DSA-2500-1 mantis - several

Bulletin has no description...

openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:0553-1)

icedtea included in java-160-openjdk was updated to version 1.8.1 which fixes two security issues : CVE-2010-2783: IcedTea 'Extended JNLP Services' arbitrary file access CVE-2010-2548: IcedTea Incomplete property access check for unsigned applications The new version also fixes many non-security...

USN-971-1: OpenJDK vulnerabilities

It was discovered that the IcedTea plugin did not correctly check certain accesses. If a user or automated system were tricked into running a specially crafted Java applet, a remote attacker could read arbitrary files with user privileges, leading to a loss of privacy. CVE-2010-2548, CVE-2010-278...

CVE-2010-2353

The Node Reference module in Content Construction Kit CCK module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes...

Design/Logic Flaw

The Node Reference module in Content Construction Kit CCK module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes...

CVE-2010-2352

The Node Reference module in Content Construction Kit CCK module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes...

CVE-2010-2353

CVE-2010-2353 affects the Drupal Content Construction Kit (CCK) Node Reference module for Drupal 6.x prior to 6.x-2.7. The backend URL used by the autocomplete widget does not perform field‑level access checks on the source field, allowing remote attackers to discover titles and IDs of nodes the ...

CVE-2010-2352

CVE-2010-2352 affects the Drupal Content Construction Kit (CCK) Node Reference module. The Node Reference feature in CCK 5.x (before 5.x-1.11) and 6.x (before 6.x-2.7) fails to perform access checks when displaying referenced nodes, enabling remote attackers to read nodes they should not access. ...

Fedora 10 : libvirt-0.5.1-2.fc10 (2008-11443)

fix missing read-only access checks, fixes CVE-2008-5086 - upstream release 0.5.1 - mostly bugfixes e.g 473071 - some driver improvements Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

[SECURITY] [DSA 1754-1] New roundup packages fix privilege escalation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1754-1 [email protected] http://www.debian.org/security/ Florian Weimer April 09, 2009 http://www.debian.org/security/faq -...

Debian DSA-1754-1 : roundup - insufficient access checks

It was discovered that roundup, an issue tracker with a command-line, web and email interface, allows users to edit resources in unauthorized ways, including granting themselves admin rights. This update introduces stricter access checks, actually enforcing the configured permissions and roles...

[SECURITY] [DSA 1754-1] New roundup packages fix privilege escalation

------------------------------------------------------------------------ Debian Security Advisory DSA-1754-1 [email protected] http://www.debian.org/security/ Florian Weimer April 09, 2009 http://www.debian.org/security/faq -...

Fedora 9 : libvirt-0.5.1-2.fc9 (2008-11433)

fix missing read-only access checks, fixes CVE-2008-5086 - upstream release 0.5.1 - mostly bugfixes e.g 473071 - some driver improvements Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

CVE-2008-4153

The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying comments, which allows remote attackers to obtain sensitive information...

Information disclosure

The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying comments, which allows remote attackers to obtain sensitive information...

CVE-2008-2771

The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors...

CVE-2008-2771

The CVE-2008-2771 issue affects the Drupal Node Hierarchy module (5.x up to 5.x-1.1 and 6.x up to 6.x-1.0). The root cause is that access checks are not properly enforced, allowing remote attackers with the “access content” permission to bypass restrictions and modify the node hierarchy through u...

CVE-2008-2771

The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors...

Fedora 8 : horde-3.1.6-1.fc8 / imp-4.1.6-1.fc8 / turba-2.1.7-1.fc8 (2008-2087)

Bug 428625 - CVE-2007-6018 horde: input validation vulnerabilities - Bug 432027 - CVE-2008-0807 turba: insufficient access checks Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

[SECURITY] [DSA 1494-2] New linux-2.6 packages fix privilege escalation

---------------------------------------------------------------------- Debian Security Advisory DSA-1494-2 [email protected] http://www.debian.org/security/ Florian Weimer, dann frazier February 12, 2008 http://www.debian.org/security/faq -...