Ubuntu: Security Advisory (USN-3584-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : sensible-utils vulnerability (USN-3584-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3584-1 advisory. Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker...

USN-3584-1 sensible-utils vulnerability

Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execute arbitrary code...

USN-3584-1: sensible-utils vulnerability

Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execute arbitrary code...

Code injection

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

PT-2018-6666

Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Server versions 5.1.0 through 5.1.7 Atlassian Bitbucket Server versions 5.2.0 through 5.2.5 Atlassian Bitbucket Server versions 5.3.0 through 5.3.3 Atlassian Bitbucket Server versions 5.4.0 through 5.4.1 Description: The...

CVE-2017-18087: Undefined Security Weakness

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

Argument injection in the download commit resource through the at parameter - CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

PT-2018-5684

Name of the Vulnerable Software and Affected Versions: Sourcetree for macOS versions 1.0b2 through 2.7.0 Description: The issue affects the handling of Mercurial and Git repositories in Sourcetree for macOS, allowing an attacker with commit permission to a linked repository to exploit argument an...

PT-2018-5685

Name of the Vulnerable Software and Affected Versions: Sourcetree for Windows versions 0.5.1.0 through 2.4.7.0 excluding 2.4.7.0 Description: The issue affects the handling of Mercurial and Git repositories in Sourcetree for Windows, allowing an attacker with commit permission to a linked...

Atlassian Bamboo Code Execution / Argument Injection Vulnerabilities

Exploit for php platform in category web applications Atlassian Bamboo Code Execution / Argument Injection Vulnerabilities CVE ID: CVE-2017-14589. CVE-2017-14590. Product: Bamboo. Affected Bamboo product versions: version = 6.2.0 but less than 6.2.5 the fixed version for 6.2.x please upgrade your...

PT-2018-19255

Name of the Vulnerable Software and Affected Versions virsh affected versions not specified Description The issue allows the hostname to be crafted maliciously with ssh arguments in virsh, which would then be passed to ssh. Recommendations At the moment, there is no information about a newer...

Debian DSA-4071-1 : sensible-utils - security update

Gabriel Corona reported that sensible-browser from sensible-utils, a collection of small utilities used to sensibly select and spawn an appropriate browser, editor or pager, does not validate strings before launching the program specified by the BROWSER environment variable, potentially allowing ...

[SECURITY] [DSA 4071-1] sensible-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4071-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 21, 2017 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4071-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : global -- gozilla vulnerability (48cca164-e269-11e7-be51-6599c735afc8)

MITRE reports : gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DLA-1209-1 : sensible-utils security update

It was discovered that there was a vulnerability in sensible-browser, a utility to start the most suitable web browser based on your environment or configuration. Remote attackers could conduct argument-injection attacks via specially- crafted URIs. For Debian 7 'Wheezy', this issue has been fixe...

CVE-2017-17522

DISPUTED Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that...