OracleVM 2.2 : xen (OVMSA-2012-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO emulation DoS vulnerability orabug 14463558 CVE-2012-3432 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 3.1 : xen (OVMSA-2013-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634 - When xe...

OracleVM 2.2 : xen (OVMSA-2012-0048)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-12: prevent a 64 bit guest setting reserved bits in DR7 orabug 14554090 CVE-2012-3494 - XSA-14: Don't BUGON PoD operations on a non-translated guest orabug 14554272 CVE-2012-3496 - XSA-17: console...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - kmod: make requestmodule killable Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - kmod: introduce callmodprobe helper Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - usermodehelper: implement UMHKILLABL...

OracleVM 3.1 : xen (OVMSA-2012-0021)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86-64: detect processors subject to AMD erratum 121 and refuse to bootCVE-2006-0744 - guest denial of service on syscall/sysenter exception generation CVE-2012-0217,CVE-2012-0218 - Remove unnecessary...

OracleVM 3.0 : xen (OVMSA-2012-0050)

The remote OracleVM system is missing necessary patches to address critical security updates : - compat/gnttab: Prevent infinite loop in compat code c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall...

OracleVM 3.1 : xen (OVMSA-2012-0051)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: builder: limit maximum size of kernel/ramdisk. Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address...

OracleVM 3.0 : xen (OVMSA-2012-0040)

The remote OracleVM system is missing necessary patches to address critical security updates : - console: bounds check whenever changing the cursor due to an escape code The device model used by fully virtualised HVM domains, qemu, does not properly handle escape VT100 sequences when emulating...

OracleVM 2.2 : xen (OVMSA-2012-0022)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-0217 CVE-2012-0218: guest DoS on syscall/sysenter exception generation orabug 13993157 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fr...

OracleVM 3.0 : xen (OVMSA-2013-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634...

Important: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.0 update

Red Hat JBoss Operations Network 3.2.3, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

SOL15863 - Libtiff vulnerabilities CVE-2012-1173 and CVE-2012-2088

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, or does not list a version that is later than the version you...

SOL15865 - Apache HTTP server vulnerability CVE-2012-4558

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. To mitigate this...

SOL15867 - Perl vulnerabilities CVE-2012-5195, CVE-2012-5526, CVE-2012-6329, and CVE-2013-1667

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update

Red Hat JBoss BRMS 6.0.3 roll up patch 1, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 update

Red Hat JBoss BPM Suite 6.0.3 roll up patch 1, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System...

CVE-2012-6662

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

CVE-2012-6662

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...