[SECURITY] [DSA 2623-1] openconnect security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2623-1 [email protected] http://www.debian.org/security/ Florian Weimer February 14, 2013 http://www.debian.org/security/faq -...

CVE-2012-5188

CVE-2012-5188 concerns mora Downloader before 1.0.0.1, where an untrusted search path can cause the launcher to execute a .exe via unspecified vectors. Multiple sources (NVD/Red Hat/JVN variants) confirm the flaw allows arbitrary code execution with the application’s privileges, tied to insecure ...

RHEL 5 / 6 : JBoss Enterprise Application Platform 5.2.0 (RHSA-2013:0257)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:0257 advisory. JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss...

CVE-2012-3280

Technical details (affected products/versions, root cause, fix) are not provided in the initial or connected documents. No concrete technical information is available here; monitor for updates and future disclosures.

Important: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update

An updated apache-cxf package for JBoss Enterprise Web Platform 5.2.0 that fixes two security issues is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS ba...

Important: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update

An update for JBoss Enterprise Web Platform 5.2.0 which fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

DSquare Exploit Pack: D2SEC_ZEND_XMLRPC

Name| d2seczendxmlrpc ---|--- CVE| CVE-2012-3363 Exploit Pack| D2ExploitPack Description| d2seczendxmlrpc Notes|...

CVE-2012-6531

1 ZendDom, 2 ZendFeed, and 3 ZendSoap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC...

CVE-2012-6531

CVE-2012-6531 affects Zend Framework 1.x: Zend_Dom, Zend_Feed, and Zend_Soap (versions before 1.11.13; 1.12.x before 1.12.0) fail to properly handle SimpleXMLElement, enabling remote XXE injection via a DOCTYPE in XML-RPC requests to read files or initiate TCP connections. This is a separate issu...

CVE-2012-3363

ZendXmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML...

CVE-2012-6531

1 ZendDom, 2 ZendFeed, and 3 ZendSoap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC...

CVE-2012-3363

CVE-2012-3363 : Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 mishandles SimpleXMLElement classes, enabling remote attackers to read arbitrary files or make TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request (XXE). This is cause...

CVE-2012-6075

Buffer overflow in the e1000receive function in the e1000 device driver hw/e1000.c in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service guest OS crash and possibly execute arbitrary guest code via a large packet...

CVE-2012-6075

CVE-2012-6075 is a buffer overflow in the e1000_receive function of the e1000 device driver (hw/e1000.c) used by QEMU 1.3.0-rc2 and related versions when SBP and LPE flags are disabled. The vulnerability could allow a remote attacker to crash the guest OS or potentially execute arbitrary code ins...

Fedora 16 : libupnp-1.6.18-1.fc16 (2013-1713)

linupnp 1.6.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Fedora 17 : httpd-2.2.23-1.fc17 (2013-1661)

This update contains the 2.2.23 release of the Apache HTTP Server. http://www.eu.apache.org/dist/httpd/CHANGES2.2.23 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format...

ruby on rails to 2.3.16 (important)

This update updates the RubyOnRails 2.3 stack to 2.3.16. Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed. CVE-2012-2695: A SQL injection via nested hashes in conditions w...

ruby on rails to 2.3.16 (important)

This update updates the RubyOnRails 2.3 stack to 2.3.16, also this update updates the RubyOnRails 3.2 stack to 3.2.11. Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed...

libvirt to fix use-after-free in virNetMessageFree() (important)

libvirt was updated to fix some bugs and security issues: Security issues fixed: - Fix crash on error paths of message dispatching, CVE-2013-0170 bnc800976 - security: Fix libvirtd crash possibility CVE-2012-4423 bnc780432 Also bugs were fixed: - qemu: Fix probing for guest capabilities bnc772586...

VulnCheck KEV: CVE-2012-1682

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136. NOTE: Oracle has...