CVE-2012-4572

CVE-2012-4572 affects Red Hat JBoss EAP prior to 6.1.0 and JBoss Portal prior to 6.1.0. The issue arises when multiple applications load the same custom authorization module class name; the first loaded implementation may be used for all apps, allowing a local attacker to influence authorization ...

BlackHole Toolkit v2 JAVA Payload Stage Code Execution (CVE-2012-0507; CVE-2012-1723; CVE-2013-0422; CVE-2013-0431; CVE-2013-1493)

BlackHole is a web exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users with BlackHole by enticing them to visit a malicious web page. Successful infection will allow the attacker to download additional malware to the target...

CentOS 5 / 6 : gnupg2 (CESA-2013:1459)

An updated gnupg2 package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

CentOS 5 : gnupg (CESA-2013:1458)

An updated gnupg package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...

RHEL 5 / 6 : gnupg2 (RHSA-2013:1459)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1459 advisory. The GNU Privacy Guard GnuPG or GPG is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP...

SuSE 11.2 / 11.3 Security Update : kdelibs4 (SAT Patch Numbers 8401 / 8402)

This kdelibs4 update fixes several security issues related to khtml/konqueror. - Fix security issues and NULL pointer references in khtml/konqueror bnc787520 CVE-2012-4512 / CVE-2012-4513 / CVE-2012-4515 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Oracle Linux 5 : gnupg (ELSA-2013-1458)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2013-1458 advisory. - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted - fix CVE-2012-6085 GnuPG: readblock corrupt key input validation - fix...

Oracle Linux 5 / 6 : gnupg2 (ELSA-2013-1459)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1459 advisory. - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted - fix CVE-2012-6085 GnuPG: readblock corrupt key input validation...

gnupg2 security update

CentOS Errata and Security Advisory CESA-2013:1459 An updated gnupg2 package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVS...

CVE-2013-1743

Multiple cross-site scripting XSS vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as...

CVE-2013-1743

CVE-2013-1743 is a cross-site scripting (XSS) vulnerability in Bugzilla’s report.cgi used to build tabular reports. It allows remote attackers to inject arbitrary script/HTML via a field value (e.g., the sum mary or real name) during report construction, due to an incomplete fix for CVE-2012-4189...

gnupg2 security update

2.0.14-6 - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted 2.0.14-5 - fix CVE-2012-6085 GnuPG: readblock corrupt key input validation - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser...

gnupg security update

1.4.5-18 - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted 1.4.5-17 - fix CVE-2012-6085 GnuPG: readblock corrupt key input validation - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack - fix CVE-2013-4402 GnuPG: infinite recursion in the...

USN-1991-1: GNU C Library vulnerabilities

It was discovered that the GNU C Library incorrectly handled the strcoll function. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2012-4412, CVE-2012-4424 It was discovered that the GNU C Library incorrectly handled multibyte characters in t...

CVE-2012-4115

CVE-2012-4115 affects Cisco UCS Fabric Interconnect: KVM virtual-media traffic is not encrypted, enabling MITM capture or modification of KVM traffic. NVD lists Confidentiality/Integrity impact as Partial, with Network attack vector and no authentication required. Cisco and Red Hat entries confir...

CVE-2012-4117

The CVE-2012-4117 issue concerns Cisco UCS Fabric Interconnect, where the server SSL certificate is not properly verified. This allows a man-in-the-middle attacker to watch or modify SSL KVM video-channel traffic via a crafted certificate. The vulnerability is tied to Bug ID CSCtr73033. Cisco’s a...

CVE-2012-4114

CVE-2012-4114 describes a vulnerability in the Cisco UCS Fabric Interconnect KVM module where video data is not encrypted, allowing a man-in-the-middle to sniff or insert packets between KVM server and remote display. Affected: Cisco UCS Fabric Interconnect KVM module (unconfirmed exact versions ...

CVE-2012-4113

The CVE-2012-4113 issue affects Cisco UCS Fabric Interconnect. It allows an authenticated, local attacker to view arbitrary files on the device’s filesystem by supplying crafted CLI command parameters. Root cause is improper filtering of user-supplied parameters in the CLI. Exploitation requires ...

CVE-2012-4112

CVE-2012-4112 affects the Cisco UCS Baseboard Management Controller (BMC). A vulnerability in the BMC’s command-line interface (CLI) allows a locally authenticated attacker to inject arbitrary commands with elevated privileges due to improper filtering of user-supplied parameters. Exploitation re...

[SECURITY] [DSA 2780-1] mysql-5.1 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2780-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 18, 2013 http://www.debian.org/security/faq -...