Fedora 23 : 1:tomcat (2016-4094bd4ad6) (httpoxy)

This updates includes a rebase from tomcat 8.0.36 up to 8.0.38 which resolves multiple CVEs and a problem that 8.0.37 introduces to freeipa : - rhbz1375581 - CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - rhbz1390532 - CVE-2016-0762 CVE-2016-50...

SOL65230547 - Apache Tomcat vulnerabilities CVE-2016-5018, CVE-2016-6794, and CVE-2016-6796

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Important: tomcat6, tomcat7, tomcat8

Issue Overview: It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges...

CVE-2016-5018

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

CVE-2015-5018

IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface LMI access...

CVE-2015-5018

CVE-2015-5018 affects IBM Security Access Manager for Web (ISAM) on Web-based appliances: versions 7.0 before FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 are vulnerable to a command-injection via Local Management Interface (LMI) that enables remote authenticated users to execute arbi...

Oracle: Security Advisory (ELSA-2008-0978)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 201309-02

Gentoo Linux Local Security Checks GLSA 201309-02 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

CVE-2014-5018

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

Fedora Update for strongswan FEDORA-2014-5238

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for strongswan FEDORA-2014-0567

Check for the Version of strongswan OpenVAS Vulnerability Test Fedora Update for strongswan FEDORA-2014-0567 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for strongswan FEDORA-2014-0567

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.2 / 11.3 Security Update : strongswan (SAT Patch Numbers 8488 / 8489)

This strongswan update fixes security issues and bugs : - Specially crafted XAuth usernames and EAP identities could cause a crash in strongswan. CVE-2013-5018 - A crafted ID packet can be used by remote attackers to crash the server or potentially gain authentication privileges under certain...

CVE-2013-5018

CVE-2013-5018 affects strongSwan (versions 4.1.11–5.0.4) where the is_asn1() function fails to validate the return value of asn1_length, allowing a remote attacker to trigger a denial of service (segmentation fault) via crafted inputs such as an XAuth username, an EAP identity, or a PEM file begi...

Fedora Update for strongswan FEDORA-2013-14481

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for strongswan FEDORA-2013-14510

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 18 : strongswan-5.1.0-2.fc18 (2013-14510)

rhbz981429: New upstream release Fixes CVE-2013-5018: rhbz991216, rhbz991215 Fixes rhbz991859 failed to build in rawhide Updated local patches and removed which are not needed Fixed errors around charon-nm Added plugins libstrongswan-pkcs12.so, libstrongswan-rc2.so, libstrongswan-sshkey.so Added...

Fedora 19 : strongswan-5.1.0-1.fc19 (2013-14481)

rhbz981429: New upstream release Fixes CVE-2013-5018: rhbz991216, rhbz991215 Fixes rhbz991859 failed to build in rawhide Updated local patches and removed which are not needed Fixed errors around charon-nm Added plugins libstrongswan-pkcs12.so, libstrongswan-rc2.so, libstrongswan-sshkey.so Added...

Security fix for the ALT Linux 7 package strongswan version 5.1.0-alt1

Aug. 7, 2013 Michael Shigorin 5.1.0-alt1 - 5.1.0: CVE-2013-5018 fix charon DoS, see also http://www.strongswan.org/blog/2013/08/01/...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2008-0017, CVE-2008-5013, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017,...