Debian DSA-3726-1 : imagemagick - security update

Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include several problems in memory handling that can result in a denial of service attack or in execution of arbitrary code by an attacker with control on the image...

CVE-2016-6723

A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as...

Remote code execution

A remote code execution vulnerability in an Android runtime library in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker using a specially crafted payload to execute arbitrary code in the context of an unprivileged process. This...

Remote code execution

A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a remote attacker to execute arbitrary code when the user is navigating to a website. This issue is rated as High due to the possibility of remote code...

CVE-2016-6717

CVE-2016-6717 corresponds to an elevation-of-privilege in Android’s Mediaserver. A local malicious app could execute code in a privileged process due to memory/parameter handling in Mediaserver when processing media data. Affected Android versions span 4.x up to 7.0 (pre-2016-11-01 and pre-2016-1...

CVE-2016-6703

CVE-2016-6703 describes a remote code execution vulnerability in the Android runtime library (ART). Affected Android releases include 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; and 6.x before 2016-11-01. An attacker could supply a specially crafted payload to execute arbitrary code...

CVE-2016-6724

A denial of service vulnerability in the Input Manager Service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to cause the device to continually reboot. This issue is rated as Moderat...

CVE-2016-9635

Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. Mitigation This...

CVE-2016-9636

Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. Mitigation This...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2016-3646)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3646 advisory. - aacraid: Check size values after double-fetch from user Dave Carroll Orabug: 25060055 CVE-2016-6480 CVE-2016-6480 - audit: fix a double fetch in...

GLSA-201611-14 : MIT Kerberos 5: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201611-14 MIT Kerberos 5: Multiple vulnerabilities Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly cause a...

CentOS Update for java CESA-2016:2658 centos5

Check for the Version of java SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882600";...

DCFM Blog 0.9.7 Blind SQL Injection Vulnerability

DCFM Blog version 0.9.7 suffers from a remote blind SQL injection vulnerability. DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Description ============ Open-source blog project. Free blo...

DCFM Blog 0.9.7 Cross Site Scripting Vulnerability

DCFM Blog version 0.9.7 suffers from a cross site scripting vulnerability. DCFM Blog 0.9.7 XSS Attack =========================== Description ============ Open-source blog project. Free blog system for any website. Uses MySQL and PHP 5. Very easily customizable and incredibly flexible...

DCFM Blog 0.9.7 Blind SQL Injection

DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog...

DCFM Blog 0.9.7 Cross Site Scripting

DCFM Blog 0.9.7 XSS Attack =========================== Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog system for any website. Uses MySQL and PHP 5. Very easily customizable and incredibly flexible...

Internet Bug Bounty: Illegal write/read access caused by gdImageAALine overflow

Upstream Bug --- https://bugs.php.net/bug.php?id=72482 Summary --- Ilegal write/read access at gdImageSetAAPixelColor caused by gdImageAALine overflow. gdImageAALine tries to clip the limit values and fails because an integer overflow occurs while calculating the new line limits. PHP 5 is affecte...

RHEL 5 / 6 : flash-plugin (RHSA-2016:2676)

An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

Eir D1000 Wireless Router - WAN Side Remote Command Injection (Metasploit) Exploit

Exploit for hardware platform in category remote exploits Exploit Title: Eir D1000 Wireless Router - WAN Side Remote Command Injection Date: 7th November 2016 Exploit Author: Kenzo Website: https://devicereversing.wordpress.com Tested on Firmware version: 2.00AADU.520150909 Type: Webapps Platform...

CentOS Update for bind CESA-2016:2141 centos5

Check the version of bind SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882587";...