CVE-2012-5607

The CVE-2012-5607 issue affects versions 4.0.9 and 4.5.0 where the Lost Password reset does not properly validate the security token, enabling a remote timing-attack-based password change. The underlying problem is the token comparison during password reset, which could let an attacker overwrite...

CVE-2012-5574

CVE-2012-5574 affects Symfony CMS: lib/form/sfForm.class.php before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request, enabling information disclosure. The entry is confirmed across multiple feeds (NVD, Gentoo GLSA 201405-25, OpenVAS entries) and remediation is t...

CVE-2012-5606

OwnCloud contains multiple XSS vulnerabilities in versions before 4.0.9 and 4.5.0. The flaws allow remote injection of arbitrary scripts/HTML via (1) file name in apps/files_versions/js/versions.js, (2) apps/files/js/filelist.js, or (3) event title in 3rdparty/fullcalendar/js/fullcalendar.js. Roo...

CVE-2012-5563

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression...

CVE-2012-5468

Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an email containing a base64 string that is decoded to incomplete multibyte characters...

libtiff security update

3.9.4-9 - Still more fixes to make test case for CVE-2012-5581 work on all platforms Resolves: 885310 3.9.4-8 - Fix incomplete patch for CVE-2012-3401 - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works with pre-4.0.2 libtiff Resolves: 885310 3.9.4-7 - Add fixes for...

Memory Corruption in QuickTime Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple QuickTime software version 7.7.2 and earlier versions. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor,...

CVE-2012-5195

CVE-2012-5195 is a heap-based buffer overflow in Perl’s Perl_repeatcpy in util.c, affecting Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5. It can cause memory exhaustion and crash (DoS) and may enable arbitrary code execution via the x string repeat operator. Connecte...

CVE-2012-6422

The CVE-2012-6422 entry concerns the kernel on certain Android devices (Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly others) using weak permissions (0666) on /dev/exynos-mem when running an Exynos 4210/4412, enabling an attacker to read or write arbitrary physical memory and achieve p...

Fedora 16 : perl-5.14.3-203.fc16 / perl-CGI-3.52-203.fc16 (2012-18330)

Fix CVE-2012-5526 escape new-lines in Set-Cookie and P3P HTTP response headers properly in CGI-3.52. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora Update for mysql FEDORA-2012-19833

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for perl FEDORA-2012-18330

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for librdmacm FEDORA-2012-19892

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for xen FEDORA-2012-19828

Check for the Version of xen OpenVAS Vulnerability Test Fedora Update for xen FEDORA-2012-19828 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora 16 : kernel-3.6.10-2.fc16 (2012-20240)

Update to latest upstream stable release, Linux v3.6.10. Various fixes across the tree. Update to latest stable upstream release, Linux v3.6.9. Various bugfixes across the tree. Update to Linux v3.6.8 with various fixes across the tree. Note that Tenable Network Security has extracted the precedi...

Fedora Update for mysql FEDORA-2012-19833

Check for the Version of mysql OpenVAS Vulnerability Test Fedora Update for mysql FEDORA-2012-19833 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Fedora Update for perl-CGI FEDORA-2012-18330

Check for the Version of perl-CGI OpenVAS Vulnerability Test Fedora Update for perl-CGI FEDORA-2012-18330 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mandriva Linux Security Advisory : perl-CGI (MDVSA-2012:180)

A vulnerability was discovered and corrected in perl-CGI : CGI.pm module before 3.63 for Perl does not properly escape newlines in 1 Set-Cookie or 2 P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm CVE-2012-5526. The...

Foswiki 1.0.10 / 1.1.6 Code Injection / Denial Of Service

Foswiki versions 1.0.0 through 1.0.10 and 1.1.0 through 1.1.6 suffer from code injection and denial of service vulnerabilities. ---+ Security Alert: Code injection vulnerability in MAKETEXT macro, Denial of Service vulnerability in MAKETEXT macro. This advisory alerts you of a potential security...

Foswiki Security Alert CVE-2012-6329, CVE-2012-6330 Remote code execution and other vulnerabilities in MAKETEXT macro

---+ Security Alert: Code injection vulnerability in MAKETEXT macro, Denial of Service vulnerability in MAKETEXT macro. This advisory alerts you of a potential security issue with your Foswiki installation. A vulnerability has been reported against the core Perl module CPAN:Locale::Maketext, whic...