Debian Security Advisory DSA 2634-1 (python-django - several vulnerabilities)

Several vulnerabilities have been discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-4520 James Kettle discovered that Django did not properly filter the HTTP Host header when processing...

VMSA-2013-0003 VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library security issues.

The remote ESXi is missing one or more security related Updates from VMSA-2013-0003. OpenVAS Vulnerability Test $Id: gbVMSA-2013-0003.nasl 6065 2017-05-04 09:03:08Z teissa $ VMSA-2013-0003 VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library securi...

SuSE 11.2 Security Update : inkscape (SAT Patch Number 7380)

inkscape was updated to fix a XXE Xml eXternal Entity attack during rasterization of SVG images CVE-2012-5656, where the rendering of malicious SVG images could have connected from inkscape to internal hosts. Also inkscape would have loaded .EPS files from untrusted /tmp occasionaly instead from...

Apache 2.2.x < 2.2.24 Multiple XSS Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.24. It is, therefore, potentially affected by the following cross-site scripting vulnerabilities : - Errors exist related to the modules modinfo, modstatus, modimagemap, modldap, and modproxyftp and...

[SECURITY] [DSA 2634-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2634-1 [email protected] http://www.debian.org/security/ Nico Golde February 27, 2013 http://www.debian.org/security/faq -...

CVE-2012-3499

Multiple cross-site scripting XSS vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the 1 modimagemap, 2 modinfo, 3 modldap, 4 modproxyftp, and 5...

CVE-2012-4558

Multiple cross-site scripting XSS vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML vi...

CVE-2012-3499

CVE-2012-3499 affects Apache HTTP Server 2.2.x (pre-2.2.24-dev) and 2.4.x (pre-2.4.4). The issue comprises multiple XSS flaws in modules including mod_imagemap, mod_info, mod_ldap, mod_proxy_ftp, and mod_status. An attacker can inject arbitrary web script/HTML via crafted Host header or URI-relat...

CVE-2012-3499

Multiple cross-site scripting XSS vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the 1 modimagemap, 2 modinfo, 3 modldap, 4 modproxyftp, and 5...

CVE-2012-5337

creationtimestamp| type| source ---|---|--- 2013-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38334...

Fedora 17 : cups-1.5.4-18.fc17 (2012-19606)

This update addresses two security issues : - CVE-2012-5519 privilege escalation for users for the CUPS SystemGroup group or via polkit is fixed by moving certain configuration keywords into a separate file, cups-files.conf, which cannot be modified by cupsd. - CVE-2012-6094 configuration issue...

SuSE 11.2 Security Update : squid3 (SAT Patch Number 7336)

A denial of service problem in Squid3 initiated via invalid Content-Length headers and memory leaks has been fixed. CVE-2012-5643 / CVE-2013-0189, SQUID-2012:1 Also a logrotate permission issue has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

CVE-2012-3499

Multiple cross-site scripting XSS vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the 1 modimagemap, 2 modinfo, 3 modldap, 4 modproxyftp, and 5...

CVE-2012-4558

Multiple cross-site scripting XSS vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML vi...

Debian: Security Advisory (DSA-2634-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubisoft Uplay 2.0.3 ActiveX Control Arbitrary Code Execution (CVE-2012-4177)

A remote code execution vulnerability exists in Ubisoft Uplay 2.0.3. The vulnerability is due to insufficient verification of a command path parameter value when parsing a Uplay ActiveX object. A remote attacker can exploit this vulnerability by enticing a user to open a webpage that contains a...

Fedora 18 : openconnect-4.08-1.fc18 (2013-2498)

This update fixes a potential buffer overflow in HTTP request generation, which could be triggered by a malicious server generating a large number of cookies or redirecting to a large path or hostname. Note that Tenable Network Security has extracted the preceding description block directly from...

Debian DSA-2631-1 : squid3 - denial of service

Squid3, a fully featured Web proxy cache, is prone to a denial of service attack due to memory consumption caused by memory leaks in cachemgr.cgi : - CVE-2012-5643 squid's cachemgr.cgi was vulnerable to excessive resource use. A remote attacker could exploit this flaw to perform a denial of servi...

Debian Security Advisory DSA 2629-1 (openjpeg - several issues)

CVE-2009-5030 Heap memory corruption leading to invalid free when processing certain Gray16 TIFF images. CVE-2012-3358 Huzaifa Sidhpurwala of the Red Hat Security Response Team found a heap-based buffer overflow in JPEG2000 image parsing. CVE-2012-3535 Huzaifa Sidhpurwala of the Red Hat Security...

CVE-2012-6072

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via...