Design/Logic Flaw

TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute...

Fedora 22 : qemu-2.3.0-5.fc22 (2015-9601)

CVE-2015-4037: insecure temporary file use in /net/slirp.c bz 1222894 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

SUSE-RU-2015:1239-1 Recommended update for freetype2

This update of freetype2 fixes a regression introduced by the security fix for CVE-2014-9671. This is not itself a security issue, it just improves on a previous one. This update is needed for LSB 5 fontconfig usage...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3043)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3043 advisory. - x8664, vdso: Fix the vdso address randomization algorithm Andy Lutomirski Orabug: 21226731 CVE-2014-9585 - isofs: Fix infinite looping over CE...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3042)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3042 advisory. - x8664, vdso: Fix the vdso address randomization algorithm Andy Lutomirski Orabug: 21226730 CVE-2014-9585 - isofs: Fix infinite looping over CE...

CentOS Update for kmod-kvm CESA-2015:1003 centos5

Check the version of kmod-kvm SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882193";...

CentOS Update for xen CESA-2015:1002 centos5

Check the version of xen SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882182";...

CentOS Update for firefox CESA-2015:0988 centos5

Check the version of firefox SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882180";...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

pipe inatomic

The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or possibly gain privileges via a...

Low: Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 5

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.1, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server...

CentOS 5 : kernel (CESA-2015:1042)

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

RHEL 5 : kernel (RHSA-2015:1042)

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

One class to rule them all

This vulnerability allows for arbitrary code execution in the context of many apps and services and results in elevation of privileges. There is a Proof-of-Concept exploit against the Google Nexus 5 device, that achieves code execution inside the highly privileged systemserver process, and then...

AIX NAS Advisory : nas_advisory3.asc

The version of the Network Authentication Service NAS installed on the remote AIX host is affected by the following vulnerabilities related to Kerberos 5 : - Denial of service and remote code execution vulnerabilities exist due to security context handles not being properly maintained, allowing a...

CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

CVE-2015-2694

MIT Kerberos 5 (krb5) 1.12.x and 1.13.x prior to 1.13.2 are vulnerable due to the kdcpreauth modules (OTP and PKINIT) not tracking client validation, enabling a remote attacker to bypass requires_preauth by submitting zero bytes or an arbitrary realm name. This can lead to obtaining a ciphertext ...

CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...