Scientific Linux Security Update : kernel on SL6.x i386/x86_64

This update fixes the following security issues : - A flaw was found in the sctpicmpprotounreachable function in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could use this flaw to cause a denial of service. CVE-2010-4526, Important - A missing...

CentOS Update for kernel CESA-2011:1386 centos5 x86_64

Check for the Version of kernel OpenVAS Vulnerability Test CentOS Update for kernel CESA-2011:1386 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Kajona 3.4.1 Cross Site Scripting

Advisory ID: HTB23097 Product: Kajona Vendor: www.kajona.de Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Vendor Notification: 20 June 2012 Vendor Patch: 26 June 2012 Public Disclosure: 11 July 2012 Vulnerability Type: Cross-Site Scripting XSS CVE Reference: CVE-2012-3805...

Multiple Vulnerabilities in phpList

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in phpList, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks against the vulnerable application. 1 Cross-Site Scripting XSS in phpList: CVE-2012-3952 Input passed via the "unconfirme...

Webmatic 3.1.1 - Blind SQL Injection

Advisory ID: HTB23096 Product: Webmatic Vendor: valarsoft.com Vulnerable Versions: 3.1.1 and probably prior Tested Version: 3.1.1 Vendor Notification: 13 June 2012 Public Disclosure: 4 July 2012 Vulnerability Type: Blind SQL Injection CVE Reference: CVE-2012-3350 CVSSv2 Base Score: 7.5...

Webmatic 3.1.1 - Blind SQL Injection

Webmatic 3.1.1 - Blind SQL Injection Advisory ID: HTB23096 Product: Webmatic Vendor: valarsoft.com Vulnerable Versions: 3.1.1 and probably prior Tested Version: 3.1.1 Vendor Notification: 13 June 2012 Public Disclosure: 4 July 2012 Vulnerability Type: Blind SQL Injection CVE Reference:...

Webmatic 3.1.1 Blind SQL Injection

Advisory ID: HTB23096 Product: Webmatic Vendor: valarsoft.com Vulnerable Versions: 3.1.1 and probably prior Tested Version: 3.1.1 Vendor Notification: 13 June 2012 Public Disclosure: 4 July 2012 Vulnerability Type: Blind SQL Injection CVE Reference: CVE-2012-3350 CVSSv2 Base Score: 7.5...

java-1.7.0-openjdk security and bug fix update

1.7.0.5-2.2.1.0.1.el6 - Modify DISTRONAME for Oracle 1.7.0.5-2.2.1.el6 - Updated priority to be 17000 and to depend on buildver variable - Variable buildver increased to 5 as it should be - Resolves: rhbz828759 1.7.0.3-2.2.1.el6 - Used newly prepared tarball with security fixes - Bump to...

net-snmp security and bug fix update

1:5.5-41 - moved /var/lib/net-snmp fro net-snmp to net-snmp-libs package 822480 1:5.5-40 - fixed CVE-2012-2141 820100 1:5.5-39 - fixed proxying of out-of-tree GETNEXT requests 799291 1:5.5-38 - fixed snmpd crashing with many AgentX subagent 749227 - fixed SNMPv2-MIB::sysObjectID value when...

Oracle Linux 6 kernel security, bug fix and enhancement update

2.6.32-279.el6 - netdrv mlx4: ignore old module parameters Jay Fenlason 830553 2.6.32-278.el6 - kernel sysctl: silence warning about missing strategy for file-max at boot time Jeff Layton 803431 - net sunrpc: make new tcpmaxslottableentries sysctl use CTLUNNUMBERED Jeff Layton 803431 - drm i915:...

CVE-2011-0716

CVE-2011-0716 affects the Linux kernel older than 2.6.38. The vulnerability lies in the br_multicast_add_group function within net/bridge/br_multicast.c, triggered when a specific Ethernet bridge configuration is used. An attacker locally can cause memory corruption and a system crash by sending ...

CVE-2011-1751

The pciejwrite function in hw/acpipiix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service guest crash and possibly execute arbitrary code by sendin...

Double free

The pciejwrite function in hw/acpipiix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service guest crash and possibly execute arbitrary code by sendin...

CVE-2011-1751

The pciejwrite function in hw/acpipiix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service guest crash and possibly execute arbitrary code by sendin...

Web@All 2.0 Cross Site Request Forgery / Cross Site Scripting

Advisory ID: HTB23094 Product: web@all Vendor: webatall.org Vulnerable Versions: 2.0 downloaded before 30th of May 2012; prior versions may also be vulnerable Tested Version: 2.0 downloaded on 25th of May 2012 Vendor Notification: 30 May 2012 Vendor Patch: 30 May 2012 Public Disclosure: 20 June...

[email protected] 2.0 Cross Site Request Forgery / Cross Site Scripting

Exploit for php platform in category web applications Product: email protected Vendor: webatall.org Vulnerable Versions: 2.0 downloaded before 30th of May 2012; prior versions may also be vulnerable Tested Version: 2.0 downloaded on 25th of May 2012 Vendor Notification: 30 May 2012 Vendor Patch: ...

SQL injection in Serendipity

Advisory ID: HTB23092 Product: Serendipity Vendor: Serendipity Team Vulnerable Versions: 1.6.1 and probably prior Tested Version: 1.6.1 Vendor Notification: 16 May 2012 Vendor Patch: 16 May 2012 Public Disclosure: 6 June 2012 Vulnerability Type: SQL injection CVE Reference: CVE-2012-2762 CVSSv2...

Multiple vulnerabilities in TinyWebGallery

Advisory ID: HTB23093 Product: TinyWebGallery Vendor: www.tinywebgallery.com Vulnerable Versions: 1.8.7 and probably prior Tested Version: 1.8.7 Vendor Notification: 23 May 2012 Vendor Patch: 24 May 2012 Public Disclosure: 13 June 2012 Vulnerability Type: Сross-Site Request Forgery CSRF, Arbitrar...

java-1.6.0-openjdk security update

1:1.6.0.0-1.48.1.11.3 - Access gnome bridge jar is forced to have 644 permissions - Resolves: rhbz828751 1:1.6.0.0-1.47.1.11.3 - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch: - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils. - packages...

Sony VAIO Wireless Manager 4.0.0.0 Buffer Overflows

Exploit for hardware platform in category dos / poc Product: Wireless Manager Sony VAIO Vendor: Sony Computers Vulnerable Versions: 4.0.0.0 and probably prior Tested Version: 4.0.0.0 Vendor Notification: 7 December 2011 Vendor Patch: 20 January 2012 Public Disclosure: 30 May 2012 Vulnerability...