glibc security, bug fix, and enhancement update

2.17-105.0.1 - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. 2.17-105 - Fix up test case for initial-exec fix 1248208. 2.17-104 - Mark all TLS variables i...

Multiple vulnerabilites in Java 1.7.0_15

The version of Java we bundle with Confluence is badly out of date, and well behind the security baseline Oracle defines see http://www.oracle.com/technetwork/java/javase/7u80-relnotes-2494162.html for example, which says we should be running update 79 for security fixes, and update 80 for...

DEBIAN-CVE-2014-0179

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service read block and hang via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the 1 virConnectCompareCPU or 2 virConnectBaselineCPU API method, relate...

UBUNTU-CVE-2014-0179

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service read block and hang via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the 1 virConnectCompareCPU or 2 virConnectBaselineCPU API method, relate...

Baseline CMS 1.95 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/15961/info Baseline CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the...

Mozilla Asks CAs for Details on Subordinate Certificate Controls

Mozilla has warned certificate authorities included in its root CA Certificate Program that they only have a few weeks left to comply with the company’s new policy, which requires CAs to adhere to the CA/Browser Forum Baseline Requirements and provide proof of audits of their subordinate...

IG Report Shows DHS Making Progress, But Still Has Room to Improve on Information Security

Although there are still a number of issues that need to be addressed with the Department of Homeland Security’s information security efforts, the department is improving in many areas and making strong progress toward implementing better security controls, a new report from the Inspector General...

[Lynis v1.3.5] The Unix / Linux auditing, security and hardening Tool

Security and system auditing tool to harden Linux systems and more Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related...

[OMENS v1.17] The framework for distributing Actionable Intelligence

OMENS Object Monitor for Enhanced Network Security was born out of the intrusion and intrusion attempts analysis that I have been doing over many years. I consistently run into intrusion attempts that existing IDS systems have difficulty detecting. OMENS is my attempt to better detect and...

IT-Grundschutz M4.334: SMB Message Signing und Samba

IT-Grundschutz M4.334: SMB Message Signing und Samba ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94241 Stand: 13. Ergänzungslieferung 13. EL. SPDX-FileCopyrightText...

Google, Mozilla Considering Limiting Certificate Validity to 60 Months

In the wake of a parade of problems with certificate authorities and attackers using stolen digital certificates, both Google and Mozilla are poised to enforce new rules in their browsers for how long end-entity certificates should be trusted. The changes will begin taking effect at the beginning...

Oracle Adds Ability to Prevent Java Apps From Running in Browsers

Oracle has released a new version of the Java Development Kit which includes a number of security improvements. The major change in JDK 7u10 is the ability to prevent any Java application from running in the browser, a big shift for the Java environment, which is a constant target of attacks. The...

A CISO's Guide To Application Security – Part 3: Toward an AppSec Center of Excellence

This post is the third in a 4-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk...

Spaceacre - SQL Injection Cross-Site Scripting HTML Injection

Spaceacre - SQL Injection Cross-Site Scripting HTML Injection ========================================================= Spaceacre SQL/XSS/HTML Injection Vulnerabilities ========================================================= Name: Spaceacre SQL/XSS/HTML Injection Vulnerabilities Vendor:...

SLAD Microsoft Baseline Security Analyzer OS run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenV...

SLAD Microsoft Baseline Security Analyzer ALL run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenV...

SLAD Microsoft Baseline Security Analyzer ALL run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in...

SLAD Microsoft Baseline Security Analyzer OS run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in...

SLAD Microsoft Baseline Security Analyzer Updates run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenV...

SLAD Netstat -natcp run

This script connects to SLAD on a remote host to run remote the Microsoft Baseline Security Analyzer. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenV...