CVE-2016-6722

An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is...

CVE-2016-6712

A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the...

Denial of service

A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the...

2016 年 12 月のセキュリティ情報 (月例) - MS16-144 ～ MS16-155

2016 年 12 月 14 日 日本時間、マイクロソフトは計 12 件 緊急 6 件、重要 6 件 の新規セキュリティ情報を公開し...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3651)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3651 advisory. - sctp: validate chunk len before actually using it Marcelo Ricardo Leitner Orabug: 25142879 CVE-2016-9555 Tenable has extracted the preceding...

Design/Logic Flaw

The kexinputkexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service memory consumption by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."...

USN-3154-1: OpenJDK 6 vulnerabilities

It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. CVE-2016-5542 It was discovered that the JMX component of OpenJDK did not...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3648)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3648 advisory. - mpi: Fix NULL ptr dereference in mpipowm ver 3 Andrey Ryabinin Orabug: 25154096 CVE-2016-8650 CVE-2016-8650 - sctp: validate chunk len before...

CentOS Update for sudo CESA-2016:2872 centos6

Check the version of sudo SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882609";...

Ubuntu: Security Advisory (USN-3154-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for sudo RHSA-2016:2872-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 / 7 : sudo (RHSA-2016:2872)

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Threat Outbreak Alert RuleID26750: Email Messages Distributing Malicious Software on December 6, 2016

Medium Alert ID: 50991 First Published: 2016 December 6 16:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26750 may contain the following files: Name |...

Threat Outbreak Alert RuleID26749: Email Messages Distributing Malicious Software on December 6, 2016

Medium Alert ID: 50990 First Published: 2016 December 6 16:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26749 may contain the following files: Name |...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-2843)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-2843 advisory. 45.5.1-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 45.5.1-1 - Updat...

VMware vRealize Operations Manager ver 6.x < 6.40 Suite API CollectorHttpRelayController RelayRequest Object DiskFileItem Deserialization DoS

The version of VMware vRealize Operations vROps Manager running on the remote web server is 6.x prior to 6.40. It is, therefore, affected by a flaw in the Suite API CollectorHttpRelayController component due to improper validation of DiskFileItem objects stored in the 'relay-request' XML before...

Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2016-2825)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-2825 advisory. 45.5.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 45.5.0-1 - Update to 45.5.0 Tenable has extracted t...

CentOS 6 / 7 : expat (CESA-2016:2824)

An update for expat is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CentOS Update for memcached CESA-2016:2820 centos6

Check the version of memcached SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882601";...

CVE-2016-8608

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before...