Apple iTunes 10 Extended M3U Stack Buffer Overflow

This module exploits a stack buffer overflow in iTunes 10.4.0.80 to 10.6.1.7. When opening an extended .m3u file containing an "EXTINF:" tag description, iTunes will copy the content after "EXTINF:" without appropriate checking from a heap buffer to a stack buffer, writing beyond the stack buffer...

FreeBSD -- Privilege escalation when returning from kernel

Problem description: FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call. Successful exploitation of the problem can lead to local kernel privilege escalation, kernel...

Survey Shows Consumers Still Openly Risking ID Theft

A new survey conducted by a credit card comparison Web site indicates consumers continue to be lax when it comes to guarding against identity theft. Users may not be able to prevent leaks such as today’s disclosure of 6.5 million stolen LinkedIn passwords, but they are still engaging in their own...

WordPress Bad Behavior Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress Security audit bad-behavior plugin 1. Cross-site scripting reflected 1.1. http://127.0.0.1/wp-admin/options-general.php %3Cscript%3Ealert1%3C/script%3E parameter 1.2. http://127.0.0.1/wp-admin/options-general.php httpblkey parameter 1.3...

FreeBSD Ports: openssl

The remote host is missing an update to the system as announced in the referenced advisory. VID 60eb344e-6eb1-11e1-8ad7-00e0815b8da8 OpenVAS Vulnerability Test $ Description: Auto generated from VID 60eb344e-6eb1-11e1-8ad7-00e0815b8da8 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Design/Logic Flaw

DISPUTED Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable...

[SECURITY] Fedora 17 Update: wicd-1.7.2.1-1.fc17

Wicd is designed to give the user as much control over behavior of network connections as possible. Every network, both wired and wireless, has its own profile with its own configuration options and connection behavior. Wicd will try to automatically connect only to networks the user specifies it...

Mathematica8.0.4 on Linux /tmp/MathLink vulnerability

The problem reported for Mathematica became worse at version 8.0.4, present for the command-line interface "math" also. Cheers, Paul Szabo [email protected] http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia ---...

Sky News: Hacking was "Responsible Journalism" in Public Interest

In a statement published by The Guardian Thursday, Sky News admitted to twice authorizing a journalist to hack into the email accounts of persons suspected of crimes, defending its actions as “editorially justified.” In the first incident, the broadcaster admitted hacking the e-mail account of Jo...

[ MDVSA-2012:038 ] openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:038 http://www.mandriva.com/security/ Package : openssl Date : March 26, 2012 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been found and corrected in...

OpenSSL 1.0.0 < 1.0.0h Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.0h. It is, therefore, affected by a vulnerability as referenced in the 1.0.0h advisory. - The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict...

OpenSSL 0.9.8 < 0.9.8u Vulnerability

The version of OpenSSL installed on the remote host is prior to 0.9.8u. It is, therefore, affected by a vulnerability as referenced in the 0.9.8u advisory. - The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict...

Mandriva Linux Security Advisory : openssl (MDVSA-2012:038)

Multiple vulnerabilities has been found and corrected in openssl : The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt...

CentOS 6 : glibc (CESA-2012:0393)

Updated glibc packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2012:0393 Updated glibc packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System...

Moderate: Red Hat Security Advisory: glibc security and bug fix update

Updated glibc packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

The Value Of Data Privacy To Consumers? About 65 Cents.

What is the value of data privacy to online shoppers? About 65 cents, according to a new study of by researchers in Britain and Germany. The report: “Study on Monetising Privacy: An Economic Model for Pricing Personal Information” was released in February and presents the results of work by...

Information disclosure

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack MMA adaptive chosen ciphertext...

Typing Test

Researchers at the American University of Beirut in Lebanon have been working on software that doesn’t analyze what passwords are typed, but rather how words are typed. Researchers Ravel Jabbour, Wes Mastri and Ali El-Hajj have found that examining the speed and rhythm of the user’s keystrokes...

AdiOS Finds iOS Apps Capable of Dumping Users' Contacts

It’s gotten to the point now where it’s almost easier to talk about the mobile apps and services that don’t ship your personal data off to some remote server for purposes unknown rather than discussing the ones that do. The latest discussion of privacy invading apps flowed from the discovery that...