Fedora 21 : perl-Module-Signature-0.78-1.fc21 / perl-Test-Signature-1.11-1.fc21 (2015-5833)

This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a 'skip' parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behavior ...

HackerOne: Open-redirect on hackerone.com

Hello! I would like to report about open-redirect on hackerone.com Here is the PoC that redirects to example.com IP address: https://hackerone.com/%2F1572395042 There is one more strange behavior in URL. For example: https://hackerone.com//hackerone.com - works https://hackerone.com//hackerone1.c...

Ruby OpenSSL Hostname Verification

After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching o...

Ruby -- OpenSSL Hostname Verification Vulnerability

Ruby Developers report: After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. I...

Little Change in Online Behavior Following Snowden Revelations

Some 30 percent of American adults say they have altered their digital behavior in the wake of Edward Snowden’s NSA spying revelations in order to hide information from the government. In Spring 2013, Snowden, a then NSA contractor working for Booz Allen Hamilton, remotely accessed the NSA’s Ft...

Debian DLA-160-1 : sudo security update

This update fixes the CVEs described below. CVE-2014-0106 Todd C. Miller reported that if the envreset option is disabled in the sudoers file, the envdelete option is not correctly applied to environment variables specified on the command line. A malicious user with sudo permissions may be able t...

Debian DLA-80-1 : libxml2 security update

Sogeti found a denial of service flaw in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption denial of service...

SQL Injection Vulnerability in VOLANS SR Internet Behavior Audit Gateway of Chengdu Flying Fish Star Technology Co.

VOLANS SR Internet Behavior Audit Gateway of Chengdu Flyingfish Star Technology Co., Ltd. is designed for small and medium-sized enterprises, providing perfect Internet behavior management, intelligent bandwidth management and multi-line load balancing solutions. SQL injection vulnerability exist...

Arbitrary File Download Vulnerability in Internet Behavior Management System of Shenzhen Wheaton Information Technology Co.

Shenzhen Wheaton Information Technology Co., Ltd. Internet behavior management system is a set of monitoring system for the user's online behavior. Shenzhen Wheaton Information Technology Co., Ltd. Internet behavior management system there are arbitrary file download vulnerability, there are...

Remote Command Execution Vulnerability in Internet Behavior Management System of Shenzhen Wheaton Information Technology Co.

Shenzhen Wheaton Information Technology Co., Ltd. Internet behavior management system is a set of monitoring system for the user's online behavior. The Internet behavior management system of Shenzhen Wheaton Information Technology Co., Ltd. suffers from a remote command execution vulnerability, t...

Shenzhen Wheaton Information Technology Co., Ltd. internet behavior management system has HTTP header getshell vulnerability

Shenzhen Wheaton Information Technology Co., Ltd. Internet behavior management system is a set of monitoring system for the user's online behavior. Shenzhen Huilton Information Technology Co., Ltd. Internet behavior management system HTTP header can getshell vulnerability, there are vulnerabiliti...

New Technique Complicates Mutex Malware Analysis

Malware analysts have had a measure of success using static mutex values as a fingerprint for detecting and blocking malicious code. These values are used in programming to enable software to synchronize communication between multiple threads or processes, or to determine whether another instance...

Twitter Changes Abuse Reporting Process to Address Doxing

Twitter has revised and simplified its rules and process for reporting abusive behavior on the service, and users now have the ability to report people who are posting their personal information. The change essentially gives Twitter users a method to combat doxing, which is the process of dumping...

DLA-160-1 sudo - security update

Bulletin has no description...

Debian DSA-3167-1 : sudo - security update

Jakub Wilk reported that sudo, a program designed to provide limited super user privileges to specific users, preserves the TZ variable from a user's environment without any sanitization. A user with sudo access may take advantage of this to exploit bugs in the C library functions which parse the...

[SECURITY] [DSA 3167-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3167-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 22, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3167-1] sudo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3167-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 22, 2015 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3167-1 (sudo - security update)

Jakub Wilk reported that sudo, a program designed to provide limited super user privileges to specific users, preserves the TZ variable from a user OpenVAS Vulnerability Test $Id: deb3167.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3167-1 using nvtgen 1.0 Script...

SeaMonkey < 2.32 Vulnerability

The version of SeaMonkey installed on the remote host is prior to 2.32. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. CVE-2014-8634, CVE-2014-8635 - A flaw exists where DOM objects with some specific...

Microsoft Internet Explorer LineBoxBuilder::FindWord Out-Of-Bounds Memory Access Vulnerability

This vulnerability consists of potentially hazardous use of memory on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...