Debian DLA-831-1 : gtk-vnc security update

Josef Gajdusek discovered two vulnerabilities in gtk-vnc, a VNC viewer widget for GTK : CVE-2017-5884 Fix bounds checking for RRE, hextile & copyrec encodings. This bug allowed a remote server to cause a denial of service by buffer overflow via a carefully crafted message containing subrectangles...

[SECURITY] [DLA 831-1] gtk-vnc security update

Package : gtk-vnc Version : 0.5.0-3.1+deb7u1 CVE ID : CVE-2017-5884 CVE-2017-5885 Debian Bug : 854450 Josef Gajdusek discovered two vulnerabilities in gtk-vnc, a VNC viewer widget for GTK: CVE-2017-5884 Fix bounds checking for RRE, hextile & copyrec encodings. This bug allowed a remote server to...

Updated gtk-vnc packages fix security vulnerability

It was found that gtk-vnc code does not properly check boundaries of subrectangle-containing tiles. A malicious server can use this to overwrite parts of the client memory CVE-2017-5884. In addition, the vncconnectionservermessage and vnccolormapset functions do not check for integer overflow...

Fedora 25 : gtk-vnc (2017-ab04a91edd)

Security fix for CVE-2017-5884, CVE-2017-5885 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CVE-2017-5884

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted 1 rre, 2 hextile, or 3 copyrect tile...

CVE-2017-5884

It was found that gtk-vnc lacked proper bounds checking while processing messages using RRE, hextile, or copyrect encodings. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library...

CVE-2016-5884

IBM iNotes is vulnerable to cross-site scripting in the Web UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The vulnerability is described across multiple sources as an XSS issue in the iNotes component and Domino-related entri...

CVE-2015-5884

CVE-2015-5884 affects Apple OS X Mail’s Mail Drop feature prior to 10.11. The issue is that encryption parameters for attachments in S/MIME mail are mishandled, enabling a remote attacker who can observe traffic to obtain sensitive data when large attachments are transmitted. Affected product/are...

Oracle: Security Advisory (ELSA-2014-0026)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2014-0027)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-283)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-5884

The CVE-2014-5884 entry concerns the 1&1 Online Storage (aka de.einsundeins.smartdrive) Android app version 5.0.11, which fails to verify X.509 certificates when connecting to SSL servers. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cer...

Low: Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4, 5.5, and 5.6. The Red Hat Security Response Team has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0174-1)

Fix a file conflict between -devel and -headless package - Update to 2.4.4 bnc858818 - changed from xz to gzipped tarball as the first was not available during update - changed a keyring file due release manager change new one is signed by 66484681 from [email protected], see...

IBM Domino 9.x < 9.0.1 Fix Pack 1 Multiple Vulnerabilities (uncredentialed check)

According to its version, the IBM Domino formerly IBM Lotus Domino on the remote host is 9.x prior to 9.0.1 Fix Pack 1 FP1. It is, therefore, affected by the following vulnerabilities : - A stack overflow issue exists due to the insecure '-z execstack' flag being used during compilation, which...

USN-2124-2: OpenJDK 6 regression

USN-2124-1 fixed vulnerabilities in OpenJDK 6. Due to an upstream regression, memory was not properly zeroed under certain circumstances which could lead to instability. This update fixes the problem. We apologize for the inconvenience. Original advisory details: A vulnerability was discovered in...

Ubuntu Update for openjdk-6 USN-2124-2

Check for the Version of openjdk-6 OpenVAS Vulnerability Test $Id: gbubuntuUSN21242.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for openjdk-6 USN-2124-2 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Ubuntu Update for openjdk-6 USN-2124-1

Check for the Version of openjdk-6 OpenVAS Vulnerability Test $Id: gbubuntuUSN21241.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for openjdk-6 USN-2124-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2124-1)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit this to expose sensitive data over the network. CVE-2014-0411 Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data...

SuSE 11.3 Security Update : openjdk (SAT Patch Number 8874)

This openjdk update fixes several security issues. For a complete list of fixed vulnerabilities and their description please refer to : http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025 800.html %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...