[slackware-security] poppler (SSA:2013-233-03)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security poppler SSA:2013-233-03 New poppler packages are available for Slackware 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...

Bugzilla 4.2 - Tabular Reports Cross-Site Scripting

source: https://www.securityfocus.com/bid/63205/info Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in...

Fedora Update for icedtea-web FEDORA-2013-17016

Check for the Version of icedtea-web OpenVAS Vulnerability Test Fedora Update for icedtea-web FEDORA-2013-17016 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

xinetd security update

CentOS Errata and Security Advisory CESA-2013:1302 An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CV...

Debian DSA-2768-1 : icedtea-web - heap-based buffer overflow

A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the us...

CVE-2012-4084

Cisco UCS Fabric Interconnect web management interface CSRF vulnerability (CVE-2012-4084) allows unauthenticated remote attackers to hijack user authentication via cookie-based session handling. Exploitation would enable the attacker to perform actions as the affected user; Cisco notes that softw...

CVE-2012-4141

CVE-2012-4141 identifies a directory traversal in the Cisco NX-OS CLI parser. The vulnerability allows a local, authenticated attacker to create arbitrary script files by supplying a relative pathname in the file name parameter, exploiting improper input filtering. Affected component: Cisco NX-OS...

CVE-2012-4075

Cisco NX-OS contains an input-parsing vulnerability where parameters including special characters (e.g., back quotes) can be manipulated by an authenticated, local attacker to gain root-privilege access and execute arbitrary shell commands. This is associated with Bug IDs CSCtf19827 and CSCtf2778...

CVE-2012-4090

CVE-2012-4090 affects Cisco NX-OS Software on Nexus 7000 devices. The vulnerability arises from improper sanitization of configuration files that are viewable by users with the network-operator role via the management interface. As a result, remote authenticated users could obtain sensitive confi...

CVE-2012-4084

Cross-site request forgery CSRF vulnerability in the web-management interface in the fabric interconnect FI component in Cisco Unified Computing System UCS allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCtg20755...

CVE-2012-4091

Cisco NX-OS RIP service engine is affected by CVE-2012-4091. A remote attacker can trigger a DoS (engine restart) by sending malformed RIP packets (RIPv4 or RIPv6) to UDP port 520. Impact is a DoS affecting routes learned via RIP. Remediation: Cisco has issued an advisory and software updates add...

CVE-2012-4098

Cisco NX-OS BGP DoS (CVE-2012-4098) affects the BGP component of Cisco NX-OS where improper filtering of AS paths allows remote attackers to trigger a denial-of-service by sending a malformed UPDATE, causing BGP service reset/resync. The public descriptions across NVD, Tenable/OSS and OpenVAS con...

CVE-2012-4122

Cisco NX-OS Software contains a vulnerability in the CLI parser that allows an authenticated, local attacker to bypass access restrictions and create or overwrite arbitrary files via shell output redirection. Affected component: the CLI parsing logic in Cisco NX-OS. Impact: local privilege abuse ...

Debian Security Advisory DSA 2768-1 (icedtea-web - heap-based buffer overflow)

A heap-based buffer overflow vulnerability was found in icedtea-web, a web browser plugin for running applets written in the Java programming language. If a user were tricked into opening a malicious website, an attacker could cause the plugin to crash or possibly execute arbitrary code as the us...

Fedora 18 : icedtea-web-1.4.1-0.fc18 (2013-17016)

Updated to icedtea-web 1.4.1 New in release 1.4.1 2013-XX-YY : - Improved and cleaned Temporary internet files panel - PR1465 - java.io.FileNotFoundException while trying to download a JAR file - PR1473 - javaws should not depend on name of local file - PR854: Resizing an applet several times...

DSA-2768-1 icedtea-web - heap-based buffer overflow

Bulletin has no description...

CVE-2012-4136

The CVE-2012-4136 issue affects Cisco UCS Fabric Interconnect’s high-availability service. The root cause is improper binding of the cluster service to the management interface, which can let a remote attacker connected via Telnet access sensitive information or cause a peer‑syncing denial of ser...

APPLE-SA-2013-09-12-2 Safari 5.1.10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-12-2 Safari 5.1.10 Safari 5.1.10 is now available and addresses the following: JavaScriptCore Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Visiting a maliciously crafted website may lead to an unexpected applicatio...

Fedora Update for xpdf FEDORA-2013-17375

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 5 : Oracle / linux / 5 / kernel (ELSA-2013-1348)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1348 advisory. - kernel signals: stop info leak via tkill and tgkill syscalls Oleg Nesterov 970875 CVE-2013-2141 - net ipv6: do udppushpendingframes AFINET sock pending data...