attacker can gain elevated privileges when authenticating as the internal system user name for arbitrary databases...

CVE-2013-4650

MongoDB versions affected are 2.4.x before 2.4.5 and 2.5.x before 2.5.1. The issue allows remote authenticated users to obtain internal system privileges by using the __system username in an arbitrary database. This is a privilege-escalation vulnerability with impact as described in the sources. ...

CVE-2010-4650

The CVE-2010-4650 issue affects the Linux kernel’s fuse_do_ioctl in fs/fuse/file.c, where a buffer overflow could be exploited by a CUSE server to achieve local denial of service or potential other impact. Multiple connected sources confirm a fix in kernel 2.6.37 and note that exploitation requir...